From 9a3c7265f20c51ed20b052ead8a97bb4c9f03927 Mon Sep 17 00:00:00 2001
From: Glenn Gore <glenn.g@affinidi.com>
Date: Tue, 1 Sep 2026 10:19:48 +0200
Subject: [PATCH 01/24] feat(console): VTA management console in the wallet, on
 the Trust Context tree (#155)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

* feat(console): a VTA management console in the wallet, on the context tree

Everything an operator does *to* their agent — contexts, keys, ACL,
approvals, policy, services — has only ever been reachable from the `pnm`
CLI, which means from a laptop with a keyring. The client library for it
already existed: `@openvtc/pnm-core/admin` covers all of the CLI's command
tree bar backup, bootstrap and auth-credential, and its doc comments were
written for a console it did not yet have.

This is the spine of that console, plus Contexts end to end.

Trust contexts are the navigation, not a section. `ContextRecord` already
carries `parent`/`basePath` and `contextId` is a filter parameter on
`keysList`, `aclList` and `auditList` — so the tree is a persistent column
and the selection scopes every pane to its right.

Two properties are load-bearing:

The console holds no key material. It composes typed documents with the
`admin/*` helpers and the offscreen document mints and signs them, so
`RUNTIME_MANAGER_TASK` carries only `type` and `payload` — the rule that the
device mints the envelope does not soften because the composer is an
extension page. Reusing `OFFSCREEN_REQUEST_TASK` inherits transport
selection, health recording and the approver ceremony; `offscreen.ts` is
unchanged. This is also why `admin/*` now types its envelope parties as
`TaskParty` (just a DID) rather than `Identity`: only `.did` was ever read,
and a surface typed on `Identity` can only be called from somewhere holding
a private key.

The wallet still ships no operator authority. The CI guard is narrowed
rather than dropped — admin task URIs are banned everywhere in `dist/`
except `manager.js`, which is its own vite build with `codeSplitting: false`
so Rollup cannot hoist a shared chunk into a wallet surface. A second
assertion fails if it ever emits more than one chunk.

The relay is gated on `sender.url`, since every content script carries this
extension's id. It does not prompt per call — the operator is the caller,
and twelve dialogs to draw one screen is dismissal, not consent; the agent's
ACL and policy engine remain the authority, and a `requireConsent` renders
as a match-code ceremony rather than a red error string.

Signed-off-by: Glenn Gore <glenn.g@affinidi.com>

* feat(console): keys, DIDs, access, approvals, policy, transports and audit

Fills out the console's remaining eight panes on the spine landed in the
previous commit. Every one is scoped by the persistent context selection
where the underlying task takes a `contextId`, so choosing `work/eng` once
scopes Keys, DIDs, Access, Policy and Audit together.

Shared vocabulary rather than nine copies of it: `table.tsx` separates the
three states a list actually has — being fetched, refused, and answered with
nothing — because written per-pane they collapse and an operator reads "you
have no keys" off a permission error. `use-async.ts` keeps `data` null until
the agent answers for the same reason.

Where the agent draws a distinction, the pane draws it too:

- Keys shows `internal` origin as unrecoverable, because such a key derives
  from no seed and nothing reconstitutes it. `keysSign` is deliberately not
  surfaced — signing is use, not administration, and a console that offers a
  "sign this" box turns key management into an oracle.
- Access renders an entry with no scopes as "everywhere" and no expiry as
  "never", both in the caution colour. `aclChangeRole` carries `fromRole`
  from the row it was opened on, so a role someone else changed in between
  rejects instead of silently overwriting them.
- Policy carries `expectedVersion` on upsert *and* delete — without it two
  operators editing one module is last-write-wins and the loser never finds
  out.
- Transports pairs advertised state against observed, and presents `unknown`
  as "not observed" rather than a failure; a constructed REST channel is not
  evidence of anything.
- Audit renders `truncated` above the table, not below: a warning under a
  long list is a warning nobody reads, and concluding "nothing else
  happened" from a partial page is the failure an audit trail exists to
  prevent.
- Sessions is headed "your sessions" — the task returns only the caller's,
  and the agent's all-sessions route is deliberately not wired here.

`webvh/dids.ts` takes the same `TaskParty` widening as `admin/*`: it too read
only `.did` off its envelope parties.

Verified by rendering the built bundle against stubbed extension APIs in
Chrome, light and dark. Admin surface remains confined to manager.js.

Signed-off-by: Glenn Gore <glenn.g@affinidi.com>

* refactor(console): one import path for ConsentRequiredError

carrier.ts defines it; sender.ts re-exported it, so half the panes reached
for one path and half the other. Two routes to one symbol invite the question
of whether they could ever be different classes — which matters here, because
every pane distinguishes this class from Error by identity to decide between
rendering a consent ceremony and rendering a red string.

Signed-off-by: Glenn Gore <glenn.g@affinidi.com>

---------

Signed-off-by: Glenn Gore <glenn.g@affinidi.com>
---
 .github/workflows/ci.yml                      |  43 +-
 CLAUDE.md                                     |  61 +++
 packages/core/src/admin/acl.ts                |   8 +-
 packages/core/src/admin/consent.ts            |   8 +-
 packages/core/src/admin/contexts.ts           |   8 +-
 packages/core/src/admin/credentials.ts        |   8 +-
 packages/core/src/admin/devices.ts            |   8 +-
 packages/core/src/admin/did-templates.ts      |   8 +-
 packages/core/src/admin/keys.ts               |   8 +-
 packages/core/src/admin/memory.ts             |   8 +-
 packages/core/src/admin/observability.ts      |   8 +-
 packages/core/src/admin/policy.ts             |   8 +-
 packages/core/src/admin/services.ts           |   8 +-
 packages/core/src/admin/sessions.ts           |   8 +-
 packages/core/src/vta/channel.ts              |  20 +
 packages/core/src/vta/contexts.ts             |  46 ++-
 packages/core/src/webvh/dids.ts               |  11 +-
 packages/extension/manager.html               |  12 +
 packages/extension/package.json               |   2 +-
 packages/extension/src/app-shell.tsx          |  27 ++
 packages/extension/src/background.ts          |  85 ++++
 packages/extension/src/bridge-protocol.ts     |  31 ++
 packages/extension/src/manager-theme.css      |  68 ++++
 packages/extension/src/manager.tsx            |  32 ++
 packages/extension/src/manager/carrier.ts     | 122 ++++++
 .../extension/src/manager/context-column.tsx  | 197 +++++++++
 .../extension/src/manager/context-tree.ts     | 130 ++++++
 .../extension/src/manager/destructive.tsx     | 265 ++++++++++++
 .../extension/src/manager/panes/access.tsx    | 366 +++++++++++++++++
 .../extension/src/manager/panes/approvals.tsx | 327 +++++++++++++++
 .../extension/src/manager/panes/audit.tsx     | 218 ++++++++++
 .../extension/src/manager/panes/contexts.tsx  | 385 ++++++++++++++++++
 packages/extension/src/manager/panes/dids.tsx | 258 ++++++++++++
 packages/extension/src/manager/panes/keys.tsx | 380 +++++++++++++++++
 .../extension/src/manager/panes/policy.tsx    | 334 +++++++++++++++
 .../extension/src/manager/panes/services.tsx  | 285 +++++++++++++
 .../extension/src/manager/panes/sessions.tsx  | 131 ++++++
 packages/extension/src/manager/sender.ts      |  43 ++
 packages/extension/src/manager/shell.tsx      | 343 ++++++++++++++++
 packages/extension/src/manager/table.tsx      | 169 ++++++++
 packages/extension/src/manager/use-async.ts   |  59 +++
 packages/extension/src/manager/use-vta.ts     | 108 +++++
 .../extension/src/manager/whoami-banner.tsx   |  98 +++++
 .../tests/manager-context-tree.test.mts       | 115 ++++++
 .../extension/tests/manager-sender.test.mts   | 149 +++++++
 .../extension/tests/manager-surface.test.mts  | 109 +++++
 packages/extension/vite.config.manager.ts     |  51 +++
 47 files changed, 5085 insertions(+), 91 deletions(-)
 create mode 100644 packages/extension/manager.html
 create mode 100644 packages/extension/src/manager-theme.css
 create mode 100644 packages/extension/src/manager.tsx
 create mode 100644 packages/extension/src/manager/carrier.ts
 create mode 100644 packages/extension/src/manager/context-column.tsx
 create mode 100644 packages/extension/src/manager/context-tree.ts
 create mode 100644 packages/extension/src/manager/destructive.tsx
 create mode 100644 packages/extension/src/manager/panes/access.tsx
 create mode 100644 packages/extension/src/manager/panes/approvals.tsx
 create mode 100644 packages/extension/src/manager/panes/audit.tsx
 create mode 100644 packages/extension/src/manager/panes/contexts.tsx
 create mode 100644 packages/extension/src/manager/panes/dids.tsx
 create mode 100644 packages/extension/src/manager/panes/keys.tsx
 create mode 100644 packages/extension/src/manager/panes/policy.tsx
 create mode 100644 packages/extension/src/manager/panes/services.tsx
 create mode 100644 packages/extension/src/manager/panes/sessions.tsx
 create mode 100644 packages/extension/src/manager/sender.ts
 create mode 100644 packages/extension/src/manager/shell.tsx
 create mode 100644 packages/extension/src/manager/table.tsx
 create mode 100644 packages/extension/src/manager/use-async.ts
 create mode 100644 packages/extension/src/manager/use-vta.ts
 create mode 100644 packages/extension/src/manager/whoami-banner.tsx
 create mode 100644 packages/extension/tests/manager-context-tree.test.mts
 create mode 100644 packages/extension/tests/manager-sender.test.mts
 create mode 100644 packages/extension/tests/manager-surface.test.mts
 create mode 100644 packages/extension/vite.config.manager.ts

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index aaee75c..fede3b9 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -66,19 +66,46 @@ jobs:
           echo "OK: $bundle is a single bundle with no dynamic import()"
 
       # `@openvtc/pnm-core/admin` is operator surface — granting authority at an
-      # agent, revoking it, destroying contexts. A wallet has no business
-      # shipping any of it, and the way it would arrive is someone importing it
-      # from the package root instead of the subpath. The task URIs are the
-      # tell: they only appear in a bundle that pulled the module in.
-      - name: Assert the wallet ships no agent-administration surface
+      # agent, revoking it, destroying contexts. The task URIs are the tell:
+      # they only appear in a bundle that pulled the module in.
+      #
+      # The management console (`manager.html`) administers the agent, so it
+      # imports the module deliberately. Every *wallet* surface — the service
+      # worker, the content and page-world scripts, the popup, the confirm
+      # window, the offscreen document, the options page — still must not, and
+      # the way it would arrive is someone importing from the package root
+      # instead of the subpath, or Rollup hoisting a shared chunk.
+      #
+      # Hence: banned everywhere in dist/ **except** `manager.js`. Phrased as an
+      # exclusion rather than a list of permitted files so it keeps holding as
+      # entries are added. `vite.config.manager.ts` builds the console alone
+      # with `codeSplitting: false`, which is what makes "exactly one file may
+      # contain this" a structural property rather than a convention.
+      - name: Assert agent-administration surface is confined to the console
         run: |
           for task in 'acl/grant/0.1' 'acl/revoke/0.1' 'acl/update/0.1' 'contexts/delete/1.0' 'keys/create/0.1' 'keys/sign/0.1' 'policy/upsert/0.2' 'device/wipe/0.1' 'config/patch/0.1' 'vta/did-templates/create/2.0' 'consent/approver-set/1.0' 'keys/import/0.1' 'did-management/did/delete/0.1' 'vta/services/enable/1.0' 'vta/services/disable/1.0' 'vta/credentials/issue/0.1' 'vta/credentials/revoke/0.1'; do
-            if grep -rlF "$task" packages/extension/dist/; then
-              echo "::error::the extension bundle contains $task — @openvtc/pnm-core/admin must not be reachable from the wallet (check for a root-barrel import)"
+            leaked=$(grep -rlF "$task" packages/extension/dist/ | grep -v '^packages/extension/dist/manager\.js$' || true)
+            if [ -n "$leaked" ]; then
+              echo "::error::$leaked contains $task — @openvtc/pnm-core/admin must not be reachable from any wallet surface (check for a root-barrel import, or a shared chunk)"
               exit 1
             fi
           done
-          echo "OK: no admin task URIs in the extension bundle"
+          echo "OK: admin task URIs appear only in manager.js"
+
+      # The console's isolation rests on it being one self-contained file: the
+      # guard above names exactly one exception, so a second chunk would be a
+      # file nothing checks. Losing `codeSplitting: false` in a future upgrade
+      # is silent otherwise.
+      - name: Assert the console is a single self-contained bundle
+        run: |
+          bundle=packages/extension/dist/manager.js
+          test -f "$bundle" || { echo "::error::$bundle was not emitted — did the manager build run?"; exit 1; }
+          extra=$(ls packages/extension/dist/manager-split-*.js 2>/dev/null || true)
+          if [ -n "$extra" ]; then
+            echo "::error::the console emitted extra chunks ($extra); codeSplitting: false was lost and the admin guard now has unchecked files"
+            exit 1
+          fi
+          echo "OK: manager.js is a single bundle"
 
       # Build the Chrome Web Store upload artefact from the dist/ that the
       # Build step just produced (scripts/package.mjs re-stages it; it does
diff --git a/CLAUDE.md b/CLAUDE.md
index 2f1bb1f..212c515 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -128,6 +128,67 @@ routing either through a channel would overwrite or duplicate a proof.
 document as the counterparty receives it — a signature copied from another
 document satisfies an "is there a `proof` member" check and fails this one.
 
+## The wallet ships no operator authority — the console does
+
+`@openvtc/pnm-core/admin` is operator surface: granting authority at an agent,
+revoking it, destroying contexts. It is deliberately absent from the package
+root barrel, and CI greps the built output for 17 of its task URIs.
+
+That guard used to read "banned anywhere in `dist/`", on the grounds that a
+wallet has no business shipping any of it. The **management console**
+(`manager.html`) makes that statement false on purpose — administering the agent
+is its whole job — so the guard was **narrowed, not deleted**: banned everywhere
+in `dist/` *except* `manager.js`. Every wallet surface (service worker, content
+and page-world scripts, popup, confirm, offscreen, options) keeps the property
+the guard was protecting.
+
+**The console is its own vite build** (`vite.config.manager.ts`,
+`codeSplitting: false`). That is what makes "exactly one file may contain admin"
+structural rather than a convention: the main build emits popup, options,
+confirm and offscreen *together*, and Rollup is free to hoist shared code into a
+common `assets/*.js` chunk that wallet surfaces load. Building the console alone
+means there is no other entry to share with. A second CI assertion fails if it
+ever emits more than one chunk, because the first guard names exactly one
+exception and an extra chunk is a file nothing checks.
+
+**The console holds no key material.** It composes typed documents with the
+`admin/*` helpers and the offscreen document signs them, so an XSS there cannot
+exfiltrate a key. This is why `admin/*` and `vta/contexts.ts` type their
+envelope parties as `TaskParty` (`vta/channel.ts`) — just a DID — rather than
+`Identity` and `RemoteDidcommEndpoint`: only `.did` was ever read, and a
+surface typed on `Identity` can only be called from somewhere holding a private
+key. The REST convenience wrappers (`vtaListContexts`, `vtaCreateContext`) still
+take the stricter pair, because they *build a channel*, and a channel signs.
+
+**Only `type` and `payload` cross the bridge.** `RUNTIME_MANAGER_TASK` carries
+those two members and nothing else; `carrier.ts` strips the envelope the admin
+helper built, and `offscreen.ts`'s existing `OFFSCREEN_REQUEST_TASK` mints the
+real one and signs it. `core/src/vta/request-task.ts` explains why the device
+must mint it, and that reasoning does not soften because the composer is an
+extension page: a wallet that counter-signs a document composed elsewhere
+attests to fields it never checked. Reusing that path also inherits transport
+selection, `TransportHealth`, and the same-browser approver ceremony for free —
+`offscreen.ts` needed no change at all.
+
+**The relay is gated on `sender.url`, not `sender.id`.** Every content script
+carries this extension's id, so `sender.id` cannot separate a page from an
+extension surface. `isExtensionPageSender` compares against
+`chrome.runtime.getURL("")`. Unlike the page-facing `RUNTIME_REQUEST_TASK`, this
+one does **not** prompt per call — the caller is the operator driving their own
+console, and twelve identical dialogs to render one screen is dismissal, not
+consent. What stands in its place: the agent's ACL, its policy engine (a
+`requireConsent` comes back as `ConsentRequiredError` and renders as a match-code
+ceremony, never as a red string), and preview-then-confirm on every irreversible
+action, showing the agent's own account of what would be destroyed.
+
+**What breaks it:** importing `admin` from the package root instead of the
+subpath; folding `manager.html` into `vite.config.ts` (a shared chunk then
+carries admin into wallet surfaces); losing `codeSplitting: false`; adding
+`RUNTIME_MANAGER_TASK` to `PAGE_FACING_RUNTIME_TYPES` or to `content.ts`'s
+dispatch table; gating on `sender.id`; or widening the carrier to pass the
+envelope through. `tests/manager-sender.test.mts`,
+`tests/manager-surface.test.mts` and the two CI assertions pin each of these.
+
 ## Advertisement is not availability
 
 A VTA's DID document says what it *offers*. `buildVtaSession` skips a channel
diff --git a/packages/core/src/admin/acl.ts b/packages/core/src/admin/acl.ts
index daa78e4..55a4550 100644
--- a/packages/core/src/admin/acl.ts
+++ b/packages/core/src/admin/acl.ts
@@ -12,9 +12,7 @@
 // from the Rust structs, which is a copy that drifts, and got the nullability of
 // `acl/show`'s response wrong in the process.
 
-import type { Identity } from "../didcomm/index.js";
-import type { TrustTaskSender } from "../vta/channel.js";
-import type { RemoteDidcommEndpoint } from "../vta/didcomm.js";
+import type { TaskParty, TrustTaskSender } from "../vta/channel.js";
 import { buildTrustTask } from "../vta/trust-task.js";
 
 import {
@@ -73,9 +71,9 @@ export type { AclEntry };
 export interface AclCallerParams {
   /** Envelope `issuer` — the caller's DIDComm identity. Its DID needs a role
    *  the agent accepts for this task; the whole family is manage-gated. */
-  holder: Identity;
+  holder: TaskParty;
   /** The agent — envelope `recipient`. */
-  service: RemoteDidcommEndpoint;
+  service: TaskParty;
 }
 
 export interface AclGrantParams extends AclCallerParams {
diff --git a/packages/core/src/admin/consent.ts b/packages/core/src/admin/consent.ts
index 742a758..bf219da 100644
--- a/packages/core/src/admin/consent.ts
+++ b/packages/core/src/admin/consent.ts
@@ -15,9 +15,7 @@
 // consent and carries a challenge the approver's decision is bound to. Most
 // consoles will use `consentList`, `consentDecision` and `consentRevoke`.
 
-import type { Identity } from "../didcomm/index.js";
-import type { TrustTaskSender } from "../vta/channel.js";
-import type { RemoteDidcommEndpoint } from "../vta/didcomm.js";
+import type { TaskParty, TrustTaskSender } from "../vta/channel.js";
 import { buildTrustTask } from "../vta/trust-task.js";
 
 import {
@@ -63,8 +61,8 @@ import {
 export type { ConsentGrant, ConsentSubject, ApproverBinding };
 
 export interface ConsentCallerParams {
-  holder: Identity;
-  service: RemoteDidcommEndpoint;
+  holder: TaskParty;
+  service: TaskParty;
 }
 
 export interface ConsentListParams extends ConsentCallerParams {
diff --git a/packages/core/src/admin/contexts.ts b/packages/core/src/admin/contexts.ts
index 673f139..d06e5ae 100644
--- a/packages/core/src/admin/contexts.ts
+++ b/packages/core/src/admin/contexts.ts
@@ -10,9 +10,7 @@
 // snake_case. Both fields happen to be single words, which is exactly the kind
 // of coincidence that hides a casing bug until someone adds `dry_run`.
 
-import type { Identity } from "../didcomm/index.js";
-import type { TrustTaskSender } from "../vta/channel.js";
-import type { RemoteDidcommEndpoint } from "../vta/didcomm.js";
+import type { TaskParty, TrustTaskSender } from "../vta/channel.js";
 import { buildTrustTask } from "../vta/trust-task.js";
 
 const TASK_CONTEXTS_DELETE = "https://trusttasks.org/spec/vta/contexts/delete/1.0";
@@ -20,8 +18,8 @@ const TASK_CONTEXTS_PREVIEW_DELETE =
   "https://trusttasks.org/spec/vta/contexts/preview-delete/1.0";
 
 export interface ContextDeleteParams {
-  holder: Identity;
-  service: RemoteDidcommEndpoint;
+  holder: TaskParty;
+  service: TaskParty;
   /** Context id (full path for a nested context). */
   id: string;
   /** Delete even when the context still holds keys or DIDs. Default false. */
diff --git a/packages/core/src/admin/credentials.ts b/packages/core/src/admin/credentials.ts
index 62b9286..103f16b 100644
--- a/packages/core/src/admin/credentials.ts
+++ b/packages/core/src/admin/credentials.ts
@@ -11,9 +11,7 @@
 // two families version independently; a matching pair is a coincidence, not a
 // rule, so read the import paths rather than assuming.
 
-import type { Identity } from "../didcomm/index.js";
-import type { TrustTaskSender } from "../vta/channel.js";
-import type { RemoteDidcommEndpoint } from "../vta/didcomm.js";
+import type { TaskParty, TrustTaskSender } from "../vta/channel.js";
 import { buildTrustTask } from "../vta/trust-task.js";
 
 import {
@@ -32,9 +30,9 @@ import {
 /** Both calls are issued by an operator identity, to an agent. */
 export interface CredentialIssuerCallerParams {
   /** Envelope `issuer` — needs an agent role that carries issuing authority. */
-  holder: Identity;
+  holder: TaskParty;
   /** The issuing agent — envelope `recipient`. */
-  service: RemoteDidcommEndpoint;
+  service: TaskParty;
 }
 
 export interface IssueCredentialParams extends CredentialIssuerCallerParams {
diff --git a/packages/core/src/admin/devices.ts b/packages/core/src/admin/devices.ts
index a018fdb..b545ec0 100644
--- a/packages/core/src/admin/devices.ts
+++ b/packages/core/src/admin/devices.ts
@@ -10,9 +10,7 @@
 // request missing either: a wipe with no recorded reason is an audit gap. That
 // is a deliberate obstacle, so this wrapper adds no default for either.
 
-import type { Identity } from "../didcomm/index.js";
-import type { TrustTaskSender } from "../vta/channel.js";
-import type { RemoteDidcommEndpoint } from "../vta/didcomm.js";
+import type { TaskParty, TrustTaskSender } from "../vta/channel.js";
 import { buildTrustTask } from "../vta/trust-task.js";
 
 import {
@@ -41,8 +39,8 @@ export type { DeviceBinding };
 export type WipeScope = DeviceWipePayload["scope"];
 
 export interface DeviceCallerParams {
-  holder: Identity;
-  service: RemoteDidcommEndpoint;
+  holder: TaskParty;
+  service: TaskParty;
 }
 
 export interface DeviceListParams extends DeviceCallerParams {
diff --git a/packages/core/src/admin/did-templates.ts b/packages/core/src/admin/did-templates.ts
index a90f767..66be7f9 100644
--- a/packages/core/src/admin/did-templates.ts
+++ b/packages/core/src/admin/did-templates.ts
@@ -16,9 +16,7 @@
 // the operation to that context's templates; omitting it addresses the global
 // set. The two are different namespaces, and a name can exist in both.
 
-import type { Identity } from "../didcomm/index.js";
-import type { TrustTaskSender } from "../vta/channel.js";
-import type { RemoteDidcommEndpoint } from "../vta/didcomm.js";
+import type { TaskParty, TrustTaskSender } from "../vta/channel.js";
 import { buildTrustTask } from "../vta/trust-task.js";
 
 import {
@@ -60,8 +58,8 @@ import {
 export type { DidTemplate, DidTemplateRecord };
 
 export interface DidTemplateCallerParams {
-  holder: Identity;
-  service: RemoteDidcommEndpoint;
+  holder: TaskParty;
+  service: TaskParty;
   /** Scope the call to one context's templates. Omit for the global set —
    *  a different namespace, in which the same name may also exist. */
   contextId?: string;
diff --git a/packages/core/src/admin/keys.ts b/packages/core/src/admin/keys.ts
index 2eaa2a7..1d1758b 100644
--- a/packages/core/src/admin/keys.ts
+++ b/packages/core/src/admin/keys.ts
@@ -23,9 +23,7 @@
 // the parameter type enforces it here; the cleartext warning cannot be
 // enforced by any type and is stated where a caller will read it.
 
-import type { Identity } from "../didcomm/index.js";
-import type { TrustTaskSender } from "../vta/channel.js";
-import type { RemoteDidcommEndpoint } from "../vta/didcomm.js";
+import type { TaskParty, TrustTaskSender } from "../vta/channel.js";
 import { buildTrustTask } from "../vta/trust-task.js";
 
 import {
@@ -103,9 +101,9 @@ export type KeyRecord = SpecKeyRecord;
 
 export interface KeysCallerParams {
   /** Envelope `issuer` — the caller's DIDComm identity. */
-  holder: Identity;
+  holder: TaskParty;
   /** The agent — envelope `recipient`. */
-  service: RemoteDidcommEndpoint;
+  service: TaskParty;
 }
 
 export interface KeysCreateParams extends KeysCallerParams {
diff --git a/packages/core/src/admin/memory.ts b/packages/core/src/admin/memory.ts
index 37a4283..ead8435 100644
--- a/packages/core/src/admin/memory.ts
+++ b/packages/core/src/admin/memory.ts
@@ -9,9 +9,7 @@
 // counterpart only in the sense that both name a key — the list is deliberately
 // a directory, so enumerating memory does not spill its contents.
 
-import type { Identity } from "../didcomm/index.js";
-import type { TrustTaskSender } from "../vta/channel.js";
-import type { RemoteDidcommEndpoint } from "../vta/didcomm.js";
+import type { TaskParty, TrustTaskSender } from "../vta/channel.js";
 import { buildTrustTask } from "../vta/trust-task.js";
 
 import {
@@ -34,8 +32,8 @@ import {
 } from "@openvtc/trust-tasks/vta/memory/delete/0.1/payload";
 
 export interface MemoryCallerParams {
-  holder: Identity;
-  service: RemoteDidcommEndpoint;
+  holder: TaskParty;
+  service: TaskParty;
   /** Required — memory has no global namespace. */
   contextId: string;
 }
diff --git a/packages/core/src/admin/observability.ts b/packages/core/src/admin/observability.ts
index c8f1cb2..2480d0d 100644
--- a/packages/core/src/admin/observability.ts
+++ b/packages/core/src/admin/observability.ts
@@ -5,9 +5,7 @@
 // "under what settings", and `config/patch` is the one write, kept in the same
 // file because you should never be looking at the second without the first.
 
-import type { Identity } from "../didcomm/index.js";
-import type { TrustTaskSender } from "../vta/channel.js";
-import type { RemoteDidcommEndpoint } from "../vta/didcomm.js";
+import type { TaskParty, TrustTaskSender } from "../vta/channel.js";
 import { buildTrustTask } from "../vta/trust-task.js";
 
 import {
@@ -40,8 +38,8 @@ import {
 export type { AuditEnvelope, ConfigField };
 
 export interface ObservabilityCallerParams {
-  holder: Identity;
-  service: RemoteDidcommEndpoint;
+  holder: TaskParty;
+  service: TaskParty;
 }
 
 export interface AuditListParams extends ObservabilityCallerParams {
diff --git a/packages/core/src/admin/policy.ts b/packages/core/src/admin/policy.ts
index 635fc95..2b1ba35 100644
--- a/packages/core/src/admin/policy.ts
+++ b/packages/core/src/admin/policy.ts
@@ -13,9 +13,7 @@
 //
 // Payload and response types come from `@openvtc/trust-tasks`.
 
-import type { Identity } from "../didcomm/index.js";
-import type { TrustTaskSender } from "../vta/channel.js";
-import type { RemoteDidcommEndpoint } from "../vta/didcomm.js";
+import type { TaskParty, TrustTaskSender } from "../vta/channel.js";
 import { buildTrustTask } from "../vta/trust-task.js";
 
 import {
@@ -46,8 +44,8 @@ import {
 export type { PolicyModule };
 
 export interface PolicyCallerParams {
-  holder: Identity;
-  service: RemoteDidcommEndpoint;
+  holder: TaskParty;
+  service: TaskParty;
 }
 
 export interface PolicyListParams extends PolicyCallerParams {
diff --git a/packages/core/src/admin/services.ts b/packages/core/src/admin/services.ts
index 19cd30e..d99a154 100644
--- a/packages/core/src/admin/services.ts
+++ b/packages/core/src/admin/services.ts
@@ -11,9 +11,7 @@
 // calls it off. A caller that treats `disable` as instantaneous will report an
 // agent as off while it is still answering.
 
-import type { Identity } from "../didcomm/index.js";
-import type { TrustTaskSender } from "../vta/channel.js";
-import type { RemoteDidcommEndpoint } from "../vta/didcomm.js";
+import type { TaskParty, TrustTaskSender } from "../vta/channel.js";
 import { buildTrustTask } from "../vta/trust-task.js";
 
 import {
@@ -70,9 +68,9 @@ export type { ServiceState, ServiceKind };
 /** Every `vta/services/*` call is issued by an operator identity, to an agent. */
 export interface ServicesCallerParams {
   /** Envelope `issuer`. Needs an admin role — the whole family is manage-gated. */
-  holder: Identity;
+  holder: TaskParty;
   /** The agent — envelope `recipient`. */
-  service: RemoteDidcommEndpoint;
+  service: TaskParty;
 }
 
 /** Transport configuration. Which members apply depends on the `ServiceKind`. */
diff --git a/packages/core/src/admin/sessions.ts b/packages/core/src/admin/sessions.ts
index c03926c..b8f72b1 100644
--- a/packages/core/src/admin/sessions.ts
+++ b/packages/core/src/admin/sessions.ts
@@ -15,9 +15,7 @@
 //
 // Payload and response types come from `@openvtc/trust-tasks`.
 
-import type { Identity } from "../didcomm/index.js";
-import type { TrustTaskSender } from "../vta/channel.js";
-import type { RemoteDidcommEndpoint } from "../vta/didcomm.js";
+import type { TaskParty, TrustTaskSender } from "../vta/channel.js";
 import { buildTrustTask } from "../vta/trust-task.js";
 
 import {
@@ -40,8 +38,8 @@ import {
 export type { Session };
 
 export interface SessionCallerParams {
-  holder: Identity;
-  service: RemoteDidcommEndpoint;
+  holder: TaskParty;
+  service: TaskParty;
 }
 
 /**
diff --git a/packages/core/src/vta/channel.ts b/packages/core/src/vta/channel.ts
index e76c7a2..4785d5b 100644
--- a/packages/core/src/vta/channel.ts
+++ b/packages/core/src/vta/channel.ts
@@ -25,6 +25,26 @@ export interface TrustTaskSender {
   send<Res>(envelope: TrustTask<unknown>, opts?: SendOpts): Promise<Res>;
 }
 
+/**
+ * A party named on a Trust-Task envelope — the `issuer` or the `recipient`.
+ *
+ * Deliberately just the DID. Building an envelope needs nothing else: an
+ * `Identity` carries key material and a `RemoteDidcommEndpoint` carries a
+ * key-agreement JWK, and neither is read when the only question is "whose DID
+ * goes in this field". Both structurally satisfy this, so a caller that holds
+ * one passes it unchanged.
+ *
+ * Asking for more than this is not free. A surface typed on `Identity` can only
+ * be called from somewhere holding a private key, which forces key material
+ * into callers that compose documents without ever signing them — the
+ * management console being the case in point: it builds admin tasks and hands
+ * them to the device to mint and sign, and holds no key of its own. Typing the
+ * envelope's parties by what they actually are keeps that possible.
+ */
+export interface TaskParty {
+  did: string;
+}
+
 export interface SendOpts {
   /** Expected response document `type` (the `<request>#response` URI). When
    *  set, a reply whose `type` is neither this nor a trust-task-error is a
diff --git a/packages/core/src/vta/contexts.ts b/packages/core/src/vta/contexts.ts
index 9d1c6d4..42a7273 100644
--- a/packages/core/src/vta/contexts.ts
+++ b/packages/core/src/vta/contexts.ts
@@ -13,9 +13,7 @@
 // exposes a bespoke `GET/POST /contexts` REST route (now deprecated) — the
 // trust-task dispatcher form is the canonical one.
 
-import type { Identity } from "../didcomm/index.js";
-import type { TrustTaskSender } from "./channel.js";
-import type { RemoteDidcommEndpoint } from "./didcomm.js";
+import type { TaskParty, TrustTaskSender } from "./channel.js";
 import { RestChannel, type RestChannelOptions } from "./rest-channel.js";
 import { buildTrustTask } from "./trust-task.js";
 
@@ -95,9 +93,9 @@ export interface ContextsListParams {
   /** Envelope `issuer` — the holder's DIDComm identity. Its DID must be in
    *  the VTA's ACL with any role (`contexts/list` is auth-gated, not
    *  admin-only; the VTA filters by `has_context_access`). */
-  holder: Identity;
+  holder: TaskParty;
   /** The VTA — envelope `recipient`. */
-  service: RemoteDidcommEndpoint;
+  service: TaskParty;
 }
 
 /** List the contexts the holder can access.
@@ -121,8 +119,8 @@ export async function contextsList(
 }
 
 export interface ContextsCreateParams {
-  holder: Identity;
-  service: RemoteDidcommEndpoint;
+  holder: TaskParty;
+  service: TaskParty;
   /** Leaf segment when `parent` is set (full path = `<parent>/<id>`), else a
    *  top-level id. Must be unique; a conflict rejects. */
   id: string;
@@ -159,15 +157,22 @@ export async function contextsCreate(
 }
 
 /** @deprecated REST-transport options. Kept for existing call sites; prefer
- *  {@link contextsList} with a channel from a `VtaSession`. */
-export interface VtaListContextsOptions extends ContextsListParams, RestChannelOptions {}
+ *  {@link contextsList} with a channel from a `VtaSession`.
+ *
+ *  `holder` and `service` come from {@link RestChannelOptions}, not from
+ *  {@link ContextsListParams}: composing the envelope needs only the two DIDs, but this
+ *  wrapper also *builds the channel*, and a channel signs and encrypts. The
+ *  narrower pair is what the wire actually requires here. */
+export interface VtaListContextsOptions
+  extends Omit<ContextsListParams, "holder" | "service">,
+    RestChannelOptions {}
 
 /** @deprecated Use {@link contextsList} with a channel from a `VtaSession`.
  *  List over REST — builds a one-shot {@link RestChannel} (dispatches
  *  `contexts/list/1.0` over `/trust-tasks`, NOT the bespoke `/contexts`). */
 export interface ContextsGetParams {
-  holder: Identity;
-  service: RemoteDidcommEndpoint;
+  holder: TaskParty;
+  service: TaskParty;
   /** Context id — the full path for a nested context. */
   id: string;
 }
@@ -198,8 +203,8 @@ export async function contextsGet(
 }
 
 export interface ContextsUpdateParams {
-  holder: Identity;
-  service: RemoteDidcommEndpoint;
+  holder: TaskParty;
+  service: TaskParty;
   /** Context to update. The id itself cannot be changed. */
   id: string;
   /** New human-readable name. Omit to leave unchanged. */
@@ -239,8 +244,8 @@ export async function contextsUpdate(
 }
 
 export interface ContextsUpdateDidParams {
-  holder: Identity;
-  service: RemoteDidcommEndpoint;
+  holder: TaskParty;
+  service: TaskParty;
   /** Context whose DID is being set. */
   id: string;
   /** The DID to associate with this context. */
@@ -269,8 +274,15 @@ export function vtaListContexts(opts: VtaListContextsOptions): Promise<ContextRe
 }
 
 /** @deprecated REST-transport options. Kept for existing call sites; prefer
- *  {@link contextsCreate} with a channel from a `VtaSession`. */
-export interface VtaCreateContextOptions extends ContextsCreateParams, RestChannelOptions {}
+ *  {@link contextsCreate} with a channel from a `VtaSession`.
+ *
+ *  `holder` and `service` come from {@link RestChannelOptions}, not from
+ *  {@link ContextsCreateParams}: composing the envelope needs only the two DIDs, but this
+ *  wrapper also *builds the channel*, and a channel signs and encrypts. The
+ *  narrower pair is what the wire actually requires here. */
+export interface VtaCreateContextOptions
+  extends Omit<ContextsCreateParams, "holder" | "service">,
+    RestChannelOptions {}
 
 /** @deprecated Use {@link contextsCreate} with a channel from a `VtaSession`.
  *  Create over REST — builds a one-shot {@link RestChannel}. */
diff --git a/packages/core/src/webvh/dids.ts b/packages/core/src/webvh/dids.ts
index 1040805..e595938 100644
--- a/packages/core/src/webvh/dids.ts
+++ b/packages/core/src/webvh/dids.ts
@@ -58,17 +58,18 @@ import {
   type Response as DidsRegisterWithServerResponse,
 } from "@openvtc/trust-tasks/vta/webvh/dids/register-with-server/1.0/payload";
 
-import type { Identity } from "../didcomm/index.js";
-import type { TrustTaskSender } from "../vta/channel.js";
-import type { RemoteDidcommEndpoint } from "../vta/didcomm.js";
+import type { TaskParty, TrustTaskSender } from "../vta/channel.js";
 import { buildTrustTask } from "../vta/trust-task.js";
 
 export type { WebvhDidRecord, WebvhPathMode };
 
 /** Who is asking, and which agent is being asked. */
 export interface WebvhCall {
-  holder: Identity;
-  service: RemoteDidcommEndpoint;
+  /** Envelope `issuer`. Only the DID is read — see `TaskParty` in
+   *  `vta/channel.ts` for why this is not typed on `Identity`. */
+  holder: TaskParty;
+  /** Envelope `recipient`. */
+  service: TaskParty;
 }
 
 const send = <T>(
diff --git a/packages/extension/manager.html b/packages/extension/manager.html
new file mode 100644
index 0000000..a5514c6
--- /dev/null
+++ b/packages/extension/manager.html
@@ -0,0 +1,12 @@
+<!doctype html>
+<html lang="en">
+  <head>
+    <meta charset="utf-8" />
+    <meta name="viewport" content="width=device-width, initial-scale=1" />
+    <title>VTA Console</title>
+  </head>
+  <body>
+    <div id="root"></div>
+    <script type="module" src="/src/manager.tsx"></script>
+  </body>
+</html>
diff --git a/packages/extension/package.json b/packages/extension/package.json
index 23e296a..57d4bfd 100644
--- a/packages/extension/package.json
+++ b/packages/extension/package.json
@@ -6,7 +6,7 @@
   "type": "module",
   "scripts": {
     "dev": "vite build --watch --mode development",
-    "build": "tsc -b && vite build && vite build -c vite.config.background.ts",
+    "build": "tsc -b && vite build && vite build -c vite.config.background.ts && vite build -c vite.config.manager.ts",
     "lint": "tsc -b",
     "test": "node --test tests/*.test.mts",
     "package": "npm run build && node scripts/package.mjs",
diff --git a/packages/extension/src/app-shell.tsx b/packages/extension/src/app-shell.tsx
index 5f0e9ef..6c107da 100644
--- a/packages/extension/src/app-shell.tsx
+++ b/packages/extension/src/app-shell.tsx
@@ -265,6 +265,33 @@ export function AppShell({ advanced, vault }: { advanced: React.ReactNode; vault
           );
         })}
 
+        {/* The management console — a separate surface, and a separate tab.
+            Not a pane here: these four are the *wallet's* settings, and
+            administering the agent (granting authority, destroying contexts) is
+            a different job with a different blast radius. It also ships as its
+            own bundle, which is what keeps `@openvtc/pnm-core/admin` out of
+            every wallet surface — see `vite.config.manager.ts`. */}
+        <button
+          onClick={() => void chrome.tabs.create({ url: chrome.runtime.getURL("manager.html") })}
+          style={{
+            display: "flex",
+            alignItems: "center",
+            gap: 10,
+            marginTop: 10,
+            padding: "7px 9px",
+            borderRadius: "var(--w-r-sm)",
+            border: `1px solid ${c.line}`,
+            background: "transparent",
+            color: c.muted,
+            fontSize: t.base,
+            textAlign: "left",
+            cursor: "pointer",
+            width: "100%",
+          }}
+        >
+          Manage agent&nbsp;↗
+        </button>
+
         {/* Both roles, always visible. The wallet's whole authority model is
             that these are two identities with different powers; showing only
             one of them made the split something you had to go and look for.
diff --git a/packages/extension/src/background.ts b/packages/extension/src/background.ts
index 8e3bea8..baceb91 100644
--- a/packages/extension/src/background.ts
+++ b/packages/extension/src/background.ts
@@ -106,6 +106,7 @@ import {
   RUNTIME_ONBOARD_PREPARE,
   PAGE_FACING_RUNTIME_TYPES,
   RUNTIME_REQUEST_TASK,
+  RUNTIME_MANAGER_TASK,
   RUNTIME_SIGN_TRUST_TASK,
   RUNTIME_TASK_CONSENT,
   CONSENT_KEEPALIVE_PORT,
@@ -153,6 +154,8 @@ import {
   OFFSCREEN_REQUEST_TASK,
   type RuntimeRequestTaskRequest,
   type RuntimeRequestTaskResponse,
+  type RuntimeManagerTaskRequest,
+  type RuntimeManagerTaskResponse,
   type RuntimeSignTrustTaskRequest,
   type RuntimeSignTrustTaskResponse,
   type RuntimeStepUpConsentRequest,
@@ -1676,6 +1679,68 @@ async function handleRequestTask(
   return res;
 }
 
+/**
+ * True when this message came from one of the extension's own pages.
+ *
+ * `sender.id === chrome.runtime.id` — already checked for every message — does
+ * NOT answer this: a content script is our script, injected into someone else's
+ * page, and passes it. `sender.url` is set by the browser from the context the
+ * message actually left, so an extension page reads
+ * `chrome-extension://<id>/manager.html` while a content script reads the page
+ * it is running in. That is the whole distinction, and it is not forgeable from
+ * page content.
+ *
+ * Used to gate the management console's relay, which — unlike the page-facing
+ * one — does not stop to ask a human before each task.
+ */
+function isExtensionPageSender(sender: chrome.runtime.MessageSender): boolean {
+  const base = chrome.runtime.getURL("");
+  return typeof sender.url === "string" && sender.url.startsWith(base);
+}
+
+/**
+ * Run one administration task proposed by the management console.
+ *
+ * ## Why this does not prompt, when `handleRequestTask` always does
+ *
+ * That prompt exists because an arbitrary web page is proposing an arbitrary
+ * task, and under a generic relay a remembered grant would mean "this site may
+ * ask my agent to do anything at all". Neither half is true here: the caller is
+ * an extension page the operator opened themselves, and there is no origin to
+ * remember or to be wrong about. Prompting per call would also make the surface
+ * unusable — a console reads a dozen lists to draw one screen, and a human who
+ * clicks through twelve identical dialogs to see a page is not consenting to
+ * anything, they are dismissing an obstacle.
+ *
+ * What still stands between the console and a destructive change: the agent's
+ * own policy engine, which answers `requireConsent` as a `consentRequired`
+ * outcome that the console renders as an approval ceremony rather than an
+ * error; the agent's ACL, which is the only authority that decides whether this
+ * caller may act at all; and the console's own preview-then-confirm on every
+ * irreversible action, which shows the agent's account of what would be
+ * destroyed rather than a generic "are you sure".
+ *
+ * The origin stamped into the task is this extension's own. That is the honest
+ * answer — the console really is the caller — and it is what the agent's audit
+ * trail will record.
+ */
+async function handleManagerTask(
+  req: RuntimeManagerTaskRequest,
+): Promise<RuntimeManagerTaskResponse> {
+  const active = await readActiveConnection();
+  if (!active.ok) return { ok: false, error: active.error };
+
+  await ensureOffscreenDocument();
+  return (await chrome.runtime.sendMessage({
+    target: OFFSCREEN_TARGET,
+    type: OFFSCREEN_REQUEST_TASK,
+    vtaDid: active.conn.vtaDid,
+    restBaseUrl: active.conn.restBaseUrl,
+    origin: new URL(chrome.runtime.getURL("")).origin,
+    params: req.params,
+  })) as RuntimeManagerTaskResponse;
+}
+
 // Sign a Trust-Task envelope with the wallet's holder did:peer #key-2.
 // Forward to the offscreen which loads the holder identity + calls the core
 // `signTrustTask` helper.
@@ -2663,6 +2728,26 @@ chrome.runtime.onMessage.addListener((message, sender, sendResponse) => {
     return true; // async sendResponse
   }
 
+  if ((message as { type?: string })?.type === RUNTIME_MANAGER_TASK) {
+    // Extension pages only. A content script carries our extension id but not
+    // our URL, and this relay does not stop to ask a human — so the gate is the
+    // whole security boundary for the console's authority.
+    if (!isExtensionPageSender(sender)) {
+      // eslint-disable-next-line no-console
+      console.warn(
+        `[background] rejecting ${RUNTIME_MANAGER_TASK} from non-extension sender url=${sender.url}`,
+      );
+      sendResponse({ ok: false, error: "manager surface is not page-reachable" });
+      return false;
+    }
+    handleManagerTask(message as RuntimeManagerTaskRequest)
+      .then(sendResponse)
+      .catch((e: unknown) =>
+        sendResponse({ ok: false, error: e instanceof Error ? e.message : String(e) }),
+      );
+    return true; // async sendResponse
+  }
+
   if ((message as { type?: string })?.type === RUNTIME_REQUEST_TASK) {
     handleRequestTask(message as RuntimeRequestTaskRequest)
       .then(sendResponse)
diff --git a/packages/extension/src/bridge-protocol.ts b/packages/extension/src/bridge-protocol.ts
index 3d0a7d8..ad36dba 100644
--- a/packages/extension/src/bridge-protocol.ts
+++ b/packages/extension/src/bridge-protocol.ts
@@ -1747,6 +1747,37 @@ export interface OffscreenRequestTaskRequest {
   params: RequestTaskParams;
 }
 
+/** manager console → background: run one administration task at the agent.
+ *
+ *  **Deliberately NOT in {@link PAGE_FACING_RUNTIME_TYPES}, and deliberately
+ *  absent from `content.ts`'s dispatch table.** Granting authority at an agent,
+ *  revoking it and destroying contexts is operator surface; a web page has no
+ *  business proposing any of it, and the relay it *is* allowed to use
+ *  ({@link RUNTIME_REQUEST_TASK}) prompts a human for every single call.
+ *
+ *  `sender.id === chrome.runtime.id` does not separate the two — a content
+ *  script passes it. The discriminator is `sender.url`, which the browser sets
+ *  and a page cannot influence: an extension page's is under
+ *  `chrome.runtime.getURL("")`, a content script's is the page it was injected
+ *  into. `background.ts` gates on exactly that.
+ *
+ *  Carries `params` and nothing else. The console composes a typed envelope
+ *  with the `@openvtc/pnm-core/admin` helpers, but only its `type` and
+ *  `payload` cross this boundary — the device mints `id`, `issuedAt`, `issuer`
+ *  and `recipient` inside its own trust boundary and the channel signs the
+ *  result, exactly as it does for a page-proposed task. See
+ *  `core/src/vta/request-task.ts` for why that division is not negotiable. */
+export const RUNTIME_MANAGER_TASK = "vta-wallet/manager-task" as const;
+
+export interface RuntimeManagerTaskRequest {
+  type: typeof RUNTIME_MANAGER_TASK;
+  params: RequestTaskParams;
+}
+
+export type RuntimeManagerTaskResponse =
+  | { ok: true; result: RequestTaskResult }
+  | { ok: false; error: string };
+
 /**
  * Every runtime message type a *web page* can originate through the content
  * script — the exact set whose origin must be the browser's, not the message
diff --git a/packages/extension/src/manager-theme.css b/packages/extension/src/manager-theme.css
new file mode 100644
index 0000000..dec25d0
--- /dev/null
+++ b/packages/extension/src/manager-theme.css
@@ -0,0 +1,68 @@
+/* Act colours — the console's only addition to the wallet's design tokens.
+ *
+ * `theme.css` stays the base: ground, surface, line, text, and the semantic
+ * ok/warn/danger triple are shared with the popup, options and confirm
+ * surfaces, so the console reads as the same product and there is exactly one
+ * palette to keep correct across light and dark.
+ *
+ * What the console needs *on top* is a way to say which act of the stack a
+ * section belongs to. The workshop deck does this with a left rail that changes
+ * colour by act, and it works because the grouping is real — the three groups
+ * answer three different questions:
+ *
+ *   identity  (purple)  who you are, and what you hold
+ *   wire      (lime)    how bytes get there, and whether they did
+ *   graph     (gold)    who may act, and who has to agree
+ *
+ * These are navigation colours and nothing else. They never encode state: a
+ * section is not "more purple" when something is wrong. `--w-ok` / `--w-warn` /
+ * `--w-danger` remain the only colours that mean anything, which is the reason
+ * the accent was kept separate from the semantics in the first place — "this is
+ * actionable" and "this verified" must stay visually separable in a security
+ * UI, and adding three more meaningful colours would undo that.
+ *
+ * Light values are darkened well past their names (a literal lime is unreadable
+ * on a near-white ground); dark values are lifted. Both are checked against
+ * `--w-surface`, not against white.
+ */
+
+:root {
+  --m-act-identity: #6b3fd4;
+  --m-act-identity-soft: #f0ebfd;
+  --m-act-wire: #4b7d16;
+  --m-act-wire-soft: #eef6e2;
+  --m-act-graph: #8f6410;
+  --m-act-graph-soft: #fbf2dc;
+
+  /* The rail's own ground — a half-step off `--w-ground` so the three columns
+   * read as three columns without a hard border doing the work. */
+  --m-rail: #f2f4f8;
+  --m-tree: #fafbfd;
+}
+
+@media (prefers-color-scheme: dark) {
+  :root {
+    --m-act-identity: #a98bff;
+    --m-act-identity-soft: #1d1733;
+    --m-act-wire: #a4d552;
+    --m-act-wire-soft: #182310;
+    --m-act-graph: #e0b355;
+    --m-act-graph-soft: #292010;
+
+    --m-rail: #0e131c;
+    --m-tree: #10151f;
+  }
+}
+
+/* The console is a full-page surface and owns the viewport. The wallet's other
+ * surfaces are sized by their container (a popup, an options frame), so this
+ * belongs here rather than in `theme.css`. */
+html,
+body,
+#root {
+  height: 100%;
+}
+
+body {
+  overflow: hidden;
+}
diff --git a/packages/extension/src/manager.tsx b/packages/extension/src/manager.tsx
new file mode 100644
index 0000000..8fa6681
--- /dev/null
+++ b/packages/extension/src/manager.tsx
@@ -0,0 +1,32 @@
+/// <reference types="chrome" />
+
+// The management console's entry point.
+//
+// A separate bundle from every other extension surface, and the separation is
+// load-bearing rather than tidy: `@openvtc/pnm-core/admin` is operator
+// authority — granting it, revoking it, destroying contexts — and CI asserts
+// that none of it reaches the wallet's own bundles. Its own vite config
+// (`vite.config.manager.ts`) with `codeSplitting: false` is what makes that
+// assertion structural instead of a promise: Rollup cannot emit a shared chunk
+// between this entry and the popup, offscreen or service worker, because it
+// does not build them together.
+//
+// Reached from the popup and options page via `chrome.tabs.create`. Deliberately
+// NOT `options_ui` (the wallet's settings are the options page, and this is not
+// settings) and deliberately not a `web_accessible_resource` — no page should
+// be able to frame or navigate to it.
+
+import { StrictMode } from "react";
+import { createRoot } from "react-dom/client";
+import { ManagerShell } from "./manager/shell.js";
+import "./theme.css";
+import "./manager-theme.css";
+
+const root = document.getElementById("root");
+if (!root) throw new Error("manager.html is missing its #root element");
+
+createRoot(root).render(
+  <StrictMode>
+    <ManagerShell />
+  </StrictMode>,
+);
diff --git a/packages/extension/src/manager/carrier.ts b/packages/extension/src/manager/carrier.ts
new file mode 100644
index 0000000..a3cda7f
--- /dev/null
+++ b/packages/extension/src/manager/carrier.ts
@@ -0,0 +1,122 @@
+// What crosses the bridge when the console runs an admin task — and what does
+// not.
+//
+// Every helper in `@openvtc/pnm-core/admin` builds a canonical envelope with
+// `buildTrustTask` and hands it to a `TrustTaskSender`. That gives the console
+// the API it wants: typed payloads and responses, with the wire shapes owned by
+// the generated `@openvtc/trust-tasks` bindings rather than transcribed here.
+//
+// But `core/src/vta/request-task.ts` is explicit that **the device mints the
+// envelope**. A wallet that counter-signs a document composed somewhere else
+// attests to every field the agent will subsequently trust *because the wallet
+// signed it* — issuer, recipient, expiry, id — none of which it checked. That
+// rule does not soften because the composer happens to be an extension page:
+// what the signature claims is the same either way.
+//
+// So the envelope the admin helper builds is a **carrier**, not a document.
+// `carrierParams` takes the only two members a caller is entitled to propose
+// and drops the rest; the offscreen document mints the real envelope and the
+// channel signs it (`signOutboundTask`, SPEC §7.2 item 7a).
+//
+// Deliberately free of relative imports so it can be unit-tested in plain Node
+// — the same constraint every other tested module in this package observes, and
+// the reason the chrome-facing half lives in `sender.ts`.
+
+import type { TrustTask } from "@openvtc/pnm-core";
+
+/** The two members that may travel. Mirrors `RequestTaskParams`. */
+export interface CarrierParams {
+  type: string;
+  payload: Record<string, unknown>;
+}
+
+/**
+ * Strip a carrier envelope down to what may cross the bridge.
+ *
+ * An absent payload becomes `{}` rather than `undefined`: `auth/whoami` and
+ * friends legitimately send an empty payload, and relaying `undefined` reaches
+ * the agent as a missing member that fails schema validation for no visible
+ * reason.
+ */
+export function carrierParams(envelope: TrustTask<unknown>): CarrierParams {
+  return {
+    type: envelope.type,
+    payload: (envelope.payload ?? {}) as Record<string, unknown>,
+  };
+}
+
+/**
+ * The agent will not run this task until a human approves it.
+ *
+ * **Not a failure, and it must never be rendered as one.** The refusal carries
+ * the executor-signed consent requests an approver has to see and the salted
+ * digest whose prefix the operator matches on their approving device. A console
+ * that printed "Error: consent required" would discard the informed-consent
+ * ceremony at the exact moment the human was supposed to act.
+ *
+ * `TrustTaskSender.send` returns a value or throws, so this arrives as a
+ * *typed* throw. The panes catch this class specifically; nothing else in the
+ * console is allowed to catch it.
+ */
+export class ConsentRequiredError extends Error {
+  /** Salted digest of the exact payload awaiting approval; a prefix is the
+   *  cross-device match code. */
+  readonly payloadDigest: string;
+  readonly challenge: string;
+  readonly approverSet: string;
+  readonly minApprovals: number;
+  /** Executor-signed `task-consent/request` documents, one per approver. */
+  readonly consentRequests: unknown[];
+  /** Task type the operator was attempting, for the ceremony's copy. */
+  readonly taskType: string;
+
+  constructor(taskType: string, outcome: Record<string, unknown>) {
+    super(`${taskType} needs human approval before the agent will run it`);
+    this.name = "ConsentRequiredError";
+    this.taskType = taskType;
+    this.payloadDigest = typeof outcome.payloadDigest === "string" ? outcome.payloadDigest : "";
+    this.challenge = typeof outcome.challenge === "string" ? outcome.challenge : "";
+    this.approverSet = typeof outcome.approverSet === "string" ? outcome.approverSet : "";
+    this.minApprovals = typeof outcome.minApprovals === "number" ? outcome.minApprovals : 1;
+    this.consentRequests = Array.isArray(outcome.consentRequests) ? outcome.consentRequests : [];
+  }
+}
+
+/** The bridge's reply, structurally. Kept here rather than imported so this
+ *  module stays free of relative imports; `sender.ts` passes the real typed
+ *  value, and a drift between the two breaks its build. */
+export interface RelayReply {
+  ok: boolean;
+  error?: string;
+  result?: Record<string, unknown>;
+}
+
+/**
+ * Turn the bridge's reply into a result, or throw the right kind of error.
+ *
+ * Three outcomes, and the middle one is the reason this is a function rather
+ * than an `if (!ok) throw`: `accepted` unwraps, `consentRequired` throws the
+ * typed ceremony, and anything else means the relay changed shape underneath
+ * this file. That last case must be loud — returning it would hand a pane an
+ * object whose members all read `undefined`, which renders as a convincing
+ * empty result.
+ */
+export function interpretOutcome<Res>(
+  taskType: string,
+  label: string,
+  reply: RelayReply,
+): Res {
+  if (!reply.ok) throw new Error(`${label} failed: ${reply.error ?? "unknown error"}`);
+
+  const outcome = reply.result;
+  if (outcome?.kind === "consentRequired") {
+    throw new ConsentRequiredError(taskType, outcome);
+  }
+  if (outcome?.kind !== "accepted") {
+    throw new Error(
+      `${label} returned an outcome this console does not understand ` +
+        `(kind=${String(outcome?.kind)}). The wallet and console builds may differ.`,
+    );
+  }
+  return outcome.result as Res;
+}
diff --git a/packages/extension/src/manager/context-column.tsx b/packages/extension/src/manager/context-column.tsx
new file mode 100644
index 0000000..38dd625
--- /dev/null
+++ b/packages/extension/src/manager/context-column.tsx
@@ -0,0 +1,197 @@
+// The persistent context column.
+//
+// This is navigation, not a pane: the selection made here scopes Keys, DIDs,
+// Access and Audit, because `contextId` is a filter parameter on all of them.
+// Which is why it sits beside the sections rather than inside one — an operator
+// picks `work/eng` once and every question they ask afterwards is about
+// `work/eng` until they say otherwise.
+
+import { useMemo, useState } from "react";
+import { c, t, font } from "../theme.js";
+import { buildContextTree, flattenContextTree, type ContextNode } from "./context-tree.js";
+import type { ContextRecord } from "@openvtc/pnm-core";
+
+/** `null` means "all contexts" — the filter cleared, not a context named null. */
+export type ContextSelection = string | null;
+
+function Row({
+  node,
+  depth,
+  hasChildren,
+  collapsed,
+  selected,
+  onToggle,
+  onSelect,
+}: {
+  node: ContextNode;
+  depth: number;
+  hasChildren: boolean;
+  collapsed: boolean;
+  selected: boolean;
+  onToggle: () => void;
+  onSelect: () => void;
+}) {
+  // A placeholder stands for a parent this caller's ACL does not reach. It is
+  // drawn so its reachable children are not silently orphaned, but there is no
+  // record behind it — nothing to scope a pane to, nothing to rename, nothing
+  // to delete. So it is not selectable, and says why.
+  const unreachable = !node.record;
+
+  return (
+    <div style={{ display: "flex", alignItems: "center", paddingLeft: 8 + depth * 14 }}>
+      <button
+        onClick={onToggle}
+        aria-label={collapsed ? `Expand ${node.name}` : `Collapse ${node.name}`}
+        style={{
+          width: 16,
+          border: "none",
+          background: "none",
+          padding: 0,
+          cursor: hasChildren ? "pointer" : "default",
+          color: c.faint,
+          fontSize: t.sm,
+          lineHeight: 1,
+          visibility: hasChildren ? "visible" : "hidden",
+        }}
+      >
+        {collapsed ? "▸" : "▾"}
+      </button>
+      <button
+        onClick={unreachable ? undefined : onSelect}
+        disabled={unreachable}
+        title={
+          unreachable
+            ? "You do not have access to this context. It is shown because you administer " +
+              "contexts inside it."
+            : node.basePath
+        }
+        style={{
+          flex: 1,
+          minWidth: 0,
+          textAlign: "left",
+          border: "none",
+          borderRadius: "var(--w-r-sm)",
+          padding: "5px 8px",
+          margin: "1px 6px 1px 0",
+          cursor: unreachable ? "default" : "pointer",
+          background: selected ? "var(--m-act-identity-soft)" : "transparent",
+          color: unreachable ? c.faint : selected ? "var(--m-act-identity)" : c.text,
+          fontFamily: font.sans,
+          fontSize: t.sm,
+          fontWeight: selected ? 640 : 440,
+          fontStyle: unreachable ? "italic" : "normal",
+          overflow: "hidden",
+          textOverflow: "ellipsis",
+          whiteSpace: "nowrap",
+        }}
+      >
+        {node.name}
+      </button>
+    </div>
+  );
+}
+
+export function ContextTree({
+  records,
+  selected,
+  onSelect,
+  loading,
+  error,
+}: {
+  records: ContextRecord[];
+  selected: ContextSelection;
+  onSelect: (id: ContextSelection) => void;
+  loading: boolean;
+  error: string | null;
+}) {
+  const [collapsed, setCollapsed] = useState<ReadonlySet<string>>(new Set());
+  const roots = useMemo(() => buildContextTree(records), [records]);
+  const rows = useMemo(() => flattenContextTree(roots, collapsed), [roots, collapsed]);
+
+  const toggle = (id: string | undefined) => {
+    if (!id) return;
+    setCollapsed((prev) => {
+      const next = new Set(prev);
+      if (next.has(id)) next.delete(id);
+      else next.add(id);
+      return next;
+    });
+  };
+
+  return (
+    <nav
+      aria-label="Trust contexts"
+      style={{
+        background: "var(--m-tree)",
+        borderRight: `1px solid ${c.line}`,
+        overflowY: "auto",
+        padding: "12px 0",
+        display: "grid",
+        gridAutoRows: "min-content",
+      }}
+    >
+      <h2
+        style={{
+          margin: "0 14px 8px",
+          fontSize: t.xs,
+          textTransform: "uppercase",
+          letterSpacing: 0.5,
+          color: c.faint,
+          fontWeight: 640,
+        }}
+      >
+        Trust contexts
+      </h2>
+
+      <div style={{ paddingLeft: 8 }}>
+        <button
+          onClick={() => onSelect(null)}
+          style={{
+            width: "calc(100% - 14px)",
+            textAlign: "left",
+            border: "none",
+            borderRadius: "var(--w-r-sm)",
+            padding: "5px 8px",
+            margin: "1px 6px 6px 16px",
+            cursor: "pointer",
+            background: selected === null ? "var(--m-act-identity-soft)" : "transparent",
+            color: selected === null ? "var(--m-act-identity)" : c.muted,
+            fontFamily: font.sans,
+            fontSize: t.sm,
+            fontWeight: selected === null ? 640 : 440,
+          }}
+        >
+          All contexts
+        </button>
+      </div>
+
+      {loading && (
+        <span style={{ padding: "6px 14px", fontSize: t.sm, color: c.faint }}>Loading…</span>
+      )}
+      {error && (
+        <span style={{ padding: "6px 14px", fontSize: t.sm, color: c.danger, lineHeight: 1.5 }}>
+          {error}
+        </span>
+      )}
+      {!loading && !error && rows.length === 0 && (
+        <span style={{ padding: "6px 14px", fontSize: t.sm, color: c.faint, lineHeight: 1.5 }}>
+          No contexts you can reach. Contexts you administer appear here — ask an admin at this
+          agent for a grant, or create one below.
+        </span>
+      )}
+
+      {rows.map(({ node, depth, hasChildren }, i) => (
+        <Row
+          key={node.id ?? `placeholder:${node.name}:${i}`}
+          node={node}
+          depth={depth}
+          hasChildren={hasChildren}
+          collapsed={Boolean(node.id && collapsed.has(node.id))}
+          selected={Boolean(node.id && node.id === selected)}
+          onToggle={() => toggle(node.id)}
+          onSelect={() => node.id && onSelect(node.id)}
+        />
+      ))}
+    </nav>
+  );
+}
diff --git a/packages/extension/src/manager/context-tree.ts b/packages/extension/src/manager/context-tree.ts
new file mode 100644
index 0000000..fb0c0ea
--- /dev/null
+++ b/packages/extension/src/manager/context-tree.ts
@@ -0,0 +1,130 @@
+// Flat `ContextRecord[]` → the tree the console navigates by.
+//
+// Contexts are the spine of this surface, not one section of it: `contextId` is
+// already a filter parameter on `keysList`, `aclList` and `auditList`, so the
+// selection made here scopes every pane to its right. That is why the tree is a
+// persistent column rather than the content of a "Contexts" page.
+//
+// ## Why an unreachable parent is drawn rather than dropped
+//
+// A caller sees the contexts their ACL entries reach, and those entries are not
+// obliged to cover a whole subtree — `work/eng` can be granted without `work`.
+// So `parent` routinely names a context this caller cannot list, and the
+// obvious tree build (index by id, attach to `byId[parent]`, keep what
+// attached) silently loses exactly those children.
+//
+// That failure is invisible in the worst way: the console renders a shorter,
+// entirely plausible tree, and an operator concludes they have no access to a
+// context they are in fact administering. So an orphan gets a **placeholder**
+// parent instead — drawn, named by the DID-less id the record itself carries,
+// and marked unreachable. A placeholder is not selectable: there is no record
+// behind it, so there is nothing to scope a pane to and nothing to delete.
+//
+// The placeholder stands for the parent and nothing more. It deliberately does
+// not try to reconstruct the chain above it from `basePath`, whose segmentation
+// this code does not own — `basePath` is shown verbatim as the node's path
+// instead, which is the agent's own answer and cannot drift from it.
+
+import type { ContextRecord } from "@openvtc/pnm-core";
+
+export interface ContextNode {
+  /** Context id — the value panes filter on. Absent on a placeholder. */
+  id?: string;
+  /** What to draw. A placeholder shows the id its child named as its parent. */
+  name: string;
+  /** The agent's own resolved path, shown verbatim. Absent on a placeholder. */
+  basePath?: string;
+  /** The record behind this node. Absent on a placeholder, which is the test
+   *  for "this node is real" — a node with no record can be expanded and read
+   *  but never selected, renamed or deleted. */
+  record?: ContextRecord;
+  children: ContextNode[];
+}
+
+/** Depth-first order with the tree's shape flattened for rendering. */
+export interface FlatContextNode {
+  node: ContextNode;
+  depth: number;
+  /** Whether any descendant exists — drives the disclosure triangle. */
+  hasChildren: boolean;
+}
+
+function byName(a: ContextNode, b: ContextNode): number {
+  return a.name.localeCompare(b.name);
+}
+
+/**
+ * Build the forest.
+ *
+ * Roots are records with no `parent`, plus one placeholder per distinct
+ * unreachable parent. Order is by name at every level, so the tree does not
+ * reshuffle between reads of the same agent.
+ */
+export function buildContextTree(records: readonly ContextRecord[]): ContextNode[] {
+  const nodes = new Map<string, ContextNode>();
+  for (const record of records) {
+    nodes.set(record.id, {
+      id: record.id,
+      name: record.name || record.id,
+      basePath: record.basePath,
+      record,
+      children: [],
+    });
+  }
+
+  const roots: ContextNode[] = [];
+  const placeholders = new Map<string, ContextNode>();
+
+  for (const record of records) {
+    const node = nodes.get(record.id);
+    if (!node) continue;
+    if (!record.parent) {
+      roots.push(node);
+      continue;
+    }
+    const parent = nodes.get(record.parent);
+    if (parent) {
+      parent.children.push(node);
+      continue;
+    }
+    // Unreachable parent — see the header. One placeholder per parent id, so
+    // two siblings under the same invisible parent share a node rather than
+    // producing two identical roots.
+    let stand = placeholders.get(record.parent);
+    if (!stand) {
+      stand = { name: record.parent, children: [] };
+      placeholders.set(record.parent, stand);
+      roots.push(stand);
+    }
+    stand.children.push(node);
+  }
+
+  const sortDeep = (list: ContextNode[]): void => {
+    list.sort(byName);
+    for (const n of list) sortDeep(n.children);
+  };
+  sortDeep(roots);
+  return roots;
+}
+
+/**
+ * Depth-first flatten, honouring a collapsed set.
+ *
+ * `collapsed` holds node ids; a placeholder has none and so can never be
+ * collapsed — hiding an unreachable parent would hide the reachable children it
+ * exists to reveal.
+ */
+export function flattenContextTree(
+  roots: readonly ContextNode[],
+  collapsed: ReadonlySet<string>,
+): FlatContextNode[] {
+  const out: FlatContextNode[] = [];
+  const walk = (node: ContextNode, depth: number): void => {
+    const hasChildren = node.children.length > 0;
+    out.push({ node, depth, hasChildren });
+    if (node.id && collapsed.has(node.id)) return;
+    for (const child of node.children) walk(child, depth + 1);
+  };
+  for (const root of roots) walk(root, 0);
+  return out;
+}
diff --git a/packages/extension/src/manager/destructive.tsx b/packages/extension/src/manager/destructive.tsx
new file mode 100644
index 0000000..ac818a5
--- /dev/null
+++ b/packages/extension/src/manager/destructive.tsx
@@ -0,0 +1,265 @@
+// Preview-then-confirm, and the consent ceremony that can interrupt it.
+//
+// ## Why the preview comes from the agent
+//
+// A generic "Are you sure?" is worth nothing: the operator already believes
+// they are sure, and the dialog adds a click rather than information. What
+// changes a decision is *what would actually be destroyed*, and only the agent
+// knows that — `contextPreviewDelete` returns the real keys and DIDs a context
+// holds, which is precisely the list an operator does not have in their head.
+//
+// So every irreversible action here is two calls: ask the agent what the change
+// would cost, render its answer verbatim, then send the change. `force` is a
+// separate explicit tick rather than something the confirm button implies,
+// because the agent refuses a non-empty deletion on purpose and overriding that
+// refusal is a second decision.
+//
+// ## Why `consentRequired` renders here
+//
+// The agent may answer "a human must approve this first". That is not a
+// failure — the refusal carries the salted payload digest whose prefix the
+// operator matches on their approving device. Rendering it as a red error would
+// discard the informed-consent ceremony at the exact moment the human was meant
+// to act, so it gets the same surface as the preview: this is the one place the
+// console catches `ConsentRequiredError`.
+
+import { useCallback, useState, type ReactNode } from "react";
+import { Button, Note } from "../ui.js";
+import { c, t, font } from "../theme.js";
+import { ConsentRequiredError } from "./carrier.js";
+
+/** How much of the digest an operator compares across devices. The full value
+ *  is unreadable aloud and nobody checks 64 characters; the prefix is what the
+ *  approving surface shows too. */
+const MATCH_CODE_LENGTH = 8;
+
+function MatchCode({ digest }: { digest: string }) {
+  const code = digest.slice(0, MATCH_CODE_LENGTH).toUpperCase();
+  return (
+    <span
+      style={{
+        fontFamily: font.mono,
+        fontSize: t.lg,
+        letterSpacing: 3,
+        fontWeight: 650,
+        color: c.text,
+      }}
+    >
+      {code || "—"}
+    </span>
+  );
+}
+
+/** The ceremony panel. Shown in place of the confirm button once the agent has
+ *  asked for approval; the operator's next move is on another device. */
+export function ConsentCeremony({ pending }: { pending: ConsentRequiredError }) {
+  return (
+    <Note tone="accent">
+      <div style={{ display: "grid", gap: 8 }}>
+        <strong>Your agent will not run this until a human approves it.</strong>
+        <div style={{ display: "flex", alignItems: "baseline", gap: 12, flexWrap: "wrap" }}>
+          <span style={{ color: c.muted }}>Match code</span>
+          <MatchCode digest={pending.payloadDigest} />
+        </div>
+        <span style={{ color: c.muted }}>
+          Approve on your approving device, and check that the code shown there is the same. It
+          is derived from this exact change — a different code means you would be approving
+          something else.
+          {pending.minApprovals > 1
+            ? ` ${pending.minApprovals} approvals are required.`
+            : ""}
+        </span>
+      </div>
+    </Note>
+  );
+}
+
+export interface DestructiveProps<P> {
+  /** Button copy for the action itself, e.g. "Delete context". */
+  label: string;
+  /** Disabled reason, or null when the action is available. Shown rather than
+   *  hiding the control — see `hasRole` in `use-vta.ts`. */
+  disabledReason?: string | null;
+  /** Ask the agent what the change would cost. */
+  preview: () => Promise<P>;
+  /** Render the agent's answer. Returning `false` from `blocking` keeps the
+   *  confirm button disabled until `force` is ticked. */
+  renderPreview: (preview: P) => ReactNode;
+  /** Whether this preview describes collateral that `force` must override. */
+  needsForce?: (preview: P) => boolean;
+  /** Copy for the force tick, when `needsForce` is true. */
+  forceLabel?: string;
+  /** Perform it. */
+  commit: (force: boolean) => Promise<void>;
+  /** Called after a successful commit, so the caller can refetch. */
+  onDone: () => void;
+}
+
+type Phase<P> =
+  | { kind: "idle" }
+  | { kind: "previewing" }
+  | { kind: "preview"; preview: P }
+  | { kind: "committing"; preview: P }
+  | { kind: "consent"; pending: ConsentRequiredError }
+  | { kind: "error"; message: string };
+
+/**
+ * The shared two-step for every irreversible action in this console.
+ *
+ * Generic over the preview shape because the previews differ (a context's keys
+ * and DIDs, a key's usages, an ACL subject's grants) while the *shape of the
+ * decision* does not: see the cost, then decide, with `force` as its own step.
+ */
+export function Destructive<P>({
+  label,
+  disabledReason = null,
+  preview,
+  renderPreview,
+  needsForce,
+  forceLabel = "Delete anyway, destroying the items listed above",
+  commit,
+  onDone,
+}: DestructiveProps<P>) {
+  const [phase, setPhase] = useState<Phase<P>>({ kind: "idle" });
+  const [force, setForce] = useState(false);
+
+  const reset = useCallback(() => {
+    setPhase({ kind: "idle" });
+    setForce(false);
+  }, []);
+
+  const start = useCallback(async () => {
+    setPhase({ kind: "previewing" });
+    try {
+      setPhase({ kind: "preview", preview: await preview() });
+    } catch (e) {
+      setPhase({
+        kind: "error",
+        message: e instanceof Error ? e.message : String(e),
+      });
+    }
+  }, [preview]);
+
+  const run = useCallback(
+    async (p: P) => {
+      setPhase({ kind: "committing", preview: p });
+      try {
+        await commit(force);
+        reset();
+        onDone();
+      } catch (e) {
+        // The one class that is not an error. See the header.
+        if (e instanceof ConsentRequiredError) {
+          setPhase({ kind: "consent", pending: e });
+          return;
+        }
+        setPhase({ kind: "error", message: e instanceof Error ? e.message : String(e) });
+      }
+    },
+    [commit, force, onDone, reset],
+  );
+
+  if (phase.kind === "idle") {
+    return (
+      <Button
+        kind="danger"
+        disabled={Boolean(disabledReason)}
+        {...(disabledReason ? { title: disabledReason } : {})}
+        onClick={() => void start()}
+      >
+        {label}
+      </Button>
+    );
+  }
+
+  if (phase.kind === "previewing") {
+    return <span style={{ fontSize: t.sm, color: c.muted }}>Asking your agent what this would destroy…</span>;
+  }
+
+  if (phase.kind === "consent") {
+    return (
+      <div style={{ display: "grid", gap: 10 }}>
+        <ConsentCeremony pending={phase.pending} />
+        <div>
+          <Button kind="quiet" onClick={reset}>
+            Close
+          </Button>
+        </div>
+      </div>
+    );
+  }
+
+  if (phase.kind === "error") {
+    return (
+      <div style={{ display: "grid", gap: 10 }}>
+        <Note tone="danger">{phase.message}</Note>
+        <div>
+          <Button kind="quiet" onClick={reset}>
+            Back
+          </Button>
+        </div>
+      </div>
+    );
+  }
+
+  const p = phase.preview;
+  const blocked = Boolean(needsForce?.(p)) && !force;
+  const busy = phase.kind === "committing";
+
+  return (
+    <div style={{ display: "grid", gap: 12, maxWidth: 460 }}>
+      <Note tone="danger">
+        <div style={{ display: "grid", gap: 8 }}>{renderPreview(p)}</div>
+      </Note>
+
+      {needsForce?.(p) && (
+        <label style={{ display: "flex", gap: 8, alignItems: "flex-start", fontSize: t.sm }}>
+          <input
+            type="checkbox"
+            checked={force}
+            onChange={(e) => setForce(e.target.checked)}
+            style={{ marginTop: 2 }}
+          />
+          <span>{forceLabel}</span>
+        </label>
+      )}
+
+      <div style={{ display: "flex", gap: 8 }}>
+        <Button kind="danger" disabled={blocked || busy} onClick={() => void run(p)}>
+          {busy ? "Working…" : label}
+        </Button>
+        <Button kind="quiet" disabled={busy} onClick={reset}>
+          Cancel
+        </Button>
+      </div>
+    </div>
+  );
+}
+
+/**
+ * Run a non-destructive mutation, routing a consent refusal to the ceremony.
+ *
+ * Every mutating call in the console goes through this or through
+ * {@link Destructive}; nothing calls an admin helper and catches `Error`
+ * directly, because that is how a `ConsentRequiredError` ends up rendered as a
+ * red string.
+ */
+export async function runMutation(
+  action: () => Promise<void>,
+  handlers: {
+    onConsent: (pending: ConsentRequiredError) => void;
+    onError: (message: string) => void;
+  },
+): Promise<boolean> {
+  try {
+    await action();
+    return true;
+  } catch (e) {
+    if (e instanceof ConsentRequiredError) {
+      handlers.onConsent(e);
+      return false;
+    }
+    handlers.onError(e instanceof Error ? e.message : String(e));
+    return false;
+  }
+}
diff --git a/packages/extension/src/manager/panes/access.tsx b/packages/extension/src/manager/panes/access.tsx
new file mode 100644
index 0000000..d772ace
--- /dev/null
+++ b/packages/extension/src/manager/panes/access.tsx
@@ -0,0 +1,366 @@
+// Access — who may act at this agent, in which contexts, until when.
+//
+// The sharpest pane in the console: an ACL entry is the authority itself, and
+// `acl/grant` is how someone who could do nothing here comes to be able to do
+// everything.
+//
+// Two things the agent enforces that this pane must not paper over:
+//
+//  - **`aclUpdate` replaces scopes wholesale, and refuses to narrow.** Sending
+//    a shorter set is not "remove these" — the agent rejects a reduction here
+//    on purpose, because a narrowing typed into an edit box looks identical to
+//    a mistake. Taking authority away goes through `aclRevoke`, which says so.
+//  - **`aclChangeRole` compare-and-swaps against the current role.** The form
+//    carries `fromRole` from the row it was opened on, so a role someone else
+//    changed in between rejects rather than silently overwriting their change.
+
+import { useCallback, useState } from "react";
+import {
+  aclChangeRole,
+  aclList,
+  aclRevoke,
+  aclGrant,
+  type AclEntry,
+} from "@openvtc/pnm-core/admin";
+import { Button, Did, Note, Panel, Pill } from "../../ui.js";
+import { c, t, font } from "../../theme.js";
+import { managerSender } from "../sender.js";
+import { ConsentRequiredError } from "../carrier.js";
+import { ConsentCeremony, Destructive, runMutation } from "../destructive.js";
+import { Loading, LoadError, Redacted, Table, Truncated, type Column } from "../table.js";
+import { useAsync } from "../use-async.js";
+import { hasRole, type Authority, type Parties } from "../use-vta.js";
+import type { ContextSelection } from "../context-column.js";
+
+const fieldStyle: React.CSSProperties = {
+  boxSizing: "border-box",
+  padding: "6px 9px",
+  background: c.ground,
+  color: c.text,
+  border: `1px solid ${c.line}`,
+  borderRadius: "var(--w-r-sm)",
+  fontSize: t.sm,
+};
+
+function Expiry({ entry }: { entry: AclEntry }) {
+  if (!entry.expiresAt) {
+    // Not "—". An entry that never expires is a standing grant, and that is a
+    // decision worth reading as one.
+    return <span style={{ color: c.warn }}>never</span>;
+  }
+  const when = new Date(entry.expiresAt);
+  const past = when.getTime() < Date.now();
+  return (
+    <span style={{ color: past ? c.faint : c.muted, whiteSpace: "nowrap" }}>
+      {when.toLocaleDateString()}
+      {past ? " (expired)" : ""}
+    </span>
+  );
+}
+
+function ChangeRole({
+  parties,
+  entry,
+  onDone,
+}: {
+  parties: Parties;
+  entry: AclEntry;
+  onDone: () => void;
+}) {
+  const [open, setOpen] = useState(false);
+  const [toRole, setToRole] = useState(entry.role);
+  const [busy, setBusy] = useState(false);
+  const [error, setError] = useState<string | null>(null);
+  const [pending, setPending] = useState<ConsentRequiredError | null>(null);
+
+  if (!open) {
+    return (
+      <Button kind="quiet" onClick={() => setOpen(true)}>
+        Change role
+      </Button>
+    );
+  }
+
+  return (
+    <div style={{ display: "grid", gap: 7 }}>
+      <input style={fieldStyle} value={toRole} onChange={(e) => setToRole(e.target.value)} />
+      <span style={{ fontSize: t.xs, color: c.faint }}>
+        from <strong>{entry.role}</strong> — rejected if it changed since this list was read
+      </span>
+      {error && <Note tone="danger">{error}</Note>}
+      {pending && <ConsentCeremony pending={pending} />}
+      <div style={{ display: "flex", gap: 6 }}>
+        <Button
+          disabled={busy || !toRole.trim() || toRole === entry.role}
+          onClick={() => {
+            setBusy(true);
+            setError(null);
+            void runMutation(
+              async () => {
+                await aclChangeRole(managerSender, {
+                  ...parties,
+                  subject: entry.subject,
+                  // Compare-and-swap against what this row was read at.
+                  fromRole: entry.role,
+                  toRole: toRole.trim(),
+                });
+              },
+              { onConsent: setPending, onError: setError },
+            ).then((ok) => {
+              setBusy(false);
+              if (ok) {
+                setOpen(false);
+                onDone();
+              }
+            });
+          }}
+        >
+          {busy ? "Changing…" : "Change"}
+        </Button>
+        <Button kind="quiet" onClick={() => setOpen(false)}>
+          Cancel
+        </Button>
+      </div>
+    </div>
+  );
+}
+
+function GrantAccess({
+  parties,
+  contextId,
+  authority,
+  onGranted,
+}: {
+  parties: Parties;
+  contextId: ContextSelection;
+  authority: Authority | null;
+  onGranted: () => void;
+}) {
+  const [subject, setSubject] = useState("");
+  const [role, setRole] = useState("");
+  const [label, setLabel] = useState("");
+  const [expiresAt, setExpiresAt] = useState("");
+  const [busy, setBusy] = useState(false);
+  const [error, setError] = useState<string | null>(null);
+  const [pending, setPending] = useState<ConsentRequiredError | null>(null);
+
+  const denied = authority && !hasRole(authority, "admin", "super-admin")
+    ? "Granting access needs the admin role at this agent."
+    : null;
+
+  const submit = useCallback(async () => {
+    setBusy(true);
+    setError(null);
+    setPending(null);
+    const entry: AclEntry = {
+      subject: subject.trim(),
+      role: role.trim(),
+      ...(contextId ? { scopes: [contextId] } : {}),
+      ...(label.trim() ? { label: label.trim() } : {}),
+      // A date input gives a local day; the wire wants an instant.
+      ...(expiresAt ? { expiresAt: new Date(`${expiresAt}T23:59:59`).toISOString() } : {}),
+    };
+    const ok = await runMutation(
+      async () => {
+        await aclGrant(managerSender, { ...parties, entry });
+      },
+      { onConsent: setPending, onError: setError },
+    );
+    setBusy(false);
+    if (ok) {
+      setSubject("");
+      setRole("");
+      setLabel("");
+      setExpiresAt("");
+      onGranted();
+    }
+  }, [parties, subject, role, label, expiresAt, contextId, onGranted]);
+
+  return (
+    <Panel
+      title="Grant access"
+      description={
+        contextId ? (
+          <>
+            Scoped to <code style={{ fontFamily: font.mono }}>{contextId}</code>. The subject will
+            be able to act at this agent within that context, as the role allows.
+          </>
+        ) : (
+          <>
+            <strong>Unscoped.</strong> With no context selected this grant reaches everything the
+            role permits, everywhere. Select a context in the tree to confine it.
+          </>
+        )
+      }
+    >
+      <div style={{ display: "grid", gap: 10, maxWidth: 620 }}>
+        <label style={{ display: "grid", gap: 4 }}>
+          <span style={{ fontSize: t.xs, color: c.muted }}>SUBJECT DID</span>
+          <input
+            style={{ ...fieldStyle, fontFamily: font.mono }}
+            value={subject}
+            onChange={(e) => setSubject(e.target.value)}
+            placeholder="did:key:z6Mk…"
+          />
+        </label>
+        <div style={{ display: "flex", gap: 10, flexWrap: "wrap" }}>
+          <label style={{ display: "grid", gap: 4 }}>
+            <span style={{ fontSize: t.xs, color: c.muted }}>ROLE</span>
+            <input style={fieldStyle} value={role} onChange={(e) => setRole(e.target.value)} />
+          </label>
+          <label style={{ display: "grid", gap: 4 }}>
+            <span style={{ fontSize: t.xs, color: c.muted }}>LABEL (optional)</span>
+            <input style={fieldStyle} value={label} onChange={(e) => setLabel(e.target.value)} />
+          </label>
+          <label style={{ display: "grid", gap: 4 }}>
+            <span style={{ fontSize: t.xs, color: c.muted }}>EXPIRES (optional)</span>
+            <input
+              type="date"
+              style={fieldStyle}
+              value={expiresAt}
+              onChange={(e) => setExpiresAt(e.target.value)}
+            />
+          </label>
+        </div>
+
+        {!expiresAt && (
+          <Note tone="warn">
+            With no expiry this is a standing grant — it lasts until someone revokes it. An expiry
+            is the difference between access you decided to give and access you forgot about.
+          </Note>
+        )}
+        {!contextId && (
+          <Note tone="danger">
+            No context is selected, so this grant is not confined to one. That is rarely what you
+            want.
+          </Note>
+        )}
+        {error && <Note tone="danger">{error}</Note>}
+        {pending && <ConsentCeremony pending={pending} />}
+
+        <div>
+          <Button
+            kind="primary"
+            disabled={busy || !subject.trim() || !role.trim() || Boolean(denied)}
+            {...(denied ? { title: denied } : {})}
+            onClick={() => void submit()}
+          >
+            {busy ? "Granting…" : "Grant access"}
+          </Button>
+        </div>
+        {denied && <span style={{ fontSize: t.sm, color: c.muted }}>{denied}</span>}
+      </div>
+    </Panel>
+  );
+}
+
+export function AccessPane({
+  parties,
+  authority,
+  contextId,
+}: {
+  parties: Parties;
+  authority: Authority | null;
+  contextId: ContextSelection;
+}) {
+  const list = useAsync(
+    () => aclList(managerSender, { ...parties, ...(contextId ? { scope: contextId } : {}) }),
+    [parties.holder.did, parties.service.did, contextId],
+  );
+
+  const revokeDenied = authority && !hasRole(authority, "admin", "super-admin")
+    ? "Revoking access needs the admin role at this agent."
+    : null;
+
+  const columns: Column<AclEntry>[] = [
+    {
+      key: "subject",
+      header: "Subject",
+      render: (e) => (
+        <div style={{ display: "grid", gap: 2 }}>
+          <Did value={e.subject} />
+          {e.label && <span style={{ color: c.muted, fontSize: t.xs }}>{e.label}</span>}
+        </div>
+      ),
+    },
+    { key: "role", header: "Role", render: (e) => <Pill tone="accent">{e.role}</Pill> },
+    {
+      key: "scopes",
+      header: "Contexts",
+      render: (e) =>
+        e.scopes?.length ? (
+          <span style={{ fontFamily: font.mono, fontSize: t.xs }}>{e.scopes.join(", ")}</span>
+        ) : (
+          // An entry with no scopes is not restricted to none — it is
+          // restricted to nothing, i.e. everywhere. Say which.
+          <span style={{ color: c.warn }}>everywhere</span>
+        ),
+    },
+    { key: "expires", header: "Expires", render: (e) => <Expiry entry={e} /> },
+    {
+      key: "actions",
+      header: "",
+      render: (e) => (
+        <div style={{ display: "grid", gap: 8, minWidth: 200 }}>
+          <ChangeRole parties={parties} entry={e} onDone={list.reload} />
+          <Destructive<AclEntry>
+            label="Revoke"
+            disabledReason={revokeDenied}
+            preview={async () => e}
+            renderPreview={(p) => (
+              <>
+                <strong>Revoking this entry takes away all of its authority.</strong>
+                <span>
+                  <Did value={p.subject} size={t.xs} /> loses the <strong>{p.role}</strong> role
+                  {p.scopes?.length ? ` in ${p.scopes.join(", ")}` : " everywhere"}. Anything
+                  running as that subject stops working immediately — including, if it is a
+                  device or an agent you rely on, one you may not be watching.
+                </span>
+              </>
+            )}
+            commit={async () => {
+              await aclRevoke(managerSender, { ...parties, subject: e.subject });
+            }}
+            onDone={list.reload}
+          />
+        </div>
+      ),
+    },
+  ];
+
+  return (
+    <div style={{ display: "grid", gap: 16, alignContent: "start" }}>
+      <Panel
+        title={contextId ? `Access to ${contextId}` : "Access to this agent"}
+        description="Who may act here, as what, and until when. This is the authority itself —
+          the agent checks it on every task, including the ones this console sends."
+      >
+        {list.error && <LoadError what="the access list" error={list.error} />}
+        {list.loading && !list.data && <Loading what="the access list" />}
+        {list.data && (
+          <>
+            <Redacted fields={list.data.redactedFields} />
+            <Table
+              columns={columns}
+              rows={list.data.entries}
+              rowKey={(e) => e.subject}
+              empty={
+                contextId
+                  ? `Nobody holds an entry scoped to ${contextId}.`
+                  : "No entries you can read. Grants you administer appear here."
+              }
+            />
+            {list.data.truncated && <Truncated what="the access list" />}
+          </>
+        )}
+      </Panel>
+
+      <GrantAccess
+        parties={parties}
+        contextId={contextId}
+        authority={authority}
+        onGranted={list.reload}
+      />
+    </div>
+  );
+}
diff --git a/packages/extension/src/manager/panes/approvals.tsx b/packages/extension/src/manager/panes/approvals.tsx
new file mode 100644
index 0000000..ec826c4
--- /dev/null
+++ b/packages/extension/src/manager/panes/approvals.tsx
@@ -0,0 +1,327 @@
+// Approvals — who gets asked when your agent will not act alone.
+//
+// This is the pane with the most leverage over the wallet's own behaviour. An
+// approver binding decides which party is sent the `task-consent/request` that
+// the wallet renders as a consent prompt; a wrong or missing one is a gated
+// action that never got its human check, which is the failure the whole consent
+// path exists to prevent.
+//
+// Two lists, and they answer different questions. **Approvers** is
+// configuration — who will be asked, per platform and context. **Grants** is
+// history — what has already been consented to, and until when.
+
+import { useCallback, useState } from "react";
+import {
+  consentApproverList,
+  consentApproverSet,
+  consentList,
+  consentRevoke,
+  type ApproverBinding,
+  type ConsentGrant,
+} from "@openvtc/pnm-core/admin";
+import { Button, Did, Note, Panel, Pill } from "../../ui.js";
+import { c, t, font } from "../../theme.js";
+import { managerSender } from "../sender.js";
+import { ConsentRequiredError } from "../carrier.js";
+import { ConsentCeremony, Destructive, runMutation } from "../destructive.js";
+import { Loading, LoadError, Table, type Column } from "../table.js";
+import { useAsync } from "../use-async.js";
+import { hasRole, type Authority, type Parties } from "../use-vta.js";
+import type { ContextSelection } from "../context-column.js";
+
+const fieldStyle: React.CSSProperties = {
+  boxSizing: "border-box",
+  padding: "6px 9px",
+  background: c.ground,
+  color: c.text,
+  border: `1px solid ${c.line}`,
+  borderRadius: "var(--w-r-sm)",
+  fontSize: t.sm,
+};
+
+function SetApprover({
+  parties,
+  contextId,
+  authority,
+  onSet,
+}: {
+  parties: Parties;
+  contextId: ContextSelection;
+  authority: Authority | null;
+  onSet: () => void;
+}) {
+  const [platform, setPlatform] = useState("");
+  const [approver, setApprover] = useState("");
+  const [route, setRoute] = useState<"wake" | "bridge-relay">("wake");
+  const [busy, setBusy] = useState(false);
+  const [error, setError] = useState<string | null>(null);
+  const [pending, setPending] = useState<ConsentRequiredError | null>(null);
+
+  const denied = authority && !hasRole(authority, "admin", "super-admin")
+    ? "Setting an approver needs the admin role at this agent."
+    : !contextId
+      ? "Select a context in the tree — an approver is bound to one."
+      : null;
+
+  const submit = useCallback(async () => {
+    if (!contextId) return;
+    setBusy(true);
+    setError(null);
+    setPending(null);
+    const ok = await runMutation(
+      async () => {
+        await consentApproverSet(managerSender, {
+          ...parties,
+          platform: platform.trim(),
+          context: contextId,
+          approver: approver.trim(),
+          route,
+        });
+      },
+      { onConsent: setPending, onError: setError },
+    );
+    setBusy(false);
+    if (ok) {
+      setPlatform("");
+      setApprover("");
+      onSet();
+    }
+  }, [parties, platform, contextId, approver, route, onSet]);
+
+  return (
+    <Panel
+      title="Bind an approver"
+      description="The party your agent asks when a task needs a human. Getting this wrong is not
+        a cosmetic error: the request goes somewhere nobody is watching, and a gated action never
+        gets its check."
+    >
+      <div style={{ display: "flex", gap: 10, flexWrap: "wrap", alignItems: "flex-end" }}>
+        <label style={{ display: "grid", gap: 4 }}>
+          <span style={{ fontSize: t.xs, color: c.muted }}>PLATFORM</span>
+          <input
+            style={fieldStyle}
+            value={platform}
+            onChange={(e) => setPlatform(e.target.value)}
+          />
+        </label>
+        <label style={{ display: "grid", gap: 4, flex: "1 1 320px" }}>
+          <span style={{ fontSize: t.xs, color: c.muted }}>APPROVER DID</span>
+          <input
+            style={{ ...fieldStyle, fontFamily: font.mono }}
+            value={approver}
+            onChange={(e) => setApprover(e.target.value)}
+            placeholder="did:key:z6Mk…"
+          />
+        </label>
+        <label style={{ display: "grid", gap: 4 }}>
+          <span style={{ fontSize: t.xs, color: c.muted }}>ROUTE</span>
+          <select
+            style={fieldStyle}
+            value={route}
+            onChange={(e) => setRoute(e.target.value as typeof route)}
+          >
+            <option value="wake">wake</option>
+            <option value="bridge-relay">bridge-relay</option>
+          </select>
+        </label>
+      </div>
+
+      {error && <Note tone="danger">{error}</Note>}
+      {pending && <ConsentCeremony pending={pending} />}
+
+      <div>
+        <Button
+          kind="primary"
+          disabled={busy || !platform.trim() || !approver.trim() || Boolean(denied)}
+          {...(denied ? { title: denied } : {})}
+          onClick={() => void submit()}
+        >
+          {busy ? "Binding…" : "Bind approver"}
+        </Button>
+      </div>
+      {denied && <span style={{ fontSize: t.sm, color: c.muted }}>{denied}</span>}
+    </Panel>
+  );
+}
+
+export function ApprovalsPane({
+  parties,
+  authority,
+  contextId,
+}: {
+  parties: Parties;
+  authority: Authority | null;
+  contextId: ContextSelection;
+}) {
+  const approvers = useAsync(
+    () =>
+      consentApproverList(managerSender, {
+        ...parties,
+        ...(contextId ? { context: contextId } : {}),
+      }),
+    [parties.holder.did, parties.service.did, contextId],
+  );
+
+  const grants = useAsync(
+    () => consentList(managerSender, parties),
+    [parties.holder.did, parties.service.did],
+  );
+
+  const revokeDenied = authority && !hasRole(authority, "admin", "super-admin")
+    ? "Revoking consent needs the admin role at this agent."
+    : null;
+
+  const approverColumns: Column<ApproverBinding>[] = [
+    { key: "platform", header: "Platform", render: (a) => a.platform },
+    {
+      key: "context",
+      header: "Context",
+      render: (a) => <span style={{ fontFamily: font.mono, fontSize: t.xs }}>{a.context}</span>,
+    },
+    { key: "approver", header: "Approver", render: (a) => <Did value={a.approver} /> },
+    {
+      key: "route",
+      header: "Route",
+      render: (a) => (
+        <div style={{ display: "grid", gap: 2 }}>
+          <Pill tone="accent">{a.route ?? "wake"}</Pill>
+          {a.routeHint && <span style={{ color: c.faint, fontSize: t.xs }}>{a.routeHint}</span>}
+        </div>
+      ),
+    },
+  ];
+
+  const grantColumns: Column<ConsentGrant>[] = [
+    {
+      key: "subject",
+      header: "Conversation",
+      render: (g) => (
+        <div style={{ display: "grid", gap: 2 }}>
+          <span style={{ fontSize: t.sm }}>
+            {g.subject.platform} · {g.subject.kind}
+          </span>
+          <span style={{ fontFamily: font.mono, fontSize: t.xs, color: c.faint, wordBreak: "break-all" }}>
+            {g.subject.conversationRef}
+          </span>
+        </div>
+      ),
+    },
+    { key: "agent", header: "Agent", render: (g) => <Did value={g.subject.agent} /> },
+    {
+      key: "effect",
+      header: "Effect",
+      render: (g) => <Pill tone={g.effect === "allow" ? "ok" : "danger"}>{g.effect}</Pill>,
+    },
+    {
+      key: "scope",
+      header: "Scope",
+      render: (g) => <span style={{ color: c.muted }}>{g.scope ?? "—"}</span>,
+    },
+    {
+      key: "granted",
+      header: "Granted",
+      render: (g) => (
+        <span style={{ color: c.muted, whiteSpace: "nowrap" }}>
+          {new Date(g.grantedAt).toLocaleDateString()}
+        </span>
+      ),
+    },
+    {
+      key: "expires",
+      header: "Expires",
+      render: (g) =>
+        g.expiresAt ? (
+          <span style={{ color: c.muted, whiteSpace: "nowrap" }}>
+            {new Date(g.expiresAt).toLocaleDateString()}
+          </span>
+        ) : (
+          <span style={{ color: c.warn }}>never</span>
+        ),
+    },
+    {
+      key: "actions",
+      header: "",
+      render: (g) => (
+        <div style={{ minWidth: 180 }}>
+          <Destructive<ConsentGrant>
+            label="Revoke"
+            disabledReason={revokeDenied}
+            preview={async () => g}
+            renderPreview={(p) => (
+              <>
+                <strong>Revoking this consent takes effect immediately.</strong>
+                <span>
+                  {p.subject.agent} loses its <strong>{p.effect}</strong> decision for this
+                  conversation. The next thing it tries will be gated again, and somebody will be
+                  asked.
+                </span>
+              </>
+            )}
+            commit={async () => {
+              await consentRevoke(managerSender, { ...parties, subject: g.subject });
+            }}
+            onDone={grants.reload}
+          />
+        </div>
+      ),
+    },
+  ];
+
+  return (
+    <div style={{ display: "grid", gap: 16, alignContent: "start" }}>
+      <Panel
+        title={contextId ? `Approvers for ${contextId}` : "Approvers"}
+        description="Who your agent asks when a task needs a human. Your wallet renders that
+          request as a consent prompt — so a binding that points nowhere is silent, not noisy."
+      >
+        {approvers.error && <LoadError what="approver bindings" error={approvers.error} />}
+        {approvers.loading && !approvers.data && <Loading what="approver bindings" />}
+        {approvers.data && (
+          <>
+            <Table
+              columns={approverColumns}
+              rows={approvers.data}
+              rowKey={(a) => `${a.platform}:${a.context}:${a.approver}`}
+              empty={
+                contextId
+                  ? `No approver is bound for ${contextId}. Tasks in this context that need a ` +
+                    "human have nobody to ask."
+                  : "No approvers bound. Tasks that need a human have nobody to ask."
+              }
+            />
+            {approvers.data.length === 0 && (
+              <Note tone="warn">
+                With no approver bound, a task your agent's policy gates on human consent cannot
+                be approved by anyone — it will be refused rather than queued.
+              </Note>
+            )}
+          </>
+        )}
+      </Panel>
+
+      <SetApprover
+        parties={parties}
+        contextId={contextId}
+        authority={authority}
+        onSet={approvers.reload}
+      />
+
+      <Panel
+        title="Consent grants"
+        description="What has already been agreed to, and until when. Unlike the approver list
+          above this is history, not configuration."
+      >
+        {grants.error && <LoadError what="consent grants" error={grants.error} />}
+        {grants.loading && !grants.data && <Loading what="consent grants" />}
+        {grants.data && (
+          <Table
+            columns={grantColumns}
+            rows={grants.data.grants}
+            rowKey={(g) => `${g.subject.platform}:${g.subject.conversationRef}:${g.subject.agent}`}
+            empty="Nothing has been consented to yet. Decisions your approvers make appear here."
+          />
+        )}
+      </Panel>
+    </div>
+  );
+}
diff --git a/packages/extension/src/manager/panes/audit.tsx b/packages/extension/src/manager/panes/audit.tsx
new file mode 100644
index 0000000..30e6703
--- /dev/null
+++ b/packages/extension/src/manager/panes/audit.tsx
@@ -0,0 +1,218 @@
+// Audit — the agent's account of what happened.
+//
+// **Truncation is rendered, never swallowed.** `AuditListResult.truncated` says
+// the agent stopped early, and its own documentation is explicit about why that
+// matters: an operator reading "nothing else occurred" off a partial page is
+// exactly the failure an audit trail exists to prevent. A list that silently
+// dropped the flag would be worse than no audit view at all, because it looks
+// authoritative.
+//
+// Entries are hash-chained (`prevHash`/`entryHash`). This pane shows that the
+// chain is there but does **not** claim to have verified it — checking a chain
+// requires the whole chain, and this is a page of it. Saying "verified" over a
+// page would be a claim nothing here can support.
+
+import { useCallback, useState } from "react";
+import { auditList, type AuditEnvelope } from "@openvtc/pnm-core/admin";
+import { Button, Did, Note, Panel, Pill } from "../../ui.js";
+import { c, t, font } from "../../theme.js";
+import { managerSender } from "../sender.js";
+import { Loading, LoadError, Table, type Column } from "../table.js";
+import { useAsync } from "../use-async.js";
+import type { Parties } from "../use-vta.js";
+import type { ContextSelection } from "../context-column.js";
+
+const PAGE = 50;
+
+const fieldStyle: React.CSSProperties = {
+  boxSizing: "border-box",
+  padding: "6px 9px",
+  background: c.ground,
+  color: c.text,
+  border: `1px solid ${c.line}`,
+  borderRadius: "var(--w-r-sm)",
+  fontSize: t.sm,
+};
+
+function Outcome({ outcome }: { outcome: string | undefined }) {
+  if (!outcome) return <span style={{ color: c.faint }}>—</span>;
+  const ok = /^(ok|success|allow|allowed|granted)$/i.test(outcome);
+  const bad = /^(deny|denied|error|fail|failed|refused|rejected)$/i.test(outcome);
+  return <Pill tone={ok ? "ok" : bad ? "danger" : "off"}>{outcome}</Pill>;
+}
+
+export function AuditPane({
+  parties,
+  contextId,
+}: {
+  parties: Parties;
+  contextId: ContextSelection;
+}) {
+  const [action, setAction] = useState("");
+  const [actor, setActor] = useState("");
+  // Applied filters, separate from the inputs: typing should not fire a request
+  // per keystroke against an agent over a mediator.
+  const [applied, setApplied] = useState({ action: "", actor: "" });
+  const [pageSize, setPageSize] = useState(PAGE);
+
+  const list = useAsync(
+    () =>
+      auditList(managerSender, {
+        ...parties,
+        pageSize,
+        ...(contextId ? { contextId } : {}),
+        ...(applied.action ? { action: applied.action } : {}),
+        ...(applied.actor ? { actor: applied.actor } : {}),
+      }),
+    [
+      parties.holder.did,
+      parties.service.did,
+      contextId,
+      applied.action,
+      applied.actor,
+      pageSize,
+    ],
+  );
+
+  const apply = useCallback(() => {
+    setPageSize(PAGE);
+    setApplied({ action: action.trim(), actor: actor.trim() });
+  }, [action, actor]);
+
+  const columns: Column<AuditEnvelope>[] = [
+    {
+      key: "when",
+      header: "When",
+      render: (e) => (
+        <span style={{ color: c.muted, whiteSpace: "nowrap" }}>
+          {new Date(e.recordedAt).toLocaleString()}
+        </span>
+      ),
+    },
+    {
+      key: "action",
+      header: "Action",
+      render: (e) => <span style={{ fontFamily: font.mono, fontSize: t.xs }}>{e.action}</span>,
+    },
+    {
+      key: "actor",
+      header: "Actor",
+      render: (e) =>
+        e.actor ? <Did value={e.actor} size={t.xs} /> : <span style={{ color: c.faint }}>—</span>,
+    },
+    {
+      key: "target",
+      header: "Target",
+      render: (e) =>
+        e.target ? (
+          <span style={{ fontFamily: font.mono, fontSize: t.xs, wordBreak: "break-all" }}>
+            {e.target}
+          </span>
+        ) : (
+          <span style={{ color: c.faint }}>—</span>
+        ),
+    },
+    { key: "outcome", header: "Outcome", render: (e) => <Outcome outcome={e.outcome} /> },
+    {
+      key: "context",
+      header: "Context",
+      render: (e) => (
+        <span style={{ fontFamily: font.mono, fontSize: t.xs, color: c.muted }}>
+          {e.contextId ?? "—"}
+        </span>
+      ),
+    },
+    {
+      key: "chain",
+      header: "Chained",
+      render: (e) =>
+        e.entryHash ? (
+          <span
+            style={{ color: c.muted, fontSize: t.xs }}
+            title="This entry carries a hash linking it to the previous one. Verifying the chain
+              needs all of it, which this page is not — so no claim is made here."
+          >
+            yes
+          </span>
+        ) : (
+          <span style={{ color: c.warn, fontSize: t.xs }}>no</span>
+        ),
+    },
+  ];
+
+  return (
+    <div style={{ display: "grid", gap: 16, alignContent: "start" }}>
+      <Panel
+        title={contextId ? `Audit for ${contextId}` : "Audit"}
+        description="What your agent recorded. Entries are hash-chained to each other; this page
+          shows that the links are present, and does not claim to have checked them — that needs
+          the whole chain, not a page of it."
+      >
+        <div style={{ display: "flex", gap: 10, flexWrap: "wrap", alignItems: "flex-end" }}>
+          <label style={{ display: "grid", gap: 4 }}>
+            <span style={{ fontSize: t.xs, color: c.muted }}>ACTION</span>
+            <input
+              style={fieldStyle}
+              value={action}
+              onChange={(e) => setAction(e.target.value)}
+              placeholder="acl/grant"
+            />
+          </label>
+          <label style={{ display: "grid", gap: 4, flex: "1 1 300px" }}>
+            <span style={{ fontSize: t.xs, color: c.muted }}>ACTOR DID</span>
+            <input
+              style={{ ...fieldStyle, fontFamily: font.mono }}
+              value={actor}
+              onChange={(e) => setActor(e.target.value)}
+            />
+          </label>
+          <div style={{ paddingBottom: 1 }}>
+            <Button onClick={apply}>Apply filters</Button>
+          </div>
+        </div>
+
+        {list.error && <LoadError what="the audit trail" error={list.error} />}
+        {list.loading && !list.data && <Loading what="the audit trail" />}
+
+        {list.data && (
+          <>
+            {/* Before the table, not after. A warning under a long list is a
+                warning nobody reads. */}
+            {list.data.truncated && (
+              <Note tone="warn">
+                <strong>This is not the whole record.</strong> Your agent stopped early, so
+                anything you conclude from what is below — including that something did
+                <em> not</em> happen — may be wrong.{" "}
+                <button
+                  onClick={() => setPageSize((n) => n + PAGE)}
+                  style={{
+                    border: "none",
+                    background: "none",
+                    padding: 0,
+                    color: c.accent,
+                    cursor: "pointer",
+                    font: "inherit",
+                    textDecoration: "underline",
+                  }}
+                >
+                  Load more
+                </button>
+                , or narrow the filters.
+              </Note>
+            )}
+            <Table
+              columns={columns}
+              rows={list.data.entries}
+              rowKey={(e) => e.eventId}
+              empty={
+                applied.action || applied.actor
+                  ? "Nothing matches those filters. Clear them to see the rest."
+                  : "Your agent has recorded nothing here yet."
+              }
+            />
+          </>
+        )}
+      </Panel>
+    </div>
+  );
+}
diff --git a/packages/extension/src/manager/panes/contexts.tsx b/packages/extension/src/manager/panes/contexts.tsx
new file mode 100644
index 0000000..300a3da
--- /dev/null
+++ b/packages/extension/src/manager/panes/contexts.tsx
@@ -0,0 +1,385 @@
+// Contexts — the pane behind the tree.
+//
+// Reads and writes the same records the tree navigates, so the two are driven
+// from one fetch in the shell rather than each holding its own copy: a rename
+// that updated the pane but not the tree would leave the operator looking at
+// two names for one context and no way to tell which is current.
+
+import { useCallback, useState } from "react";
+import {
+  contextsCreate,
+  contextsUpdate,
+  type ContextRecord,
+} from "@openvtc/pnm-core";
+import { contextDelete, contextPreviewDelete } from "@openvtc/pnm-core/admin";
+import { Button, Did, Empty, Note, Panel } from "../../ui.js";
+import { c, t, font } from "../../theme.js";
+import { managerSender } from "../sender.js";
+import { ConsentRequiredError } from "../carrier.js";
+import { Destructive, ConsentCeremony, runMutation } from "../destructive.js";
+import { hasRole, type Authority, type Parties } from "../use-vta.js";
+import type { ContextSelection } from "../context-column.js";
+
+const fieldStyle: React.CSSProperties = {
+  width: "100%",
+  boxSizing: "border-box",
+  padding: "7px 10px",
+  background: c.ground,
+  color: c.text,
+  border: `1px solid ${c.line}`,
+  borderRadius: "var(--w-r-sm)",
+  fontSize: t.sm,
+};
+
+function Label({ children }: { children: React.ReactNode }) {
+  return (
+    <span style={{ fontSize: t.xs, color: c.muted, textTransform: "uppercase", letterSpacing: 0.4 }}>
+      {children}
+    </span>
+  );
+}
+
+/** What deleting a context would destroy, in the agent's own words. */
+interface DeletePreview {
+  id: string;
+  keys: string[];
+  webvhDids: string[];
+}
+
+function CreateContext({
+  parties,
+  parent,
+  authority,
+  onCreated,
+}: {
+  parties: Parties;
+  parent: ContextSelection;
+  authority: Authority | null;
+  onCreated: () => void;
+}) {
+  const [id, setId] = useState("");
+  const [name, setName] = useState("");
+  const [description, setDescription] = useState("");
+  const [busy, setBusy] = useState(false);
+  const [error, setError] = useState<string | null>(null);
+  const [pending, setPending] = useState<ConsentRequiredError | null>(null);
+
+  // `contexts/create` is super-admin at the agent — it also applies a finer
+  // check on the parent. Disabled-with-a-reason rather than hidden: an operator
+  // who cannot create needs to know that is the rule, not that the console
+  // forgot the feature.
+  const denied = authority && !hasRole(authority, "admin", "super-admin")
+    ? "Creating a context needs the admin role at this agent."
+    : null;
+
+  const submit = useCallback(async () => {
+    setBusy(true);
+    setError(null);
+    setPending(null);
+    const ok = await runMutation(
+      async () => {
+        await contextsCreate(managerSender, {
+          ...parties,
+          id: id.trim(),
+          ...(name.trim() ? { name: name.trim() } : {}),
+          ...(description.trim() ? { description: description.trim() } : {}),
+          ...(parent ? { parent } : {}),
+        });
+      },
+      { onConsent: setPending, onError: setError },
+    );
+    setBusy(false);
+    if (ok) {
+      setId("");
+      setName("");
+      setDescription("");
+      onCreated();
+    }
+  }, [parties, id, name, description, parent, onCreated]);
+
+  return (
+    <Panel
+      title="New context"
+      description={
+        parent ? (
+          <>
+            Nested under <code style={{ fontFamily: font.mono }}>{parent}</code>. A context is a
+            sealed compartment: the keys and DIDs inside it are isolated from every other one, so
+            a compromise stops at its edge.
+          </>
+        ) : (
+          <>
+            Top-level. Select a context in the tree first to nest inside it. A context is a sealed
+            compartment: the keys and DIDs inside it are isolated from every other one, so a
+            compromise stops at its edge.
+          </>
+        )
+      }
+    >
+      <div style={{ display: "grid", gap: 10, maxWidth: 520 }}>
+        <label style={{ display: "grid", gap: 4 }}>
+          <Label>Id {parent ? "(leaf segment)" : ""}</Label>
+          <input
+            style={fieldStyle}
+            value={id}
+            onChange={(e) => setId(e.target.value)}
+            placeholder={parent ? "payroll" : "work"}
+          />
+        </label>
+        <label style={{ display: "grid", gap: 4 }}>
+          <Label>Name (optional)</Label>
+          <input style={fieldStyle} value={name} onChange={(e) => setName(e.target.value)} />
+        </label>
+        <label style={{ display: "grid", gap: 4 }}>
+          <Label>Description (optional)</Label>
+          <input
+            style={fieldStyle}
+            value={description}
+            onChange={(e) => setDescription(e.target.value)}
+          />
+        </label>
+
+        {error && <Note tone="danger">{error}</Note>}
+        {pending && <ConsentCeremony pending={pending} />}
+
+        <div>
+          <Button
+            kind="primary"
+            disabled={busy || !id.trim() || Boolean(denied)}
+            {...(denied ? { title: denied } : {})}
+            onClick={() => void submit()}
+          >
+            {busy ? "Creating…" : "Create context"}
+          </Button>
+        </div>
+        {denied && <span style={{ fontSize: t.sm, color: c.muted }}>{denied}</span>}
+      </div>
+    </Panel>
+  );
+}
+
+function EditContext({
+  parties,
+  record,
+  authority,
+  onChanged,
+}: {
+  parties: Parties;
+  record: ContextRecord;
+  authority: Authority | null;
+  onChanged: () => void;
+}) {
+  const [name, setName] = useState(record.name ?? "");
+  const [description, setDescription] = useState(record.description ?? "");
+  const [busy, setBusy] = useState(false);
+  const [error, setError] = useState<string | null>(null);
+  const [pending, setPending] = useState<ConsentRequiredError | null>(null);
+
+  const denied = authority && !hasRole(authority, "admin", "super-admin", "operator")
+    ? "Editing a context needs an administrative role at this agent."
+    : null;
+
+  const save = useCallback(async () => {
+    setBusy(true);
+    setError(null);
+    setPending(null);
+    const ok = await runMutation(
+      async () => {
+        // `policy` is deliberately not sent. `contextsUpdate` replaces it whole
+        // rather than merging, so writing it from a form that never read it
+        // would silently drop every constraint the form does not know about.
+        await contextsUpdate(managerSender, {
+          ...parties,
+          id: record.id,
+          name: name.trim(),
+          description: description.trim(),
+        });
+      },
+      { onConsent: setPending, onError: setError },
+    );
+    setBusy(false);
+    if (ok) onChanged();
+  }, [parties, record.id, name, description, onChanged]);
+
+  const dirty = name !== (record.name ?? "") || description !== (record.description ?? "");
+
+  return (
+    <Panel title={record.name || record.id} description={<code style={{ fontFamily: font.mono }}>{record.basePath}</code>}>
+      <dl
+        style={{
+          margin: 0,
+          display: "grid",
+          gridTemplateColumns: "auto 1fr",
+          gap: "6px 18px",
+          fontSize: t.sm,
+          alignItems: "baseline",
+        }}
+      >
+        <dt style={{ color: c.muted }}>Id</dt>
+        <dd style={{ margin: 0, fontFamily: font.mono }}>{record.id}</dd>
+        <dt style={{ color: c.muted }}>DID</dt>
+        <dd style={{ margin: 0 }}>
+          {record.did ? <Did value={record.did} /> : <span style={{ color: c.faint }}>none bound</span>}
+        </dd>
+        <dt style={{ color: c.muted }}>Created</dt>
+        <dd style={{ margin: 0, color: c.muted }}>{new Date(record.createdAt).toLocaleString()}</dd>
+        <dt style={{ color: c.muted }}>Updated</dt>
+        <dd style={{ margin: 0, color: c.muted }}>{new Date(record.updatedAt).toLocaleString()}</dd>
+      </dl>
+
+      <div style={{ display: "grid", gap: 10, maxWidth: 520, marginTop: 6 }}>
+        <label style={{ display: "grid", gap: 4 }}>
+          <Label>Name</Label>
+          <input style={fieldStyle} value={name} onChange={(e) => setName(e.target.value)} />
+        </label>
+        <label style={{ display: "grid", gap: 4 }}>
+          <Label>Description</Label>
+          <input
+            style={fieldStyle}
+            value={description}
+            onChange={(e) => setDescription(e.target.value)}
+          />
+        </label>
+
+        {error && <Note tone="danger">{error}</Note>}
+        {pending && <ConsentCeremony pending={pending} />}
+
+        <div>
+          <Button
+            disabled={busy || !dirty || Boolean(denied)}
+            {...(denied ? { title: denied } : {})}
+            onClick={() => void save()}
+          >
+            {busy ? "Saving…" : "Save changes"}
+          </Button>
+        </div>
+      </div>
+    </Panel>
+  );
+}
+
+function DeleteContext({
+  parties,
+  record,
+  authority,
+  onDeleted,
+}: {
+  parties: Parties;
+  record: ContextRecord;
+  authority: Authority | null;
+  onDeleted: () => void;
+}) {
+  const denied = authority && !hasRole(authority, "admin", "super-admin")
+    ? "Deleting a context needs the admin role at this agent."
+    : null;
+
+  return (
+    <Panel
+      title="Delete this context"
+      description="The keys and DIDs a context holds do not come back. Your agent is asked what
+        this would destroy before anything is sent."
+    >
+      <Destructive<DeletePreview>
+        label="Delete context"
+        disabledReason={denied}
+        preview={() => contextPreviewDelete(managerSender, { ...parties, id: record.id })}
+        needsForce={(p) => p.keys.length > 0 || p.webvhDids.length > 0}
+        forceLabel="Delete anyway, destroying the keys and DIDs listed above"
+        renderPreview={(p) => (
+          <>
+            <strong>
+              Deleting {record.name || record.id} is irreversible.
+            </strong>
+            {p.keys.length === 0 && p.webvhDids.length === 0 ? (
+              <span>Your agent reports it holds no keys and no DIDs.</span>
+            ) : (
+              <>
+                {p.keys.length > 0 && (
+                  <div>
+                    <div style={{ color: c.muted, marginBottom: 3 }}>
+                      {p.keys.length} key{p.keys.length === 1 ? "" : "s"} destroyed:
+                    </div>
+                    <ul style={{ margin: 0, paddingLeft: 18, fontFamily: font.mono, fontSize: t.xs }}>
+                      {p.keys.map((k) => (
+                        <li key={k}>{k}</li>
+                      ))}
+                    </ul>
+                  </div>
+                )}
+                {p.webvhDids.length > 0 && (
+                  <div>
+                    <div style={{ color: c.muted, marginBottom: 3 }}>
+                      {p.webvhDids.length} DID{p.webvhDids.length === 1 ? "" : "s"} destroyed:
+                    </div>
+                    <ul style={{ margin: 0, paddingLeft: 18 }}>
+                      {p.webvhDids.map((d) => (
+                        <li key={d}>
+                          <Did value={d} size={t.xs} />
+                        </li>
+                      ))}
+                    </ul>
+                  </div>
+                )}
+              </>
+            )}
+          </>
+        )}
+        commit={async (force) => {
+          await contextDelete(managerSender, { ...parties, id: record.id, force });
+        }}
+        onDone={onDeleted}
+      />
+    </Panel>
+  );
+}
+
+export function ContextsPane({
+  parties,
+  authority,
+  records,
+  selected,
+  onChanged,
+}: {
+  parties: Parties;
+  authority: Authority | null;
+  records: ContextRecord[];
+  selected: ContextSelection;
+  onChanged: () => void;
+}) {
+  const record = selected ? records.find((r) => r.id === selected) : undefined;
+
+  return (
+    <div style={{ display: "grid", gap: 16, alignContent: "start" }}>
+      {selected && !record && (
+        <Empty>
+          That context is no longer in your agent's list. It may have been deleted, or your access
+          to it revoked.
+        </Empty>
+      )}
+
+      {record && (
+        <>
+          <EditContext
+            parties={parties}
+            record={record}
+            authority={authority}
+            onChanged={onChanged}
+          />
+          <DeleteContext
+            parties={parties}
+            record={record}
+            authority={authority}
+            onDeleted={onChanged}
+          />
+        </>
+      )}
+
+      <CreateContext
+        parties={parties}
+        parent={selected}
+        authority={authority}
+        onCreated={onChanged}
+      />
+    </div>
+  );
+}
diff --git a/packages/extension/src/manager/panes/dids.tsx b/packages/extension/src/manager/panes/dids.tsx
new file mode 100644
index 0000000..efe573b
--- /dev/null
+++ b/packages/extension/src/manager/panes/dids.tsx
@@ -0,0 +1,258 @@
+// DIDs — the `did:webvh` identifiers a context publishes.
+//
+// Scoped to the selected context like Keys, and for the same reason:
+// `webvhDidList` takes a `contextId`, so a changed selection asks the agent a
+// different question rather than filtering an answer it already gave.
+//
+// A DID here is a *published* identifier: its log lives on a hosting server and
+// anyone can resolve it. That is why deletion is treated as the sharpest action
+// in this console — see the confirm copy.
+
+import { useCallback, useState } from "react";
+import {
+  webvhDidCreate,
+  webvhDidDelete,
+  webvhDidList,
+  type WebvhDidRecord,
+} from "@openvtc/pnm-core/webvh";
+import { Button, Did, Note, Panel, Pill } from "../../ui.js";
+import { c, t, font } from "../../theme.js";
+import { managerSender } from "../sender.js";
+import { ConsentRequiredError } from "../carrier.js";
+import { ConsentCeremony, Destructive, runMutation } from "../destructive.js";
+import { Loading, LoadError, Table, type Column } from "../table.js";
+import { useAsync } from "../use-async.js";
+import { hasRole, type Authority, type Parties } from "../use-vta.js";
+import type { ContextSelection } from "../context-column.js";
+
+const fieldStyle: React.CSSProperties = {
+  boxSizing: "border-box",
+  padding: "6px 9px",
+  background: c.ground,
+  color: c.text,
+  border: `1px solid ${c.line}`,
+  borderRadius: "var(--w-r-sm)",
+  fontSize: t.sm,
+};
+
+function CreateDid({
+  parties,
+  contextId,
+  authority,
+  onCreated,
+}: {
+  parties: Parties;
+  contextId: ContextSelection;
+  authority: Authority | null;
+  onCreated: () => void;
+}) {
+  const [serverId, setServerId] = useState("");
+  const [portable, setPortable] = useState(false);
+  const [busy, setBusy] = useState(false);
+  const [error, setError] = useState<string | null>(null);
+  const [pending, setPending] = useState<ConsentRequiredError | null>(null);
+
+  const denied = authority && !hasRole(authority, "admin", "super-admin", "operator")
+    ? "Creating a DID needs an administrative role at this agent."
+    : !contextId
+      ? "Select a context in the tree first — a DID is created inside one."
+      : null;
+
+  const submit = useCallback(async () => {
+    if (!contextId) return;
+    setBusy(true);
+    setError(null);
+    setPending(null);
+    const ok = await runMutation(
+      async () => {
+        await webvhDidCreate(managerSender, {
+          ...parties,
+          contextId,
+          portable,
+          ...(serverId.trim() ? { serverId: serverId.trim() } : {}),
+        });
+      },
+      { onConsent: setPending, onError: setError },
+    );
+    setBusy(false);
+    if (ok) {
+      setServerId("");
+      onCreated();
+    }
+  }, [parties, contextId, serverId, portable, onCreated]);
+
+  return (
+    <Panel
+      title="New DID"
+      description={
+        contextId ? (
+          <>
+            Created in <code style={{ fontFamily: font.mono }}>{contextId}</code> and published as
+            a <code style={{ fontFamily: font.mono }}>did:webvh</code> log on a hosting server.
+            Once published it is resolvable by anyone.
+          </>
+        ) : (
+          "Select a context in the tree to create a DID inside it."
+        )
+      }
+    >
+      <div style={{ display: "flex", gap: 10, flexWrap: "wrap", alignItems: "flex-end" }}>
+        <label style={{ display: "grid", gap: 4 }}>
+          <span style={{ fontSize: t.xs, color: c.muted }}>SERVER ID (optional)</span>
+          <input
+            style={fieldStyle}
+            value={serverId}
+            onChange={(e) => setServerId(e.target.value)}
+            placeholder="your agent's default"
+          />
+        </label>
+        <label style={{ display: "flex", gap: 7, alignItems: "center", fontSize: t.sm, paddingBottom: 7 }}>
+          <input type="checkbox" checked={portable} onChange={(e) => setPortable(e.target.checked)} />
+          Portable
+        </label>
+      </div>
+
+      {portable && (
+        <Note tone="warn">
+          A portable DID can be moved to another hosting domain later. That flexibility is decided
+          now and cannot be added afterwards — but it also means the DID's identifier does not pin
+          it to one host.
+        </Note>
+      )}
+      {error && <Note tone="danger">{error}</Note>}
+      {pending && <ConsentCeremony pending={pending} />}
+
+      <div>
+        <Button
+          kind="primary"
+          disabled={busy || Boolean(denied)}
+          {...(denied ? { title: denied } : {})}
+          onClick={() => void submit()}
+        >
+          {busy ? "Creating…" : "Create DID"}
+        </Button>
+      </div>
+      {denied && <span style={{ fontSize: t.sm, color: c.muted }}>{denied}</span>}
+    </Panel>
+  );
+}
+
+export function DidsPane({
+  parties,
+  authority,
+  contextId,
+}: {
+  parties: Parties;
+  authority: Authority | null;
+  contextId: ContextSelection;
+}) {
+  const list = useAsync(
+    () =>
+      webvhDidList(managerSender, {
+        ...parties,
+        ...(contextId ? { contextId } : {}),
+      }),
+    [parties.holder.did, parties.service.did, contextId],
+  );
+
+  const denied = authority && !hasRole(authority, "admin", "super-admin")
+    ? "Deleting a DID needs the admin role at this agent."
+    : null;
+
+  const columns: Column<WebvhDidRecord>[] = [
+    { key: "did", header: "DID", render: (d) => <Did value={d.did} /> },
+    {
+      key: "context",
+      header: "Context",
+      render: (d) => <span style={{ fontFamily: font.mono, fontSize: t.xs }}>{d.contextId}</span>,
+    },
+    {
+      key: "server",
+      header: "Server",
+      render: (d) => <span style={{ color: c.muted }}>{d.serverId}</span>,
+    },
+    {
+      key: "portable",
+      header: "Portable",
+      render: (d) => (d.portable ? <Pill tone="accent">portable</Pill> : <span style={{ color: c.faint }}>—</span>),
+    },
+    {
+      key: "log",
+      header: "Log entries",
+      render: (d) => <span style={{ color: c.muted }}>{d.logEntryCount}</span>,
+    },
+    {
+      key: "created",
+      header: "Created",
+      render: (d) => (
+        <span style={{ color: c.muted, whiteSpace: "nowrap" }}>
+          {new Date(d.createdAt).toLocaleDateString()}
+        </span>
+      ),
+    },
+    {
+      key: "actions",
+      header: "",
+      render: (d) => (
+        <div style={{ minWidth: 190 }}>
+          <Destructive<WebvhDidRecord>
+            label="Delete"
+            disabledReason={denied}
+            preview={async () => d}
+            forceLabel="Delete anyway"
+            renderPreview={(p) => (
+              <>
+                <strong>Deleting this DID cannot be undone.</strong>
+                <span style={{ fontFamily: font.mono, fontSize: t.xs, wordBreak: "break-all" }}>
+                  {p.did}
+                </span>
+                <span>
+                  Its {p.logEntryCount} log{p.logEntryCount === 1 ? " entry" : " entries"} and the
+                  keys behind them go with it. Anyone still resolving this DID — a relying party
+                  holding a credential you issued, an ACL entry naming it — stops being able to
+                  verify anything signed by it.
+                </span>
+              </>
+            )}
+            commit={async () => {
+              await webvhDidDelete(managerSender, { ...parties, did: d.did });
+            }}
+            onDone={list.reload}
+          />
+        </div>
+      ),
+    },
+  ];
+
+  return (
+    <div style={{ display: "grid", gap: 16, alignContent: "start" }}>
+      <Panel
+        title={contextId ? `DIDs in ${contextId}` : "DIDs in every context you can reach"}
+        description="Published did:webvh identifiers. Each one's log is served by a hosting
+          server and resolvable by anyone — these are the identities others see."
+      >
+        {list.error && <LoadError what="DIDs" error={list.error} />}
+        {list.loading && !list.data && <Loading what="DIDs" />}
+        {list.data && (
+          <Table
+            columns={columns}
+            rows={list.data.dids}
+            rowKey={(d) => d.did}
+            empty={
+              contextId
+                ? `No DIDs in ${contextId}. Identifiers published from this context appear here.`
+                : "No DIDs you can reach. Published identifiers you administer appear here."
+            }
+          />
+        )}
+      </Panel>
+
+      <CreateDid
+        parties={parties}
+        contextId={contextId}
+        authority={authority}
+        onCreated={list.reload}
+      />
+    </div>
+  );
+}
diff --git a/packages/extension/src/manager/panes/keys.tsx b/packages/extension/src/manager/panes/keys.tsx
new file mode 100644
index 0000000..6a0beb2
--- /dev/null
+++ b/packages/extension/src/manager/panes/keys.tsx
@@ -0,0 +1,380 @@
+// Keys — scoped to the selected context.
+//
+// `keysList` takes a `contextId`, so this pane asks a different question when
+// the tree selection changes rather than filtering a full list client-side. The
+// difference matters: a caller's ACL may not reach every context, and asking
+// per-context gets the agent's answer for the one being looked at instead of
+// silently rendering a subset of a list that failed elsewhere.
+//
+// **Nothing here signs anything.** `keysSign` and `keysDeriveAndSign` exist in
+// the admin module and are deliberately not surfaced: signing with an operator
+// key is not an administration task, it is use, and a console that offers a
+// "sign this" box turns an audit trail of key management into an oracle.
+
+import { useCallback, useState } from "react";
+import {
+  keysCreate,
+  keysList,
+  keysRename,
+  keysRevoke,
+  type KeyRecord,
+  type KeyStatus,
+} from "@openvtc/pnm-core/admin";
+import { Button, Note, Panel, Pill } from "../../ui.js";
+import { c, t, font } from "../../theme.js";
+import { managerSender } from "../sender.js";
+import { ConsentRequiredError } from "../carrier.js";
+import { ConsentCeremony, Destructive, runMutation } from "../destructive.js";
+import { Loading, LoadError, Table, Truncated, type Column } from "../table.js";
+import { useAsync } from "../use-async.js";
+import { hasRole, type Authority, type Parties } from "../use-vta.js";
+import type { ContextSelection } from "../context-column.js";
+
+const PAGE = 50;
+
+const fieldStyle: React.CSSProperties = {
+  boxSizing: "border-box",
+  padding: "6px 9px",
+  background: c.ground,
+  color: c.text,
+  border: `1px solid ${c.line}`,
+  borderRadius: "var(--w-r-sm)",
+  fontSize: t.sm,
+};
+
+function StatusPill({ status }: { status: KeyStatus }) {
+  return <Pill tone={status === "active" ? "ok" : "off"}>{status}</Pill>;
+}
+
+/** Where the key came from, which is the difference between recoverable and
+ *  gone forever. `internal` keys are generated from the CSPRNG and derive from
+ *  no seed — nothing reconstitutes them. */
+function OriginNote({ record }: { record: KeyRecord }) {
+  if (record.origin !== "internal") {
+    return <span style={{ color: c.muted }}>{record.origin ?? "derived"}</span>;
+  }
+  return (
+    <span style={{ color: c.warn }} title="Generated from the CSPRNG, not derived from a seed. Nothing can reconstitute it.">
+      internal · unrecoverable
+    </span>
+  );
+}
+
+function CreateKey({
+  parties,
+  contextId,
+  authority,
+  onCreated,
+}: {
+  parties: Parties;
+  contextId: ContextSelection;
+  authority: Authority | null;
+  onCreated: () => void;
+}) {
+  const [keyType, setKeyType] = useState<"ed25519" | "x25519" | "p256">("ed25519");
+  const [label, setLabel] = useState("");
+  const [keyId, setKeyId] = useState("");
+  const [internal, setInternal] = useState(false);
+  const [busy, setBusy] = useState(false);
+  const [error, setError] = useState<string | null>(null);
+  const [pending, setPending] = useState<ConsentRequiredError | null>(null);
+
+  const denied = authority && !hasRole(authority, "admin", "super-admin", "operator")
+    ? "Creating a key needs an administrative role at this agent."
+    : !contextId
+      ? "Select a context in the tree first — a key is minted into one."
+      : null;
+
+  // `keyId` is optional for a derived key (the agent names it after the
+  // derivation path) but there is no path for an internal one, so the agent has
+  // nothing to name it after. Required here rather than discovered as a reject.
+  const needsKeyId = internal && !keyId.trim();
+
+  const submit = useCallback(async () => {
+    if (!contextId) return;
+    setBusy(true);
+    setError(null);
+    setPending(null);
+    const ok = await runMutation(
+      async () => {
+        await keysCreate(managerSender, {
+          ...parties,
+          keyType,
+          contextId,
+          internal,
+          ...(label.trim() ? { label: label.trim() } : {}),
+          ...(keyId.trim() ? { keyId: keyId.trim() } : {}),
+        });
+      },
+      { onConsent: setPending, onError: setError },
+    );
+    setBusy(false);
+    if (ok) {
+      setLabel("");
+      setKeyId("");
+      onCreated();
+    }
+  }, [parties, contextId, keyType, label, keyId, internal, onCreated]);
+
+  return (
+    <Panel
+      title="New key"
+      description={
+        contextId ? (
+          <>
+            Minted into <code style={{ fontFamily: font.mono }}>{contextId}</code>. Your agent
+            holds the private half and never returns it — only the public key comes back.
+          </>
+        ) : (
+          "Select a context in the tree to mint a key into it."
+        )
+      }
+    >
+      <div style={{ display: "flex", gap: 10, flexWrap: "wrap", alignItems: "flex-end" }}>
+        <label style={{ display: "grid", gap: 4 }}>
+          <span style={{ fontSize: t.xs, color: c.muted }}>TYPE</span>
+          <select
+            style={fieldStyle}
+            value={keyType}
+            onChange={(e) => setKeyType(e.target.value as typeof keyType)}
+          >
+            <option value="ed25519">ed25519 (signing)</option>
+            <option value="x25519">x25519 (key agreement)</option>
+            <option value="p256">p256</option>
+          </select>
+        </label>
+        <label style={{ display: "grid", gap: 4 }}>
+          <span style={{ fontSize: t.xs, color: c.muted }}>LABEL</span>
+          <input style={fieldStyle} value={label} onChange={(e) => setLabel(e.target.value)} />
+        </label>
+        <label style={{ display: "grid", gap: 4 }}>
+          <span style={{ fontSize: t.xs, color: c.muted }}>
+            KEY ID {internal ? "(required)" : "(optional)"}
+          </span>
+          <input style={fieldStyle} value={keyId} onChange={(e) => setKeyId(e.target.value)} />
+        </label>
+        <label style={{ display: "flex", gap: 7, alignItems: "center", fontSize: t.sm, paddingBottom: 7 }}>
+          <input type="checkbox" checked={internal} onChange={(e) => setInternal(e.target.checked)} />
+          Generate from the CSPRNG
+        </label>
+      </div>
+
+      {internal && (
+        <Note tone="warn">
+          An internal key derives from no seed. It cannot be re-derived, exported or recovered by
+          any means — losing the agent's keyspace loses this key and everything it authorises.
+        </Note>
+      )}
+      {error && <Note tone="danger">{error}</Note>}
+      {pending && <ConsentCeremony pending={pending} />}
+
+      <div>
+        <Button
+          kind="primary"
+          disabled={busy || Boolean(denied) || needsKeyId}
+          {...(denied ? { title: denied } : {})}
+          onClick={() => void submit()}
+        >
+          {busy ? "Minting…" : "Mint key"}
+        </Button>
+      </div>
+      {denied && <span style={{ fontSize: t.sm, color: c.muted }}>{denied}</span>}
+    </Panel>
+  );
+}
+
+function RenameKey({
+  parties,
+  record,
+  onDone,
+}: {
+  parties: Parties;
+  record: KeyRecord;
+  onDone: () => void;
+}) {
+  const [open, setOpen] = useState(false);
+  const [next, setNext] = useState(record.keyId);
+  const [busy, setBusy] = useState(false);
+  const [error, setError] = useState<string | null>(null);
+  const [pending, setPending] = useState<ConsentRequiredError | null>(null);
+
+  if (!open) {
+    return (
+      <Button kind="quiet" onClick={() => setOpen(true)}>
+        Rename
+      </Button>
+    );
+  }
+
+  return (
+    <div style={{ display: "grid", gap: 7 }}>
+      <input style={fieldStyle} value={next} onChange={(e) => setNext(e.target.value)} />
+      {error && <Note tone="danger">{error}</Note>}
+      {pending && <ConsentCeremony pending={pending} />}
+      <div style={{ display: "flex", gap: 6 }}>
+        <Button
+          disabled={busy || !next.trim() || next === record.keyId}
+          onClick={() => {
+            setBusy(true);
+            setError(null);
+            void runMutation(
+              async () => {
+                await keysRename(managerSender, {
+                  ...parties,
+                  keyId: record.keyId,
+                  newKeyId: next.trim(),
+                });
+              },
+              { onConsent: setPending, onError: setError },
+            ).then((ok) => {
+              setBusy(false);
+              if (ok) {
+                setOpen(false);
+                onDone();
+              }
+            });
+          }}
+        >
+          {busy ? "Saving…" : "Save"}
+        </Button>
+        <Button kind="quiet" onClick={() => setOpen(false)}>
+          Cancel
+        </Button>
+      </div>
+    </div>
+  );
+}
+
+export function KeysPane({
+  parties,
+  authority,
+  contextId,
+}: {
+  parties: Parties;
+  authority: Authority | null;
+  contextId: ContextSelection;
+}) {
+  const [limit, setLimit] = useState(PAGE);
+
+  const list = useAsync(
+    () =>
+      keysList(managerSender, {
+        ...parties,
+        limit,
+        ...(contextId ? { contextId } : {}),
+      }),
+    [parties.holder.did, parties.service.did, contextId, limit],
+  );
+
+  const revokeDenied = authority && !hasRole(authority, "admin", "super-admin", "operator")
+    ? "Revoking a key needs an administrative role at this agent."
+    : null;
+
+  const columns: Column<KeyRecord>[] = [
+    {
+      key: "keyId",
+      header: "Key",
+      render: (k) => (
+        <div style={{ display: "grid", gap: 2 }}>
+          <span style={{ fontFamily: font.mono, wordBreak: "break-all" }}>{k.keyId}</span>
+          {k.label && <span style={{ color: c.muted, fontSize: t.xs }}>{k.label}</span>}
+        </div>
+      ),
+    },
+    { key: "type", header: "Type", render: (k) => <span style={{ color: c.muted }}>{k.keyType}</span> },
+    { key: "status", header: "Status", render: (k) => <StatusPill status={k.status} /> },
+    { key: "origin", header: "Origin", render: (k) => <OriginNote record={k} /> },
+    {
+      key: "path",
+      header: "Derivation",
+      render: (k) => (
+        <span style={{ fontFamily: font.mono, fontSize: t.xs, color: c.faint }}>
+          {k.derivationPath ?? "—"}
+        </span>
+      ),
+    },
+    {
+      key: "created",
+      header: "Created",
+      render: (k) => (
+        <span style={{ color: c.muted, whiteSpace: "nowrap" }}>
+          {new Date(k.createdAt).toLocaleDateString()}
+        </span>
+      ),
+    },
+    {
+      key: "actions",
+      header: "",
+      render: (k) =>
+        k.status === "revoked" ? (
+          <span style={{ color: c.faint, fontSize: t.xs }}>revoked</span>
+        ) : (
+          <div style={{ display: "grid", gap: 8, minWidth: 190 }}>
+            <RenameKey parties={parties} record={k} onDone={list.reload} />
+            <Destructive<KeyRecord>
+              label="Revoke"
+              disabledReason={revokeDenied}
+              // There is no `keys/preview-revoke`, so the preview is the record
+              // itself — read back from the agent so what the operator confirms
+              // against is the agent's current view, not a row that may have
+              // been stale since the list was fetched.
+              preview={async () => k}
+              renderPreview={(p) => (
+                <>
+                  <strong>Revoking {p.keyId} cannot be undone.</strong>
+                  <span>
+                    Anything this key authorises stops working, and any signature made with it
+                    from now on will not verify. Existing signatures are unaffected.
+                  </span>
+                </>
+              )}
+              commit={async () => {
+                await keysRevoke(managerSender, { ...parties, keyId: k.keyId });
+              }}
+              onDone={list.reload}
+            />
+          </div>
+        ),
+    },
+  ];
+
+  return (
+    <div style={{ display: "grid", gap: 16, alignContent: "start" }}>
+      <Panel
+        title={contextId ? `Keys in ${contextId}` : "Keys in every context you can reach"}
+        description="Your agent holds every private half. This console never sees one, and never
+          asks for a signature — that is use, not administration."
+      >
+        {list.error && <LoadError what="keys" error={list.error} />}
+        {list.loading && !list.data && <Loading what="keys" />}
+        {list.data && (
+          <>
+            <Table
+              columns={columns}
+              rows={list.data.keys}
+              rowKey={(k) => k.keyId}
+              empty={
+                contextId
+                  ? `No keys in ${contextId}. Keys minted into this context appear here.`
+                  : "No keys you can reach. Keys you administer appear here."
+              }
+            />
+            {list.data.total > list.data.keys.length && (
+              <Truncated
+                what={`your agent's ${list.data.total} keys`}
+                onMore={() => setLimit((n) => n + PAGE)}
+              />
+            )}
+          </>
+        )}
+      </Panel>
+
+      <CreateKey
+        parties={parties}
+        contextId={contextId}
+        authority={authority}
+        onCreated={list.reload}
+      />
+    </div>
+  );
+}
diff --git a/packages/extension/src/manager/panes/policy.tsx b/packages/extension/src/manager/panes/policy.tsx
new file mode 100644
index 0000000..9912ca6
--- /dev/null
+++ b/packages/extension/src/manager/panes/policy.tsx
@@ -0,0 +1,334 @@
+// Policy — the Rego modules the agent evaluates before it acts.
+//
+// A power-user surface, and labelled as one. For "which tasks need a human"
+// the answer is the Approvals pane; this is the layer underneath, where the
+// rule is written rather than chosen.
+//
+// **Every write carries `expectedVersion`.** `PolicyModule` has a `version`,
+// and both upsert and delete accept the version the editor was opened on. That
+// is the difference between saving your edit and silently discarding somebody
+// else's: without it, two operators editing the same module means last-write-
+// wins, and the loser never finds out.
+
+import { useCallback, useState } from "react";
+import {
+  policyDelete,
+  policyList,
+  policyUpsert,
+  type PolicyModule,
+} from "@openvtc/pnm-core/admin";
+import { Button, Note, Panel, Pill } from "../../ui.js";
+import { c, t, font } from "../../theme.js";
+import { managerSender } from "../sender.js";
+import { ConsentRequiredError } from "../carrier.js";
+import { ConsentCeremony, Destructive, runMutation } from "../destructive.js";
+import { Loading, LoadError, Table, Truncated, type Column } from "../table.js";
+import { useAsync } from "../use-async.js";
+import { hasRole, type Authority, type Parties } from "../use-vta.js";
+import type { ContextSelection } from "../context-column.js";
+
+const fieldStyle: React.CSSProperties = {
+  boxSizing: "border-box",
+  padding: "6px 9px",
+  background: c.ground,
+  color: c.text,
+  border: `1px solid ${c.line}`,
+  borderRadius: "var(--w-r-sm)",
+  fontSize: t.sm,
+};
+
+const codeStyle: React.CSSProperties = {
+  ...fieldStyle,
+  fontFamily: font.mono,
+  fontSize: t.xs,
+  minHeight: 180,
+  width: "100%",
+  lineHeight: 1.5,
+  resize: "vertical",
+};
+
+function PolicyEditor({
+  parties,
+  existing,
+  authority,
+  onSaved,
+  onCancel,
+}: {
+  parties: Parties;
+  /** Absent for a new module. */
+  existing?: PolicyModule;
+  authority: Authority | null;
+  onSaved: () => void;
+  onCancel?: () => void;
+}) {
+  const [name, setName] = useState(existing?.name ?? "");
+  const [description, setDescription] = useState(existing?.description ?? "");
+  const [module, setModule] = useState(existing?.module ?? "");
+  const [enabled, setEnabled] = useState(existing?.enabled ?? false);
+  const [busy, setBusy] = useState(false);
+  const [error, setError] = useState<string | null>(null);
+  const [pending, setPending] = useState<ConsentRequiredError | null>(null);
+
+  const denied = authority && !hasRole(authority, "admin", "super-admin")
+    ? "Editing policy needs the admin role at this agent."
+    : null;
+
+  const save = useCallback(async () => {
+    setBusy(true);
+    setError(null);
+    setPending(null);
+    const ok = await runMutation(
+      async () => {
+        await policyUpsert(managerSender, {
+          ...parties,
+          ...(existing ? { id: existing.id, expectedVersion: existing.version } : {}),
+          name: name.trim(),
+          module,
+          enabled,
+          ...(description.trim() ? { description: description.trim() } : {}),
+        });
+      },
+      { onConsent: setPending, onError: setError },
+    );
+    setBusy(false);
+    if (ok) onSaved();
+  }, [parties, existing, name, description, module, enabled, onSaved]);
+
+  return (
+    <Panel
+      title={existing ? `Edit ${existing.name}` : "New policy module"}
+      description={
+        existing ? (
+          <>
+            Saving is compare-and-swapped against version{" "}
+            <strong>{existing.version}</strong> — if someone else has changed this module since
+            this editor opened, your save is refused rather than overwriting theirs.
+          </>
+        ) : (
+          "A Rego module the agent evaluates before it acts. Written by hand; for the common " +
+          "case of 'this task needs a human', use the Approvals pane instead."
+        )
+      }
+    >
+      <div style={{ display: "grid", gap: 10 }}>
+        <div style={{ display: "flex", gap: 10, flexWrap: "wrap" }}>
+          <label style={{ display: "grid", gap: 4, flex: "1 1 220px" }}>
+            <span style={{ fontSize: t.xs, color: c.muted }}>NAME</span>
+            <input style={fieldStyle} value={name} onChange={(e) => setName(e.target.value)} />
+          </label>
+          <label style={{ display: "grid", gap: 4, flex: "2 1 320px" }}>
+            <span style={{ fontSize: t.xs, color: c.muted }}>DESCRIPTION</span>
+            <input
+              style={fieldStyle}
+              value={description}
+              onChange={(e) => setDescription(e.target.value)}
+            />
+          </label>
+        </div>
+
+        <label style={{ display: "grid", gap: 4 }}>
+          <span style={{ fontSize: t.xs, color: c.muted }}>REGO MODULE</span>
+          <textarea
+            style={codeStyle}
+            value={module}
+            onChange={(e) => setModule(e.target.value)}
+            spellCheck={false}
+            placeholder={"package vta.policy\n\ndefault allow := false\n"}
+          />
+        </label>
+
+        <label style={{ display: "flex", gap: 8, alignItems: "center", fontSize: t.sm }}>
+          <input type="checkbox" checked={enabled} onChange={(e) => setEnabled(e.target.checked)} />
+          Enabled — the agent evaluates this module on every gated task
+        </label>
+
+        {enabled && (
+          <Note tone="warn">
+            An enabled module takes effect as soon as it is saved. A module that denies more than
+            you intended will refuse real work, including work this console does.
+          </Note>
+        )}
+        {error && <Note tone="danger">{error}</Note>}
+        {pending && <ConsentCeremony pending={pending} />}
+
+        <div style={{ display: "flex", gap: 8 }}>
+          <Button
+            kind="primary"
+            disabled={busy || !name.trim() || !module.trim() || Boolean(denied)}
+            {...(denied ? { title: denied } : {})}
+            onClick={() => void save()}
+          >
+            {busy ? "Saving…" : existing ? "Save changes" : "Create module"}
+          </Button>
+          {onCancel && (
+            <Button kind="quiet" onClick={onCancel}>
+              Cancel
+            </Button>
+          )}
+        </div>
+        {denied && <span style={{ fontSize: t.sm, color: c.muted }}>{denied}</span>}
+      </div>
+    </Panel>
+  );
+}
+
+export function PolicyPane({
+  parties,
+  authority,
+  contextId,
+}: {
+  parties: Parties;
+  authority: Authority | null;
+  contextId: ContextSelection;
+}) {
+  const [editing, setEditing] = useState<PolicyModule | null>(null);
+  const [creating, setCreating] = useState(false);
+
+  const list = useAsync(
+    () => policyList(managerSender, { ...parties, ...(contextId ? { contextId } : {}) }),
+    [parties.holder.did, parties.service.did, contextId],
+  );
+
+  const denied = authority && !hasRole(authority, "admin", "super-admin")
+    ? "Deleting policy needs the admin role at this agent."
+    : null;
+
+  const done = () => {
+    setEditing(null);
+    setCreating(false);
+    list.reload();
+  };
+
+  const columns: Column<PolicyModule>[] = [
+    {
+      key: "name",
+      header: "Module",
+      render: (p) => (
+        <div style={{ display: "grid", gap: 2 }}>
+          <span style={{ fontWeight: 600 }}>{p.name}</span>
+          {p.description && (
+            <span style={{ color: c.muted, fontSize: t.xs }}>{p.description}</span>
+          )}
+        </div>
+      ),
+    },
+    {
+      key: "enabled",
+      header: "State",
+      render: (p) => (p.enabled ? <Pill tone="ok">enabled</Pill> : <Pill tone="off">disabled</Pill>),
+    },
+    {
+      key: "applies",
+      header: "Applies to",
+      render: (p) =>
+        p.appliesTo?.length ? (
+          <span style={{ fontFamily: font.mono, fontSize: t.xs }}>{p.appliesTo.join(", ")}</span>
+        ) : (
+          <span style={{ color: c.muted }}>every task</span>
+        ),
+    },
+    {
+      key: "version",
+      header: "Version",
+      render: (p) => <span style={{ color: c.muted }}>{p.version}</span>,
+    },
+    {
+      key: "updated",
+      header: "Updated",
+      render: (p) => (
+        <span style={{ color: c.muted, whiteSpace: "nowrap" }}>
+          {new Date(p.updatedAt).toLocaleDateString()}
+        </span>
+      ),
+    },
+    {
+      key: "actions",
+      header: "",
+      render: (p) => (
+        <div style={{ display: "grid", gap: 8, minWidth: 190 }}>
+          <Button kind="quiet" onClick={() => setEditing(p)}>
+            Edit
+          </Button>
+          <Destructive<PolicyModule>
+            label="Delete"
+            disabledReason={denied}
+            preview={async () => p}
+            renderPreview={(m) => (
+              <>
+                <strong>Deleting {m.name} removes the rule it enforces.</strong>
+                <span>
+                  {m.enabled
+                    ? "It is currently enabled, so whatever it was refusing becomes allowed as " +
+                      "soon as this is deleted."
+                    : "It is currently disabled, so nothing changes about what the agent " +
+                      "allows today — but the module itself is not recoverable."}
+                </span>
+              </>
+            )}
+            commit={async () => {
+              await policyDelete(managerSender, {
+                ...parties,
+                id: p.id,
+                // Same compare-and-swap as the editor: delete the version that
+                // was read, not whatever is there now.
+                expectedVersion: p.version,
+              });
+            }}
+            onDone={done}
+          />
+        </div>
+      ),
+    },
+  ];
+
+  if (editing) {
+    return (
+      <PolicyEditor
+        parties={parties}
+        existing={editing}
+        authority={authority}
+        onSaved={done}
+        onCancel={() => setEditing(null)}
+      />
+    );
+  }
+
+  return (
+    <div style={{ display: "grid", gap: 16, alignContent: "start" }}>
+      <Panel
+        title={contextId ? `Policy in ${contextId}` : "Policy"}
+        description="Hand-authored Rego the agent evaluates before it acts. For the common case
+          — which tasks need a human — the Approvals pane is the surface to use."
+      >
+        {list.error && <LoadError what="policy modules" error={list.error} />}
+        {list.loading && !list.data && <Loading what="policy modules" />}
+        {list.data && (
+          <>
+            <Table
+              columns={columns}
+              rows={list.data.policies}
+              rowKey={(p) => p.id}
+              empty="No policy modules. Without one the agent falls back to its configured
+                defaults — which, for consent enforcement, is off."
+            />
+            {list.data.truncated && <Truncated what="the policy list" />}
+          </>
+        )}
+        {!creating && (
+          <div>
+            <Button onClick={() => setCreating(true)}>New module</Button>
+          </div>
+        )}
+      </Panel>
+
+      {creating && (
+        <PolicyEditor
+          parties={parties}
+          authority={authority}
+          onSaved={done}
+          onCancel={() => setCreating(false)}
+        />
+      )}
+    </div>
+  );
+}
diff --git a/packages/extension/src/manager/panes/services.tsx b/packages/extension/src/manager/panes/services.tsx
new file mode 100644
index 0000000..d735554
--- /dev/null
+++ b/packages/extension/src/manager/panes/services.tsx
@@ -0,0 +1,285 @@
+// Services — what the agent advertises, beside what the wallet has observed.
+//
+// **Advertisement is not availability.** A DID document says what an agent
+// *offers*; `buildVtaSession` skips a channel whose mediator it cannot reach
+// and falls through to the next, so an agent routinely advertises TSP, DIDComm
+// and REST while every byte goes over REST. A services list alone therefore
+// answers a different question from the one an operator is asking when
+// something misbehaves.
+//
+// So both columns are shown, and the third state is load-bearing: `up` needs
+// positive evidence (a completed mediator handshake and an open socket), `down`
+// is a skip the wallet recorded, and `unknown` means **not observed** — a REST
+// channel is built from a URL without contacting anything. `unknown` is not a
+// failure and must never be rendered as one; presenting it as a problem is how
+// an operator ends up chasing a transport that is working.
+
+import { servicesList, serviceDisable, serviceEnable, type ServiceState } from "@openvtc/pnm-core/admin";
+import { agentPing } from "@openvtc/pnm-core/admin";
+import { useCallback, useState } from "react";
+import { Button, Did, Note, Panel, Pill } from "../../ui.js";
+import { c, t, font } from "../../theme.js";
+import { managerSender } from "../sender.js";
+import { ConsentRequiredError } from "../carrier.js";
+import { ConsentCeremony, Destructive, runMutation } from "../destructive.js";
+import { Loading, LoadError, Table, type Column } from "../table.js";
+import { useAsync } from "../use-async.js";
+import { useTransportHealth } from "../../use-transport-health.js";
+import { hasRole, type Authority, type Parties } from "../use-vta.js";
+import type { Transport, TransportObservation } from "../../transports.js";
+
+/** `ServiceKind` → the name `TransportHealth` records observations under. */
+const OBSERVED_AS: Partial<Record<ServiceState["kind"], Transport>> = {
+  tsp: "TSP",
+  didcomm: "DIDComm",
+  rest: "REST",
+};
+
+function Observed({ observation }: { observation: TransportObservation | undefined }) {
+  if (!observation) {
+    return (
+      <span style={{ color: c.faint }} title="No session has been built over this transport yet.">
+        not observed
+      </span>
+    );
+  }
+  if (observation.state === "up") return <Pill tone="ok">up</Pill>;
+  if (observation.state === "unknown") {
+    return (
+      <span
+        style={{ color: c.faint }}
+        title="Built from a URL without contacting anything — construction is not evidence."
+      >
+        not observed
+      </span>
+    );
+  }
+  return (
+    <div style={{ display: "grid", gap: 2 }}>
+      <Pill tone="danger">down</Pill>
+      {observation.detail && (
+        <span style={{ color: c.muted, fontSize: t.xs, maxWidth: 320, lineHeight: 1.45 }}>
+          {observation.detail}
+        </span>
+      )}
+    </div>
+  );
+}
+
+function HealthCheck({ parties }: { parties: Parties }) {
+  const [result, setResult] = useState<string | null>(null);
+  const [error, setError] = useState<string | null>(null);
+  const [busy, setBusy] = useState(false);
+
+  const ping = useCallback(async () => {
+    setBusy(true);
+    setError(null);
+    setResult(null);
+    const started = performance.now();
+    try {
+      await agentPing(managerSender, parties);
+      setResult(`answered in ${Math.round(performance.now() - started)} ms`);
+    } catch (e) {
+      setError(e instanceof Error ? e.message : String(e));
+    } finally {
+      setBusy(false);
+    }
+  }, [parties]);
+
+  return (
+    <Panel
+      title="Reachability"
+      description="Sends a messaging/ping over whichever transport the wallet actually selects.
+        A round trip proves the path this console is using works end to end — which is a
+        different claim from any transport being advertised."
+    >
+      <div style={{ display: "flex", gap: 12, alignItems: "center", flexWrap: "wrap" }}>
+        <Button onClick={() => void ping()} disabled={busy}>
+          {busy ? "Pinging…" : "Ping agent"}
+        </Button>
+        {result && <span style={{ color: c.ok, fontSize: t.sm }}>{result}</span>}
+        {error && <span style={{ color: c.danger, fontSize: t.sm }}>{error}</span>}
+      </div>
+    </Panel>
+  );
+}
+
+export function ServicesPane({
+  parties,
+  authority,
+}: {
+  parties: Parties;
+  authority: Authority | null;
+}) {
+  const list = useAsync(
+    () => servicesList(managerSender, parties),
+    [parties.holder.did, parties.service.did],
+  );
+  const { health, sessions } = useTransportHealth(parties.service.did);
+
+  const [error, setError] = useState<string | null>(null);
+  const [pending, setPending] = useState<ConsentRequiredError | null>(null);
+
+  const denied = authority && !hasRole(authority, "admin", "super-admin")
+    ? "Changing a transport needs the admin role at this agent."
+    : null;
+
+  const columns: Column<ServiceState>[] = [
+    {
+      key: "kind",
+      header: "Transport",
+      render: (s) => <span style={{ fontWeight: 600 }}>{s.kind}</span>,
+    },
+    {
+      key: "advertised",
+      header: "Advertised",
+      render: (s) => (s.enabled ? <Pill tone="ok">enabled</Pill> : <Pill tone="off">disabled</Pill>),
+    },
+    {
+      key: "observed",
+      header: "Observed",
+      render: (s) => {
+        const key = OBSERVED_AS[s.kind];
+        return <Observed observation={key ? health[key] : undefined} />;
+      },
+    },
+    {
+      key: "endpoint",
+      header: "Endpoint",
+      render: (s) => (
+        <div style={{ display: "grid", gap: 2, maxWidth: 380 }}>
+          {s.mediatorDid && <Did value={s.mediatorDid} size={t.xs} />}
+          {s.url && (
+            <span style={{ fontFamily: font.mono, fontSize: t.xs, wordBreak: "break-all" }}>
+              {s.url}
+            </span>
+          )}
+          {!s.mediatorDid && !s.url && <span style={{ color: c.faint }}>—</span>}
+        </div>
+      ),
+    },
+    {
+      key: "drain",
+      header: "Draining",
+      render: (s) =>
+        s.drainsUntil ? (
+          <span style={{ color: c.warn, whiteSpace: "nowrap" }}>
+            until {new Date(s.drainsUntil).toLocaleString()}
+          </span>
+        ) : (
+          <span style={{ color: c.faint }}>—</span>
+        ),
+    },
+    {
+      key: "actions",
+      header: "",
+      render: (s) => (
+        <div style={{ minWidth: 190 }}>
+          {s.enabled ? (
+            <Destructive<ServiceState>
+              label="Disable"
+              disabledReason={denied}
+              preview={async () => s}
+              renderPreview={(p) => (
+                <>
+                  <strong>Disabling {p.kind} stops the agent advertising it.</strong>
+                  <span>
+                    Anything reaching this agent over {p.kind} falls back to another transport if
+                    it has one — and fails outright if it does not. Your wallet's own inbox rides
+                    the mediator transports, so disabling one can leave approval requests with
+                    nowhere to arrive.
+                  </span>
+                </>
+              )}
+              commit={async () => {
+                await serviceDisable(managerSender, { ...parties, kind: s.kind });
+              }}
+              onDone={list.reload}
+            />
+          ) : (
+            <Button
+              disabled={Boolean(denied)}
+              {...(denied ? { title: denied } : {})}
+              onClick={() => {
+                setError(null);
+                setPending(null);
+                void runMutation(
+                  async () => {
+                    // An empty config is schema-valid — every member of it is
+                    // optional — and means "re-enable on whatever you last
+                    // held". Inventing a mediator DID here would be this
+                    // console deciding one, which it has no basis to do.
+                    await serviceEnable(managerSender, {
+                      ...parties,
+                      kind: s.kind,
+                      config: {},
+                    });
+                  },
+                  { onConsent: setPending, onError: setError },
+                ).then((ok) => ok && list.reload());
+              }}
+            >
+              Enable
+            </Button>
+          )}
+        </div>
+      ),
+    },
+  ];
+
+  return (
+    <div style={{ display: "grid", gap: 16, alignContent: "start" }}>
+      <Panel
+        title="Transports"
+        description="What your agent offers, beside what your wallet has actually seen work. The
+          two differ more often than you would expect — a transport can be advertised for months
+          while every byte goes over another one."
+      >
+        {list.error && <LoadError what="the service list" error={list.error} />}
+        {list.loading && !list.data && <Loading what="the service list" />}
+        {error && <Note tone="danger">{error}</Note>}
+        {pending && <ConsentCeremony pending={pending} />}
+        {list.data && (
+          <Table
+            columns={columns}
+            rows={list.data}
+            rowKey={(s) => s.kind}
+            empty="Your agent advertises no transports, which would make it unreachable. That is
+              almost certainly wrong rather than deliberate."
+          />
+        )}
+        <Note tone="accent">
+          <strong>"Not observed" is not a failure.</strong> A REST channel is built from a URL
+          without contacting anything, so construction proves nothing either way — and a
+          transport nothing has used yet has simply not been tested. Only <em>down</em> means the
+          wallet tried and could not.
+        </Note>
+      </Panel>
+
+      <HealthCheck parties={parties} />
+
+      <Panel
+        title="Mediator sessions"
+        description="The live sockets your wallet holds. The one marked as your inbox is the one
+          whose death means nothing pushed to this wallet arrives — approval requests included."
+      >
+        <Table
+          columns={[
+            { key: "mediator", header: "Mediator", render: (s) => <Did value={s.mediatorDid} /> },
+            { key: "vta", header: "For agent", render: (s) => <Did value={s.vtaDid} /> },
+            {
+              key: "inbox",
+              header: "Role",
+              render: (s) =>
+                s.isInbox ? <Pill tone="ok">inbox</Pill> : <span style={{ color: c.muted }}>outbound</span>,
+            },
+          ]}
+          rows={sessions}
+          rowKey={(s) => `${s.mediatorDid}:${s.vtaDid}`}
+          empty="No mediator session is open. Nothing pushed to this wallet will arrive —
+            including approval requests — until one is."
+        />
+      </Panel>
+    </div>
+  );
+}
diff --git a/packages/extension/src/manager/panes/sessions.tsx b/packages/extension/src/manager/panes/sessions.tsx
new file mode 100644
index 0000000..3138b69
--- /dev/null
+++ b/packages/extension/src/manager/panes/sessions.tsx
@@ -0,0 +1,131 @@
+// Sessions — **yours**, and only yours.
+//
+// `sessionsList` returns the caller's own sessions and nothing else. The agent
+// has a separate admin route that lists everyone's, and this task deliberately
+// does not use it. So the heading says "your sessions": a console that put this
+// answer under "all sessions" would be lying about its own scope, and an
+// operator would read an empty list as "nobody else is signed in".
+
+import {
+  sessionRevoke,
+  sessionsList,
+  type Session,
+} from "@openvtc/pnm-core/admin";
+import { Note, Panel, Pill } from "../../ui.js";
+import { c, t, font } from "../../theme.js";
+import { managerSender } from "../sender.js";
+import { Destructive } from "../destructive.js";
+import { Loading, LoadError, Table, type Column } from "../table.js";
+import { useAsync } from "../use-async.js";
+import type { Authority, Parties } from "../use-vta.js";
+
+function When({ iso }: { iso: string }) {
+  return (
+    <span style={{ color: c.muted, whiteSpace: "nowrap" }}>{new Date(iso).toLocaleString()}</span>
+  );
+}
+
+export function SessionsPane({
+  parties,
+  authority,
+}: {
+  parties: Parties;
+  authority: Authority | null;
+}) {
+  const list = useAsync(
+    () => sessionsList(managerSender, parties),
+    [parties.holder.did, parties.service.did],
+  );
+
+  const current = authority?.session.id;
+
+  const columns: Column<Session>[] = [
+    {
+      key: "id",
+      header: "Session",
+      render: (s) => (
+        <div style={{ display: "grid", gap: 2 }}>
+          <span style={{ fontFamily: font.mono, fontSize: t.xs, wordBreak: "break-all" }}>
+            {s.id}
+          </span>
+          {s.id === current && <Pill tone="accent">this console</Pill>}
+        </div>
+      ),
+    },
+    {
+      key: "amr",
+      header: "Signed in with",
+      render: (s) => (
+        <span style={{ color: c.muted }}>{s.amr?.length ? s.amr.join(" + ") : "—"}</span>
+      ),
+    },
+    {
+      key: "acr",
+      header: "Assurance",
+      render: (s) => <span style={{ color: c.muted }}>{s.acr ?? "—"}</span>,
+    },
+    { key: "issued", header: "Started", render: (s) => <When iso={s.issuedAt} /> },
+    { key: "expires", header: "Expires", render: (s) => <When iso={s.expiresAt} /> },
+    {
+      key: "actions",
+      header: "",
+      render: (s) => (
+        <div style={{ minWidth: 180 }}>
+          <Destructive<Session>
+            label="Revoke"
+            preview={async () => s}
+            renderPreview={(p) => (
+              <>
+                <strong>
+                  {p.id === current
+                    ? "This is the session this console is using."
+                    : "Revoking this session signs it out immediately."}
+                </strong>
+                <span>
+                  {p.id === current
+                    ? "Revoking it signs you out here. You will need to authenticate again " +
+                      "before this console can do anything else."
+                    : "Whatever is using it stops being able to act at this agent until it " +
+                      "authenticates again."}
+                </span>
+              </>
+            )}
+            commit={async () => {
+              await sessionRevoke(managerSender, { ...parties, sessionId: s.id });
+            }}
+            onDone={list.reload}
+          />
+        </div>
+      ),
+    },
+  ];
+
+  return (
+    <div style={{ display: "grid", gap: 16, alignContent: "start" }}>
+      <Panel
+        title="Your sessions"
+        description="Every session authenticated as you at this agent. Your agent also knows
+          about other people's; this list is deliberately not that one, so an empty result here
+          says nothing about anybody else."
+      >
+        {list.error && <LoadError what="your sessions" error={list.error} />}
+        {list.loading && !list.data && <Loading what="your sessions" />}
+        {list.data && (
+          <Table
+            columns={columns}
+            rows={list.data}
+            rowKey={(s) => s.id}
+            empty="Your agent reports no sessions for you — including, apparently, the one this
+              console is using, which is worth a second look."
+          />
+        )}
+        {list.data && list.data.length > 1 && (
+          <Note tone="warn">
+            More than one session is signed in as you. That is normal if you use several devices,
+            and worth a look if you do not.
+          </Note>
+        )}
+      </Panel>
+    </div>
+  );
+}
diff --git a/packages/extension/src/manager/sender.ts b/packages/extension/src/manager/sender.ts
new file mode 100644
index 0000000..da2001f
--- /dev/null
+++ b/packages/extension/src/manager/sender.ts
@@ -0,0 +1,43 @@
+/// <reference types="chrome" />
+
+// The console's `TrustTaskSender` — the chrome-facing half.
+//
+// All the reasoning about what may cross the bridge, and what a consent refusal
+// means, lives in `carrier.ts`, which is free of relative imports so it can be
+// unit-tested in plain Node. This file is the wiring: put the two permitted
+// members on a runtime message, and interpret what comes back.
+//
+// What routing through the wallet's own relay buys, with no change to
+// `offscreen.ts`: transport selection and fallback (TSP > DIDComm > REST),
+// `TransportHealth` recording, outbound signing, and the same-browser approver
+// ceremony on a `consentRequired`.
+
+import type { SendOpts, TrustTask, TrustTaskSender } from "@openvtc/pnm-core";
+import { RUNTIME_MANAGER_TASK, type RuntimeManagerTaskResponse } from "../bridge-protocol.js";
+import { sendToBackground } from "../send-message.js";
+import { carrierParams, interpretOutcome } from "./carrier.js";
+
+/**
+ * A `TrustTaskSender` backed by the wallet's runtime bridge.
+ *
+ * Stateless and cheap — construct one per pane or share one, it makes no
+ * difference. The session it ultimately runs on is the offscreen document's
+ * warm one, pooled there and shared with the wallet's own traffic.
+ */
+export class ManagerTaskSender implements TrustTaskSender {
+  async send<Res>(envelope: TrustTask<unknown>, opts?: SendOpts): Promise<Res> {
+    const reply = await sendToBackground<RuntimeManagerTaskResponse>({
+      type: RUNTIME_MANAGER_TASK,
+      // The carrier is unpacked here and nowhere else.
+      params: carrierParams(envelope),
+    });
+    return interpretOutcome<Res>(
+      envelope.type,
+      opts?.operationLabel ?? envelope.type,
+      reply,
+    );
+  }
+}
+
+/** One shared instance; the class holds nothing worth having twice. */
+export const managerSender = new ManagerTaskSender();
diff --git a/packages/extension/src/manager/shell.tsx b/packages/extension/src/manager/shell.tsx
new file mode 100644
index 0000000..8706d8c
--- /dev/null
+++ b/packages/extension/src/manager/shell.tsx
@@ -0,0 +1,343 @@
+/// <reference types="chrome" />
+
+// The console shell: act rail, context tree, pane.
+//
+// Three columns, and the middle one is the idea. Sections answer "what am I
+// looking at"; the context tree answers "about which compartment", and it
+// persists across sections because `contextId` is a filter on Keys, DIDs,
+// Access and Audit alike. Folding the tree into a Contexts *page* would force
+// the operator to re-answer the second question every time they changed the
+// first.
+//
+// Routing is on `location.hash`, matching `app-shell.tsx`, so a pane is
+// linkable and a reload lands where the operator was.
+
+import { useCallback, useEffect, useMemo, useState } from "react";
+import { contextsList, type ContextRecord } from "@openvtc/pnm-core";
+import { c, t } from "../theme.js";
+import { Note } from "../ui.js";
+import { ContextTree, type ContextSelection } from "./context-column.js";
+import { WhoamiBanner } from "./whoami-banner.js";
+import { ContextsPane } from "./panes/contexts.js";
+import { KeysPane } from "./panes/keys.js";
+import { DidsPane } from "./panes/dids.js";
+import { AccessPane } from "./panes/access.js";
+import { SessionsPane } from "./panes/sessions.js";
+import { ApprovalsPane } from "./panes/approvals.js";
+import { PolicyPane } from "./panes/policy.js";
+import { ServicesPane } from "./panes/services.js";
+import { AuditPane } from "./panes/audit.js";
+import { managerSender } from "./sender.js";
+import { useVta, type Parties } from "./use-vta.js";
+
+/** Section ids double as the URL hash. */
+export type SectionId =
+  | "contexts"
+  | "keys"
+  | "dids"
+  | "services"
+  | "audit"
+  | "access"
+  | "sessions"
+  | "approvals"
+  | "policy";
+
+interface Act {
+  title: string;
+  /** CSS custom property holding this act's colour. */
+  colour: string;
+  soft: string;
+  sections: { id: SectionId; label: string }[];
+}
+
+// The deck's three acts. The grouping is not decorative — each answers a
+// different question, and the colour is how the rail says which one you are in.
+const ACTS: Act[] = [
+  {
+    title: "Identity & custody",
+    colour: "var(--m-act-identity)",
+    soft: "var(--m-act-identity-soft)",
+    sections: [
+      { id: "contexts", label: "Contexts" },
+      { id: "keys", label: "Keys" },
+      { id: "dids", label: "DIDs" },
+    ],
+  },
+  {
+    title: "Wire & execution",
+    colour: "var(--m-act-wire)",
+    soft: "var(--m-act-wire-soft)",
+    sections: [
+      { id: "services", label: "Transports" },
+      { id: "audit", label: "Audit" },
+    ],
+  },
+  {
+    title: "Authority & graph",
+    colour: "var(--m-act-graph)",
+    soft: "var(--m-act-graph-soft)",
+    sections: [
+      { id: "access", label: "Access" },
+      { id: "approvals", label: "Approvals" },
+      { id: "policy", label: "Policy" },
+      { id: "sessions", label: "Sessions" },
+    ],
+  },
+];
+
+function sectionFromHash(): SectionId {
+  const raw = location.hash.replace(/^#/, "");
+  const known = ACTS.flatMap((a) => a.sections.map((s) => s.id));
+  return (known as string[]).includes(raw) ? (raw as SectionId) : "contexts";
+}
+
+function ActRail({
+  section,
+  onSelect,
+}: {
+  section: SectionId;
+  onSelect: (id: SectionId) => void;
+}) {
+  return (
+    <nav
+      aria-label="Sections"
+      style={{
+        background: "var(--m-rail)",
+        borderRight: `1px solid ${c.line}`,
+        overflowY: "auto",
+        padding: "12px 0",
+        display: "grid",
+        gridAutoRows: "min-content",
+        gap: 14,
+      }}
+    >
+      {ACTS.map((act) => (
+        <div key={act.title} style={{ borderLeft: `4px solid ${act.colour}`, paddingLeft: 11 }}>
+          <h2
+            style={{
+              margin: "0 0 5px",
+              fontSize: t.xs,
+              textTransform: "uppercase",
+              letterSpacing: 0.5,
+              // The act's own colour, not a neutral. The rail is the only thing
+              // saying which of the three questions a section answers, and a
+              // 4px edge alone is too quiet to carry it.
+              color: act.colour,
+              fontWeight: 640,
+            }}
+          >
+            {act.title}
+          </h2>
+          {act.sections.map((s) => {
+            const active = s.id === section;
+            return (
+              <button
+                key={s.id}
+                onClick={() => onSelect(s.id)}
+                aria-current={active ? "page" : undefined}
+                style={{
+                  display: "block",
+                  width: "calc(100% - 10px)",
+                  textAlign: "left",
+                  border: "none",
+                  borderRadius: "var(--w-r-sm)",
+                  padding: "6px 9px",
+                  margin: "1px 0",
+                  cursor: "pointer",
+                  background: active ? act.soft : "transparent",
+                  color: active ? act.colour : c.text,
+                  fontSize: t.sm,
+                  fontWeight: active ? 640 : 440,
+                }}
+              >
+                {s.label}
+              </button>
+            );
+          })}
+        </div>
+      ))}
+    </nav>
+  );
+}
+
+/** Contexts are fetched once here and handed to both the tree and the pane, so
+ *  a rename cannot leave the two showing different names for one context. */
+function useContexts(parties: Parties | null) {
+  const [records, setRecords] = useState<ContextRecord[]>([]);
+  const [loading, setLoading] = useState(true);
+  const [error, setError] = useState<string | null>(null);
+
+  const reload = useCallback(async () => {
+    if (!parties) return;
+    setLoading(true);
+    setError(null);
+    try {
+      setRecords(await contextsList(managerSender, parties));
+    } catch (e) {
+      setError(e instanceof Error ? e.message : String(e));
+    } finally {
+      setLoading(false);
+    }
+  }, [parties]);
+
+  useEffect(() => {
+    void reload();
+  }, [reload]);
+
+  return { records, loading, error, reload };
+}
+
+export function ManagerShell() {
+  const vta = useVta();
+  const [section, setSection] = useState<SectionId>(sectionFromHash);
+  const [selected, setSelected] = useState<ContextSelection>(null);
+
+  useEffect(() => {
+    const onHash = () => setSection(sectionFromHash());
+    addEventListener("hashchange", onHash);
+    return () => removeEventListener("hashchange", onHash);
+  }, []);
+
+  const go = useCallback((id: SectionId) => {
+    location.hash = id;
+    setSection(id);
+  }, []);
+
+  const parties = vta.status === "ready" ? vta.parties : null;
+  const contexts = useContexts(parties);
+
+  // Every mutation refetches both: the records that were changed, and the
+  // authority that change may have altered.
+  const onChanged = useCallback(() => {
+    void contexts.reload();
+    void vta.refreshAuthority();
+  }, [contexts, vta]);
+
+  const body = useMemo(() => {
+    if (vta.status !== "ready" || !parties) return null;
+    switch (section) {
+      case "contexts":
+        return (
+          <ContextsPane
+            parties={parties}
+            authority={vta.authority}
+            records={contexts.records}
+            selected={selected}
+            onChanged={onChanged}
+          />
+        );
+      case "keys":
+        return <KeysPane parties={parties} authority={vta.authority} contextId={selected} />;
+      case "dids":
+        return <DidsPane parties={parties} authority={vta.authority} contextId={selected} />;
+      case "services":
+        return <ServicesPane parties={parties} authority={vta.authority} />;
+      case "audit":
+        return <AuditPane parties={parties} contextId={selected} />;
+      case "access":
+        return <AccessPane parties={parties} authority={vta.authority} contextId={selected} />;
+      case "approvals":
+        return <ApprovalsPane parties={parties} authority={vta.authority} contextId={selected} />;
+      case "policy":
+        return <PolicyPane parties={parties} authority={vta.authority} contextId={selected} />;
+      case "sessions":
+        return <SessionsPane parties={parties} authority={vta.authority} />;
+    }
+  }, [vta, parties, section, contexts.records, selected, onChanged]);
+
+  if (vta.status === "loading") {
+    return <Centered>Reading your wallet's connection…</Centered>;
+  }
+
+  if (vta.status === "disconnected") {
+    return (
+      <Centered>
+        <div style={{ display: "grid", gap: 12, maxWidth: "60ch" }}>
+          <strong style={{ fontSize: t.md }}>No agent connected</strong>
+          <span style={{ color: c.muted, lineHeight: 1.6 }}>
+            This console administers the agent your wallet is onboarded with, and there isn't one
+            yet. Open the wallet's setup and connect an agent first.
+          </span>
+          <div>
+            <button
+              onClick={() => void chrome.tabs.create({ url: chrome.runtime.getURL("options.html#setup") })}
+              style={{
+                border: `1px solid ${c.line}`,
+                background: c.accent,
+                color: "var(--w-accent-ink)",
+                borderRadius: "var(--w-r-sm)",
+                padding: "7px 13px",
+                fontSize: t.sm,
+                cursor: "pointer",
+              }}
+            >
+              Open wallet setup
+            </button>
+          </div>
+        </div>
+      </Centered>
+    );
+  }
+
+  return (
+    <div
+      style={{
+        height: "100%",
+        display: "grid",
+        gridTemplateColumns: "186px 244px minmax(0, 1fr)",
+        gridTemplateRows: "auto minmax(0, 1fr)",
+        gridTemplateAreas: `"rail tree banner" "rail tree pane"`,
+      }}
+    >
+      <div style={{ gridArea: "rail", minHeight: 0 }}>
+        <ActRail section={section} onSelect={go} />
+      </div>
+
+      <div style={{ gridArea: "tree", minHeight: 0, display: "grid" }}>
+        <ContextTree
+          records={contexts.records}
+          selected={selected}
+          onSelect={setSelected}
+          loading={contexts.loading}
+          error={contexts.error}
+        />
+      </div>
+
+      <div style={{ gridArea: "banner" }}>
+        <WhoamiBanner
+          agentDid={vta.parties.service.did}
+          authority={vta.authority}
+          error={vta.authorityError}
+        />
+      </div>
+
+      <main style={{ gridArea: "pane", overflowY: "auto", padding: "20px 24px", minWidth: 0 }}>
+        {contexts.error && (
+          <div style={{ marginBottom: 16 }}>
+            <Note tone="danger">
+              Your agent would not list contexts — {contexts.error}
+            </Note>
+          </div>
+        )}
+        {body}
+      </main>
+    </div>
+  );
+}
+
+function Centered({ children }: { children: React.ReactNode }) {
+  return (
+    <div
+      style={{
+        height: "100%",
+        display: "grid",
+        placeItems: "center",
+        padding: 32,
+        fontSize: t.base,
+        color: c.text,
+      }}
+    >
+      {children}
+    </div>
+  );
+}
diff --git a/packages/extension/src/manager/table.tsx b/packages/extension/src/manager/table.tsx
new file mode 100644
index 0000000..409b484
--- /dev/null
+++ b/packages/extension/src/manager/table.tsx
@@ -0,0 +1,169 @@
+// The console's list vocabulary.
+//
+// Nine panes render "a list of records the agent holds", and each one has the
+// same three states worth distinguishing — loading, the agent refused, and the
+// agent answered with nothing. Written per-pane those collapse: an empty array
+// and a failed call both render as no rows, and the operator reads "you have no
+// keys" off a permission error.
+//
+// So the states are separated here, once, and each says something different.
+
+import type { ReactNode } from "react";
+import { c, t } from "../theme.js";
+import { Note } from "../ui.js";
+
+export interface Column<R> {
+  key: string;
+  header: string;
+  /** Column width; omit to let it take its share. */
+  width?: string;
+  render: (row: R) => ReactNode;
+}
+
+export function Table<R>({
+  columns,
+  rows,
+  rowKey,
+  empty,
+}: {
+  columns: Column<R>[];
+  rows: R[];
+  rowKey: (row: R) => string;
+  /** What would appear here. An empty state is a chance to explain, so this is
+   *  required rather than defaulting to "None". */
+  empty: ReactNode;
+}) {
+  if (rows.length === 0) {
+    return (
+      <div style={{ fontSize: t.sm, color: c.faint, padding: "10px 0", lineHeight: 1.55 }}>
+        {empty}
+      </div>
+    );
+  }
+  return (
+    // Wide tables scroll inside their own box rather than pushing the page
+    // sideways — a DID column is wider than any pane.
+    <div style={{ overflowX: "auto" }}>
+      <table
+        style={{
+          borderCollapse: "collapse",
+          width: "100%",
+          // A floor, not a width. Without it a wide cell — a destructive
+          // preview opening inside the actions column — steals space from
+          // the identifier columns and wraps DIDs mid-token. The container
+          // scrolls instead, which is the tradeoff already chosen above.
+          minWidth: 760,
+          fontSize: t.sm,
+        }}
+      >
+        <thead>
+          <tr>
+            {columns.map((col) => (
+              <th
+                key={col.key}
+                style={{
+                  textAlign: "left",
+                  padding: "6px 12px 6px 0",
+                  borderBottom: `1px solid ${c.line}`,
+                  color: c.faint,
+                  fontSize: t.xs,
+                  textTransform: "uppercase",
+                  letterSpacing: 0.4,
+                  fontWeight: 640,
+                  whiteSpace: "nowrap",
+                  ...(col.width ? { width: col.width } : {}),
+                }}
+              >
+                {col.header}
+              </th>
+            ))}
+          </tr>
+        </thead>
+        <tbody>
+          {rows.map((row) => (
+            <tr key={rowKey(row)}>
+              {columns.map((col) => (
+                <td
+                  key={col.key}
+                  style={{
+                    padding: "7px 12px 7px 0",
+                    borderBottom: `1px solid ${c.lineSoft}`,
+                    verticalAlign: "top",
+                  }}
+                >
+                  {col.render(row)}
+                </td>
+              ))}
+            </tr>
+          ))}
+        </tbody>
+      </table>
+    </div>
+  );
+}
+
+/** The agent is being asked. Distinct from "answered with nothing". */
+export function Loading({ what }: { what: string }) {
+  return <div style={{ fontSize: t.sm, color: c.faint, padding: "10px 0" }}>Reading {what}…</div>;
+}
+
+/**
+ * The agent refused, or could not be reached.
+ *
+ * Rendered as a note rather than an empty list, because the two mean opposite
+ * things: "you have none" and "we could not find out" are different answers,
+ * and only one of them should stop an operator worrying.
+ */
+export function LoadError({ what, error }: { what: string; error: string }) {
+  return (
+    <Note tone="danger">
+      Your agent would not return {what} — {error}
+    </Note>
+  );
+}
+
+/**
+ * A page that stopped early.
+ *
+ * Worth its own component because the failure it prevents is specific: an
+ * operator reading "nothing else happened" off a truncated list. `auditList`'s
+ * own documentation is explicit that this is what an audit trail exists to
+ * prevent.
+ */
+export function Truncated({ what, onMore }: { what: string; onMore?: () => void }) {
+  return (
+    <Note tone="warn">
+      This is not all of {what} — your agent stopped early.{" "}
+      {onMore ? (
+        <button
+          onClick={onMore}
+          style={{
+            border: "none",
+            background: "none",
+            padding: 0,
+            color: c.accent,
+            cursor: "pointer",
+            font: "inherit",
+            textDecoration: "underline",
+          }}
+        >
+          Load more
+        </button>
+      ) : (
+        "Narrow the filters to see the rest."
+      )}
+    </Note>
+  );
+}
+
+/** A redaction list from the agent, shown rather than silently ignored — a
+ *  field the agent withheld is not a field that is absent. */
+export function Redacted({ fields }: { fields: string[] }) {
+  if (fields.length === 0) return null;
+  return (
+    <Note tone="warn">
+      Your agent withheld {fields.join(", ")} from this answer. What you see is complete except
+      for those.
+    </Note>
+  );
+}
diff --git a/packages/extension/src/manager/use-async.ts b/packages/extension/src/manager/use-async.ts
new file mode 100644
index 0000000..368cab2
--- /dev/null
+++ b/packages/extension/src/manager/use-async.ts
@@ -0,0 +1,59 @@
+// One fetch-and-reload hook for the panes.
+//
+// The three states are kept separate on purpose — see `table.tsx`. `data`
+// stays `null` until the agent answers, so "not asked yet" and "answered with
+// an empty list" are never the same value; a pane that defaulted `data` to `[]`
+// would render its empty state during the first load and tell the operator they
+// have no keys before anyone had asked.
+
+import { useCallback, useEffect, useState } from "react";
+
+export interface Async<T> {
+  data: T | null;
+  loading: boolean;
+  error: string | null;
+  reload: () => void;
+}
+
+/**
+ * Run `fetcher` on mount and whenever `deps` change.
+ *
+ * `fetcher` must be stable or memoised by the caller; `deps` is what actually
+ * drives re-fetching, and in this console it is nearly always the selected
+ * context id — changing the compartment is what changes the question.
+ */
+export function useAsync<T>(fetcher: () => Promise<T>, deps: readonly unknown[]): Async<T> {
+  const [data, setData] = useState<T | null>(null);
+  const [loading, setLoading] = useState(true);
+  const [error, setError] = useState<string | null>(null);
+  const [nonce, setNonce] = useState(0);
+
+  // eslint-disable-next-line react-hooks/exhaustive-deps
+  const run = useCallback(fetcher, deps);
+
+  useEffect(() => {
+    let live = true;
+    setLoading(true);
+    setError(null);
+    void run().then(
+      (value) => {
+        if (!live) return;
+        setData(value);
+        setLoading(false);
+      },
+      (e: unknown) => {
+        if (!live) return;
+        // The previous answer is deliberately kept. A refresh that fails should
+        // not blank a list the operator is reading — the error says the data is
+        // stale, which is more useful than an empty page that says nothing.
+        setError(e instanceof Error ? e.message : String(e));
+        setLoading(false);
+      },
+    );
+    return () => {
+      live = false;
+    };
+  }, [run, nonce]);
+
+  return { data, loading, error, reload: useCallback(() => setNonce((n) => n + 1), []) };
+}
diff --git a/packages/extension/src/manager/use-vta.ts b/packages/extension/src/manager/use-vta.ts
new file mode 100644
index 0000000..807729d
--- /dev/null
+++ b/packages/extension/src/manager/use-vta.ts
@@ -0,0 +1,108 @@
+/// <reference types="chrome" />
+
+// Which agent this console is administering, and what it may do there.
+//
+// Two separate questions, deliberately answered by two different places:
+//
+//  - **Which agent** comes from `chrome.storage.local` (`active-vta.ts`), the
+//    same connection record the popup and background read. The console does not
+//    get its own notion of "the active VTA"; a second one would drift.
+//
+//  - **What this caller may do** comes from the agent itself, via `whoAmI`, and
+//    is never inferred from anything stored locally. That is the whole point of
+//    the task: it re-resolves roles and scopes at call time rather than reading
+//    them out of an access token, so a role granted or revoked since the token
+//    was minted shows up immediately. A console that cached authority would
+//    show an operator buttons they can no longer use, and — worse — hide ones
+//    they just gained.
+
+import { useCallback, useEffect, useState } from "react";
+import type { TaskParty } from "@openvtc/pnm-core";
+import { whoAmI, type Session } from "@openvtc/pnm-core/admin";
+import { readActiveHolderDid, readActiveVtaDid } from "../active-vta.js";
+import { managerSender } from "./sender.js";
+
+/** The two DIDs an admin envelope names. See `TaskParty` in core for why this
+ *  is the whole of what the console needs — composing a document requires no
+ *  key material, and the console holds none. */
+export interface Parties {
+  holder: TaskParty;
+  service: TaskParty;
+}
+
+export interface Authority {
+  session: Session;
+  roles: string[];
+  scopes: string[];
+}
+
+export type VtaState =
+  | { status: "loading" }
+  /** No agent onboarded, or the connection record is gone. Not an error — a
+   *  fresh install looks exactly like this, and the console says so. */
+  | { status: "disconnected" }
+  | { status: "ready"; parties: Parties; authority: Authority | null; authorityError: string | null };
+
+/**
+ * Resolve the active agent and this caller's authority at it.
+ *
+ * `refreshAuthority` is exported deliberately: **every mutation calls it**. An
+ * `acl/change-role` or a `contexts/create` can change what the caller may do
+ * next, and the honest moment to find that out is immediately after the change,
+ * not on the next full page load.
+ */
+export function useVta(): VtaState & { refreshAuthority: () => Promise<void> } {
+  const [state, setState] = useState<VtaState>({ status: "loading" });
+
+  const loadAuthority = useCallback(async (parties: Parties) => {
+    try {
+      const authority = await whoAmI(managerSender, parties);
+      setState({ status: "ready", parties, authority, authorityError: null });
+    } catch (e) {
+      // An ACL rejection here is an *answer*, not a glitch: the caller really
+      // has no authority at this agent. Keep the console open and say so —
+      // blanking the page would leave an operator unable to see even which
+      // agent they are failing to reach.
+      setState({
+        status: "ready",
+        parties,
+        authority: null,
+        authorityError: e instanceof Error ? e.message : String(e),
+      });
+    }
+  }, []);
+
+  useEffect(() => {
+    void (async () => {
+      const [vtaDid, holderDid] = await Promise.all([readActiveVtaDid(), readActiveHolderDid()]);
+      if (!vtaDid || !holderDid) {
+        setState({ status: "disconnected" });
+        return;
+      }
+      const parties: Parties = { holder: { did: holderDid }, service: { did: vtaDid } };
+      setState({ status: "ready", parties, authority: null, authorityError: null });
+      await loadAuthority(parties);
+    })();
+  }, [loadAuthority]);
+
+  const refreshAuthority = useCallback(async () => {
+    if (state.status !== "ready") return;
+    await loadAuthority(state.parties);
+  }, [state, loadAuthority]);
+
+  return { ...state, refreshAuthority };
+}
+
+/**
+ * Whether the agent has told us this caller holds `role`.
+ *
+ * Used to *disable and explain*, never to hide. A hidden control tells an
+ * operator their agent has no such feature; a disabled one with a reason tells
+ * them who to ask. And it is advisory in both cases — the agent's ACL is the
+ * only authority that decides, and it decides again on every task regardless of
+ * what this returns.
+ */
+export function hasRole(authority: Authority | null, ...roles: string[]): boolean {
+  if (!authority) return false;
+  return roles.some((r) => authority.roles.includes(r));
+}
diff --git a/packages/extension/src/manager/whoami-banner.tsx b/packages/extension/src/manager/whoami-banner.tsx
new file mode 100644
index 0000000..2e03d86
--- /dev/null
+++ b/packages/extension/src/manager/whoami-banner.tsx
@@ -0,0 +1,98 @@
+// Who this console is, to this agent.
+//
+// Always visible, and refetched after every mutation. `whoAmI` re-resolves
+// roles and scopes at call time rather than reading them out of the access
+// token — a role change or a revocation since the token was minted is visible
+// immediately, and that is the only reason to call it at all. Pinning it to the
+// top of every pane means an operator never has to wonder which identity a
+// change they are about to make will be attributed to.
+
+import { Did, Pill } from "../ui.js";
+import { c, t } from "../theme.js";
+import type { Authority } from "./use-vta.js";
+
+function Field({ label, children }: { label: string; children: React.ReactNode }) {
+  return (
+    <div style={{ display: "grid", gap: 2, minWidth: 0 }}>
+      <span style={{ fontSize: t.xs, color: c.faint, textTransform: "uppercase", letterSpacing: 0.4 }}>
+        {label}
+      </span>
+      <span style={{ fontSize: t.sm, color: c.text, minWidth: 0 }}>{children}</span>
+    </div>
+  );
+}
+
+export function WhoamiBanner({
+  agentDid,
+  authority,
+  error,
+}: {
+  agentDid: string;
+  authority: Authority | null;
+  error: string | null;
+}) {
+  return (
+    <header
+      style={{
+        display: "flex",
+        alignItems: "center",
+        gap: 28,
+        flexWrap: "wrap",
+        padding: "12px 22px",
+        borderBottom: `1px solid ${c.line}`,
+        background: c.surface,
+      }}
+    >
+      <Field label="Agent">
+        <Did value={agentDid} />
+      </Field>
+
+      {authority ? (
+        <>
+          <Field label="Acting as">
+            <Did value={authority.session.subject} />
+          </Field>
+          <Field label="Roles">
+            {authority.roles.length ? (
+              <span style={{ display: "inline-flex", gap: 5, flexWrap: "wrap" }}>
+                {authority.roles.map((r) => (
+                  <Pill key={r} tone="accent">
+                    {r}
+                  </Pill>
+                ))}
+              </span>
+            ) : (
+              // Not the same as "unknown". The agent answered, and the answer
+              // was none — so every manage-gated task below will be refused,
+              // and saying so here is cheaper than thirteen refusals.
+              <span style={{ color: c.warn }}>none held at this agent</span>
+            )}
+          </Field>
+          <Field label="Scopes">
+            <span style={{ color: c.muted }}>
+              {authority.scopes.length ? authority.scopes.join(" · ") : "—"}
+            </span>
+          </Field>
+          <Field label="Session expires">
+            <span style={{ color: c.muted }}>
+              {new Date(authority.session.expiresAt).toLocaleString()}
+            </span>
+          </Field>
+        </>
+      ) : error ? (
+        // An ACL rejection is an answer: this caller's authority really is
+        // gone, or was never granted. Say which agent refused, and stop short
+        // of guessing why.
+        <Field label="Authority">
+          <span style={{ color: c.danger }}>
+            The agent would not introspect this session — {error}
+          </span>
+        </Field>
+      ) : (
+        <Field label="Authority">
+          <span style={{ color: c.faint }}>resolving…</span>
+        </Field>
+      )}
+    </header>
+  );
+}
diff --git a/packages/extension/tests/manager-context-tree.test.mts b/packages/extension/tests/manager-context-tree.test.mts
new file mode 100644
index 0000000..7180dd5
--- /dev/null
+++ b/packages/extension/tests/manager-context-tree.test.mts
@@ -0,0 +1,115 @@
+// The context tree — and specifically, that an unreachable parent does not
+// swallow its children.
+//
+// A caller sees the contexts their ACL entries reach, and those entries are not
+// obliged to cover a whole subtree: `work/eng` can be granted without `work`.
+// The obvious tree build (index by id, attach to `byId[parent]`, keep what
+// attached) drops exactly those children, and does it invisibly — the console
+// renders a shorter, entirely plausible tree and the operator concludes they
+// have no access to a context they are in fact administering.
+
+import { test } from "node:test";
+import assert from "node:assert/strict";
+import {
+  buildContextTree,
+  flattenContextTree,
+  type ContextNode,
+} from "../src/manager/context-tree.ts";
+import type { ContextRecord } from "@openvtc/pnm-core";
+
+const ctx = (
+  id: string,
+  extra: Partial<ContextRecord> = {},
+): ContextRecord => ({
+  id,
+  name: id,
+  did: null,
+  description: null,
+  basePath: id,
+  createdAt: "2026-01-01T00:00:00Z",
+  updatedAt: "2026-01-01T00:00:00Z",
+  ...extra,
+});
+
+/** Ids in depth-first order, with placeholders shown as `?name`. */
+function shape(nodes: ContextNode[]): string[] {
+  const out: string[] = [];
+  const walk = (n: ContextNode, depth: number) => {
+    out.push(`${"  ".repeat(depth)}${n.record ? n.id : `?${n.name}`}`);
+    for (const c of n.children) walk(c, depth + 1);
+  };
+  for (const n of nodes) walk(n, 0);
+  return out;
+}
+
+test("nests children under the parent they name", () => {
+  const tree = buildContextTree([
+    ctx("work"),
+    ctx("eng", { parent: "work", basePath: "work/eng" }),
+    ctx("payroll", { parent: "work", basePath: "work/payroll" }),
+    ctx("personal"),
+  ]);
+  assert.deepEqual(shape(tree), ["personal", "work", "  eng", "  payroll"]);
+});
+
+test("a child whose parent is not visible is still shown", () => {
+  // The caller administers work/eng but holds no grant on work itself.
+  const tree = buildContextTree([ctx("eng", { parent: "work", basePath: "work/eng" })]);
+  assert.deepEqual(
+    shape(tree),
+    ["?work", "  eng"],
+    "the reachable child was dropped along with its unreachable parent",
+  );
+});
+
+test("siblings under one unreachable parent share a single placeholder", () => {
+  const tree = buildContextTree([
+    ctx("eng", { parent: "work", basePath: "work/eng" }),
+    ctx("payroll", { parent: "work", basePath: "work/payroll" }),
+  ]);
+  assert.deepEqual(shape(tree), ["?work", "  eng", "  payroll"]);
+});
+
+test("a placeholder carries no record, so nothing can be done to it", () => {
+  const [placeholder] = buildContextTree([ctx("eng", { parent: "work" })]);
+  assert.equal(placeholder!.record, undefined);
+  assert.equal(placeholder!.id, undefined, "a placeholder with an id would become selectable");
+});
+
+test("ordering is by name at every level, so the tree does not reshuffle", () => {
+  const tree = buildContextTree([
+    ctx("zeta"),
+    ctx("alpha"),
+    ctx("b", { parent: "alpha" }),
+    ctx("a", { parent: "alpha" }),
+  ]);
+  assert.deepEqual(shape(tree), ["alpha", "  a", "  b", "zeta"]);
+});
+
+test("a record with no name falls back to its id rather than rendering blank", () => {
+  const [node] = buildContextTree([ctx("work", { name: "" })]);
+  assert.equal(node!.name, "work");
+});
+
+test("collapsing hides descendants and nothing else", () => {
+  const tree = buildContextTree([
+    ctx("work"),
+    ctx("eng", { parent: "work" }),
+    ctx("personal"),
+  ]);
+  const rows = flattenContextTree(tree, new Set(["work"]));
+  assert.deepEqual(
+    rows.map((r) => r.node.id ?? `?${r.node.name}`),
+    ["personal", "work"],
+  );
+  assert.equal(rows.find((r) => r.node.id === "work")?.hasChildren, true);
+});
+
+test("an unreachable parent cannot be collapsed", () => {
+  // It has no id, so there is no key to put in the collapsed set — which is the
+  // point: hiding the placeholder would hide the reachable children it exists
+  // to reveal.
+  const tree = buildContextTree([ctx("eng", { parent: "work" })]);
+  const rows = flattenContextTree(tree, new Set(["work", "eng"]));
+  assert.deepEqual(rows.map((r) => r.node.id ?? `?${r.node.name}`), ["?work", "eng"]);
+});
diff --git a/packages/extension/tests/manager-sender.test.mts b/packages/extension/tests/manager-sender.test.mts
new file mode 100644
index 0000000..da0c106
--- /dev/null
+++ b/packages/extension/tests/manager-sender.test.mts
@@ -0,0 +1,149 @@
+// What crosses the bridge when the console runs an admin task, and what must
+// not.
+//
+// The console composes admin tasks with the `@openvtc/pnm-core/admin` helpers,
+// which build a canonical envelope and hand it to `sender.send`. That envelope
+// is a **carrier**: only its `type` and `payload` may travel. The device mints
+// the real one — id, issuedAt, issuer, recipient — inside the wallet's trust
+// boundary, and the channel signs it.
+//
+// If the carrier's parties ever reach the wire, the wallet is signing a
+// document composed somewhere else and attesting to fields it never checked.
+// That the composer is an extension page rather than a web page does not change
+// what the signature would be claiming — which is why this is pinned here,
+// rather than left resting on the fact that today's background handler happens
+// to ignore them.
+
+import { test } from "node:test";
+import assert from "node:assert/strict";
+import {
+  ConsentRequiredError,
+  carrierParams,
+  interpretOutcome,
+} from "../src/manager/carrier.ts";
+
+/** A carrier with every authority-bearing field populated, and deliberately
+ *  populated *wrongly* — if any of it survives, the assertions say which. */
+const carrier = {
+  id: "urn:uuid:carrier-chosen-id",
+  type: "https://trusttasks.org/spec/acl/grant/0.1",
+  issuer: "did:key:zATTACKER",
+  recipient: "did:key:zSOMEONE-ELSES-AGENT",
+  issuedAt: "1999-01-01T00:00:00Z",
+  expiresAt: "2999-01-01T00:00:00Z",
+  threadId: "urn:uuid:carrier-chosen-thread",
+  payload: { entry: { subject: "did:key:zSUBJECT", role: "admin" } },
+};
+
+test("keeps the task type and payload", () => {
+  assert.deepEqual(carrierParams(carrier), {
+    type: carrier.type,
+    payload: carrier.payload,
+  });
+});
+
+test("drops every authority-bearing field", () => {
+  const wire = JSON.stringify(carrierParams(carrier));
+  for (const forged of [
+    carrier.id,
+    carrier.issuer,
+    carrier.recipient,
+    carrier.issuedAt,
+    carrier.expiresAt,
+    carrier.threadId,
+  ]) {
+    assert.ok(
+      !wire.includes(forged),
+      `the carrier's "${forged}" survived. Only type and payload may travel — the device ` +
+        "mints the envelope, and a wallet that signs a document composed elsewhere " +
+        "attests to fields it never checked.",
+    );
+  }
+  // Stated positively too, so a future member added to `TrustTask` is caught by
+  // shape rather than by having been listed above.
+  assert.deepEqual(Object.keys(carrierParams(carrier)).sort(), ["payload", "type"]);
+});
+
+test("an absent payload becomes an empty object, not undefined", () => {
+  // `auth/whoami` and friends legitimately send `{}`. Relaying `undefined`
+  // reaches the agent as a missing member and fails schema validation for no
+  // visible reason.
+  assert.deepEqual(carrierParams({ ...carrier, payload: undefined }).payload, {});
+});
+
+test("an accepted outcome yields the agent's result, unwrapped", () => {
+  const res = interpretOutcome<{ entries: number[] }>("t", "acl/list/0.1", {
+    ok: true,
+    result: { kind: "accepted", result: { entries: [1, 2, 3] } },
+  });
+  assert.deepEqual(res, { entries: [1, 2, 3] });
+});
+
+test("a consent refusal throws ConsentRequiredError with the digest intact", () => {
+  const err = (() => {
+    try {
+      interpretOutcome(carrier.type, "acl/grant/0.1", {
+        ok: true,
+        result: {
+          kind: "consentRequired",
+          payloadDigest: "abcdef0123456789",
+          challenge: "chal",
+          approverSet: "set-1",
+          minApprovals: 2,
+          consentRequests: [{ one: 1 }],
+        },
+      });
+      return null;
+    } catch (e) {
+      return e;
+    }
+  })();
+
+  assert.ok(
+    err instanceof ConsentRequiredError,
+    "a consent refusal must be its own class — caught as a plain Error it renders as a red " +
+      "string, discarding the ceremony at the moment the human was meant to act",
+  );
+  assert.equal(err.payloadDigest, "abcdef0123456789");
+  assert.equal(err.minApprovals, 2);
+  assert.equal(err.taskType, carrier.type);
+  assert.deepEqual(err.consentRequests, [{ one: 1 }]);
+});
+
+test("a consent refusal missing its digest still throws the ceremony class", () => {
+  // Degraded, not reclassified: the operator sees an empty match code and can
+  // tell something is wrong, rather than the refusal arriving as a red error
+  // that offers them nothing to do.
+  const err = (() => {
+    try {
+      interpretOutcome("t", "l", { ok: true, result: { kind: "consentRequired" } });
+      return null;
+    } catch (e) {
+      return e;
+    }
+  })();
+  assert.ok(err instanceof ConsentRequiredError);
+  assert.equal(err.payloadDigest, "");
+  assert.equal(err.minApprovals, 1, "a missing count must not read as zero approvals needed");
+});
+
+test("a failed relay throws, naming the operation", () => {
+  assert.throws(
+    () => interpretOutcome("t", "acl/grant/0.1", { ok: false, error: "no active connection" }),
+    /acl\/grant\/0\.1 failed: no active connection/,
+  );
+});
+
+test("an unrecognised outcome is reported, not returned as a result", () => {
+  // A relay that changed shape underneath this file. Returning it would hand a
+  // pane an object whose members all read undefined, which renders as a
+  // convincing empty result.
+  assert.throws(
+    () => interpretOutcome("t", "l", { ok: true, result: { kind: "somethingNew" } }),
+    /outcome this console does not understand/,
+  );
+});
+
+test("a reply with no result at all is reported rather than unwrapped", () => {
+  assert.throws(() => interpretOutcome("t", "l", { ok: true }), /does not understand/);
+});
diff --git a/packages/extension/tests/manager-surface.test.mts b/packages/extension/tests/manager-surface.test.mts
new file mode 100644
index 0000000..40f94df
--- /dev/null
+++ b/packages/extension/tests/manager-surface.test.mts
@@ -0,0 +1,109 @@
+// The management console's relay must not be reachable from a web page.
+//
+// `RUNTIME_MANAGER_TASK` runs admin tasks — granting authority at an agent,
+// revoking it, destroying contexts — and, unlike the page-facing relay, it does
+// not stop to ask a human first. Two things keep a page away from it, and
+// neither fails loudly on its own:
+//
+//  1. It must be absent from `PAGE_FACING_RUNTIME_TYPES`. Membership there is
+//     not a permission grant, but it is the list that says "a page originates
+//     this", and adding it would be the first step of treating it that way.
+//  2. It must be absent from `content.ts`'s dispatch table, which is the only
+//     bridge a page has. The content script inlines its constants by hand (it
+//     bundles as a classic script and cannot import), so nothing but a test
+//     notices a new entry.
+//
+// And the background must gate on the sender being an extension page: every
+// content script carries this extension's id, so `sender.id` cannot separate
+// them and `sender.url` is what does.
+//
+// Reads the sources rather than importing them, the way
+// `page-facing-surface.test.mts` does — `content.ts` touches `chrome` at module
+// scope and `background.ts` registers listeners on import.
+
+import { test } from "node:test";
+import assert from "node:assert/strict";
+import { readFileSync } from "node:fs";
+import { fileURLToPath } from "node:url";
+
+const src = (name: string) =>
+  readFileSync(fileURLToPath(new URL(`../src/${name}`, import.meta.url)), "utf8");
+
+const protocol = src("bridge-protocol.ts");
+const content = src("content.ts");
+const background = src("background.ts");
+
+/** The literal wire value, so the assertions below check the string a message
+ *  actually carries rather than the identifier naming it. */
+const MANAGER_TYPE = "vta-wallet/manager-task";
+
+test("the console's wire type is what bridge-protocol declares", () => {
+  assert.match(
+    protocol,
+    new RegExp(`export const RUNTIME_MANAGER_TASK =\\s*"${MANAGER_TYPE}"`),
+    "RUNTIME_MANAGER_TASK's value changed — every assertion here reads the literal, " +
+      "and the console and background must agree on it",
+  );
+});
+
+test("the console's relay is not page-facing", () => {
+  const m = /export const PAGE_FACING_RUNTIME_TYPES = \[([^\]]*)\]/.exec(protocol);
+  assert.ok(m, "PAGE_FACING_RUNTIME_TYPES not found — this test is reading the wrong shape");
+  const members = m[1]!
+    .split(",")
+    .map((s) => s.replace(/\/\/.*$/gm, "").trim())
+    .filter(Boolean);
+  assert.ok(
+    !members.includes("RUNTIME_MANAGER_TASK"),
+    "RUNTIME_MANAGER_TASK is listed as page-facing. That list is for messages a web page " +
+      "originates; the console's relay runs admin tasks without a per-call human check, " +
+      "and no page may originate one.",
+  );
+});
+
+test("the content script cannot route to the console's relay", () => {
+  assert.ok(
+    !content.includes(MANAGER_TYPE),
+    `content.ts mentions ${MANAGER_TYPE}. The content script is the only bridge a web page ` +
+      "has; a route to the console's relay there hands an arbitrary page the operator's " +
+      "authority.",
+  );
+});
+
+test("the background gates the console's relay on an extension-page sender", () => {
+  // The gate's substance, not its spelling: `sender.id` is true for a content
+  // script too, so the check that matters is against the extension's own URL.
+  assert.match(
+    background,
+    /function isExtensionPageSender\([\s\S]{0,400}?chrome\.runtime\.getURL\(""\)[\s\S]{0,200}?sender\.url[\s\S]{0,80}?startsWith/,
+    "isExtensionPageSender no longer compares sender.url against chrome.runtime.getURL(\"\"). " +
+      "sender.id is shared with every content script and cannot make this distinction.",
+  );
+
+  // …and that the gate is actually applied to this message type, before the
+  // handler runs. An unguarded branch is the failure this whole file exists for.
+  const branch =
+    /RUNTIME_MANAGER_TASK\)\s*\{([\s\S]*?)handleManagerTask/.exec(background);
+  assert.ok(branch, "no dispatch branch for RUNTIME_MANAGER_TASK found in background.ts");
+  assert.match(
+    branch[1]!,
+    /if \(!isExtensionPageSender\(sender\)\)/,
+    "the RUNTIME_MANAGER_TASK branch reaches handleManagerTask without checking " +
+      "isExtensionPageSender first",
+  );
+});
+
+test("the console's relay does not carry a page origin", () => {
+  // `RuntimeRequestTaskRequest` has an `origin` member because a page proposed
+  // the task and the browser's attested origin has to travel with it. The
+  // console's request must NOT: there is no page, and a member here would be a
+  // value the background could read instead of stamping its own.
+  const m = /export interface RuntimeManagerTaskRequest \{([\s\S]*?)\}/.exec(protocol);
+  assert.ok(m, "RuntimeManagerTaskRequest not found");
+  assert.ok(
+    !/\borigin\b/.test(m[1]!),
+    "RuntimeManagerTaskRequest carries an `origin`. The console has no page origin to " +
+      "report; the background stamps the extension's own, and a member here is a claim " +
+      "waiting to be trusted.",
+  );
+});
diff --git a/packages/extension/vite.config.manager.ts b/packages/extension/vite.config.manager.ts
new file mode 100644
index 0000000..75e55e8
--- /dev/null
+++ b/packages/extension/vite.config.manager.ts
@@ -0,0 +1,51 @@
+import { defineConfig } from "vite";
+import react from "@vitejs/plugin-react";
+import wasm from "vite-plugin-wasm";
+import topLevelAwait from "vite-plugin-top-level-await";
+import { resolve } from "node:path";
+
+// Separate build for the management console — the one surface allowed to import
+// `@openvtc/pnm-core/admin`.
+//
+// That module is operator authority: granting it at an agent, revoking it,
+// destroying contexts. CI asserts no admin task URI appears anywhere in `dist/`
+// **except** `manager.js`, and this config is what makes that assertion
+// structural rather than a convention someone has to remember.
+//
+// Two properties do the work, and both would be lost by folding this entry into
+// `vite.config.ts`:
+//
+//  - **Its own Rollup graph.** The main build emits popup, options, confirm and
+//    offscreen together, and Rollup is free to hoist code they share into a
+//    common `assets/*.js` chunk. An admin symbol reaching such a chunk would
+//    land in a file the wallet's surfaces load. Building the console alone
+//    means there is no other entry to share with.
+//  - **`codeSplitting: false`.** One output file, so "which file may contain
+//    admin" has a single answer that a `grep` can check. If this option is ever
+//    lost the build emits extra chunks and the guard fails loudly — which is
+//    the point; the same option protects the service worker for a different
+//    reason (see `vite.config.background.ts`).
+//
+// `emptyOutDir: false` so it does not wipe the main build's output; it runs
+// after both other builds, and the manifest assembly that runs in the main
+// build has already happened by then.
+export default defineConfig({
+  plugins: [react(), wasm(), topLevelAwait()],
+  build: {
+    outDir: "dist",
+    emptyOutDir: false,
+    // es2022 — see vite.config.ts: esbuild 0.28 won't down-level the
+    // top-level-await plugin's destructuring to vite's default targets.
+    target: "es2022",
+    rollupOptions: {
+      input: { manager: resolve(__dirname, "manager.html") },
+      output: {
+        entryFileNames: "manager.js",
+        // Named so the guard can address it, and so a stray second chunk is
+        // visible as `assets/*` rather than hiding among the main build's.
+        chunkFileNames: "manager-split-[name].js",
+        codeSplitting: false,
+      },
+    },
+  },
+});

From 8229305fa2e6e7e7ac73533ecd6eb60c4cb4e1f1 Mon Sep 17 00:00:00 2001
From: Glenn Gore <glenn.g@affinidi.com>
Date: Tue, 1 Sep 2026 14:20:32 +0200
Subject: [PATCH 02/24] fix(console): five things a live agent showed were
 wrong
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

First run against a real VTA. Every one of these was invisible against
stubbed data.

**The context column showed where it filters nothing.** Transports and
Sessions take no `contextId` at all, so selecting a context there looked
like it did something and did nothing — worse than clutter, because it
implies the list on screen was scoped when it never was. Each section now
declares `contextScoped`, and the column and its grid track appear only where
that is true. A new pane has to answer the question, which is the point.

**The console invented an origin, and it broke two panes.** `requestTask`
stamps `payload.ext["openvtc.origin"]` when given an origin, and its contract
says a caller without an attested one should omit it rather than invent one —
the console has no proposing page. Stamping this extension's own put an `ext`
member on every payload, and the agent rejected `acl/list` and `policy/list`
outright with "unknown field `ext`", taking out Access and Policy entirely.
The page path is untouched and still carries its attested origin; both halves
are now pinned by tests.

Worth reporting upstream separately: `ACLListPayload` and `PolicyListPayload`
both declare `ext` in the generated bindings, so those Rust structs have
drifted from the schemas they are generated alongside. SPEC §4.5.1 makes `ext`
legal on any payload. The console no longer depends on that being fixed.

**"SESSION EXPIRES 01/01/1970."** The agent sent no `expiresAt`, and
`new Date(undefined)` renders as the epoch — which reads as a real answer. A
session whose expiry is unknown is not one that expired in 1970, and that
distinction is the entire job of that banner field. Every timestamp now goes
through `formatInstant`/`formatDate`, which say "unknown" rather than
guessing, and `isPast` never reports an absent date as expired.

**One context had two names on one screen.** The tree rendered `name`
("Verifiable Trust Agent") while every table column and pane title rendered
`id` ("vta"), with nothing connecting them — and with ids like `vta`, `vtc`
and `webvh`, connecting them by eye is exactly what an operator should not be
doing. Both are shown now, everywhere, in one order: the label first because
that is what you navigate by, the id beneath in monospace because that is
what joins the tree to every table beside it.

**Audit rows open.** A row shows what fits; what does not fit is the part
answering "why" — `detail` is free-form per action, `actor`/`target` are full
DID URLs a column truncates, and `prevHash`/`entryHash` are the only evidence
of chaining there is. Rows now expand to the entry as the agent sent it. The
CHAINED column is gone: against the live agent every row read "no", and a
column that always says the same thing carries no information while costing
the width a DID needed — it is one note above the table instead. Non-DID
actors (`internal:webvh-rest-auth`) are no longer styled as DIDs.

Signed-off-by: Glenn Gore <glenn.g@affinidi.com>
---
 packages/extension/src/background.ts          |   6 +-
 packages/extension/src/bridge-protocol.ts     |  18 +-
 .../extension/src/manager/context-column.tsx  |  27 +-
 packages/extension/src/manager/format.ts      |  88 ++++
 .../extension/src/manager/panes/access.tsx    |  12 +-
 .../extension/src/manager/panes/approvals.tsx |  11 +-
 .../extension/src/manager/panes/audit.tsx     | 407 ++++++++++++++----
 .../extension/src/manager/panes/contexts.tsx  |   5 +-
 packages/extension/src/manager/panes/dids.tsx |   9 +-
 packages/extension/src/manager/panes/keys.tsx |   9 +-
 .../extension/src/manager/panes/policy.tsx    |   9 +-
 .../extension/src/manager/panes/services.tsx  |   3 +-
 .../extension/src/manager/panes/sessions.tsx  |   3 +-
 packages/extension/src/manager/shell.tsx      | 141 ++++--
 .../extension/src/manager/whoami-banner.tsx   |   3 +-
 packages/extension/src/offscreen.ts           |   5 +-
 .../extension/tests/manager-surface.test.mts  |  32 ++
 17 files changed, 643 insertions(+), 145 deletions(-)
 create mode 100644 packages/extension/src/manager/format.ts

diff --git a/packages/extension/src/background.ts b/packages/extension/src/background.ts
index baceb91..43675fd 100644
--- a/packages/extension/src/background.ts
+++ b/packages/extension/src/background.ts
@@ -1731,12 +1731,16 @@ async function handleManagerTask(
   if (!active.ok) return { ok: false, error: active.error };
 
   await ensureOffscreenDocument();
+  // No `origin`. There is no proposing page — the operator is acting directly,
+  // the same position a CLI is in — and `requestTask` is explicit that a caller
+  // with no attested origin should omit it rather than invent one. Inventing
+  // this extension's own put an `ext` member on every payload, which some agent
+  // payload structs reject outright.
   return (await chrome.runtime.sendMessage({
     target: OFFSCREEN_TARGET,
     type: OFFSCREEN_REQUEST_TASK,
     vtaDid: active.conn.vtaDid,
     restBaseUrl: active.conn.restBaseUrl,
-    origin: new URL(chrome.runtime.getURL("")).origin,
     params: req.params,
   })) as RuntimeManagerTaskResponse;
 }
diff --git a/packages/extension/src/bridge-protocol.ts b/packages/extension/src/bridge-protocol.ts
index ad36dba..be512a6 100644
--- a/packages/extension/src/bridge-protocol.ts
+++ b/packages/extension/src/bridge-protocol.ts
@@ -1743,7 +1743,23 @@ export interface OffscreenRequestTaskRequest {
   type: typeof OFFSCREEN_REQUEST_TASK;
   vtaDid: string;
   restBaseUrl: string;
-  origin: string;
+  /**
+   * The origin the browser attributed to the proposing page, when there is one.
+   *
+   * **Absent for the management console, deliberately.** `requestTask` stamps
+   * this into `payload.ext["openvtc.origin"]` so the origin a human approves is
+   * bound to the payload that executes — which is essential when a *page*
+   * proposed the task and meaningless when the operator is driving their own
+   * console. `requestTask`'s own contract says a caller with no attested origin
+   * should omit it rather than invent one, and inventing one here was not free:
+   * it put an `ext` member on every payload, and an agent whose struct has
+   * drifted from its schema rejects the whole request as malformed.
+   *
+   * The page path is unaffected — `background.ts` still refuses a page-facing
+   * message that carries no browser-attested origin, which is where that
+   * requirement is enforced.
+   */
+  origin?: string;
   params: RequestTaskParams;
 }
 
diff --git a/packages/extension/src/manager/context-column.tsx b/packages/extension/src/manager/context-column.tsx
index 38dd625..901fa6f 100644
--- a/packages/extension/src/manager/context-column.tsx
+++ b/packages/extension/src/manager/context-column.tsx
@@ -9,6 +9,7 @@
 import { useMemo, useState } from "react";
 import { c, t, font } from "../theme.js";
 import { buildContextTree, flattenContextTree, type ContextNode } from "./context-tree.js";
+import { contextLabel } from "./format.js";
 import type { ContextRecord } from "@openvtc/pnm-core";
 
 /** `null` means "all contexts" — the filter cleared, not a context named null. */
@@ -36,6 +37,11 @@ function Row({
   // record behind it — nothing to scope a pane to, nothing to rename, nothing
   // to delete. So it is not selectable, and says why.
   const unreachable = !node.record;
+  // The id is what joins this tree to every table beside it, so it is shown
+  // whenever it differs from the label — never dropped in favour of the label.
+  const label = node.record
+    ? contextLabel(node.record)
+    : { primary: node.name, id: undefined };
 
   return (
     <div style={{ display: "flex", alignItems: "center", paddingLeft: 8 + depth * 14 }}>
@@ -81,11 +87,26 @@ function Row({
           fontWeight: selected ? 640 : 440,
           fontStyle: unreachable ? "italic" : "normal",
           overflow: "hidden",
-          textOverflow: "ellipsis",
-          whiteSpace: "nowrap",
         }}
       >
-        {node.name}
+        <span style={{ display: "block", overflow: "hidden", textOverflow: "ellipsis" }}>
+          {label.primary}
+        </span>
+        {label.id && (
+          <span
+            style={{
+              display: "block",
+              fontFamily: font.mono,
+              fontSize: t.xs,
+              fontWeight: 400,
+              color: selected ? "var(--m-act-identity)" : c.faint,
+              overflow: "hidden",
+              textOverflow: "ellipsis",
+            }}
+          >
+            {label.id}
+          </span>
+        )}
       </button>
     </div>
   );
diff --git a/packages/extension/src/manager/format.ts b/packages/extension/src/manager/format.ts
new file mode 100644
index 0000000..abebbf3
--- /dev/null
+++ b/packages/extension/src/manager/format.ts
@@ -0,0 +1,88 @@
+// Rendering helpers that refuse to state more than the agent said.
+//
+// Both of these exist because of the same failure, seen against a live agent:
+// a value the console did not have was rendered as a confident, wrong one.
+
+import type { ContextRecord } from "@openvtc/pnm-core";
+
+/**
+ * Anything at or before this is treated as "no timestamp", not as a date.
+ *
+ * `new Date(null)`, `new Date(0)` and `new Date(undefined as never)` all land
+ * on or near the epoch, and `toLocaleString()` renders that as
+ * "01/01/1970, 01:00:00" — which reads as a real answer and is not one. A
+ * session whose expiry the agent did not send is not a session that expired
+ * fifty-six years ago, and the difference matters on a banner whose whole job
+ * is to say how long your authority lasts.
+ *
+ * A year is generous: no real timestamp in this system predates the protocol.
+ */
+const NOT_A_TIMESTAMP = Date.UTC(1971, 0, 1);
+
+/** Parse to a Date, or null when the value cannot be one. */
+function parseInstant(value: string | number | null | undefined): Date | null {
+  if (value === null || value === undefined || value === "") return null;
+  const d = new Date(value);
+  const ms = d.getTime();
+  if (Number.isNaN(ms) || ms <= NOT_A_TIMESTAMP) return null;
+  return d;
+}
+
+/** Date and time, or `fallback` when the agent gave nothing usable. */
+export function formatInstant(
+  value: string | number | null | undefined,
+  fallback = "unknown",
+): string {
+  return parseInstant(value)?.toLocaleString() ?? fallback;
+}
+
+/** Date only, or `fallback`. */
+export function formatDate(
+  value: string | number | null | undefined,
+  fallback = "unknown",
+): string {
+  return parseInstant(value)?.toLocaleDateString() ?? fallback;
+}
+
+/** Whether an instant has passed. `false` when there is no usable instant —
+ *  "we don't know" must never render as "expired". */
+export function isPast(value: string | number | null | undefined): boolean {
+  const d = parseInstant(value);
+  return d !== null && d.getTime() < Date.now();
+}
+
+/**
+ * How a context is named everywhere in this console.
+ *
+ * The tree used to render `name` ("Verifiable Trust Agent") while every table
+ * column and pane title rendered `id` ("vta"), so the same context had two
+ * names on one screen and nothing connecting them. An operator selecting
+ * "Verifiable Trust Agent" and reading "Audit for vta" has to guess those are
+ * the same thing — and when the ids are `vta`, `vtc` and `webvh`, guessing is
+ * exactly what they should not be doing.
+ *
+ * So both are shown, always, in the same order: the operator's own label reads
+ * first because that is what they navigate by, and the `id` follows in
+ * monospace because that is the vocabulary the agent's own records carry — a
+ * key's `contextId`, a DID's `contextId`, an ACL scope. The id is what joins
+ * this tree to every table beside it, so it is never the half that gets
+ * dropped.
+ */
+export interface ContextLabel {
+  /** What to read first. The operator's label, or the id when there is none. */
+  primary: string;
+  /** The agent's own identifier, when it differs from `primary`. Monospace. */
+  id?: string;
+}
+
+export function contextLabel(record: ContextRecord): ContextLabel {
+  const name = record.name?.trim();
+  return name && name !== record.id ? { primary: name, id: record.id } : { primary: record.id };
+}
+
+/** One-line form for a heading: `Verifiable Trust Agent (vta)`. */
+export function contextHeading(record: ContextRecord | undefined, id: string): string {
+  if (!record) return id;
+  const label = contextLabel(record);
+  return label.id ? `${label.primary} (${label.id})` : label.primary;
+}
diff --git a/packages/extension/src/manager/panes/access.tsx b/packages/extension/src/manager/panes/access.tsx
index d772ace..ee8869b 100644
--- a/packages/extension/src/manager/panes/access.tsx
+++ b/packages/extension/src/manager/panes/access.tsx
@@ -29,6 +29,7 @@ import { ConsentRequiredError } from "../carrier.js";
 import { ConsentCeremony, Destructive, runMutation } from "../destructive.js";
 import { Loading, LoadError, Redacted, Table, Truncated, type Column } from "../table.js";
 import { useAsync } from "../use-async.js";
+import { formatDate, isPast } from "../format.js";
 import { hasRole, type Authority, type Parties } from "../use-vta.js";
 import type { ContextSelection } from "../context-column.js";
 
@@ -48,11 +49,10 @@ function Expiry({ entry }: { entry: AclEntry }) {
     // decision worth reading as one.
     return <span style={{ color: c.warn }}>never</span>;
   }
-  const when = new Date(entry.expiresAt);
-  const past = when.getTime() < Date.now();
+  const past = isPast(entry.expiresAt);
   return (
     <span style={{ color: past ? c.faint : c.muted, whiteSpace: "nowrap" }}>
-      {when.toLocaleDateString()}
+      {formatDate(entry.expiresAt)}
       {past ? " (expired)" : ""}
     </span>
   );
@@ -258,10 +258,14 @@ export function AccessPane({
   parties,
   authority,
   contextId,
+  contextHeading,
 }: {
   parties: Parties;
   authority: Authority | null;
   contextId: ContextSelection;
+  /** How the selected context is named in the tree, so heading and navigation
+   *  agree. See `contextLabel` in `format.ts`. */
+  contextHeading?: string | undefined;
 }) {
   const list = useAsync(
     () => aclList(managerSender, { ...parties, ...(contextId ? { scope: contextId } : {}) }),
@@ -331,7 +335,7 @@ export function AccessPane({
   return (
     <div style={{ display: "grid", gap: 16, alignContent: "start" }}>
       <Panel
-        title={contextId ? `Access to ${contextId}` : "Access to this agent"}
+        title={contextHeading ? `Access to ${contextHeading}` : "Access to this agent"}
         description="Who may act here, as what, and until when. This is the authority itself —
           the agent checks it on every task, including the ones this console sends."
       >
diff --git a/packages/extension/src/manager/panes/approvals.tsx b/packages/extension/src/manager/panes/approvals.tsx
index ec826c4..c622f91 100644
--- a/packages/extension/src/manager/panes/approvals.tsx
+++ b/packages/extension/src/manager/panes/approvals.tsx
@@ -26,6 +26,7 @@ import { ConsentRequiredError } from "../carrier.js";
 import { ConsentCeremony, Destructive, runMutation } from "../destructive.js";
 import { Loading, LoadError, Table, type Column } from "../table.js";
 import { useAsync } from "../use-async.js";
+import { formatDate } from "../format.js";
 import { hasRole, type Authority, type Parties } from "../use-vta.js";
 import type { ContextSelection } from "../context-column.js";
 
@@ -148,10 +149,14 @@ export function ApprovalsPane({
   parties,
   authority,
   contextId,
+  contextHeading,
 }: {
   parties: Parties;
   authority: Authority | null;
   contextId: ContextSelection;
+  /** How the selected context is named in the tree, so heading and navigation
+   *  agree. See `contextLabel` in `format.ts`. */
+  contextHeading?: string | undefined;
 }) {
   const approvers = useAsync(
     () =>
@@ -222,7 +227,7 @@ export function ApprovalsPane({
       header: "Granted",
       render: (g) => (
         <span style={{ color: c.muted, whiteSpace: "nowrap" }}>
-          {new Date(g.grantedAt).toLocaleDateString()}
+          {formatDate(g.grantedAt)}
         </span>
       ),
     },
@@ -232,7 +237,7 @@ export function ApprovalsPane({
       render: (g) =>
         g.expiresAt ? (
           <span style={{ color: c.muted, whiteSpace: "nowrap" }}>
-            {new Date(g.expiresAt).toLocaleDateString()}
+            {formatDate(g.expiresAt)}
           </span>
         ) : (
           <span style={{ color: c.warn }}>never</span>
@@ -270,7 +275,7 @@ export function ApprovalsPane({
   return (
     <div style={{ display: "grid", gap: 16, alignContent: "start" }}>
       <Panel
-        title={contextId ? `Approvers for ${contextId}` : "Approvers"}
+        title={contextHeading ? `Approvers for ${contextHeading}` : "Approvers"}
         description="Who your agent asks when a task needs a human. Your wallet renders that
           request as a consent prompt — so a binding that points nowhere is silent, not noisy."
       >
diff --git a/packages/extension/src/manager/panes/audit.tsx b/packages/extension/src/manager/panes/audit.tsx
index 30e6703..cb121cb 100644
--- a/packages/extension/src/manager/panes/audit.tsx
+++ b/packages/extension/src/manager/panes/audit.tsx
@@ -1,24 +1,39 @@
-// Audit — the agent's account of what happened.
+// Audit — the agent's account of what happened, and the whole of each entry.
 //
 // **Truncation is rendered, never swallowed.** `AuditListResult.truncated` says
 // the agent stopped early, and its own documentation is explicit about why that
 // matters: an operator reading "nothing else occurred" off a partial page is
-// exactly the failure an audit trail exists to prevent. A list that silently
-// dropped the flag would be worse than no audit view at all, because it looks
-// authoritative.
+// exactly the failure an audit trail exists to prevent.
 //
-// Entries are hash-chained (`prevHash`/`entryHash`). This pane shows that the
-// chain is there but does **not** claim to have verified it — checking a chain
-// requires the whole chain, and this is a page of it. Saying "verified" over a
-// page would be a claim nothing here can support.
+// ## Why a row opens
+//
+// A table row can only show what fits, and what does not fit is the part that
+// answers "why". `AuditEnvelope.detail` is free-form per action, `target` and
+// `actor` are full DID URLs that a column truncates, and `prevHash`/`entryHash`
+// are the only evidence of chaining there is. A summary the operator cannot get
+// behind is a summary they have to take on trust — from the surface whose whole
+// purpose is not needing to.
+//
+// So the row expands to the entry as the agent sent it, `detail` included and
+// unformatted beyond indentation. Nothing here reinterprets it: this pane's job
+// is to hand over the record, not to explain it.
+//
+// ## What is deliberately not claimed
+//
+// Entries carry `prevHash`/`entryHash`. Verifying a chain needs the whole
+// chain, and this is a page of it — so the console reports whether the links are
+// *present* and never that they were checked. Against a live agent every entry
+// came back with no hash at all, which is worth saying once, plainly, rather
+// than repeating "no" down a column.
 
-import { useCallback, useState } from "react";
+import { useCallback, useMemo, useState } from "react";
 import { auditList, type AuditEnvelope } from "@openvtc/pnm-core/admin";
 import { Button, Did, Note, Panel, Pill } from "../../ui.js";
 import { c, t, font } from "../../theme.js";
 import { managerSender } from "../sender.js";
-import { Loading, LoadError, Table, type Column } from "../table.js";
+import { Loading, LoadError } from "../table.js";
 import { useAsync } from "../use-async.js";
+import { formatInstant } from "../format.js";
 import type { Parties } from "../use-vta.js";
 import type { ContextSelection } from "../context-column.js";
 
@@ -41,12 +56,236 @@ function Outcome({ outcome }: { outcome: string | undefined }) {
   return <Pill tone={ok ? "ok" : bad ? "danger" : "off"}>{outcome}</Pill>;
 }
 
+/** One field of the opened entry. Absent values say so rather than vanishing —
+ *  "the agent recorded no target" is information. */
+function Field({ label, children }: { label: string; children: React.ReactNode }) {
+  return (
+    <>
+      <dt style={{ color: c.muted, whiteSpace: "nowrap" }}>{label}</dt>
+      <dd style={{ margin: 0, minWidth: 0, wordBreak: "break-word" }}>{children}</dd>
+    </>
+  );
+}
+
+function Absent() {
+  return <span style={{ color: c.faint }}>not recorded</span>;
+}
+
+function EntryDetail({ entry }: { entry: AuditEnvelope }) {
+  const detail = useMemo(() => {
+    if (!entry.detail || Object.keys(entry.detail).length === 0) return null;
+    try {
+      return JSON.stringify(entry.detail, null, 2);
+    } catch {
+      // A detail object the agent sent that will not serialise is itself worth
+      // reporting; silently showing nothing would hide the interesting case.
+      return "(this entry's detail could not be displayed)";
+    }
+  }, [entry.detail]);
+
+  return (
+    <div
+      style={{
+        background: c.raised,
+        border: `1px solid ${c.line}`,
+        borderRadius: "var(--w-r-sm)",
+        padding: "14px 16px",
+        display: "grid",
+        gap: 12,
+      }}
+    >
+      <dl
+        style={{
+          margin: 0,
+          display: "grid",
+          gridTemplateColumns: "auto minmax(0, 1fr)",
+          gap: "6px 18px",
+          fontSize: t.sm,
+          alignItems: "baseline",
+        }}
+      >
+        <Field label="Event id">
+          <span style={{ fontFamily: font.mono, fontSize: t.xs }}>{entry.eventId}</span>
+        </Field>
+        <Field label="Recorded">{formatInstant(entry.recordedAt)}</Field>
+        <Field label="Action">
+          <span style={{ fontFamily: font.mono, fontSize: t.xs }}>{entry.action}</span>
+        </Field>
+        <Field label="Outcome">
+          <Outcome outcome={entry.outcome} />
+        </Field>
+        <Field label="Actor">
+          {entry.actor ? (
+            entry.actor.startsWith("did:") ? (
+              <Did value={entry.actor} size={t.xs} />
+            ) : (
+              // Not every actor is a DID — a live agent records things like
+              // `internal:webvh-rest-auth`. Rendering that through the DID
+              // component would style a non-DID as one.
+              <span style={{ fontFamily: font.mono, fontSize: t.xs }}>{entry.actor}</span>
+            )
+          ) : (
+            <Absent />
+          )}
+        </Field>
+        <Field label="Target">
+          {entry.target ? (
+            entry.target.startsWith("did:") ? (
+              <Did value={entry.target} size={t.xs} />
+            ) : (
+              <span style={{ fontFamily: font.mono, fontSize: t.xs }}>{entry.target}</span>
+            )
+          ) : (
+            <Absent />
+          )}
+        </Field>
+        <Field label="Context">
+          {entry.contextId ? (
+            <span style={{ fontFamily: font.mono, fontSize: t.xs }}>{entry.contextId}</span>
+          ) : (
+            <Absent />
+          )}
+        </Field>
+        <Field label="Chain">
+          {entry.entryHash ? (
+            <div style={{ display: "grid", gap: 3 }}>
+              <span style={{ fontFamily: font.mono, fontSize: t.xs, wordBreak: "break-all" }}>
+                this: {entry.entryHash}
+              </span>
+              <span style={{ fontFamily: font.mono, fontSize: t.xs, wordBreak: "break-all", color: c.muted }}>
+                prev: {entry.prevHash ?? "—"}
+              </span>
+              <span style={{ color: c.faint, fontSize: t.xs }}>
+                Present, not verified — checking a chain needs all of it.
+              </span>
+            </div>
+          ) : (
+            <span style={{ color: c.warn }}>
+              This entry carries no hash, so nothing links it to the one before it.
+            </span>
+          )}
+        </Field>
+      </dl>
+
+      {detail && (
+        <div style={{ display: "grid", gap: 5 }}>
+          <span style={{ fontSize: t.xs, color: c.muted, textTransform: "uppercase", letterSpacing: 0.4 }}>
+            Detail, as the agent recorded it
+          </span>
+          <pre
+            style={{
+              margin: 0,
+              padding: "10px 12px",
+              background: c.ground,
+              border: `1px solid ${c.line}`,
+              borderRadius: "var(--w-r-sm)",
+              fontSize: t.xs,
+              lineHeight: 1.5,
+              overflowX: "auto",
+              maxHeight: 320,
+            }}
+          >
+            {detail}
+          </pre>
+        </div>
+      )}
+      {!detail && (
+        <span style={{ fontSize: t.sm, color: c.faint }}>
+          This entry carries no detail beyond the fields above.
+        </span>
+      )}
+    </div>
+  );
+}
+
+/** Compact cell for a value that may be a DID URL far wider than its column. */
+function Truncated({ value }: { value: string }) {
+  return (
+    <span
+      title={value}
+      style={{
+        fontFamily: font.mono,
+        fontSize: t.xs,
+        display: "block",
+        maxWidth: 260,
+        overflow: "hidden",
+        textOverflow: "ellipsis",
+        whiteSpace: "nowrap",
+      }}
+    >
+      {value}
+    </span>
+  );
+}
+
+function Row({
+  entry,
+  open,
+  onToggle,
+}: {
+  entry: AuditEnvelope;
+  open: boolean;
+  onToggle: () => void;
+}) {
+  return (
+    <>
+      <tr
+        onClick={onToggle}
+        style={{ cursor: "pointer", background: open ? c.raised : "transparent" }}
+      >
+        {[
+          <span key="x" style={{ color: c.faint, fontSize: t.xs }} aria-hidden>
+            {open ? "▾" : "▸"}
+          </span>,
+          <span key="w" style={{ color: c.muted, whiteSpace: "nowrap" }}>
+            {formatInstant(entry.recordedAt)}
+          </span>,
+          <span key="a" style={{ fontFamily: font.mono, fontSize: t.xs }}>
+            {entry.action}
+          </span>,
+          entry.actor ? <Truncated key="ac" value={entry.actor} /> : <Absent key="ac" />,
+          entry.target ? <Truncated key="tg" value={entry.target} /> : <Absent key="tg" />,
+          <Outcome key="o" outcome={entry.outcome} />,
+          <span key="c" style={{ fontFamily: font.mono, fontSize: t.xs, color: c.muted }}>
+            {entry.contextId ?? "—"}
+          </span>,
+        ].map((cell, i) => (
+          <td
+            key={i}
+            style={{
+              padding: "7px 12px 7px 0",
+              borderBottom: open ? "none" : `1px solid ${c.lineSoft}`,
+              verticalAlign: "top",
+            }}
+          >
+            {cell}
+          </td>
+        ))}
+      </tr>
+      {open && (
+        <tr>
+          <td
+            colSpan={7}
+            style={{ padding: "0 12px 14px 0", borderBottom: `1px solid ${c.lineSoft}` }}
+          >
+            <EntryDetail entry={entry} />
+          </td>
+        </tr>
+      )}
+    </>
+  );
+}
+
 export function AuditPane({
   parties,
   contextId,
+  contextHeading,
 }: {
   parties: Parties;
   contextId: ContextSelection;
+  /** How the selected context is named in the tree — so the heading and the
+   *  navigation agree. See `contextLabel` in `format.ts`. */
+  contextHeading?: string | undefined;
 }) {
   const [action, setAction] = useState("");
   const [actor, setActor] = useState("");
@@ -54,6 +293,7 @@ export function AuditPane({
   // per keystroke against an agent over a mediator.
   const [applied, setApplied] = useState({ action: "", actor: "" });
   const [pageSize, setPageSize] = useState(PAGE);
+  const [openId, setOpenId] = useState<string | null>(null);
 
   const list = useAsync(
     () =>
@@ -64,89 +304,27 @@ export function AuditPane({
         ...(applied.action ? { action: applied.action } : {}),
         ...(applied.actor ? { actor: applied.actor } : {}),
       }),
-    [
-      parties.holder.did,
-      parties.service.did,
-      contextId,
-      applied.action,
-      applied.actor,
-      pageSize,
-    ],
+    [parties.holder.did, parties.service.did, contextId, applied.action, applied.actor, pageSize],
   );
 
   const apply = useCallback(() => {
     setPageSize(PAGE);
+    setOpenId(null);
     setApplied({ action: action.trim(), actor: actor.trim() });
   }, [action, actor]);
 
-  const columns: Column<AuditEnvelope>[] = [
-    {
-      key: "when",
-      header: "When",
-      render: (e) => (
-        <span style={{ color: c.muted, whiteSpace: "nowrap" }}>
-          {new Date(e.recordedAt).toLocaleString()}
-        </span>
-      ),
-    },
-    {
-      key: "action",
-      header: "Action",
-      render: (e) => <span style={{ fontFamily: font.mono, fontSize: t.xs }}>{e.action}</span>,
-    },
-    {
-      key: "actor",
-      header: "Actor",
-      render: (e) =>
-        e.actor ? <Did value={e.actor} size={t.xs} /> : <span style={{ color: c.faint }}>—</span>,
-    },
-    {
-      key: "target",
-      header: "Target",
-      render: (e) =>
-        e.target ? (
-          <span style={{ fontFamily: font.mono, fontSize: t.xs, wordBreak: "break-all" }}>
-            {e.target}
-          </span>
-        ) : (
-          <span style={{ color: c.faint }}>—</span>
-        ),
-    },
-    { key: "outcome", header: "Outcome", render: (e) => <Outcome outcome={e.outcome} /> },
-    {
-      key: "context",
-      header: "Context",
-      render: (e) => (
-        <span style={{ fontFamily: font.mono, fontSize: t.xs, color: c.muted }}>
-          {e.contextId ?? "—"}
-        </span>
-      ),
-    },
-    {
-      key: "chain",
-      header: "Chained",
-      render: (e) =>
-        e.entryHash ? (
-          <span
-            style={{ color: c.muted, fontSize: t.xs }}
-            title="This entry carries a hash linking it to the previous one. Verifying the chain
-              needs all of it, which this page is not — so no claim is made here."
-          >
-            yes
-          </span>
-        ) : (
-          <span style={{ color: c.warn, fontSize: t.xs }}>no</span>
-        ),
-    },
-  ];
+  const entries = list.data?.entries ?? [];
+  // Said once, as a note, rather than repeated down a column of "no". Against a
+  // live agent this is every row, and a column that always reads the same
+  // carries no information while costing the width a DID needed.
+  const unchained = entries.length > 0 && entries.every((e) => !e.entryHash);
 
   return (
     <div style={{ display: "grid", gap: 16, alignContent: "start" }}>
       <Panel
-        title={contextId ? `Audit for ${contextId}` : "Audit"}
-        description="What your agent recorded. Entries are hash-chained to each other; this page
-          shows that the links are present, and does not claim to have checked them — that needs
-          the whole chain, not a page of it."
+        title={contextHeading ? `Audit for ${contextHeading}` : "Audit"}
+        description="What your agent recorded. Select a row to see the whole entry, including the
+          detail the agent attached to it."
       >
         <div style={{ display: "flex", gap: 10, flexWrap: "wrap", alignItems: "flex-end" }}>
           <label style={{ display: "grid", gap: 4 }}>
@@ -159,7 +337,7 @@ export function AuditPane({
             />
           </label>
           <label style={{ display: "grid", gap: 4, flex: "1 1 300px" }}>
-            <span style={{ fontSize: t.xs, color: c.muted }}>ACTOR DID</span>
+            <span style={{ fontSize: t.xs, color: c.muted }}>ACTOR</span>
             <input
               style={{ ...fieldStyle, fontFamily: font.mono }}
               value={actor}
@@ -200,16 +378,61 @@ export function AuditPane({
                 , or narrow the filters.
               </Note>
             )}
-            <Table
-              columns={columns}
-              rows={list.data.entries}
-              rowKey={(e) => e.eventId}
-              empty={
-                applied.action || applied.actor
+
+            {unchained && (
+              <Note tone="warn">
+                None of these entries carries a hash linking it to the one before it, so the
+                trail cannot be checked for gaps or reordering. That is the agent's recording
+                configuration, not something this console can establish from here.
+              </Note>
+            )}
+
+            {entries.length === 0 ? (
+              <div style={{ fontSize: t.sm, color: c.faint, padding: "10px 0", lineHeight: 1.55 }}>
+                {applied.action || applied.actor
                   ? "Nothing matches those filters. Clear them to see the rest."
-                  : "Your agent has recorded nothing here yet."
-              }
-            />
+                  : "Your agent has recorded nothing here yet."}
+              </div>
+            ) : (
+              <div style={{ overflowX: "auto" }}>
+                <table
+                  style={{ borderCollapse: "collapse", width: "100%", minWidth: 800, fontSize: t.sm }}
+                >
+                  <thead>
+                    <tr>
+                      {["", "When", "Action", "Actor", "Target", "Outcome", "Context"].map((h) => (
+                        <th
+                          key={h || "disclose"}
+                          style={{
+                            textAlign: "left",
+                            padding: "6px 12px 6px 0",
+                            borderBottom: `1px solid ${c.line}`,
+                            color: c.faint,
+                            fontSize: t.xs,
+                            textTransform: "uppercase",
+                            letterSpacing: 0.4,
+                            fontWeight: 640,
+                            whiteSpace: "nowrap",
+                          }}
+                        >
+                          {h}
+                        </th>
+                      ))}
+                    </tr>
+                  </thead>
+                  <tbody>
+                    {entries.map((e) => (
+                      <Row
+                        key={e.eventId}
+                        entry={e}
+                        open={openId === e.eventId}
+                        onToggle={() => setOpenId((cur) => (cur === e.eventId ? null : e.eventId))}
+                      />
+                    ))}
+                  </tbody>
+                </table>
+              </div>
+            )}
           </>
         )}
       </Panel>
diff --git a/packages/extension/src/manager/panes/contexts.tsx b/packages/extension/src/manager/panes/contexts.tsx
index 300a3da..96d5391 100644
--- a/packages/extension/src/manager/panes/contexts.tsx
+++ b/packages/extension/src/manager/panes/contexts.tsx
@@ -18,6 +18,7 @@ import { managerSender } from "../sender.js";
 import { ConsentRequiredError } from "../carrier.js";
 import { Destructive, ConsentCeremony, runMutation } from "../destructive.js";
 import { hasRole, type Authority, type Parties } from "../use-vta.js";
+import { formatInstant } from "../format.js";
 import type { ContextSelection } from "../context-column.js";
 
 const fieldStyle: React.CSSProperties = {
@@ -222,9 +223,9 @@ function EditContext({
           {record.did ? <Did value={record.did} /> : <span style={{ color: c.faint }}>none bound</span>}
         </dd>
         <dt style={{ color: c.muted }}>Created</dt>
-        <dd style={{ margin: 0, color: c.muted }}>{new Date(record.createdAt).toLocaleString()}</dd>
+        <dd style={{ margin: 0, color: c.muted }}>{formatInstant(record.createdAt)}</dd>
         <dt style={{ color: c.muted }}>Updated</dt>
-        <dd style={{ margin: 0, color: c.muted }}>{new Date(record.updatedAt).toLocaleString()}</dd>
+        <dd style={{ margin: 0, color: c.muted }}>{formatInstant(record.updatedAt)}</dd>
       </dl>
 
       <div style={{ display: "grid", gap: 10, maxWidth: 520, marginTop: 6 }}>
diff --git a/packages/extension/src/manager/panes/dids.tsx b/packages/extension/src/manager/panes/dids.tsx
index efe573b..17857fd 100644
--- a/packages/extension/src/manager/panes/dids.tsx
+++ b/packages/extension/src/manager/panes/dids.tsx
@@ -22,6 +22,7 @@ import { ConsentRequiredError } from "../carrier.js";
 import { ConsentCeremony, Destructive, runMutation } from "../destructive.js";
 import { Loading, LoadError, Table, type Column } from "../table.js";
 import { useAsync } from "../use-async.js";
+import { formatDate } from "../format.js";
 import { hasRole, type Authority, type Parties } from "../use-vta.js";
 import type { ContextSelection } from "../context-column.js";
 
@@ -141,10 +142,14 @@ export function DidsPane({
   parties,
   authority,
   contextId,
+  contextHeading,
 }: {
   parties: Parties;
   authority: Authority | null;
   contextId: ContextSelection;
+  /** How the selected context is named in the tree, so heading and navigation
+   *  agree. See `contextLabel` in `format.ts`. */
+  contextHeading?: string | undefined;
 }) {
   const list = useAsync(
     () =>
@@ -186,7 +191,7 @@ export function DidsPane({
       header: "Created",
       render: (d) => (
         <span style={{ color: c.muted, whiteSpace: "nowrap" }}>
-          {new Date(d.createdAt).toLocaleDateString()}
+          {formatDate(d.createdAt)}
         </span>
       ),
     },
@@ -227,7 +232,7 @@ export function DidsPane({
   return (
     <div style={{ display: "grid", gap: 16, alignContent: "start" }}>
       <Panel
-        title={contextId ? `DIDs in ${contextId}` : "DIDs in every context you can reach"}
+        title={contextHeading ? `DIDs in ${contextHeading}` : "DIDs in every context you can reach"}
         description="Published did:webvh identifiers. Each one's log is served by a hosting
           server and resolvable by anyone — these are the identities others see."
       >
diff --git a/packages/extension/src/manager/panes/keys.tsx b/packages/extension/src/manager/panes/keys.tsx
index 6a0beb2..91a814c 100644
--- a/packages/extension/src/manager/panes/keys.tsx
+++ b/packages/extension/src/manager/panes/keys.tsx
@@ -27,6 +27,7 @@ import { ConsentRequiredError } from "../carrier.js";
 import { ConsentCeremony, Destructive, runMutation } from "../destructive.js";
 import { Loading, LoadError, Table, Truncated, type Column } from "../table.js";
 import { useAsync } from "../use-async.js";
+import { formatDate } from "../format.js";
 import { hasRole, type Authority, type Parties } from "../use-vta.js";
 import type { ContextSelection } from "../context-column.js";
 
@@ -249,10 +250,14 @@ export function KeysPane({
   parties,
   authority,
   contextId,
+  contextHeading,
 }: {
   parties: Parties;
   authority: Authority | null;
   contextId: ContextSelection;
+  /** How the selected context is named in the tree, so heading and navigation
+   *  agree. See `contextLabel` in `format.ts`. */
+  contextHeading?: string | undefined;
 }) {
   const [limit, setLimit] = useState(PAGE);
 
@@ -298,7 +303,7 @@ export function KeysPane({
       header: "Created",
       render: (k) => (
         <span style={{ color: c.muted, whiteSpace: "nowrap" }}>
-          {new Date(k.createdAt).toLocaleDateString()}
+          {formatDate(k.createdAt)}
         </span>
       ),
     },
@@ -341,7 +346,7 @@ export function KeysPane({
   return (
     <div style={{ display: "grid", gap: 16, alignContent: "start" }}>
       <Panel
-        title={contextId ? `Keys in ${contextId}` : "Keys in every context you can reach"}
+        title={contextHeading ? `Keys in ${contextHeading}` : "Keys in every context you can reach"}
         description="Your agent holds every private half. This console never sees one, and never
           asks for a signature — that is use, not administration."
       >
diff --git a/packages/extension/src/manager/panes/policy.tsx b/packages/extension/src/manager/panes/policy.tsx
index 9912ca6..530c8a4 100644
--- a/packages/extension/src/manager/panes/policy.tsx
+++ b/packages/extension/src/manager/panes/policy.tsx
@@ -24,6 +24,7 @@ import { ConsentRequiredError } from "../carrier.js";
 import { ConsentCeremony, Destructive, runMutation } from "../destructive.js";
 import { Loading, LoadError, Table, Truncated, type Column } from "../table.js";
 import { useAsync } from "../use-async.js";
+import { formatDate } from "../format.js";
 import { hasRole, type Authority, type Parties } from "../use-vta.js";
 import type { ContextSelection } from "../context-column.js";
 
@@ -176,10 +177,14 @@ export function PolicyPane({
   parties,
   authority,
   contextId,
+  contextHeading,
 }: {
   parties: Parties;
   authority: Authority | null;
   contextId: ContextSelection;
+  /** How the selected context is named in the tree, so heading and navigation
+   *  agree. See `contextLabel` in `format.ts`. */
+  contextHeading?: string | undefined;
 }) {
   const [editing, setEditing] = useState<PolicyModule | null>(null);
   const [creating, setCreating] = useState(false);
@@ -237,7 +242,7 @@ export function PolicyPane({
       header: "Updated",
       render: (p) => (
         <span style={{ color: c.muted, whiteSpace: "nowrap" }}>
-          {new Date(p.updatedAt).toLocaleDateString()}
+          {formatDate(p.updatedAt)}
         </span>
       ),
     },
@@ -296,7 +301,7 @@ export function PolicyPane({
   return (
     <div style={{ display: "grid", gap: 16, alignContent: "start" }}>
       <Panel
-        title={contextId ? `Policy in ${contextId}` : "Policy"}
+        title={contextHeading ? `Policy in ${contextHeading}` : "Policy"}
         description="Hand-authored Rego the agent evaluates before it acts. For the common case
           — which tasks need a human — the Approvals pane is the surface to use."
       >
diff --git a/packages/extension/src/manager/panes/services.tsx b/packages/extension/src/manager/panes/services.tsx
index d735554..d554a21 100644
--- a/packages/extension/src/manager/panes/services.tsx
+++ b/packages/extension/src/manager/panes/services.tsx
@@ -24,6 +24,7 @@ import { ConsentRequiredError } from "../carrier.js";
 import { ConsentCeremony, Destructive, runMutation } from "../destructive.js";
 import { Loading, LoadError, Table, type Column } from "../table.js";
 import { useAsync } from "../use-async.js";
+import { formatInstant } from "../format.js";
 import { useTransportHealth } from "../../use-transport-health.js";
 import { hasRole, type Authority, type Parties } from "../use-vta.js";
 import type { Transport, TransportObservation } from "../../transports.js";
@@ -164,7 +165,7 @@ export function ServicesPane({
       render: (s) =>
         s.drainsUntil ? (
           <span style={{ color: c.warn, whiteSpace: "nowrap" }}>
-            until {new Date(s.drainsUntil).toLocaleString()}
+            until {formatInstant(s.drainsUntil)}
           </span>
         ) : (
           <span style={{ color: c.faint }}>—</span>
diff --git a/packages/extension/src/manager/panes/sessions.tsx b/packages/extension/src/manager/panes/sessions.tsx
index 3138b69..5f69209 100644
--- a/packages/extension/src/manager/panes/sessions.tsx
+++ b/packages/extension/src/manager/panes/sessions.tsx
@@ -17,11 +17,12 @@ import { managerSender } from "../sender.js";
 import { Destructive } from "../destructive.js";
 import { Loading, LoadError, Table, type Column } from "../table.js";
 import { useAsync } from "../use-async.js";
+import { formatInstant } from "../format.js";
 import type { Authority, Parties } from "../use-vta.js";
 
 function When({ iso }: { iso: string }) {
   return (
-    <span style={{ color: c.muted, whiteSpace: "nowrap" }}>{new Date(iso).toLocaleString()}</span>
+    <span style={{ color: c.muted, whiteSpace: "nowrap" }}>{formatInstant(iso)}</span>
   );
 }
 
diff --git a/packages/extension/src/manager/shell.tsx b/packages/extension/src/manager/shell.tsx
index 8706d8c..0eebbb2 100644
--- a/packages/extension/src/manager/shell.tsx
+++ b/packages/extension/src/manager/shell.tsx
@@ -29,6 +29,7 @@ import { ServicesPane } from "./panes/services.js";
 import { AuditPane } from "./panes/audit.js";
 import { managerSender } from "./sender.js";
 import { useVta, type Parties } from "./use-vta.js";
+import { contextHeading } from "./format.js";
 
 /** Section ids double as the URL hash. */
 export type SectionId =
@@ -42,12 +43,30 @@ export type SectionId =
   | "approvals"
   | "policy";
 
+interface Section {
+  id: SectionId;
+  label: string;
+  /**
+   * Whether the selected context actually narrows what this pane asks.
+   *
+   * Declared per section rather than inferred, because getting it wrong is
+   * invisible: Transports and Sessions take no `contextId` at all, so with the
+   * tree always on screen an operator could pick a context, watch nothing
+   * change, and reasonably conclude the filter was broken — or worse, that the
+   * list they were reading *was* scoped when it never was. A filter that does
+   * not filter is not clutter, it is a false claim about what is on screen.
+   *
+   * A new pane has to answer this, which is the point.
+   */
+  contextScoped: boolean;
+}
+
 interface Act {
   title: string;
   /** CSS custom property holding this act's colour. */
   colour: string;
   soft: string;
-  sections: { id: SectionId; label: string }[];
+  sections: Section[];
 }
 
 // The deck's three acts. The grouping is not decorative — each answers a
@@ -58,9 +77,9 @@ const ACTS: Act[] = [
     colour: "var(--m-act-identity)",
     soft: "var(--m-act-identity-soft)",
     sections: [
-      { id: "contexts", label: "Contexts" },
-      { id: "keys", label: "Keys" },
-      { id: "dids", label: "DIDs" },
+      { id: "contexts", label: "Contexts", contextScoped: true },
+      { id: "keys", label: "Keys", contextScoped: true },
+      { id: "dids", label: "DIDs", contextScoped: true },
     ],
   },
   {
@@ -68,8 +87,10 @@ const ACTS: Act[] = [
     colour: "var(--m-act-wire)",
     soft: "var(--m-act-wire-soft)",
     sections: [
-      { id: "services", label: "Transports" },
-      { id: "audit", label: "Audit" },
+      // Transports are agent-wide: `servicesList` takes no context, because a
+      // transport is not owned by one.
+      { id: "services", label: "Transports", contextScoped: false },
+      { id: "audit", label: "Audit", contextScoped: true },
     ],
   },
   {
@@ -77,17 +98,26 @@ const ACTS: Act[] = [
     colour: "var(--m-act-graph)",
     soft: "var(--m-act-graph-soft)",
     sections: [
-      { id: "access", label: "Access" },
-      { id: "approvals", label: "Approvals" },
-      { id: "policy", label: "Policy" },
-      { id: "sessions", label: "Sessions" },
+      { id: "access", label: "Access", contextScoped: true },
+      { id: "approvals", label: "Approvals", contextScoped: true },
+      { id: "policy", label: "Policy", contextScoped: true },
+      // `sessionsList` returns the caller's sessions; a session is held at the
+      // agent, not inside a context.
+      { id: "sessions", label: "Sessions", contextScoped: false },
     ],
   },
 ];
 
+const SECTIONS: Section[] = ACTS.flatMap((a) => a.sections);
+
+/** Whether the context column belongs on screen for `section`. */
+function isContextScoped(section: SectionId): boolean {
+  return SECTIONS.find((s) => s.id === section)?.contextScoped ?? false;
+}
+
 function sectionFromHash(): SectionId {
   const raw = location.hash.replace(/^#/, "");
-  const known = ACTS.flatMap((a) => a.sections.map((s) => s.id));
+  const known = SECTIONS.map((s) => s.id);
   return (known as string[]).includes(raw) ? (raw as SectionId) : "contexts";
 }
 
@@ -213,6 +243,15 @@ export function ManagerShell() {
     void vta.refreshAuthority();
   }, [contexts, vta]);
 
+  // One name for the selected context, shared by every pane heading, so a
+  // heading can never disagree with the tree entry that produced it.
+  const heading = selected
+    ? contextHeading(
+        contexts.records.find((r) => r.id === selected),
+        selected,
+      )
+    : undefined;
+
   const body = useMemo(() => {
     if (vta.status !== "ready" || !parties) return null;
     switch (section) {
@@ -227,23 +266,58 @@ export function ManagerShell() {
           />
         );
       case "keys":
-        return <KeysPane parties={parties} authority={vta.authority} contextId={selected} />;
+        return (
+          <KeysPane
+            parties={parties}
+            authority={vta.authority}
+            contextId={selected}
+            contextHeading={heading}
+          />
+        );
       case "dids":
-        return <DidsPane parties={parties} authority={vta.authority} contextId={selected} />;
+        return (
+          <DidsPane
+            parties={parties}
+            authority={vta.authority}
+            contextId={selected}
+            contextHeading={heading}
+          />
+        );
       case "services":
         return <ServicesPane parties={parties} authority={vta.authority} />;
       case "audit":
-        return <AuditPane parties={parties} contextId={selected} />;
+        return <AuditPane parties={parties} contextId={selected} contextHeading={heading} />;
       case "access":
-        return <AccessPane parties={parties} authority={vta.authority} contextId={selected} />;
+        return (
+          <AccessPane
+            parties={parties}
+            authority={vta.authority}
+            contextId={selected}
+            contextHeading={heading}
+          />
+        );
       case "approvals":
-        return <ApprovalsPane parties={parties} authority={vta.authority} contextId={selected} />;
+        return (
+          <ApprovalsPane
+            parties={parties}
+            authority={vta.authority}
+            contextId={selected}
+            contextHeading={heading}
+          />
+        );
       case "policy":
-        return <PolicyPane parties={parties} authority={vta.authority} contextId={selected} />;
+        return (
+          <PolicyPane
+            parties={parties}
+            authority={vta.authority}
+            contextId={selected}
+            contextHeading={heading}
+          />
+        );
       case "sessions":
         return <SessionsPane parties={parties} authority={vta.authority} />;
     }
-  }, [vta, parties, section, contexts.records, selected, onChanged]);
+  }, [vta, parties, section, contexts.records, selected, heading, onChanged]);
 
   if (vta.status === "loading") {
     return <Centered>Reading your wallet's connection…</Centered>;
@@ -279,29 +353,38 @@ export function ManagerShell() {
     );
   }
 
+  // The context column appears only where the selection actually narrows the
+  // question. On Transports and Sessions it would be a filter that filters
+  // nothing — see `Section.contextScoped`.
+  const scoped = isContextScoped(section);
+
   return (
     <div
       style={{
         height: "100%",
         display: "grid",
-        gridTemplateColumns: "186px 244px minmax(0, 1fr)",
+        gridTemplateColumns: scoped ? "186px 244px minmax(0, 1fr)" : "186px minmax(0, 1fr)",
         gridTemplateRows: "auto minmax(0, 1fr)",
-        gridTemplateAreas: `"rail tree banner" "rail tree pane"`,
+        gridTemplateAreas: scoped
+          ? `"rail tree banner" "rail tree pane"`
+          : `"rail banner" "rail pane"`,
       }}
     >
       <div style={{ gridArea: "rail", minHeight: 0 }}>
         <ActRail section={section} onSelect={go} />
       </div>
 
-      <div style={{ gridArea: "tree", minHeight: 0, display: "grid" }}>
-        <ContextTree
-          records={contexts.records}
-          selected={selected}
-          onSelect={setSelected}
-          loading={contexts.loading}
-          error={contexts.error}
-        />
-      </div>
+      {scoped && (
+        <div style={{ gridArea: "tree", minHeight: 0, display: "grid" }}>
+          <ContextTree
+            records={contexts.records}
+            selected={selected}
+            onSelect={setSelected}
+            loading={contexts.loading}
+            error={contexts.error}
+          />
+        </div>
+      )}
 
       <div style={{ gridArea: "banner" }}>
         <WhoamiBanner
diff --git a/packages/extension/src/manager/whoami-banner.tsx b/packages/extension/src/manager/whoami-banner.tsx
index 2e03d86..2108de5 100644
--- a/packages/extension/src/manager/whoami-banner.tsx
+++ b/packages/extension/src/manager/whoami-banner.tsx
@@ -9,6 +9,7 @@
 
 import { Did, Pill } from "../ui.js";
 import { c, t } from "../theme.js";
+import { formatInstant } from "./format.js";
 import type { Authority } from "./use-vta.js";
 
 function Field({ label, children }: { label: string; children: React.ReactNode }) {
@@ -75,7 +76,7 @@ export function WhoamiBanner({
           </Field>
           <Field label="Session expires">
             <span style={{ color: c.muted }}>
-              {new Date(authority.session.expiresAt).toLocaleString()}
+              {formatInstant(authority.session.expiresAt)}
             </span>
           </Field>
         </>
diff --git a/packages/extension/src/offscreen.ts b/packages/extension/src/offscreen.ts
index fcc59ef..5286378 100644
--- a/packages/extension/src/offscreen.ts
+++ b/packages/extension/src/offscreen.ts
@@ -1152,7 +1152,10 @@ async function doRequestTask(req: OffscreenRequestTaskRequest) {
     payload: req.params.payload,
     holderDid: holder.did,
     vtaDid: req.vtaDid,
-    origin: req.origin,
+    // Spread rather than passing `undefined`: `requestTask` stamps
+    // `payload.ext` only when an origin is present, and the management console
+    // deliberately supplies none. See `OffscreenRequestTaskRequest.origin`.
+    ...(req.origin ? { origin: req.origin } : {}),
   });
   // Same-browser approver: if this VTA has a local approver identity, surface
   // the ceremony right here on the rejection and relay the signed decision over
diff --git a/packages/extension/tests/manager-surface.test.mts b/packages/extension/tests/manager-surface.test.mts
index 40f94df..511f7ad 100644
--- a/packages/extension/tests/manager-surface.test.mts
+++ b/packages/extension/tests/manager-surface.test.mts
@@ -107,3 +107,35 @@ test("the console's relay does not carry a page origin", () => {
       "waiting to be trusted.",
   );
 });
+
+test("the console does not invent an origin for the task it relays", () => {
+  // `requestTask` stamps `payload.ext["openvtc.origin"]` only when given an
+  // origin, and its contract says a caller without an attested one should omit
+  // it rather than invent one. The console has no proposing page.
+  //
+  // This is not stylistic. Stamping the extension's own origin put an `ext`
+  // member on every payload, and a live agent whose `acl/list` and
+  // `policy/list` structs have drifted from their schemas rejected the whole
+  // request — "unknown field `ext`" — taking out two panes entirely.
+  const handler = /async function handleManagerTask\([\s\S]*?\n\}/.exec(background);
+  assert.ok(handler, "handleManagerTask not found in background.ts");
+  assert.ok(
+    !/\borigin:/.test(handler[0]),
+    "handleManagerTask sets an `origin`. There is no proposing page to attest, and the " +
+      "stamp it produces lands in payload.ext, which some agent payload structs reject.",
+  );
+});
+
+test("the page-facing relay still carries its attested origin", () => {
+  // The guard above must not be read as "origin is optional now". The page
+  // path's whole security property is that the browser's origin travels with
+  // the proposal and ends up inside the payload digest a human approves.
+  const handler = /async function handleRequestTask\([\s\S]*?\n\}/.exec(background);
+  assert.ok(handler, "handleRequestTask not found in background.ts");
+  assert.match(
+    handler[0],
+    /origin: req\.origin/,
+    "handleRequestTask no longer forwards the attested origin — a page-proposed task would " +
+      "then be approved without the origin bound to its payload",
+  );
+});

From 3479cb89e61b630b637de0bdf7ad9f1e4ee91c45 Mon Sep 17 00:00:00 2001
From: Glenn Gore <glenn.g@affinidi.com>
Date: Tue, 1 Sep 2026 14:55:41 +0200
Subject: [PATCH 03/24] feat(console): app state, agent memory and credential
 issuance
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Adds a fourth act to the rail. The deck's three answer "who am I", "how do
bytes move" and "who may act"; none of them answers "what is stored here",
which is the question these three share.

**App state** (`vta/app-state/*`) is where applications keep metadata in the
agent — the openvtc install record, sync cursors, per-app preferences. Unlike
the wallet's own storage these follow the holder to every device, so a wrong
value here follows them too. Two things the pane refuses to flatten: writes
carry `expectedVersion`, so an edit compare-and-swaps against what was read
rather than overwriting whatever an application wrote since; and deletes are
soft, so `includeDeleted` distinguishes "nothing ever wrote this" from
"something removed it".

**Memory** (`vta/memory/*`) is what the agent recalls between conversations.
Read, write and forget, as asked — with the write path stating plainly that a
hand-written memory is stored identically to one the agent formed itself, so
nothing downstream can tell them apart.

Both of those **require** a context and say so rather than showing an empty
list. `contextId` is part of the record's address in these families, not a
filter over it: `(context, namespace, key)` names one record, and two contexts
holding the same namespace and key hold unrelated records. Fanning out to
build an agent-wide view would produce a list where identical-looking rows are
different records.

**Credentials** is issuer-side only, and the pane leads with why. The
`vta/credentials` family declares `issue` and `revoke` and nothing else — no
list — so this console cannot show what has been issued, and a blank table
would read as "you have issued nothing", which is a claim it has no basis for.
It says so and points at the audit trail. The issued id is surfaced
prominently on success for the same reason: it is the only handle revocation
has, and there is no way to look it up later. Revocation likewise cannot
preview, so its confirm step states what could not be checked instead of
dressing a guess up as one.

Holder-side credentials are deliberately absent. They live in
`vault/credentials/*`, which ships no TypeScript bindings in
`@openvtc/trust-tasks`; transcribing those shapes by hand is the copy that
drifts this repo already removed once, so that half waits for the bindings
rather than being approximated. The pane says that too, rather than leaving a
gap the reader has to explain to themselves.

`app-state/records.ts` takes the same `TaskParty` widening as `admin/*`.

Signed-off-by: Glenn Gore <glenn.g@affinidi.com>
---
 packages/core/src/app-state/records.ts        |   8 +-
 packages/extension/src/manager-theme.css      |   7 +-
 .../extension/src/manager/panes/app-state.tsx | 483 ++++++++++++++++++
 .../src/manager/panes/credentials.tsx         | 410 +++++++++++++++
 .../extension/src/manager/panes/memory.tsx    | 333 ++++++++++++
 packages/extension/src/manager/shell.tsx      |  51 +-
 6 files changed, 1285 insertions(+), 7 deletions(-)
 create mode 100644 packages/extension/src/manager/panes/app-state.tsx
 create mode 100644 packages/extension/src/manager/panes/credentials.tsx
 create mode 100644 packages/extension/src/manager/panes/memory.tsx

diff --git a/packages/core/src/app-state/records.ts b/packages/core/src/app-state/records.ts
index 87bd273..beb9f7b 100644
--- a/packages/core/src/app-state/records.ts
+++ b/packages/core/src/app-state/records.ts
@@ -15,9 +15,7 @@
 // is the isolation boundary** — not a filter, and not a convenience. Two
 // contexts holding the same namespace and key hold two unrelated records.
 
-import type { Identity } from "../didcomm/index.js";
-import type { TrustTaskSender } from "../vta/channel.js";
-import type { RemoteDidcommEndpoint } from "../vta/didcomm.js";
+import type { TaskParty, TrustTaskSender } from "../vta/channel.js";
 import { buildTrustTask } from "../vta/trust-task.js";
 
 import {
@@ -63,9 +61,9 @@ export type { AppStateRecord };
 /** Every `vta/app-state/*` call is issued by an identity, to an agent. */
 export interface AppStateCallerParams {
   /** Envelope `issuer` — the caller's DIDComm identity. */
-  holder: Identity;
+  holder: TaskParty;
   /** The agent — envelope `recipient`. */
-  service: RemoteDidcommEndpoint;
+  service: TaskParty;
   /** The VTA context the record is scoped to. The isolation boundary: the same
    *  `(namespace, key)` in another context is a different record. */
   contextId: string;
diff --git a/packages/extension/src/manager-theme.css b/packages/extension/src/manager-theme.css
index dec25d0..41dcc5b 100644
--- a/packages/extension/src/manager-theme.css
+++ b/packages/extension/src/manager-theme.css
@@ -10,7 +10,8 @@
  * colour by act, and it works because the grouping is real — the three groups
  * answer three different questions:
  *
- *   identity  (purple)  who you are, and what you hold
+ *   identity  (purple)  who you are
+ *   data      (teal)    what is stored here, and who put it there
  *   wire      (lime)    how bytes get there, and whether they did
  *   graph     (gold)    who may act, and who has to agree
  *
@@ -33,6 +34,8 @@
   --m-act-wire-soft: #eef6e2;
   --m-act-graph: #8f6410;
   --m-act-graph-soft: #fbf2dc;
+  --m-act-data: #0e6f78;
+  --m-act-data-soft: #e2f2f4;
 
   /* The rail's own ground — a half-step off `--w-ground` so the three columns
    * read as three columns without a hard border doing the work. */
@@ -48,6 +51,8 @@
     --m-act-wire-soft: #182310;
     --m-act-graph: #e0b355;
     --m-act-graph-soft: #292010;
+    --m-act-data: #4dc4d0;
+    --m-act-data-soft: #0e2326;
 
     --m-rail: #0e131c;
     --m-tree: #10151f;
diff --git a/packages/extension/src/manager/panes/app-state.tsx b/packages/extension/src/manager/panes/app-state.tsx
new file mode 100644
index 0000000..31832e7
--- /dev/null
+++ b/packages/extension/src/manager/panes/app-state.tsx
@@ -0,0 +1,483 @@
+// App state — where applications keep their metadata in the agent.
+//
+// `vta/app-state/*`: durable key/value records the *agent* holds, as opposed to
+// the wallet's own `KVStore`, which is this browser profile's state and is
+// invisible to a phone or a second laptop signed in as the same holder. This is
+// the only place an application can keep something that has to be true on every
+// device — so it is also the place where a wrong or stale record follows the
+// user everywhere.
+//
+// ## Why this pane demands a context, rather than defaulting to all of them
+//
+// Every other context-scoped pane treats `contextId` as a filter: omit it and
+// the agent answers for everything the caller can reach. App-state does not
+// work that way — `contextId` is part of the *address*. A record is
+// `(contextId, namespace, key)`, and two contexts holding the same namespace
+// and key hold two unrelated records.
+//
+// So there is no "all contexts" answer to give, and inventing one by fanning
+// out across contexts would produce a list in which identical-looking rows are
+// different records. The pane asks for a context instead.
+//
+// ## Two things the agent tracks that this pane must not flatten
+//
+// Records are **versioned**, and every write can carry `expectedVersion` — so
+// an edit compare-and-swaps against what was read rather than overwriting
+// whatever arrived since. And deletes are **soft**: `includeDeleted` reveals
+// tombstones, which is the difference between "no application ever wrote this"
+// and "something deleted it".
+
+import { useCallback, useState } from "react";
+import {
+  appStateDelete,
+  appStateList,
+  appStatePut,
+  type AppStateRecord,
+} from "@openvtc/pnm-core";
+import { Button, Note, Panel, Pill } from "../../ui.js";
+import { c, t, font } from "../../theme.js";
+import { managerSender } from "../sender.js";
+import { ConsentRequiredError } from "../carrier.js";
+import { ConsentCeremony, Destructive, runMutation } from "../destructive.js";
+import { Loading, LoadError, Table, Truncated, type Column } from "../table.js";
+import { useAsync } from "../use-async.js";
+import { formatInstant } from "../format.js";
+import { hasRole, type Authority, type Parties } from "../use-vta.js";
+import type { ContextSelection } from "../context-column.js";
+
+const PAGE = 100;
+
+const fieldStyle: React.CSSProperties = {
+  boxSizing: "border-box",
+  padding: "6px 9px",
+  background: c.ground,
+  color: c.text,
+  border: `1px solid ${c.line}`,
+  borderRadius: "var(--w-r-sm)",
+  fontSize: t.sm,
+};
+
+const codeStyle: React.CSSProperties = {
+  ...fieldStyle,
+  fontFamily: font.mono,
+  fontSize: t.xs,
+  minHeight: 140,
+  width: "100%",
+  lineHeight: 1.5,
+  resize: "vertical",
+};
+
+/** The record's value, rendered as the agent stored it. */
+function Value({ record }: { record: AppStateRecord }) {
+  if (record.value === undefined) {
+    // `appStateList` can be asked for keys without values, and a tombstone has
+    // none. Three different facts — not fetched, deleted, stored empty — that
+    // an empty cell would collapse into one.
+    return (
+      <span style={{ color: c.faint }}>{record.deleted ? "deleted" : "not fetched"}</span>
+    );
+  }
+  const text = JSON.stringify(record.value, null, 2);
+  return (
+    <pre
+      style={{
+        margin: 0,
+        fontFamily: font.mono,
+        fontSize: t.xs,
+        lineHeight: 1.5,
+        whiteSpace: "pre-wrap",
+        wordBreak: "break-word",
+        maxHeight: 160,
+        overflowY: "auto",
+        maxWidth: 460,
+      }}
+    >
+      {text}
+    </pre>
+  );
+}
+
+function WriteRecord({
+  parties,
+  contextId,
+  authority,
+  existing,
+  onDone,
+  onCancel,
+}: {
+  parties: Parties;
+  contextId: string;
+  authority: Authority | null;
+  existing?: AppStateRecord;
+  onDone: () => void;
+  onCancel?: () => void;
+}) {
+  const [namespace, setNamespace] = useState(existing?.namespace ?? "");
+  const [key, setKey] = useState(existing?.key ?? "");
+  const [value, setValue] = useState(() => {
+    return existing?.value === undefined ? "{}" : JSON.stringify(existing.value, null, 2);
+  });
+  const [busy, setBusy] = useState(false);
+  const [error, setError] = useState<string | null>(null);
+  const [pending, setPending] = useState<ConsentRequiredError | null>(null);
+
+  const denied = authority && !hasRole(authority, "admin", "super-admin", "operator")
+    ? "Writing app state needs an administrative role at this agent."
+    : null;
+
+  const save = useCallback(async () => {
+    setBusy(true);
+    setError(null);
+    setPending(null);
+    // The schema types `value` as a JSON object, so anything else is refused
+    // here rather than sent and rejected. Reporting "expected an object" beside
+    // the box beats the agent's parse error arriving with no cursor in it.
+    let parsed: Record<string, unknown>;
+    try {
+      const candidate: unknown = JSON.parse(value);
+      if (candidate === null || typeof candidate !== "object" || Array.isArray(candidate)) {
+        setError("A record's value must be a JSON object — an array or a bare value is not one.");
+        setBusy(false);
+        return;
+      }
+      parsed = candidate as Record<string, unknown>;
+    } catch {
+      setError("That is not valid JSON. A record's value must be a JSON object.");
+      setBusy(false);
+      return;
+    }
+    const ok = await runMutation(
+      async () => {
+        await appStatePut(managerSender, {
+          ...parties,
+          contextId,
+          namespace: namespace.trim(),
+          key: key.trim(),
+          value: parsed,
+          // Compare-and-swap against the version this editor opened on, so an
+          // application that wrote since is not silently overwritten.
+          ...(existing ? { expectedVersion: existing.version } : {}),
+        });
+      },
+      { onConsent: setPending, onError: setError },
+    );
+    setBusy(false);
+    if (ok) onDone();
+  }, [parties, contextId, namespace, key, value, existing, onDone]);
+
+  return (
+    <Panel
+      title={existing ? `Edit ${existing.namespace}/${existing.key}` : "New record"}
+      description={
+        existing ? (
+          <>
+            Saving is compare-and-swapped against version{" "}
+            <strong>{existing.version}</strong> — if an application has written
+            since this editor opened, your save is refused rather than overwriting it.
+          </>
+        ) : (
+          <>
+            Written into <code style={{ fontFamily: font.mono }}>{contextId}</code>. Applications
+            read this on every device the holder uses, so a wrong value here follows them
+            everywhere.
+          </>
+        )
+      }
+    >
+      <div style={{ display: "grid", gap: 10 }}>
+        <div style={{ display: "flex", gap: 10, flexWrap: "wrap" }}>
+          <label style={{ display: "grid", gap: 4, flex: "1 1 220px" }}>
+            <span style={{ fontSize: t.xs, color: c.muted }}>NAMESPACE</span>
+            <input
+              style={{ ...fieldStyle, fontFamily: font.mono }}
+              value={namespace}
+              onChange={(e) => setNamespace(e.target.value)}
+              disabled={Boolean(existing)}
+              placeholder="net.openvtc.app"
+            />
+          </label>
+          <label style={{ display: "grid", gap: 4, flex: "1 1 220px" }}>
+            <span style={{ fontSize: t.xs, color: c.muted }}>KEY</span>
+            <input
+              style={{ ...fieldStyle, fontFamily: font.mono }}
+              value={key}
+              onChange={(e) => setKey(e.target.value)}
+              disabled={Boolean(existing)}
+            />
+          </label>
+        </div>
+        {existing && (
+          <span style={{ fontSize: t.xs, color: c.faint }}>
+            Namespace and key form the record's address and cannot be changed — write a new
+            record and delete this one instead.
+          </span>
+        )}
+
+        <label style={{ display: "grid", gap: 4 }}>
+          <span style={{ fontSize: t.xs, color: c.muted }}>VALUE</span>
+          <textarea
+            style={codeStyle}
+            value={value}
+            onChange={(e) => setValue(e.target.value)}
+            spellCheck={false}
+          />
+        </label>
+        <span style={{ fontSize: t.xs, color: c.faint }}>
+          A JSON object. Applications read this shape directly, so a key renamed here is a key
+          the application stops finding.
+        </span>
+
+        {error && <Note tone="danger">{error}</Note>}
+        {pending && <ConsentCeremony pending={pending} />}
+
+        <div style={{ display: "flex", gap: 8 }}>
+          <Button
+            kind="primary"
+            disabled={busy || !namespace.trim() || !key.trim() || Boolean(denied)}
+            {...(denied ? { title: denied } : {})}
+            onClick={() => void save()}
+          >
+            {busy ? "Saving…" : existing ? "Save changes" : "Write record"}
+          </Button>
+          {onCancel && (
+            <Button kind="quiet" disabled={busy} onClick={onCancel}>
+              Cancel
+            </Button>
+          )}
+        </div>
+        {denied && <span style={{ fontSize: t.sm, color: c.muted }}>{denied}</span>}
+      </div>
+    </Panel>
+  );
+}
+
+export function AppStatePane({
+  parties,
+  authority,
+  contextId,
+  contextHeading,
+}: {
+  parties: Parties;
+  authority: Authority | null;
+  contextId: ContextSelection;
+  contextHeading?: string | undefined;
+}) {
+  const [namespace, setNamespace] = useState("");
+  const [applied, setApplied] = useState("");
+  const [includeDeleted, setIncludeDeleted] = useState(false);
+  const [editing, setEditing] = useState<AppStateRecord | null>(null);
+  const [creating, setCreating] = useState(false);
+
+  const list = useAsync(
+    async () =>
+      contextId
+        ? appStateList(managerSender, {
+            ...parties,
+            contextId,
+            includeValues: true,
+            includeDeleted,
+            pageSize: PAGE,
+            ...(applied ? { namespace: applied } : {}),
+          })
+        : null,
+    [parties.holder.did, parties.service.did, contextId, applied, includeDeleted],
+  );
+
+  const deleteDenied = authority && !hasRole(authority, "admin", "super-admin", "operator")
+    ? "Deleting app state needs an administrative role at this agent."
+    : null;
+
+  // `contextId` is the record's address, not a filter — there is no
+  // agent-wide answer to give. See the header.
+  if (!contextId) {
+    return (
+      <Panel
+        title="App state"
+        description="Durable key/value records applications keep in your agent, so they are true
+          on every device you use rather than only in this browser."
+      >
+        <Note tone="accent">
+          <strong>Select a context in the tree.</strong> Unlike keys or DIDs, a context is part of
+          an app-state record's address rather than a filter over it —{" "}
+          <code style={{ fontFamily: font.mono }}>(context, namespace, key)</code> together name
+          one record. Two contexts holding the same namespace and key hold two unrelated records,
+          so there is no agent-wide list to show you.
+        </Note>
+      </Panel>
+    );
+  }
+
+  const records = list.data?.records ?? [];
+  const done = () => {
+    setEditing(null);
+    setCreating(false);
+    list.reload();
+  };
+
+  if (editing) {
+    return (
+      <WriteRecord
+        parties={parties}
+        contextId={contextId}
+        authority={authority}
+        existing={editing}
+        onDone={done}
+        onCancel={() => setEditing(null)}
+      />
+    );
+  }
+
+  const columns: Column<AppStateRecord>[] = [
+    {
+      key: "ns",
+      header: "Namespace",
+      render: (r) => (
+        <span style={{ fontFamily: font.mono, fontSize: t.xs }}>{r.namespace}</span>
+      ),
+    },
+    {
+      key: "key",
+      header: "Key",
+      render: (r) => <span style={{ fontFamily: font.mono, fontSize: t.xs }}>{r.key}</span>,
+    },
+    { key: "value", header: "Value", render: (r) => <Value record={r} /> },
+    {
+      key: "version",
+      header: "Version",
+      render: (r) => <span style={{ color: c.muted }}>{r.version}</span>,
+    },
+    {
+      key: "state",
+      header: "State",
+      render: (r) =>
+        // A tombstone is not an absent record, and the difference is the whole
+        // reason `includeDeleted` exists.
+        r.deleted ? (
+          <Pill tone="off">deleted</Pill>
+        ) : (
+          <Pill tone="ok">live</Pill>
+        ),
+    },
+    {
+      key: "updated",
+      header: "Updated",
+      render: (r) => (
+        <span style={{ color: c.muted, whiteSpace: "nowrap" }}>
+          {formatInstant(r.updatedAt, "—")}
+        </span>
+      ),
+    },
+    {
+      key: "actions",
+      header: "",
+      render: (r) =>
+        r.deleted ? (
+          <span style={{ color: c.faint, fontSize: t.xs }}>deleted</span>
+        ) : (
+          <div style={{ display: "grid", gap: 8, minWidth: 190 }}>
+            <Button kind="quiet" onClick={() => setEditing(r)}>
+              Edit
+            </Button>
+            <Destructive<AppStateRecord>
+              label="Delete"
+              disabledReason={deleteDenied}
+              preview={async () => r}
+              renderPreview={(p) => (
+                <>
+                  <strong>
+                    Deleting {p.namespace}/{p.key} takes it away on every device.
+                  </strong>
+                  <span>
+                    App state is the agent's copy, not this browser's — whatever application
+                    reads this key stops finding it everywhere the holder is signed in, not just
+                    here. If the application treats an absent record as "not set up yet", that is
+                    the state it will fall back to.
+                  </span>
+                </>
+              )}
+              commit={async () => {
+                await appStateDelete(managerSender, {
+                  ...parties,
+                  contextId,
+                  namespace: r.namespace,
+                  key: r.key,
+                  expectedVersion: r.version,
+                });
+              }}
+              onDone={done}
+            />
+          </div>
+        ),
+    },
+  ];
+
+  return (
+    <div style={{ display: "grid", gap: 16, alignContent: "start" }}>
+      <Panel
+        title={`App state in ${contextHeading ?? contextId}`}
+        description="Durable key/value records applications keep in your agent. Unlike the
+          wallet's own storage these follow the holder to every device, so what is here is what
+          every one of them sees."
+      >
+        <div style={{ display: "flex", gap: 10, flexWrap: "wrap", alignItems: "flex-end" }}>
+          <label style={{ display: "grid", gap: 4, flex: "1 1 260px" }}>
+            <span style={{ fontSize: t.xs, color: c.muted }}>NAMESPACE</span>
+            <input
+              style={{ ...fieldStyle, fontFamily: font.mono }}
+              value={namespace}
+              onChange={(e) => setNamespace(e.target.value)}
+              placeholder="all namespaces"
+            />
+          </label>
+          <div style={{ paddingBottom: 1 }}>
+            <Button onClick={() => setApplied(namespace.trim())}>Filter</Button>
+          </div>
+          <label
+            style={{ display: "flex", gap: 7, alignItems: "center", fontSize: t.sm, paddingBottom: 7 }}
+          >
+            <input
+              type="checkbox"
+              checked={includeDeleted}
+              onChange={(e) => setIncludeDeleted(e.target.checked)}
+            />
+            Show deleted
+          </label>
+        </div>
+
+        {list.error && <LoadError what="app state" error={list.error} />}
+        {list.loading && !list.data && <Loading what="app state" />}
+        {list.data && (
+          <>
+            <Table
+              columns={columns}
+              rows={records}
+              rowKey={(r) => `${r.namespace}/${r.key}`}
+              empty={
+                applied
+                  ? `No records in namespace ${applied}. Clear the filter to see the rest.`
+                  : `No application has written anything into ${contextId}.`
+              }
+            />
+            {list.data.cursor && <Truncated what="this context's records" />}
+          </>
+        )}
+
+        {!creating && (
+          <div>
+            <Button onClick={() => setCreating(true)}>New record</Button>
+          </div>
+        )}
+      </Panel>
+
+      {creating && (
+        <WriteRecord
+          parties={parties}
+          contextId={contextId}
+          authority={authority}
+          onDone={done}
+          onCancel={() => setCreating(false)}
+        />
+      )}
+    </div>
+  );
+}
diff --git a/packages/extension/src/manager/panes/credentials.tsx b/packages/extension/src/manager/panes/credentials.tsx
new file mode 100644
index 0000000..4146b28
--- /dev/null
+++ b/packages/extension/src/manager/panes/credentials.tsx
@@ -0,0 +1,410 @@
+// Credentials — what this agent issues to others, and takes back.
+//
+// ## What this pane cannot do, and why it says so
+//
+// `vta/credentials` declares exactly two tasks: `issue` and `revoke`. There is
+// **no list**. So this console can mint a credential and revoke one by id, and
+// it genuinely cannot show you what has been issued — not because the pane is
+// unfinished, but because the agent exposes no way to ask.
+//
+// That is stated on the surface rather than hidden behind an empty table. A
+// blank list would read as "you have issued nothing", which is a claim this
+// console has no basis for and which would be wrong the moment anything had
+// been issued. The audit trail is the honest answer for "what happened", and
+// the pane points at it.
+//
+// The holder side — the credentials this agent *holds* — lives in a different
+// family again (`vault/credentials/*`), which ships no TypeScript bindings in
+// `@openvtc/trust-tasks`. Writing those shapes by hand here is exactly the
+// copy-that-drifts this repo already removed once, so that half waits for the
+// bindings rather than being approximated.
+
+import { useCallback, useState } from "react";
+import { issueCredential, revokeCredential } from "@openvtc/pnm-core/admin";
+import { Button, Did, Note, Panel } from "../../ui.js";
+import { c, t, font } from "../../theme.js";
+import { managerSender } from "../sender.js";
+import { ConsentRequiredError } from "../carrier.js";
+import { ConsentCeremony, runMutation } from "../destructive.js";
+import { hasRole, type Authority, type Parties } from "../use-vta.js";
+
+const DAY = 86400;
+
+const fieldStyle: React.CSSProperties = {
+  boxSizing: "border-box",
+  padding: "6px 9px",
+  background: c.ground,
+  color: c.text,
+  border: `1px solid ${c.line}`,
+  borderRadius: "var(--w-r-sm)",
+  fontSize: t.sm,
+};
+
+const codeStyle: React.CSSProperties = {
+  ...fieldStyle,
+  fontFamily: font.mono,
+  fontSize: t.xs,
+  minHeight: 140,
+  width: "100%",
+  lineHeight: 1.5,
+  resize: "vertical",
+};
+
+function Label({ children }: { children: React.ReactNode }) {
+  return (
+    <span style={{ fontSize: t.xs, color: c.muted, textTransform: "uppercase", letterSpacing: 0.4 }}>
+      {children}
+    </span>
+  );
+}
+
+function IssueCredential({
+  parties,
+  authority,
+}: {
+  parties: Parties;
+  authority: Authority | null;
+}) {
+  const [holderDid, setHolderDid] = useState("");
+  const [credentialType, setCredentialType] = useState("");
+  const [claims, setClaims] = useState("{\n  \n}");
+  const [validityDays, setValidityDays] = useState("365");
+  const [purpose, setPurpose] = useState("");
+  const [busy, setBusy] = useState(false);
+  const [error, setError] = useState<string | null>(null);
+  const [pending, setPending] = useState<ConsentRequiredError | null>(null);
+  const [issued, setIssued] = useState<string | null>(null);
+
+  const denied = authority && !hasRole(authority, "admin", "super-admin")
+    ? "Issuing a credential needs the admin role at this agent."
+    : null;
+
+  const days = Number(validityDays);
+  const daysValid = Number.isFinite(days) && days > 0;
+
+  const submit = useCallback(async () => {
+    setBusy(true);
+    setError(null);
+    setPending(null);
+    setIssued(null);
+
+    let parsed: Record<string, unknown>;
+    try {
+      const candidate: unknown = JSON.parse(claims);
+      if (candidate === null || typeof candidate !== "object" || Array.isArray(candidate)) {
+        setError("Claims must be a JSON object.");
+        setBusy(false);
+        return;
+      }
+      parsed = candidate as Record<string, unknown>;
+    } catch {
+      setError("Claims are not valid JSON.");
+      setBusy(false);
+      return;
+    }
+
+    const ok = await runMutation(
+      async () => {
+        const res = await issueCredential(managerSender, {
+          ...parties,
+          holderDid: holderDid.trim(),
+          claims: parsed as never,
+          validitySeconds: Math.round(days * DAY),
+          ...(credentialType.trim() ? { credentialType: credentialType.trim() } : {}),
+          ...(purpose.trim() ? { purpose: purpose.trim() } : {}),
+        });
+        // The id is the only handle revocation has, and there is no list to
+        // recover it from later. Surfaced prominently for exactly that reason.
+        const id = (res as { credentialId?: string; id?: string }).credentialId
+          ?? (res as { id?: string }).id
+          ?? null;
+        setIssued(id);
+      },
+      { onConsent: setPending, onError: setError },
+    );
+    setBusy(false);
+    if (ok) {
+      setHolderDid("");
+      setClaims("{\n  \n}");
+    }
+  }, [parties, holderDid, claims, days, credentialType, purpose]);
+
+  return (
+    <Panel
+      title="Issue a credential"
+      description="Your agent signs this as issuer. Once it reaches the holder it is theirs to
+        present anywhere, to anyone who trusts your agent — revocation is the only way back."
+    >
+      <div style={{ display: "grid", gap: 10, maxWidth: 680 }}>
+        <label style={{ display: "grid", gap: 4 }}>
+          <Label>Holder DID</Label>
+          <input
+            style={{ ...fieldStyle, fontFamily: font.mono }}
+            value={holderDid}
+            onChange={(e) => setHolderDid(e.target.value)}
+            placeholder="did:key:z6Mk…"
+          />
+        </label>
+
+        <div style={{ display: "flex", gap: 10, flexWrap: "wrap" }}>
+          <label style={{ display: "grid", gap: 4, flex: "1 1 220px" }}>
+            <Label>Type (optional)</Label>
+            <input
+              style={fieldStyle}
+              value={credentialType}
+              onChange={(e) => setCredentialType(e.target.value)}
+              placeholder="MembershipCredential"
+            />
+          </label>
+          <label style={{ display: "grid", gap: 4 }}>
+            <Label>Valid for (days)</Label>
+            <input
+              style={{ ...fieldStyle, width: 120 }}
+              value={validityDays}
+              onChange={(e) => setValidityDays(e.target.value)}
+            />
+          </label>
+          <label style={{ display: "grid", gap: 4, flex: "1 1 200px" }}>
+            <Label>Purpose (optional)</Label>
+            <input style={fieldStyle} value={purpose} onChange={(e) => setPurpose(e.target.value)} />
+          </label>
+        </div>
+
+        <label style={{ display: "grid", gap: 4 }}>
+          <Label>Claims</Label>
+          <textarea
+            style={codeStyle}
+            value={claims}
+            onChange={(e) => setClaims(e.target.value)}
+            spellCheck={false}
+          />
+        </label>
+        <span style={{ fontSize: t.xs, color: c.faint }}>
+          A JSON object. Everything in here is asserted by your agent and readable by anyone the
+          holder shows it to.
+        </span>
+
+        {!daysValid && validityDays.trim() !== "" && (
+          <Note tone="danger">Validity must be a positive number of days.</Note>
+        )}
+        {error && <Note tone="danger">{error}</Note>}
+        {pending && <ConsentCeremony pending={pending} />}
+
+        {issued !== null && (
+          <Note tone="warn">
+            <div style={{ display: "grid", gap: 6 }}>
+              <strong>Issued. Keep this id.</strong>
+              <span style={{ fontFamily: font.mono, fontSize: t.sm, wordBreak: "break-all" }}>
+                {issued || "(your agent returned no id)"}
+              </span>
+              <span>
+                It is the only handle revocation has, and your agent offers no way to list
+                issued credentials — so if this is lost, the audit trail is the only place it
+                can be recovered from.
+              </span>
+            </div>
+          </Note>
+        )}
+
+        <div>
+          <Button
+            kind="primary"
+            disabled={busy || !holderDid.trim() || !daysValid || Boolean(denied)}
+            {...(denied ? { title: denied } : {})}
+            onClick={() => void submit()}
+          >
+            {busy ? "Issuing…" : "Issue credential"}
+          </Button>
+        </div>
+        {denied && <span style={{ fontSize: t.sm, color: c.muted }}>{denied}</span>}
+      </div>
+    </Panel>
+  );
+}
+
+function RevokeCredential({
+  parties,
+  authority,
+}: {
+  parties: Parties;
+  authority: Authority | null;
+}) {
+  const [credentialId, setCredentialId] = useState("");
+  const [reason, setReason] = useState("");
+  const [confirming, setConfirming] = useState(false);
+  const [busy, setBusy] = useState(false);
+  const [error, setError] = useState<string | null>(null);
+  const [pending, setPending] = useState<ConsentRequiredError | null>(null);
+  const [done, setDone] = useState(false);
+
+  const denied = authority && !hasRole(authority, "admin", "super-admin")
+    ? "Revoking a credential needs the admin role at this agent."
+    : null;
+
+  const submit = useCallback(async () => {
+    setBusy(true);
+    setError(null);
+    setPending(null);
+    const ok = await runMutation(
+      async () => {
+        await revokeCredential(managerSender, {
+          ...parties,
+          credentialId: credentialId.trim(),
+          ...(reason.trim() ? { reason: reason.trim() } : {}),
+        });
+      },
+      { onConsent: setPending, onError: setError },
+    );
+    setBusy(false);
+    if (ok) {
+      setDone(true);
+      setConfirming(false);
+      setCredentialId("");
+      setReason("");
+    }
+  }, [parties, credentialId, reason]);
+
+  return (
+    <Panel
+      title="Revoke a credential"
+      description="By id. There is no list to pick from — your agent exposes no way to enumerate
+        what it has issued, so the id has to come from wherever you recorded it, or from the
+        audit trail."
+    >
+      <div style={{ display: "grid", gap: 10, maxWidth: 680 }}>
+        <label style={{ display: "grid", gap: 4 }}>
+          <Label>Credential id</Label>
+          <input
+            style={{ ...fieldStyle, fontFamily: font.mono }}
+            value={credentialId}
+            onChange={(e) => {
+              setCredentialId(e.target.value);
+              setConfirming(false);
+              setDone(false);
+            }}
+          />
+        </label>
+        <label style={{ display: "grid", gap: 4 }}>
+          <Label>Reason (optional, recorded)</Label>
+          <input style={fieldStyle} value={reason} onChange={(e) => setReason(e.target.value)} />
+        </label>
+
+        {error && <Note tone="danger">{error}</Note>}
+        {pending && <ConsentCeremony pending={pending} />}
+        {done && <Note tone="accent">Revoked.</Note>}
+
+        {/* No preview is possible — there is no read task to preview *from*.
+            So the confirm step states what cannot be checked rather than
+            dressing up a guess as a preview. */}
+        {confirming ? (
+          <>
+            <Note tone="danger">
+              <div style={{ display: "grid", gap: 6 }}>
+                <strong>Revoking cannot be undone, and cannot be previewed.</strong>
+                <span style={{ fontFamily: font.mono, fontSize: t.xs, wordBreak: "break-all" }}>
+                  {credentialId.trim()}
+                </span>
+                <span>
+                  Your agent offers no way to read a credential back, so this console cannot show
+                  you whose it is or what it says before you revoke it — check the id against
+                  your own records first. Whoever holds it stops being able to present it
+                  anywhere that checks revocation.
+                </span>
+              </div>
+            </Note>
+            <div style={{ display: "flex", gap: 8 }}>
+              <Button kind="danger" disabled={busy} onClick={() => void submit()}>
+                {busy ? "Revoking…" : "Revoke it"}
+              </Button>
+              <Button kind="quiet" disabled={busy} onClick={() => setConfirming(false)}>
+                Cancel
+              </Button>
+            </div>
+          </>
+        ) : (
+          <div>
+            <Button
+              kind="danger"
+              disabled={!credentialId.trim() || Boolean(denied)}
+              {...(denied ? { title: denied } : {})}
+              onClick={() => setConfirming(true)}
+            >
+              Revoke
+            </Button>
+          </div>
+        )}
+        {denied && <span style={{ fontSize: t.sm, color: c.muted }}>{denied}</span>}
+      </div>
+    </Panel>
+  );
+}
+
+export function CredentialsPane({
+  parties,
+  authority,
+  onOpenAudit,
+}: {
+  parties: Parties;
+  authority: Authority | null;
+  /** Send the operator to the pane that *can* answer "what was issued". */
+  onOpenAudit: () => void;
+}) {
+  return (
+    <div style={{ display: "grid", gap: 16, alignContent: "start" }}>
+      <Panel
+        title="Credentials this agent issues"
+        description="Your agent as an issuer: minting credentials for others, and taking them
+          back."
+      >
+        <Note tone="warn">
+          <div style={{ display: "grid", gap: 6 }}>
+            <strong>There is no list of issued credentials, and this is not an empty one.</strong>
+            <span>
+              The <code style={{ fontFamily: font.mono }}>vta/credentials</code> family declares
+              only <code style={{ fontFamily: font.mono }}>issue</code> and{" "}
+              <code style={{ fontFamily: font.mono }}>revoke</code> — your agent exposes no way
+              to ask what it has issued, so showing you a table here would mean inventing one.
+              The audit trail records every issuance and is the honest place to look.{" "}
+              <button
+                onClick={onOpenAudit}
+                style={{
+                  border: "none",
+                  background: "none",
+                  padding: 0,
+                  color: c.accent,
+                  cursor: "pointer",
+                  font: "inherit",
+                  textDecoration: "underline",
+                }}
+              >
+                Open the audit trail
+              </button>
+              .
+            </span>
+          </div>
+        </Note>
+        <div style={{ fontSize: t.sm, color: c.muted, lineHeight: 1.55 }}>
+          Issuing as <Did value={parties.service.did} size={t.xs} />
+        </div>
+      </Panel>
+
+      <IssueCredential parties={parties} authority={authority} />
+      <RevokeCredential parties={parties} authority={authority} />
+
+      <Panel
+        title="Credentials this agent holds"
+        description="Not built yet, and deliberately not approximated."
+      >
+        <Note tone="accent">
+          The holder side lives in a different task family (
+          <code style={{ fontFamily: font.mono }}>vault/credentials/*</code>: query, get, receive,
+          archive, restore, purge), and that family ships no TypeScript bindings in{" "}
+          <code style={{ fontFamily: font.mono }}>@openvtc/trust-tasks</code>. Transcribing those
+          shapes by hand is a copy that drifts from the schemas the agent is generated from —
+          this repo removed one such copy already — so this half waits for the bindings rather
+          than guessing at them.
+        </Note>
+      </Panel>
+    </div>
+  );
+}
diff --git a/packages/extension/src/manager/panes/memory.tsx b/packages/extension/src/manager/panes/memory.tsx
new file mode 100644
index 0000000..e3548a7
--- /dev/null
+++ b/packages/extension/src/manager/panes/memory.tsx
@@ -0,0 +1,333 @@
+// Agent memory — what your agent has been told to remember.
+//
+// `vta/memory/*`: plain string key/value, scoped to a context. This is the
+// store behind the memory tooling an assistant uses, so what is listed here is
+// what it will recall in a future conversation — which makes deletion the
+// operation that matters most. A memory formed from a misunderstanding does not
+// decay; it gets recalled, acted on, and quietly shapes answers until somebody
+// removes it.
+//
+// **`contextId` is required**, and the module says why: memory has no global
+// namespace. The context is the isolation boundary — an agent scoped elsewhere
+// cannot see these — so, as with app-state, there is no agent-wide list to
+// show and the pane asks for a context instead of inventing one.
+//
+// ## Writing by hand
+//
+// `memoryPut` is offered here, and it is worth being clear about what it does:
+// a memory written from this console is stored identically to one the agent
+// formed during a conversation. There is no provenance marker in the record, so
+// nothing downstream can tell them apart — the value is simply what the agent
+// will recall. Useful for correcting; not a place to be casual.
+
+import { useCallback, useMemo, useState } from "react";
+import { memoryDelete, memoryList, memoryPut } from "@openvtc/pnm-core/admin";
+import { Button, Note, Panel } from "../../ui.js";
+import { c, t, font } from "../../theme.js";
+import { managerSender } from "../sender.js";
+import { ConsentRequiredError } from "../carrier.js";
+import { ConsentCeremony, Destructive, runMutation } from "../destructive.js";
+import { Loading, LoadError, Table, type Column } from "../table.js";
+import { useAsync } from "../use-async.js";
+import { hasRole, type Authority, type Parties } from "../use-vta.js";
+import type { ContextSelection } from "../context-column.js";
+
+interface MemoryItem {
+  key: string;
+  value: string;
+}
+
+const fieldStyle: React.CSSProperties = {
+  boxSizing: "border-box",
+  padding: "6px 9px",
+  background: c.ground,
+  color: c.text,
+  border: `1px solid ${c.line}`,
+  borderRadius: "var(--w-r-sm)",
+  fontSize: t.sm,
+};
+
+function WriteMemory({
+  parties,
+  contextId,
+  authority,
+  existing,
+  onDone,
+  onCancel,
+}: {
+  parties: Parties;
+  contextId: string;
+  authority: Authority | null;
+  existing?: MemoryItem;
+  onDone: () => void;
+  onCancel?: () => void;
+}) {
+  const [key, setKey] = useState(existing?.key ?? "");
+  const [value, setValue] = useState(existing?.value ?? "");
+  const [busy, setBusy] = useState(false);
+  const [error, setError] = useState<string | null>(null);
+  const [pending, setPending] = useState<ConsentRequiredError | null>(null);
+
+  const denied = authority && !hasRole(authority, "admin", "super-admin", "operator")
+    ? "Writing memory needs an administrative role at this agent."
+    : null;
+
+  const save = useCallback(async () => {
+    setBusy(true);
+    setError(null);
+    setPending(null);
+    const ok = await runMutation(
+      async () => {
+        await memoryPut(managerSender, {
+          ...parties,
+          contextId,
+          key: key.trim(),
+          value,
+        });
+      },
+      { onConsent: setPending, onError: setError },
+    );
+    setBusy(false);
+    if (ok) onDone();
+  }, [parties, contextId, key, value, onDone]);
+
+  return (
+    <Panel
+      title={existing ? `Edit ${existing.key}` : "New memory"}
+      description={
+        existing
+          ? "Writing replaces whatever this key held. There is no version check on this " +
+            "family, so a write here wins over anything stored since this editor opened."
+          : "Your agent will recall this in future conversations, exactly as if it had formed " +
+            "the memory itself — nothing in the record marks it as hand-written."
+      }
+    >
+      <div style={{ display: "grid", gap: 10 }}>
+        <label style={{ display: "grid", gap: 4 }}>
+          <span style={{ fontSize: t.xs, color: c.muted }}>KEY</span>
+          <input
+            style={{ ...fieldStyle, fontFamily: font.mono }}
+            value={key}
+            onChange={(e) => setKey(e.target.value)}
+            disabled={Boolean(existing)}
+          />
+        </label>
+        {existing && (
+          <span style={{ fontSize: t.xs, color: c.faint }}>
+            The key is the record's address. To rename, write a new memory and forget this one.
+          </span>
+        )}
+        <label style={{ display: "grid", gap: 4 }}>
+          <span style={{ fontSize: t.xs, color: c.muted }}>VALUE</span>
+          <textarea
+            style={{ ...fieldStyle, minHeight: 110, width: "100%", lineHeight: 1.55, resize: "vertical" }}
+            value={value}
+            onChange={(e) => setValue(e.target.value)}
+          />
+        </label>
+
+        {error && <Note tone="danger">{error}</Note>}
+        {pending && <ConsentCeremony pending={pending} />}
+
+        <div style={{ display: "flex", gap: 8 }}>
+          <Button
+            kind="primary"
+            disabled={busy || !key.trim() || !value.trim() || Boolean(denied)}
+            {...(denied ? { title: denied } : {})}
+            onClick={() => void save()}
+          >
+            {busy ? "Saving…" : existing ? "Save" : "Remember this"}
+          </Button>
+          {onCancel && (
+            <Button kind="quiet" disabled={busy} onClick={onCancel}>
+              Cancel
+            </Button>
+          )}
+        </div>
+        {denied && <span style={{ fontSize: t.sm, color: c.muted }}>{denied}</span>}
+      </div>
+    </Panel>
+  );
+}
+
+export function MemoryPane({
+  parties,
+  authority,
+  contextId,
+  contextHeading,
+}: {
+  parties: Parties;
+  authority: Authority | null;
+  contextId: ContextSelection;
+  contextHeading?: string | undefined;
+}) {
+  const [filter, setFilter] = useState("");
+  const [editing, setEditing] = useState<MemoryItem | null>(null);
+  const [creating, setCreating] = useState(false);
+
+  const list = useAsync(
+    async () => (contextId ? memoryList(managerSender, { ...parties, contextId }) : null),
+    [parties.holder.did, parties.service.did, contextId],
+  );
+
+  const items = list.data ?? [];
+  // Filtering happens here because `vta/memory/list` takes no filter — the
+  // agent sends the whole context. Said plainly rather than implied, so the
+  // count below is not mistaken for a server-side search.
+  const shown = useMemo(() => {
+    const needle = filter.trim().toLowerCase();
+    if (!needle) return items;
+    return items.filter(
+      (i) => i.key.toLowerCase().includes(needle) || i.value.toLowerCase().includes(needle),
+    );
+  }, [items, filter]);
+
+  const denied = authority && !hasRole(authority, "admin", "super-admin", "operator")
+    ? "Forgetting a memory needs an administrative role at this agent."
+    : null;
+
+  if (!contextId) {
+    return (
+      <Panel
+        title="Agent memory"
+        description="What your agent remembers between conversations."
+      >
+        <Note tone="accent">
+          <strong>Select a context in the tree.</strong> Memory has no global namespace — the
+          context is the isolation boundary, and an agent scoped to a different one cannot see
+          these at all. There is no agent-wide list to show you.
+        </Note>
+      </Panel>
+    );
+  }
+
+  const done = () => {
+    setEditing(null);
+    setCreating(false);
+    list.reload();
+  };
+
+  if (editing) {
+    return (
+      <WriteMemory
+        parties={parties}
+        contextId={contextId}
+        authority={authority}
+        existing={editing}
+        onDone={done}
+        onCancel={() => setEditing(null)}
+      />
+    );
+  }
+
+  const columns: Column<MemoryItem>[] = [
+    {
+      key: "key",
+      header: "Key",
+      width: "220px",
+      render: (m) => (
+        <span style={{ fontFamily: font.mono, fontSize: t.xs, wordBreak: "break-word" }}>
+          {m.key}
+        </span>
+      ),
+    },
+    {
+      key: "value",
+      header: "Remembered",
+      render: (m) => (
+        <span style={{ lineHeight: 1.55, whiteSpace: "pre-wrap", wordBreak: "break-word" }}>
+          {m.value}
+        </span>
+      ),
+    },
+    {
+      key: "actions",
+      header: "",
+      render: (m) => (
+        <div style={{ display: "grid", gap: 8, minWidth: 190 }}>
+          <Button kind="quiet" onClick={() => setEditing(m)}>
+            Edit
+          </Button>
+          <Destructive<MemoryItem>
+            label="Forget"
+            disabledReason={denied}
+            preview={async () => m}
+            renderPreview={(p) => (
+              <>
+                <strong>Forgetting this cannot be undone.</strong>
+                <span style={{ fontFamily: font.mono, fontSize: t.xs }}>{p.key}</span>
+                <span style={{ whiteSpace: "pre-wrap" }}>{p.value}</span>
+                <span>
+                  Your agent stops recalling this in future conversations. Anything it has
+                  already said or done on the strength of it is unaffected.
+                </span>
+              </>
+            )}
+            commit={async () => {
+              await memoryDelete(managerSender, { ...parties, contextId, key: m.key });
+            }}
+            onDone={done}
+          />
+        </div>
+      ),
+    },
+  ];
+
+  return (
+    <div style={{ display: "grid", gap: 16, alignContent: "start" }}>
+      <Panel
+        title={`Memory in ${contextHeading ?? contextId}`}
+        description="What your agent will recall in future conversations. A memory formed from a
+          misunderstanding does not decay on its own — this is where it gets removed."
+      >
+        <div style={{ display: "flex", gap: 10, flexWrap: "wrap", alignItems: "flex-end" }}>
+          <label style={{ display: "grid", gap: 4, flex: "1 1 320px" }}>
+            <span style={{ fontSize: t.xs, color: c.muted }}>FILTER</span>
+            <input
+              style={fieldStyle}
+              value={filter}
+              onChange={(e) => setFilter(e.target.value)}
+              placeholder="key or text"
+            />
+          </label>
+          {filter.trim() && (
+            <span style={{ fontSize: t.sm, color: c.muted, paddingBottom: 7 }}>
+              {shown.length} of {items.length}
+            </span>
+          )}
+        </div>
+
+        {list.error && <LoadError what="agent memory" error={list.error} />}
+        {list.loading && !list.data && <Loading what="agent memory" />}
+        {list.data && (
+          <Table
+            columns={columns}
+            rows={shown}
+            rowKey={(m) => m.key}
+            empty={
+              filter.trim()
+                ? "Nothing here matches that. Clear the filter to see the rest."
+                : `Your agent remembers nothing in ${contextId}.`
+            }
+          />
+        )}
+
+        {!creating && (
+          <div>
+            <Button onClick={() => setCreating(true)}>New memory</Button>
+          </div>
+        )}
+      </Panel>
+
+      {creating && (
+        <WriteMemory
+          parties={parties}
+          contextId={contextId}
+          authority={authority}
+          onDone={done}
+          onCancel={() => setCreating(false)}
+        />
+      )}
+    </div>
+  );
+}
diff --git a/packages/extension/src/manager/shell.tsx b/packages/extension/src/manager/shell.tsx
index 0eebbb2..f871a21 100644
--- a/packages/extension/src/manager/shell.tsx
+++ b/packages/extension/src/manager/shell.tsx
@@ -27,6 +27,9 @@ import { ApprovalsPane } from "./panes/approvals.js";
 import { PolicyPane } from "./panes/policy.js";
 import { ServicesPane } from "./panes/services.js";
 import { AuditPane } from "./panes/audit.js";
+import { CredentialsPane } from "./panes/credentials.js";
+import { MemoryPane } from "./panes/memory.js";
+import { AppStatePane } from "./panes/app-state.js";
 import { managerSender } from "./sender.js";
 import { useVta, type Parties } from "./use-vta.js";
 import { contextHeading } from "./format.js";
@@ -36,6 +39,9 @@ export type SectionId =
   | "contexts"
   | "keys"
   | "dids"
+  | "credentials"
+  | "memory"
+  | "app-state"
   | "services"
   | "audit"
   | "access"
@@ -82,6 +88,23 @@ const ACTS: Act[] = [
       { id: "dids", label: "DIDs", contextScoped: true },
     ],
   },
+  {
+    // A fourth act, not in the deck. The three there answer "who am I", "how do
+    // bytes move" and "who may act"; none of them answers "what is stored
+    // here", which is the one question credentials, memory and app-state share.
+    title: "Data & credentials",
+    colour: "var(--m-act-data)",
+    soft: "var(--m-act-data-soft)",
+    sections: [
+      // Issuer-side only, and agent-wide: `vta/credentials` takes no context.
+      { id: "credentials", label: "Credentials", contextScoped: false },
+      // For both of these `contextId` is part of the record's address rather
+      // than a filter, so the pane refuses to answer agent-wide. The column is
+      // shown because the selection is required, not merely useful.
+      { id: "memory", label: "Memory", contextScoped: true },
+      { id: "app-state", label: "App state", contextScoped: true },
+    ],
+  },
   {
     title: "Wire & execution",
     colour: "var(--m-act-wire)",
@@ -283,6 +306,32 @@ export function ManagerShell() {
             contextHeading={heading}
           />
         );
+      case "credentials":
+        return (
+          <CredentialsPane
+            parties={parties}
+            authority={vta.authority}
+            onOpenAudit={() => go("audit")}
+          />
+        );
+      case "memory":
+        return (
+          <MemoryPane
+            parties={parties}
+            authority={vta.authority}
+            contextId={selected}
+            contextHeading={heading}
+          />
+        );
+      case "app-state":
+        return (
+          <AppStatePane
+            parties={parties}
+            authority={vta.authority}
+            contextId={selected}
+            contextHeading={heading}
+          />
+        );
       case "services":
         return <ServicesPane parties={parties} authority={vta.authority} />;
       case "audit":
@@ -317,7 +366,7 @@ export function ManagerShell() {
       case "sessions":
         return <SessionsPane parties={parties} authority={vta.authority} />;
     }
-  }, [vta, parties, section, contexts.records, selected, heading, onChanged]);
+  }, [vta, parties, section, contexts.records, selected, heading, onChanged, go]);
 
   if (vta.status === "loading") {
     return <Centered>Reading your wallet's connection…</Centered>;

From 6e2b83267b7e2d7182cdc360c2b817cb478186c4 Mon Sep 17 00:00:00 2001
From: Glenn Gore <glenn.g@affinidi.com>
Date: Tue, 1 Sep 2026 16:23:53 +0200
Subject: [PATCH 04/24] feat(console): the credentials this agent holds
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Closes the half the credentials pane has been carrying a placeholder for.
`vault/credentials/*` had no specification, so no bindings, so nothing to
implement against without hand-transcribing shapes out of someone's service
code. trustoverip/dtgwg-trust-tasks-tf#338 specified the family from that
implementation and shipped in @openvtc/trust-tasks 0.16.4; this consumes it.

`vault/credentials.ts` in core is the client — query, get, receive, and the
five lifecycle verbs. It sits beside the password-manager vault because they
share the wire slug and the agent's keyspace, and the module header says why
they are otherwise different things (disjoint namespaces, a presentable VC
rather than a raw secret, no sealed envelope).

Two properties the pane renders rather than flattens:

**Query refuses an unconstrained filter**, because the answer would be the
shape of the holder's whole life — every community, every role, every issuer.
`isRunnableCredentialQuery` is exported so a caller can check locally: the
Search control stays disabled and explains itself instead of firing a request
whose refusal the operator would have to interpret. The two tick-boxes widen a
search rather than narrowing one, so they deliberately do not count.

**Validity and lifecycle are orthogonal**, so they get separate columns. Against
representative data that is immediately load-bearing: an invitation that is
expired but active, a role that is valid but archived, a membership that is
revoked and in the trash with its restore deadline shown. A single "status"
column would have been wrong about three of the four, and the available actions
follow lifecycle — archive, unarchive, restore or purge — rather than validity.

Delete previews as recoverable and says what recovery would cost (going back to
the issuer, which for an invitation may not be possible at all); purge previews
as the thing with no way back, and is offered only on a row that is already a
tombstone.

`credVaultGet` is in core and deliberately not wired to a button. It is the only
call that returns credential contents, and a console has no reason to fetch a
body it would only display — presentation is use, not administration, the same
line `keysSign` sits on the far side of.

The task-surface ratchet moves 152 -> 160. Its comment listed this family as
unspecced; that is now the eight that moved, and the remaining 17 are named.

Signed-off-by: Glenn Gore <glenn.g@affinidi.com>
---
 package-lock.json                             |   9 +-
 package.json                                  |   3 +
 packages/core/src/vault/credentials.ts        | 340 ++++++++++++++++++
 packages/core/src/vault/index.ts              |   4 +
 packages/core/tests/task-surface.mjs          |  27 +-
 .../src/manager/panes/credentials.tsx         | 333 +++++++++++++++--
 6 files changed, 682 insertions(+), 34 deletions(-)
 create mode 100644 packages/core/src/vault/credentials.ts

diff --git a/package-lock.json b/package-lock.json
index 880320f..ec01f21 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -15,6 +15,9 @@
         "packages/demo-rp",
         "packages/reviewer-demo"
       ],
+      "dependencies": {
+        "@openvtc/trust-tasks": "^0.16.4"
+      },
       "engines": {
         "node": ">=24"
       }
@@ -2301,9 +2304,9 @@
       "link": true
     },
     "node_modules/@openvtc/trust-tasks": {
-      "version": "0.16.3",
-      "resolved": "https://registry.npmjs.org/@openvtc/trust-tasks/-/trust-tasks-0.16.3.tgz",
-      "integrity": "sha512-dEWebVgAEvjc7rqfAkAT96sDiVSvTSxv1HGfrCI5XxYk7DfNNHToNGZeppAseMJM2/nuvLinDyhXoQis6XgbTA==",
+      "version": "0.16.4",
+      "resolved": "https://registry.npmjs.org/@openvtc/trust-tasks/-/trust-tasks-0.16.4.tgz",
+      "integrity": "sha512-ugLhwyotd2HiHv/FH9hUNfqMI3I7M3iej3ekReXSCRQ7SgeDzaeIppjivlcNOS7KjTlVu46k3r4AA5rvZkHfyA==",
       "license": "Apache-2.0"
     },
     "node_modules/@openvtc/vti-didcomm-js": {
diff --git a/package.json b/package.json
index a5819ce..c130abb 100644
--- a/package.json
+++ b/package.json
@@ -26,5 +26,8 @@
   "overrides": {
     "uuid": "^11.1.1",
     "esbuild": "^0.28.1"
+  },
+  "dependencies": {
+    "@openvtc/trust-tasks": "^0.16.4"
   }
 }
diff --git a/packages/core/src/vault/credentials.ts b/packages/core/src/vault/credentials.ts
new file mode 100644
index 0000000..4953b9a
--- /dev/null
+++ b/packages/core/src/vault/credentials.ts
@@ -0,0 +1,340 @@
+// The credential vault — the W3C credentials a holder **holds**.
+//
+// `vault/credentials/*`: invitations, memberships, roles. It shares the `vault`
+// slug and the agent's `vault` keyspace with the password-manager surface in
+// this directory, and is otherwise a different thing — the two use disjoint key
+// namespaces, and a credential body is a presentable VC rather than a raw
+// secret, so nothing here builds or opens a sealed envelope.
+//
+// Distinct again from `../credentials/`, which is the *exchange* protocol
+// (offer, request, present), and from `../admin/credentials.ts`, which is the
+// agent as an **issuer**. This module is the holder's own store.
+//
+// ## Query enumerates; get discloses
+//
+// `credVaultQuery` returns body-free descriptors and `credVaultGet` returns the
+// credential itself, and they are separate calls on purpose: a consumer can
+// browse its own vault continuously while the far narrower act of reading a
+// credential's contents stays a separate, separately-recorded request. A caller
+// that finds itself calling `credVaultGet` in a loop to populate a list has
+// mistaken the two.
+//
+// **`credVaultQuery` refuses an unconstrained filter**, and so must callers.
+// An empty filter returns the shape of the holder's whole life — every
+// community, every role, every issuer — so the agent rejects it rather than
+// answering. `includeArchived` and `includeDeleted` are modifiers and do not
+// satisfy the requirement; `{ includeDeleted: true }` alone is an enumeration
+// wearing a flag. {@link isRunnableCredentialQuery} is the local check, so a
+// caller can disable a control rather than discover this from a rejection.
+//
+// Wire types come from `@openvtc/trust-tasks`, generated from the same JSON
+// Schemas the agent is generated from. Specified in
+// `dtgwg-trust-tasks-tf#338`, which wrote the family down from the
+// implementation that had been dispatching it unspecified.
+
+import type { TaskParty, TrustTaskSender } from "../vta/channel.js";
+import { buildTrustTask } from "../vta/trust-task.js";
+
+import {
+  TYPE_URI as CRED_QUERY,
+  RESPONSE_TYPE_URI as CRED_QUERY_RESPONSE,
+  type VaultCredentialsQueryResponsePayload,
+  type CredentialDescriptor,
+  type CredentialStatus,
+} from "@openvtc/trust-tasks/vault/credentials/query/0.1/payload";
+import {
+  TYPE_URI as CRED_GET,
+  RESPONSE_TYPE_URI as CRED_GET_RESPONSE,
+  type VaultCredentialsGetResponsePayload,
+} from "@openvtc/trust-tasks/vault/credentials/get/0.1/payload";
+import {
+  TYPE_URI as CRED_RECEIVE,
+  RESPONSE_TYPE_URI as CRED_RECEIVE_RESPONSE,
+  type VaultCredentialsReceiveResponsePayload,
+} from "@openvtc/trust-tasks/vault/credentials/receive/0.1/payload";
+import {
+  TYPE_URI as CRED_ARCHIVE,
+  RESPONSE_TYPE_URI as CRED_ARCHIVE_RESPONSE,
+} from "@openvtc/trust-tasks/vault/credentials/archive/0.1/payload";
+import {
+  TYPE_URI as CRED_UNARCHIVE,
+  RESPONSE_TYPE_URI as CRED_UNARCHIVE_RESPONSE,
+} from "@openvtc/trust-tasks/vault/credentials/unarchive/0.1/payload";
+import {
+  TYPE_URI as CRED_DELETE,
+  RESPONSE_TYPE_URI as CRED_DELETE_RESPONSE,
+} from "@openvtc/trust-tasks/vault/credentials/delete/0.1/payload";
+import {
+  TYPE_URI as CRED_RESTORE,
+  RESPONSE_TYPE_URI as CRED_RESTORE_RESPONSE,
+} from "@openvtc/trust-tasks/vault/credentials/restore/0.1/payload";
+import {
+  TYPE_URI as CRED_PURGE,
+  RESPONSE_TYPE_URI as CRED_PURGE_RESPONSE,
+} from "@openvtc/trust-tasks/vault/credentials/purge/0.1/payload";
+
+export type { CredentialDescriptor, CredentialStatus };
+
+/** Archival state. **Orthogonal to validity** — a credential can be `valid`
+ *  and `archived`, or `revoked` and `active`. A caller that collapses the two
+ *  axes mis-renders its own vault: "can I present this?" needs both, and only
+ *  an `active` one may be presented. */
+export type CredentialLifecycle = "active" | "archived" | "deleted";
+
+export interface CredVaultCallerParams {
+  /** Envelope `issuer`. */
+  holder: TaskParty;
+  /** The agent — envelope `recipient`. */
+  service: TaskParty;
+}
+
+/** The indexed fields a query may constrain on. At least one is REQUIRED. */
+export interface CredentialFilter {
+  /** Match credentials carrying this VC `type` tag. */
+  type?: string;
+  /** Match credentials held for this community or context DID. */
+  communityDid?: string;
+  /** Match credentials from this issuer DID. */
+  issuerDid?: string;
+  /** Match the agent's semantic classification — `invite`, `membership`,
+   *  `role`, `endorsement`, `personhood`, or an agent-defined token. */
+  purpose?: string;
+  /** Match the validity dimension. */
+  status?: CredentialStatus;
+}
+
+export interface CredVaultQueryParams extends CredVaultCallerParams, CredentialFilter {
+  /** Also return archived credentials. A **modifier, not a filter** — it does
+   *  not satisfy the at-least-one-filter requirement. */
+  includeArchived?: boolean;
+  /** Also return soft-deleted tombstones, so a trash view can offer restore or
+   *  purge. Same modifier semantics. */
+  includeDeleted?: boolean;
+}
+
+/**
+ * Whether this filter is one the agent will run.
+ *
+ * Exported so a caller can decide *before* sending — a search box that knows
+ * an empty query is refused can stay disabled and say why, rather than firing a
+ * request that comes back as an error the user has to interpret.
+ *
+ * The modifiers are deliberately not counted. They widen what a filter matches;
+ * they do not constrain anything.
+ */
+export function isRunnableCredentialQuery(filter: CredentialFilter): boolean {
+  return Boolean(
+    filter.type || filter.communityDid || filter.issuerDid || filter.purpose || filter.status,
+  );
+}
+
+/**
+ * Search stored credentials. Returns **body-free** descriptors.
+ *
+ * Throws before sending when the filter constrains nothing — the agent would
+ * refuse it as an enumeration, and failing here names the reason at the call
+ * site instead of surfacing a `filterRequired` from three layers down.
+ */
+export async function credVaultQuery(
+  sender: TrustTaskSender,
+  params: CredVaultQueryParams,
+): Promise<CredentialDescriptor[]> {
+  if (!isRunnableCredentialQuery(params)) {
+    throw new Error(
+      "vault/credentials/query needs at least one of type, communityDid, issuerDid, purpose " +
+        "or status. An unconstrained query enumerates the whole vault and the agent refuses " +
+        "it; includeArchived and includeDeleted are modifiers and do not count.",
+    );
+  }
+  const envelope = buildTrustTask(
+    CRED_QUERY,
+    {
+      ...(params.type ? { type: params.type } : {}),
+      ...(params.communityDid ? { communityDid: params.communityDid } : {}),
+      ...(params.issuerDid ? { issuerDid: params.issuerDid } : {}),
+      ...(params.purpose ? { purpose: params.purpose } : {}),
+      ...(params.status ? { status: params.status } : {}),
+      ...(params.includeArchived ? { includeArchived: true } : {}),
+      ...(params.includeDeleted ? { includeDeleted: true } : {}),
+    },
+    { issuer: params.holder.did, recipient: params.service.did },
+  );
+  const res = await sender.send<VaultCredentialsQueryResponsePayload>(envelope, {
+    expectedResponseType: CRED_QUERY_RESPONSE,
+    operationLabel: "vault/credentials/query/0.1",
+  });
+  return res.credentials ?? [];
+}
+
+export interface CredVaultGetParams extends CredVaultCallerParams {
+  /** Handle from a {@link CredentialDescriptor}. Opaque — never derive one. */
+  id: string;
+}
+
+/**
+ * Fetch one credential's full body, for presentation.
+ *
+ * The only call in this module that returns credential contents. An archived or
+ * soft-deleted credential is not returned: those states mean "not for use", and
+ * a body handed back is a body that can be presented.
+ *
+ * Hold the result no longer than the presentation it was fetched for. The agent
+ * remains the record — only it sees a later revocation or lifecycle change, and
+ * a cached body outlives both.
+ */
+export async function credVaultGet(
+  sender: TrustTaskSender,
+  params: CredVaultGetParams,
+): Promise<Record<string, unknown>> {
+  const envelope = buildTrustTask(
+    CRED_GET,
+    { id: params.id },
+    { issuer: params.holder.did, recipient: params.service.did },
+  );
+  const res = await sender.send<VaultCredentialsGetResponsePayload>(envelope, {
+    expectedResponseType: CRED_GET_RESPONSE,
+    operationLabel: "vault/credentials/get/0.1",
+  });
+  return res.credential as Record<string, unknown>;
+}
+
+export interface CredVaultReceiveParams extends CredVaultCallerParams {
+  /** The verifiable credential. */
+  credential: Record<string, unknown>;
+  /** Handle to store under. Absent, the agent derives one from the
+   *  credential's own `id`. Supplying it makes a retry after an ambiguous
+   *  failure replace rather than duplicate. */
+  id?: string;
+  /** Context to hold it in. Absent, the caller's own. */
+  contextId?: string;
+  /** Credential format, where the body does not make it evident. */
+  format?: string;
+}
+
+/**
+ * Verify and store a received credential.
+ *
+ * The agent verifies the proof against the issuer key resolved from its DID
+ * **before** storing, and stores nothing that fails. There is no `purpose`
+ * parameter on purpose: the agent derives the classification from the
+ * credential's type tags, so a caller cannot file a credential under a
+ * classification its contents do not support.
+ */
+export async function credVaultReceive(
+  sender: TrustTaskSender,
+  params: CredVaultReceiveParams,
+): Promise<VaultCredentialsReceiveResponsePayload> {
+  const envelope = buildTrustTask(
+    CRED_RECEIVE,
+    {
+      credential: params.credential,
+      ...(params.id ? { id: params.id } : {}),
+      ...(params.contextId ? { contextId: params.contextId } : {}),
+      ...(params.format ? { format: params.format } : {}),
+    },
+    { issuer: params.holder.did, recipient: params.service.did },
+  );
+  return sender.send<VaultCredentialsReceiveResponsePayload>(envelope, {
+    expectedResponseType: CRED_RECEIVE_RESPONSE,
+    operationLabel: "vault/credentials/receive/0.1",
+  });
+}
+
+/** What a lifecycle transition reports back. `lifecycle` is the state *after*
+ *  it — echoed rather than inferred from the verb that was called. */
+export interface CredVaultLifecycleResult {
+  id: string;
+  lifecycle: CredentialLifecycle;
+  /** Restore deadline. Present after a default `delete`; **absent after a
+   *  forced one**, and that absence is how a caller knows nothing can be
+   *  restored. */
+  graceUntil?: string;
+}
+
+export interface CredVaultLifecycleParams extends CredVaultCallerParams {
+  id: string;
+  /** Recorded with the transition. Must not carry credential contents — it
+   *  lands in a trail read by people entitled to know a credential changed
+   *  state without being entitled to know what it said. */
+  reason?: string;
+}
+
+function lifecycleCall(
+  sender: TrustTaskSender,
+  params: CredVaultLifecycleParams,
+  type: string,
+  responseType: string,
+  label: string,
+  extra: Record<string, unknown> = {},
+): Promise<CredVaultLifecycleResult> {
+  const envelope = buildTrustTask(
+    type,
+    { id: params.id, ...(params.reason ? { reason: params.reason } : {}), ...extra },
+    { issuer: params.holder.did, recipient: params.service.did },
+  );
+  return sender.send<CredVaultLifecycleResult>(envelope, {
+    expectedResponseType: responseType,
+    operationLabel: label,
+  });
+}
+
+/** Hide from default query results and refuse for presentation. Reversible
+ *  with {@link credVaultUnarchive}; the credential is untouched. */
+export function credVaultArchive(
+  sender: TrustTaskSender,
+  params: CredVaultLifecycleParams,
+): Promise<CredVaultLifecycleResult> {
+  return lifecycleCall(
+    sender, params, CRED_ARCHIVE, CRED_ARCHIVE_RESPONSE, "vault/credentials/archive/0.1");
+}
+
+/** Return an archived credential to active. Refuses a soft-deleted one — that
+ *  comes back through {@link credVaultRestore}, which has a deadline. */
+export function credVaultUnarchive(
+  sender: TrustTaskSender,
+  params: CredVaultLifecycleParams,
+): Promise<CredVaultLifecycleResult> {
+  return lifecycleCall(
+    sender, params, CRED_UNARCHIVE, CRED_UNARCHIVE_RESPONSE, "vault/credentials/unarchive/0.1");
+}
+
+export interface CredVaultDeleteParams extends CredVaultLifecycleParams {
+  /**
+   * Erase immediately instead of tombstoning. **Irrecoverable** — no grace
+   * window, no restore, and the result carries no `graceUntil`.
+   *
+   * The default path exists because a credential cannot be re-obtained by
+   * asking nicely: re-issuance means going back to the issuer, and for an
+   * invitation or a one-time membership that may not be possible at all.
+   */
+  force?: boolean;
+}
+
+/** Move to a recoverable tombstone, or erase outright with `force`. */
+export function credVaultDelete(
+  sender: TrustTaskSender,
+  params: CredVaultDeleteParams,
+): Promise<CredVaultLifecycleResult> {
+  return lifecycleCall(
+    sender, params, CRED_DELETE, CRED_DELETE_RESPONSE, "vault/credentials/delete/0.1",
+    params.force ? { force: true } : {});
+}
+
+/** Return a soft-deleted credential to active, while its grace window lasts.
+ *  After `graceUntil` the agent has erased it and there is nothing to restore. */
+export function credVaultRestore(
+  sender: TrustTaskSender,
+  params: CredVaultLifecycleParams,
+): Promise<CredVaultLifecycleResult> {
+  return lifecycleCall(
+    sender, params, CRED_RESTORE, CRED_RESTORE_RESPONSE, "vault/credentials/restore/0.1");
+}
+
+/** Erase immediately and irrecoverably. No tombstone, no grace window. */
+export function credVaultPurge(
+  sender: TrustTaskSender,
+  params: CredVaultLifecycleParams,
+): Promise<CredVaultLifecycleResult> {
+  return lifecycleCall(
+    sender, params, CRED_PURGE, CRED_PURGE_RESPONSE, "vault/credentials/purge/0.1");
+}
diff --git a/packages/core/src/vault/index.ts b/packages/core/src/vault/index.ts
index 74bc0cf..ca449fc 100644
--- a/packages/core/src/vault/index.ts
+++ b/packages/core/src/vault/index.ts
@@ -5,5 +5,9 @@ export * from "./delete.js";
 export * from "./release.js";
 export * from "./proxy-login.js";
 export * from "./sign-trust-task.js";
+// The credential vault — the credentials a holder *holds*. Shares this slug
+// and the agent's keyspace with the secrets surface above, and is otherwise a
+// different store; see the module header.
+export * from "./credentials.js";
 export * from "./task-signer.js";
 export type { VtaAuthInputs } from "../vta/auth.js";
diff --git a/packages/core/tests/task-surface.mjs b/packages/core/tests/task-surface.mjs
index f7aa593..c684a36 100644
--- a/packages/core/tests/task-surface.mjs
+++ b/packages/core/tests/task-surface.mjs
@@ -178,21 +178,28 @@ test("coverage against the agent's surface is recorded, not discovered", () => {
     [...REFERENCED.keys()].map(family).filter((f) => canonicalFamilies.has(f)),
   );
 
-  // 152 of 177 as of vta-sdk 0.29.0. It was 130 until the specced-but-
+  // 160 of 177 as of vta-sdk 0.29.0. It was 130 until the specced-but-
   // unimplemented gap was closed in one pass: `trust-task-discovery/0.1`,
   // `acl/update/0.1`, `vta/webvh/servers/retire-orphan/0.1`,
   // `vtc/members/removal-notice/0.1`, `vta/app-state/*` (6), `vta/services/*`
   // (8), `vta/credentials/{issue,revoke}/0.1`, and
   // `auth/passkey/login/{start,finish}/0.2`.
   //
-  // **All 25 still outstanding are unspecced** — no schema in the registry, so
-  // no binding in @openvtc/trust-tasks to implement against: `vault/*`'s
-  // archive/restore/purge/unarchive and its whole `credentials` sub-family,
-  // `vta/backup/*`, `vta/attestation/*`, `vta/seeds/*`,
-  // `vta/audit/*-retention`, and `vta/management/reload-services`. That makes
-  // this number, for the first time, a statement about upstream rather than
-  // about this repo: it moves when a spec lands, not when someone here finds
-  // time.
+  // 152 -> 160 is the whole `vault/credentials/*` sub-family — receive, query,
+  // get, archive, unarchive, delete, restore, purge — which moved here from
+  // the unspecced list rather than from a backlog. The agent had been
+  // dispatching all eight with no schema in the registry; specifying them
+  // (trustoverip/dtgwg-trust-tasks-tf#338, shipped in @openvtc/trust-tasks
+  // 0.16.4) is what produced bindings to implement against.
+  //
+  // **All 17 still outstanding are unspecced** — no schema in the registry, so
+  // no binding in @openvtc/trust-tasks to implement against: `vault/*`'s own
+  // archive/restore/purge/unarchive (the *secrets* lifecycle, distinct from
+  // the credential one above), `vta/backup/*`, `vta/attestation/*`,
+  // `vta/seeds/*`, `vta/audit/*-retention`, and
+  // `vta/management/reload-services`. That keeps this number a statement about
+  // upstream rather than about this repo: it moves when a spec lands, and the
+  // last eight moved because one did.
   //
   // **Nothing is behind any more.** Every implemented family names the newest
   // version `vta-sdk` publishes: `vault/{list,get,upsert}` and
@@ -203,7 +210,7 @@ test("coverage against the agent's surface is recorded, not discovered", () => {
   // the agent does not name, rather than as a deprecation warning. That is the
   // expected shape of a cutover here: nothing is deployed, so neither side
   // keeps an old version alive.
-  const expected = 152;
+  const expected = 160;
   assert.equal(
     implemented.size,
     expected,
diff --git a/packages/extension/src/manager/panes/credentials.tsx b/packages/extension/src/manager/panes/credentials.tsx
index 4146b28..9ad62b0 100644
--- a/packages/extension/src/manager/panes/credentials.tsx
+++ b/packages/extension/src/manager/panes/credentials.tsx
@@ -14,18 +14,40 @@
 // the pane points at it.
 //
 // The holder side — the credentials this agent *holds* — lives in a different
-// family again (`vault/credentials/*`), which ships no TypeScript bindings in
-// `@openvtc/trust-tasks`. Writing those shapes by hand here is exactly the
-// copy-that-drifts this repo already removed once, so that half waits for the
-// bindings rather than being approximated.
+// family again (`vault/credentials/*`) and is in `HeldCredentials` below. It
+// waited on `trustoverip/dtgwg-trust-tasks-tf#338`, which specified that family
+// from the implementation that had been dispatching it unspecified; before that
+// there were no bindings and hand-transcribing the shapes would have been the
+// copy-that-drifts this repo has removed once already.
+//
+// Two things that surface carries which a list of credentials would otherwise
+// flatten. **Query refuses an unconstrained filter** — an empty one returns the
+// shape of the holder's whole life, so the pane requires a filter and says so
+// rather than firing a request it knows will be refused. And **validity and
+// lifecycle are orthogonal**: a credential can be `valid` and `archived`, or
+// `revoked` and `active`, so both are rendered and neither is derived from the
+// other.
 
-import { useCallback, useState } from "react";
+import { useCallback, useMemo, useState } from "react";
 import { issueCredential, revokeCredential } from "@openvtc/pnm-core/admin";
-import { Button, Did, Note, Panel } from "../../ui.js";
+import {
+  credVaultArchive,
+  credVaultDelete,
+  credVaultPurge,
+  credVaultQuery,
+  credVaultRestore,
+  credVaultUnarchive,
+  isRunnableCredentialQuery,
+  type CredentialDescriptor,
+  type CredentialFilter,
+} from "@openvtc/pnm-core";
+import { Button, Did, Note, Panel, Pill } from "../../ui.js";
 import { c, t, font } from "../../theme.js";
 import { managerSender } from "../sender.js";
 import { ConsentRequiredError } from "../carrier.js";
-import { ConsentCeremony, runMutation } from "../destructive.js";
+import { ConsentCeremony, Destructive, runMutation } from "../destructive.js";
+import { Loading, LoadError, Table, type Column } from "../table.js";
+import { formatDate, isPast } from "../format.js";
 import { hasRole, type Authority, type Parties } from "../use-vta.js";
 
 const DAY = 86400;
@@ -339,6 +361,288 @@ function RevokeCredential({
   );
 }
 
+/** Validity and lifecycle are separate axes, so they get separate pills. A
+ *  single "status" column would have to pick one and would be wrong about the
+ *  other — a revoked-but-active credential and a valid-but-archived one are
+ *  both real, and mean opposite things. */
+function ValidityPill({ status }: { status: CredentialDescriptor["status"] }) {
+  const tone = status === "valid" ? "ok" : status === "unknown" ? "off" : "danger";
+  return <Pill tone={tone}>{status}</Pill>;
+}
+
+function LifecyclePill({ record }: { record: CredentialDescriptor }) {
+  const state = record.lifecycle ?? "active";
+  if (state === "active") return <Pill tone="ok">active</Pill>;
+  if (state === "archived") return <Pill tone="off">archived</Pill>;
+  // A tombstone's grace window is the whole reason to show this row: after it
+  // passes the agent has erased the credential and restore does nothing.
+  const expired = isPast(record.graceUntil);
+  return (
+    <div style={{ display: "grid", gap: 2 }}>
+      <Pill tone="danger">deleted</Pill>
+      <span style={{ fontSize: t.xs, color: expired ? c.faint : c.warn, whiteSpace: "nowrap" }}>
+        {record.graceUntil
+          ? expired
+            ? "grace expired"
+            : `restorable until ${formatDate(record.graceUntil)}`
+          : "not restorable"}
+      </span>
+    </div>
+  );
+}
+
+function HeldCredentials({
+  parties,
+  authority,
+}: {
+  parties: Parties;
+  authority: Authority | null;
+}) {
+  const [filter, setFilter] = useState<CredentialFilter>({});
+  const [applied, setApplied] = useState<CredentialFilter | null>(null);
+  const [includeArchived, setIncludeArchived] = useState(false);
+  const [includeDeleted, setIncludeDeleted] = useState(false);
+  const [rows, setRows] = useState<CredentialDescriptor[] | null>(null);
+  const [loading, setLoading] = useState(false);
+  const [error, setError] = useState<string | null>(null);
+
+  // The agent refuses an unconstrained query, so the control is disabled rather
+  // than firing a request whose refusal the operator would have to interpret.
+  const runnable = isRunnableCredentialQuery(filter);
+
+  const search = useCallback(
+    async (f: CredentialFilter = filter, arch = includeArchived, del = includeDeleted) => {
+      if (!isRunnableCredentialQuery(f)) return;
+      setLoading(true);
+      setError(null);
+      try {
+        setRows(await credVaultQuery(managerSender, {
+          ...parties, ...f, includeArchived: arch, includeDeleted: del,
+        }));
+        setApplied(f);
+      } catch (e) {
+        setError(e instanceof Error ? e.message : String(e));
+      } finally {
+        setLoading(false);
+      }
+    },
+    [parties, filter, includeArchived, includeDeleted],
+  );
+
+  const reload = useCallback(() => {
+    if (applied) void search(applied, includeArchived, includeDeleted);
+  }, [applied, search, includeArchived, includeDeleted]);
+
+  const denied = authority && !hasRole(authority, "admin", "super-admin", "operator")
+    ? "Changing a stored credential needs an administrative role at this agent."
+    : null;
+
+  const set = (k: keyof CredentialFilter) => (e: React.ChangeEvent<HTMLInputElement | HTMLSelectElement>) =>
+    setFilter((prev) => {
+      const next = { ...prev };
+      if (e.target.value) (next as Record<string, string>)[k] = e.target.value;
+      else delete next[k];
+      return next;
+    });
+
+  const columns: Column<CredentialDescriptor>[] = useMemo(() => [
+    {
+      key: "types",
+      header: "Credential",
+      render: (r) => (
+        <div style={{ display: "grid", gap: 2 }}>
+          <span style={{ fontWeight: 600 }}>
+            {r.types.filter((x) => x !== "VerifiableCredential").join(", ") || "VerifiableCredential"}
+          </span>
+          <span style={{ fontFamily: font.mono, fontSize: t.xs, color: c.faint }}>{r.id}</span>
+        </div>
+      ),
+    },
+    {
+      key: "issuer",
+      header: "Issuer",
+      render: (r) => (r.issuerDid ? <Did value={r.issuerDid} size={t.xs} /> : <span style={{ color: c.faint }}>—</span>),
+    },
+    {
+      key: "purpose",
+      header: "Purpose",
+      render: (r) => <span style={{ color: c.muted }}>{r.purpose ?? "—"}</span>,
+    },
+    { key: "validity", header: "Validity", render: (r) => <ValidityPill status={r.status} /> },
+    { key: "lifecycle", header: "State", render: (r) => <LifecyclePill record={r} /> },
+    {
+      key: "until",
+      header: "Valid until",
+      render: (r) => (
+        <span style={{ color: c.muted, whiteSpace: "nowrap" }}>{formatDate(r.validUntil, "—")}</span>
+      ),
+    },
+    {
+      key: "actions",
+      header: "",
+      render: (r) => {
+        const state = r.lifecycle ?? "active";
+        return (
+          <div style={{ display: "grid", gap: 8, minWidth: 200 }}>
+            {state === "active" && (
+              <Button
+                kind="quiet"
+                disabled={Boolean(denied)}
+                {...(denied ? { title: denied } : {})}
+                onClick={() => void credVaultArchive(managerSender, { ...parties, id: r.id }).then(reload)}
+              >
+                Archive
+              </Button>
+            )}
+            {state === "archived" && (
+              <Button
+                kind="quiet"
+                disabled={Boolean(denied)}
+                {...(denied ? { title: denied } : {})}
+                onClick={() => void credVaultUnarchive(managerSender, { ...parties, id: r.id }).then(reload)}
+              >
+                Unarchive
+              </Button>
+            )}
+            {state === "deleted" && !isPast(r.graceUntil) && (
+              <Button
+                kind="quiet"
+                disabled={Boolean(denied)}
+                {...(denied ? { title: denied } : {})}
+                onClick={() => void credVaultRestore(managerSender, { ...parties, id: r.id }).then(reload)}
+              >
+                Restore
+              </Button>
+            )}
+            {state !== "deleted" ? (
+              <Destructive<CredentialDescriptor>
+                label="Delete"
+                disabledReason={denied}
+                preview={async () => r}
+                renderPreview={(p) => (
+                  <>
+                    <strong>This moves the credential to the trash, recoverably.</strong>
+                    <span>
+                      It stops being presentable straight away. Your agent keeps it until its
+                      grace window passes, then erases it — after that, getting it back means
+                      going back to {p.issuerDid ? "the issuer" : "whoever issued it"}, which for
+                      an invitation or a one-time membership may not be possible at all.
+                    </span>
+                  </>
+                )}
+                commit={async () => {
+                  await credVaultDelete(managerSender, { ...parties, id: r.id });
+                }}
+                onDone={reload}
+              />
+            ) : (
+              <Destructive<CredentialDescriptor>
+                label="Purge"
+                disabledReason={denied}
+                preview={async () => r}
+                renderPreview={() => (
+                  <>
+                    <strong>Purging erases this now, and nothing can bring it back.</strong>
+                    <span>
+                      Not a faster delete — it skips the grace window entirely. Use it when the
+                      requirement is that the material stop existing.
+                    </span>
+                  </>
+                )}
+                commit={async () => {
+                  await credVaultPurge(managerSender, { ...parties, id: r.id });
+                }}
+                onDone={reload}
+              />
+            )}
+          </div>
+        );
+      },
+    },
+  ], [parties, denied, reload]);
+
+  return (
+    <Panel
+      title="Credentials this agent holds"
+      description="Invitations, memberships and roles issued to you and stored by your agent.
+        Searching returns metadata only — your agent never puts a credential's contents in a
+        search result."
+    >
+      <div style={{ display: "flex", gap: 10, flexWrap: "wrap", alignItems: "flex-end" }}>
+        <label style={{ display: "grid", gap: 4, flex: "1 1 200px" }}>
+          <Label>Type</Label>
+          <input style={fieldStyle} value={filter.type ?? ""} onChange={set("type")}
+            placeholder="MembershipCredential" />
+        </label>
+        <label style={{ display: "grid", gap: 4, flex: "1 1 200px" }}>
+          <Label>Purpose</Label>
+          <input style={fieldStyle} value={filter.purpose ?? ""} onChange={set("purpose")}
+            placeholder="membership" />
+        </label>
+        <label style={{ display: "grid", gap: 4, flex: "1 1 240px" }}>
+          <Label>Issuer DID</Label>
+          <input style={{ ...fieldStyle, fontFamily: font.mono }} value={filter.issuerDid ?? ""}
+            onChange={set("issuerDid")} />
+        </label>
+        <label style={{ display: "grid", gap: 4 }}>
+          <Label>Validity</Label>
+          <select style={fieldStyle} value={filter.status ?? ""} onChange={set("status")}>
+            <option value="">any</option>
+            <option value="valid">valid</option>
+            <option value="expired">expired</option>
+            <option value="revoked">revoked</option>
+            <option value="unknown">unknown</option>
+          </select>
+        </label>
+        <div style={{ paddingBottom: 1 }}>
+          <Button
+            kind="primary"
+            disabled={!runnable || loading}
+            {...(!runnable ? { title: "Set at least one filter — see below." } : {})}
+            onClick={() => void search()}
+          >
+            {loading ? "Searching…" : "Search"}
+          </Button>
+        </div>
+      </div>
+
+      <div style={{ display: "flex", gap: 16, flexWrap: "wrap" }}>
+        <label style={{ display: "flex", gap: 7, alignItems: "center", fontSize: t.sm }}>
+          <input type="checkbox" checked={includeArchived}
+            onChange={(e) => { setIncludeArchived(e.target.checked); if (applied) void search(applied, e.target.checked, includeDeleted); }} />
+          Include archived
+        </label>
+        <label style={{ display: "flex", gap: 7, alignItems: "center", fontSize: t.sm }}>
+          <input type="checkbox" checked={includeDeleted}
+            onChange={(e) => { setIncludeDeleted(e.target.checked); if (applied) void search(applied, includeArchived, e.target.checked); }} />
+          Include deleted (trash)
+        </label>
+      </div>
+
+      {!runnable && (
+        <Note tone="accent">
+          <strong>Set at least one filter.</strong> Your agent refuses a search that constrains
+          nothing, because the answer would be the shape of everything you hold — every community,
+          every role, every issuer. The two tick-boxes widen a search rather than narrowing one,
+          so they do not count on their own.
+        </Note>
+      )}
+
+      {error && <LoadError what="your stored credentials" error={error} />}
+      {loading && !rows && <Loading what="your stored credentials" />}
+
+      {rows && (
+        <Table
+          columns={columns}
+          rows={rows}
+          rowKey={(r) => r.id}
+          empty="Nothing matches that filter. Your agent answered — this is not a failed search."
+        />
+      )}
+    </Panel>
+  );
+}
+
 export function CredentialsPane({
   parties,
   authority,
@@ -391,20 +695,7 @@ export function CredentialsPane({
       <IssueCredential parties={parties} authority={authority} />
       <RevokeCredential parties={parties} authority={authority} />
 
-      <Panel
-        title="Credentials this agent holds"
-        description="Not built yet, and deliberately not approximated."
-      >
-        <Note tone="accent">
-          The holder side lives in a different task family (
-          <code style={{ fontFamily: font.mono }}>vault/credentials/*</code>: query, get, receive,
-          archive, restore, purge), and that family ships no TypeScript bindings in{" "}
-          <code style={{ fontFamily: font.mono }}>@openvtc/trust-tasks</code>. Transcribing those
-          shapes by hand is a copy that drifts from the schemas the agent is generated from —
-          this repo removed one such copy already — so this half waits for the bindings rather
-          than guessing at them.
-        </Note>
-      </Panel>
+      <HeldCredentials parties={parties} authority={authority} />
     </div>
   );
 }

From ed5e3f77060fc1a224d9db725dd1f999dec68059 Mon Sep 17 00:00:00 2001
From: Glenn Gore <glenn.g@affinidi.com>
Date: Wed, 2 Sep 2026 06:58:53 +0200
Subject: [PATCH 05/24] feat(console): the issued-credentials list, and the
 notice it replaces
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The credentials pane opened with a notice rather than a table:

    There is no list of issued credentials, and this is not an empty one.

That was true, and building the empty table would have been the easy lie —
it reads as "you have issued nothing" and is wrong the moment anything has
been. The task now exists, so the notice becomes what it was standing in for.

The chain that got here, in order: the gap was filed
(trust-tasks-tf#337), specified (trust-tasks-tf#342), implemented in the
agent (verifiable-trust-infrastructure#1235), released
(@openvtc/trust-tasks 0.16.6, vta-sdk 0.32.3), and is now consumed here.
The console kept saying "there is no list" for all of it, which was the
honest thing to say while it was true.

`listCredentials` in core admin returns metadata only — there is no task that
reads a credential body back, and this console does not pretend otherwise.
Its `holderDid` is named for the *subject* rather than `holder`, matching
`issueCredential`, because `holder` on the caller params is the envelope's
issuer: two different parties would otherwise share one member name on one
object.

The pane renders two things the shape makes easy to lose. `truncated` goes
*above* the table, because it changes what the list means — anything concluded
from a partial page, including that a credential was never issued, may be
wrong — and a caution under a long list is one nobody reads. And `status` is
derived by the agent at read time with `revoked` beating `expired`, so it is
painted as received and never recomputed or cached here.

Revoking is now a row action that hands its id to the form below. The id is an
opaque UUID, and asking an operator to copy one by eye immediately before an
irreversible action is how the wrong credential gets revoked.

Two pieces of copy that the new list made false are corrected rather than left
standing: the revoke panel no longer says there is nothing to pick from, and
its confirm no longer claims the console can show nothing about the credential
— it can show who holds it and when it was issued, and still cannot show what
it claims. That last limit is real and stays stated.

Task-surface ratchet 160 -> 161, canonical total 177 -> 178. Unlike the eight
before it, this family did not move off the unspecced list — the task did not
exist on either side until this month.

Signed-off-by: Glenn Gore <glenn.g@affinidi.com>
---
 package-lock.json                             |   8 +-
 package.json                                  |   2 +-
 packages/core/src/admin/credentials.ts        |  87 +++++
 packages/core/task-surface.json               |  15 +-
 packages/core/tests/task-surface.mjs          |  13 +-
 .../src/manager/panes/credentials.tsx         | 318 +++++++++++++++---
 6 files changed, 385 insertions(+), 58 deletions(-)

diff --git a/package-lock.json b/package-lock.json
index ec01f21..6e96ede 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -16,7 +16,7 @@
         "packages/reviewer-demo"
       ],
       "dependencies": {
-        "@openvtc/trust-tasks": "^0.16.4"
+        "@openvtc/trust-tasks": "^0.16.6"
       },
       "engines": {
         "node": ">=24"
@@ -2304,9 +2304,9 @@
       "link": true
     },
     "node_modules/@openvtc/trust-tasks": {
-      "version": "0.16.4",
-      "resolved": "https://registry.npmjs.org/@openvtc/trust-tasks/-/trust-tasks-0.16.4.tgz",
-      "integrity": "sha512-ugLhwyotd2HiHv/FH9hUNfqMI3I7M3iej3ekReXSCRQ7SgeDzaeIppjivlcNOS7KjTlVu46k3r4AA5rvZkHfyA==",
+      "version": "0.16.6",
+      "resolved": "https://registry.npmjs.org/@openvtc/trust-tasks/-/trust-tasks-0.16.6.tgz",
+      "integrity": "sha512-Uf1PPzkYAlhtkW04FdwTLbAMoI+xl2ckFs/rigNvsP198Eujr8lJORZX1/DX9yLxRAKqjhP2TumJW5QKDgxx6Q==",
       "license": "Apache-2.0"
     },
     "node_modules/@openvtc/vti-didcomm-js": {
diff --git a/package.json b/package.json
index c130abb..b7854c5 100644
--- a/package.json
+++ b/package.json
@@ -28,6 +28,6 @@
     "esbuild": "^0.28.1"
   },
   "dependencies": {
-    "@openvtc/trust-tasks": "^0.16.4"
+    "@openvtc/trust-tasks": "^0.16.6"
   }
 }
diff --git a/packages/core/src/admin/credentials.ts b/packages/core/src/admin/credentials.ts
index 103f16b..d43b576 100644
--- a/packages/core/src/admin/credentials.ts
+++ b/packages/core/src/admin/credentials.ts
@@ -14,6 +14,14 @@
 import type { TaskParty, TrustTaskSender } from "../vta/channel.js";
 import { buildTrustTask } from "../vta/trust-task.js";
 
+import {
+  TYPE_URI as CREDENTIALS_LIST,
+  RESPONSE_TYPE_URI as CREDENTIALS_LIST_RESPONSE,
+  type VTACredentialsListResponsePayload,
+  type IssuedCredentialSummary,
+  type IssuedCredentialStatus,
+} from "@openvtc/trust-tasks/vta/credentials/list/0.1/payload";
+
 import {
   TYPE_URI as CREDENTIALS_ISSUE,
   RESPONSE_TYPE_URI as CREDENTIALS_ISSUE_RESPONSE,
@@ -126,3 +134,82 @@ export async function revokeCredential(
     operationLabel: "vta/credentials/revoke/0.1",
   });
 }
+
+export type { IssuedCredentialSummary, IssuedCredentialStatus };
+
+export interface ListCredentialsParams extends CredentialIssuerCallerParams {
+  /**
+   * Only credentials issued to this DID.
+   *
+   * Named `holderDid` rather than `holder` — matching {@link issueCredential} —
+   * because `holder` on the caller params is the envelope's *issuer*, this
+   * library's own identity. Two different parties would otherwise share one
+   * member name on the same object.
+   */
+  holderDid?: string;
+  /** Only credentials carrying this type tag beyond `VerifiableCredential`. */
+  credentialType?: string;
+  /** Only credentials in this state. */
+  status?: IssuedCredentialStatus;
+  /** Maximum records to return. The agent caps this. */
+  pageSize?: number;
+  /** Continue a previous page. Opaque — never construct or parse one. */
+  cursor?: string;
+}
+
+export interface ListCredentialsResult {
+  credentials: IssuedCredentialSummary[];
+  /** The agent stopped early. **Check this before drawing conclusions** — a
+   *  truncated page is not a complete account of what was issued, and reading
+   *  "nothing else was issued" off one is the mistake the member exists to
+   *  prevent. */
+  truncated: boolean;
+  /** Pass as `cursor` to continue. Absent on the last page, so a caller stops
+   *  on its absence rather than needing an empty page to learn it is done. */
+  cursor?: string;
+}
+
+/**
+ * What this agent has issued, as metadata.
+ *
+ * **No credential bodies.** `vault/list/0.1` states the rule this family
+ * follows — list enumerates, release uses — and an issuer that needs a body
+ * minted it and got it back from {@link issueCredential}. A caller reaching for
+ * this to populate claim data has mistaken it for a read of the credentials
+ * themselves; there is no such task.
+ *
+ * `status` is derived by the agent when it answers, never stored, and
+ * `revoked` takes precedence over `expired` — a credential revoked before its
+ * window closed is revoked, and reading it as merely expired hides that
+ * somebody acted. Do not cache the result: a cached page reports a credential
+ * as active after it has been revoked.
+ *
+ * Unlike the holder-side `credVaultQuery`, an unfiltered call is answered. The
+ * caller here is the issuer reading a record of its own past actions rather
+ * than a delegate reading someone's private store.
+ */
+export async function listCredentials(
+  sender: TrustTaskSender,
+  params: ListCredentialsParams,
+): Promise<ListCredentialsResult> {
+  const envelope = buildTrustTask(
+    CREDENTIALS_LIST,
+    {
+      ...(params.holderDid ? { holder: params.holderDid } : {}),
+      ...(params.credentialType ? { credentialType: params.credentialType } : {}),
+      ...(params.status ? { status: params.status } : {}),
+      ...(params.pageSize !== undefined ? { pageSize: params.pageSize } : {}),
+      ...(params.cursor ? { cursor: params.cursor } : {}),
+    },
+    { issuer: params.holder.did, recipient: params.service.did },
+  );
+  const res = await sender.send<VTACredentialsListResponsePayload>(envelope, {
+    expectedResponseType: CREDENTIALS_LIST_RESPONSE,
+    operationLabel: "vta/credentials/list/0.1",
+  });
+  return {
+    credentials: res.credentials ?? [],
+    truncated: res.truncated ?? false,
+    ...(res.cursor ? { cursor: res.cursor } : {}),
+  };
+}
diff --git a/packages/core/task-surface.json b/packages/core/task-surface.json
index 9deb470..535ab34 100644
--- a/packages/core/task-surface.json
+++ b/packages/core/task-surface.json
@@ -2,7 +2,7 @@
   "$comment": "Generated by scripts/sync-task-surface.mjs from a vta-sdk checkout. Do not hand-edit: re-run the script. Checked by tests/task-surface.mjs.",
   "source": {
     "crate": "vta-sdk",
-    "version": "0.30.0",
+    "version": "0.32.3",
     "scanned": "vta-sdk/src/**/*.rs"
   },
   "tasks": [
@@ -416,10 +416,16 @@
       "uri": "https://trusttasks.org/spec/provision/integration/0.1"
     },
     {
-      "uri": "https://trusttasks.org/spec/provision/integration/0.2"
+      "uri": "https://trusttasks.org/spec/provision/integration/0.2",
+      "consts": [
+        "V0_2"
+      ]
     },
     {
-      "uri": "https://trusttasks.org/spec/provision/integration/0.3"
+      "uri": "https://trusttasks.org/spec/provision/integration/0.3",
+      "consts": [
+        "V0_3"
+      ]
     },
     {
       "uri": "https://trusttasks.org/spec/push/wake/0.2"
@@ -672,6 +678,9 @@
     {
       "uri": "https://trusttasks.org/spec/vta/credentials/issue/0.2"
     },
+    {
+      "uri": "https://trusttasks.org/spec/vta/credentials/list/0.1"
+    },
     {
       "uri": "https://trusttasks.org/spec/vta/credentials/revoke/0.1"
     },
diff --git a/packages/core/tests/task-surface.mjs b/packages/core/tests/task-surface.mjs
index c684a36..9c53021 100644
--- a/packages/core/tests/task-surface.mjs
+++ b/packages/core/tests/task-surface.mjs
@@ -178,13 +178,22 @@ test("coverage against the agent's surface is recorded, not discovered", () => {
     [...REFERENCED.keys()].map(family).filter((f) => canonicalFamilies.has(f)),
   );
 
-  // 160 of 177 as of vta-sdk 0.29.0. It was 130 until the specced-but-
+  // 161 of 178 as of vta-sdk 0.32.3. It was 130 until the specced-but-
   // unimplemented gap was closed in one pass: `trust-task-discovery/0.1`,
   // `acl/update/0.1`, `vta/webvh/servers/retire-orphan/0.1`,
   // `vtc/members/removal-notice/0.1`, `vta/app-state/*` (6), `vta/services/*`
   // (8), `vta/credentials/{issue,revoke}/0.1`, and
   // `auth/passkey/login/{start,finish}/0.2`.
   //
+  // 160 -> 161 is `vta/credentials/list/0.1`, and the canonical total moved
+  // with it (177 -> 178) because the task did not exist on either side before.
+  // Specified at trustoverip/dtgwg-trust-tasks-tf#342 and implemented at
+  // OpenVTC/verifiable-trust-infrastructure#1235, in response to a gap this
+  // console surfaced: `revoke` is keyed on a `credentialId` that `issue`
+  // returns exactly once, so an issuer that had not recorded it could not ask.
+  // Unlike the eight below, this is not a family that moved off the unspecced
+  // list — it is new.
+  //
   // 152 -> 160 is the whole `vault/credentials/*` sub-family — receive, query,
   // get, archive, unarchive, delete, restore, purge — which moved here from
   // the unspecced list rather than from a backlog. The agent had been
@@ -210,7 +219,7 @@ test("coverage against the agent's surface is recorded, not discovered", () => {
   // the agent does not name, rather than as a deprecation warning. That is the
   // expected shape of a cutover here: nothing is deployed, so neither side
   // keeps an old version alive.
-  const expected = 160;
+  const expected = 161;
   assert.equal(
     implemented.size,
     expected,
diff --git a/packages/extension/src/manager/panes/credentials.tsx b/packages/extension/src/manager/panes/credentials.tsx
index 9ad62b0..67682e6 100644
--- a/packages/extension/src/manager/panes/credentials.tsx
+++ b/packages/extension/src/manager/panes/credentials.tsx
@@ -1,17 +1,23 @@
 // Credentials — what this agent issues to others, and takes back.
 //
-// ## What this pane cannot do, and why it says so
+// ## What it took to show the issued list
 //
-// `vta/credentials` declares exactly two tasks: `issue` and `revoke`. There is
-// **no list**. So this console can mint a credential and revoke one by id, and
-// it genuinely cannot show you what has been issued — not because the pane is
-// unfinished, but because the agent exposes no way to ask.
+// `vta/credentials` declared `issue` and `revoke` and nothing else, so this
+// pane spent its first version saying so — "there is no list of issued
+// credentials, and this is not an empty one" — rather than rendering a blank
+// table, which would have read as "you have issued nothing" and been wrong the
+// moment anything had been.
 //
-// That is stated on the surface rather than hidden behind an empty table. A
-// blank list would read as "you have issued nothing", which is a claim this
-// console has no basis for and which would be wrong the moment anything had
-// been issued. The audit trail is the honest answer for "what happened", and
-// the pane points at it.
+// The task now exists: specified at trustoverip/dtgwg-trust-tasks-tf#342 and
+// implemented at OpenVTC/verifiable-trust-infrastructure#1235. `IssuedList`
+// below is what the notice became.
+//
+// Two things it renders that the shape makes easy to lose. `truncated` means
+// the agent stopped early, so a caller must not read the page as a complete
+// account of what was issued — it is surfaced above the table rather than
+// below it. And `status` is derived by the agent at read time with `revoked`
+// beating `expired`, so it is never cached and never recomputed here: a copy
+// of a fact about the clock is wrong from the first second after it is made.
 //
 // The holder side — the credentials this agent *holds* — lives in a different
 // family again (`vault/credentials/*`) and is in `HeldCredentials` below. It
@@ -28,8 +34,13 @@
 // `revoked` and `active`, so both are rendered and neither is derived from the
 // other.
 
-import { useCallback, useMemo, useState } from "react";
-import { issueCredential, revokeCredential } from "@openvtc/pnm-core/admin";
+import { useCallback, useEffect, useMemo, useState } from "react";
+import {
+  issueCredential,
+  listCredentials,
+  revokeCredential,
+  type IssuedCredentialSummary,
+} from "@openvtc/pnm-core/admin";
 import {
   credVaultArchive,
   credVaultDelete,
@@ -47,6 +58,7 @@ import { managerSender } from "../sender.js";
 import { ConsentRequiredError } from "../carrier.js";
 import { ConsentCeremony, Destructive, runMutation } from "../destructive.js";
 import { Loading, LoadError, Table, type Column } from "../table.js";
+import { useAsync } from "../use-async.js";
 import { formatDate, isPast } from "../format.js";
 import { hasRole, type Authority, type Parties } from "../use-vta.js";
 
@@ -247,9 +259,15 @@ function IssueCredential({
 function RevokeCredential({
   parties,
   authority,
+  prefillId,
+  onConsumed,
 }: {
   parties: Parties;
   authority: Authority | null;
+  /** A credential id picked from the list above, so an operator never copies an
+   *  opaque identifier by eye before an irreversible action. */
+  prefillId?: string | null;
+  onConsumed?: () => void;
 }) {
   const [credentialId, setCredentialId] = useState("");
   const [reason, setReason] = useState("");
@@ -263,6 +281,17 @@ function RevokeCredential({
     ? "Revoking a credential needs the admin role at this agent."
     : null;
 
+  // A pick from the list replaces whatever was typed, and clears any previous
+  // outcome — a stale "Revoked." beside a different id reads as a result for
+  // the one now in the field.
+  useEffect(() => {
+    if (!prefillId) return;
+    setCredentialId(prefillId);
+    setConfirming(false);
+    setDone(false);
+    setError(null);
+  }, [prefillId]);
+
   const submit = useCallback(async () => {
     setBusy(true);
     setError(null);
@@ -283,15 +312,15 @@ function RevokeCredential({
       setConfirming(false);
       setCredentialId("");
       setReason("");
+      onConsumed?.();
     }
-  }, [parties, credentialId, reason]);
+  }, [parties, credentialId, reason, onConsumed]);
 
   return (
     <Panel
       title="Revoke a credential"
-      description="By id. There is no list to pick from — your agent exposes no way to enumerate
-        what it has issued, so the id has to come from wherever you recorded it, or from the
-        audit trail."
+      description="By id. Pick a row above and its id lands here — copying an opaque identifier
+        by eye before an irreversible action is how the wrong credential gets revoked."
     >
       <div style={{ display: "grid", gap: 10, maxWidth: 680 }}>
         <label style={{ display: "grid", gap: 4 }}>
@@ -322,15 +351,16 @@ function RevokeCredential({
           <>
             <Note tone="danger">
               <div style={{ display: "grid", gap: 6 }}>
-                <strong>Revoking cannot be undone, and cannot be previewed.</strong>
+                <strong>Revoking cannot be undone.</strong>
                 <span style={{ fontFamily: font.mono, fontSize: t.xs, wordBreak: "break-all" }}>
                   {credentialId.trim()}
                 </span>
                 <span>
-                  Your agent offers no way to read a credential back, so this console cannot show
-                  you whose it is or what it says before you revoke it — check the id against
-                  your own records first. Whoever holds it stops being able to present it
-                  anywhere that checks revocation.
+                  Whoever holds this stops being able to present it anywhere that checks
+                  revocation. The list above shows who holds it and when it was issued; what it
+                  actually <em>claims</em> cannot be shown — there is no task that reads a
+                  credential body back — so if the claims are what you are deciding on, check
+                  your own records first.
                 </span>
               </div>
             </Note>
@@ -643,34 +673,164 @@ function HeldCredentials({
   );
 }
 
-export function CredentialsPane({
+/** Validity of an issued credential. Derived by the agent at read time — see
+ *  the header — so this only paints what it was told. */
+function IssuedStatus({ row }: { row: IssuedCredentialSummary }) {
+  if (row.status === "revoked") {
+    return (
+      <div style={{ display: "grid", gap: 2 }}>
+        <Pill tone="danger">revoked</Pill>
+        {row.revokedAt && (
+          <span style={{ fontSize: t.xs, color: c.muted, whiteSpace: "nowrap" }}>
+            {formatDate(row.revokedAt)}
+          </span>
+        )}
+        {row.revocationReason && (
+          <span style={{ fontSize: t.xs, color: c.faint, maxWidth: 200, lineHeight: 1.4 }}>
+            {row.revocationReason}
+          </span>
+        )}
+      </div>
+    );
+  }
+  return <Pill tone={row.status === "active" ? "ok" : "off"}>{row.status}</Pill>;
+}
+
+function IssuedList({
   parties,
   authority,
-  onOpenAudit,
+  onRevoke,
 }: {
   parties: Parties;
   authority: Authority | null;
-  /** Send the operator to the pane that *can* answer "what was issued". */
-  onOpenAudit: () => void;
+  /** Hand a credential id to the revoke form below, so an operator never has to
+   *  copy an opaque identifier by eye. */
+  onRevoke: (credentialId: string) => void;
 }) {
+  const [holderDid, setHolderDid] = useState("");
+  const [status, setStatus] = useState("");
+  const [applied, setApplied] = useState({ holderDid: "", status: "" });
+  const [pageSize, setPageSize] = useState(50);
+
+  const list = useAsync(
+    () =>
+      listCredentials(managerSender, {
+        ...parties,
+        pageSize,
+        ...(applied.holderDid ? { holderDid: applied.holderDid } : {}),
+        ...(applied.status
+          ? { status: applied.status as IssuedCredentialSummary["status"] }
+          : {}),
+      }),
+    [parties.holder.did, parties.service.did, applied.holderDid, applied.status, pageSize],
+  );
+
+  const denied = authority && !hasRole(authority, "admin", "super-admin", "operator")
+    ? "Reading the issuance log needs an administrative role at this agent."
+    : null;
+
+  const columns: Column<IssuedCredentialSummary>[] = [
+    {
+      key: "id",
+      header: "Credential",
+      render: (r) => (
+        <div style={{ display: "grid", gap: 2 }}>
+          <span style={{ fontWeight: 600 }}>{r.credentialType ?? "VerifiableCredential"}</span>
+          <span
+            style={{ fontFamily: font.mono, fontSize: t.xs, color: c.faint, wordBreak: "break-all" }}
+          >
+            {r.credentialId}
+          </span>
+        </div>
+      ),
+    },
+    { key: "holder", header: "Issued to", render: (r) => <Did value={r.holder} size={t.xs} /> },
+    { key: "status", header: "Status", render: (r) => <IssuedStatus row={r} /> },
+    {
+      key: "issued",
+      header: "Issued",
+      render: (r) => (
+        <span style={{ color: c.muted, whiteSpace: "nowrap" }}>{formatDate(r.issuedAt)}</span>
+      ),
+    },
+    {
+      key: "expires",
+      header: "Expires",
+      render: (r) => (
+        <span style={{ color: c.muted, whiteSpace: "nowrap" }}>{formatDate(r.expiresAt)}</span>
+      ),
+    },
+    {
+      key: "actions",
+      header: "",
+      render: (r) =>
+        r.status === "revoked" ? (
+          <span style={{ color: c.faint, fontSize: t.xs }}>revoked</span>
+        ) : (
+          <Button
+            kind="quiet"
+            disabled={Boolean(denied)}
+            {...(denied ? { title: denied } : {})}
+            onClick={() => onRevoke(r.credentialId)}
+          >
+            Revoke…
+          </Button>
+        ),
+    },
+  ];
+
   return (
-    <div style={{ display: "grid", gap: 16, alignContent: "start" }}>
-      <Panel
-        title="Credentials this agent issues"
-        description="Your agent as an issuer: minting credentials for others, and taking them
-          back."
-      >
-        <Note tone="warn">
-          <div style={{ display: "grid", gap: 6 }}>
-            <strong>There is no list of issued credentials, and this is not an empty one.</strong>
-            <span>
-              The <code style={{ fontFamily: font.mono }}>vta/credentials</code> family declares
-              only <code style={{ fontFamily: font.mono }}>issue</code> and{" "}
-              <code style={{ fontFamily: font.mono }}>revoke</code> — your agent exposes no way
-              to ask what it has issued, so showing you a table here would mean inventing one.
-              The audit trail records every issuance and is the honest place to look.{" "}
+    <Panel
+      title="Credentials this agent has issued"
+      description="Metadata only — your agent returns no claim bodies here, and this console does
+        not ask for any. Status is computed when the list is read, so it is current rather than
+        remembered."
+    >
+      <div style={{ display: "flex", gap: 10, flexWrap: "wrap", alignItems: "flex-end" }}>
+        <label style={{ display: "grid", gap: 4, flex: "1 1 300px" }}>
+          <Label>Holder DID</Label>
+          <input
+            style={{ ...fieldStyle, fontFamily: font.mono }}
+            value={holderDid}
+            onChange={(e) => setHolderDid(e.target.value)}
+            placeholder="all holders"
+          />
+        </label>
+        <label style={{ display: "grid", gap: 4 }}>
+          <Label>Status</Label>
+          <select style={fieldStyle} value={status} onChange={(e) => setStatus(e.target.value)}>
+            <option value="">any</option>
+            <option value="active">active</option>
+            <option value="expired">expired</option>
+            <option value="revoked">revoked</option>
+          </select>
+        </label>
+        <div style={{ paddingBottom: 1 }}>
+          <Button
+            onClick={() => {
+              setPageSize(50);
+              setApplied({ holderDid: holderDid.trim(), status });
+            }}
+          >
+            Filter
+          </Button>
+        </div>
+      </div>
+
+      {list.error && <LoadError what="the issuance log" error={list.error} />}
+      {list.loading && !list.data && <Loading what="the issuance log" />}
+
+      {list.data && (
+        <>
+          {/* Above the table. A caution under a long list is one nobody reads,
+              and this one changes what the list *means*. */}
+          {list.data.truncated && (
+            <Note tone="warn">
+              <strong>This is not everything your agent has issued.</strong> It stopped early, so
+              anything you conclude from what is below — including that a credential was never
+              issued — may be wrong.{" "}
               <button
-                onClick={onOpenAudit}
+                onClick={() => setPageSize((n) => n + 50)}
                 style={{
                   border: "none",
                   background: "none",
@@ -681,19 +841,81 @@ export function CredentialsPane({
                   textDecoration: "underline",
                 }}
               >
-                Open the audit trail
+                Load more
               </button>
-              .
-            </span>
-          </div>
-        </Note>
+              , or narrow by holder.
+            </Note>
+          )}
+          <Table
+            columns={columns}
+            rows={list.data.credentials}
+            rowKey={(r) => r.credentialId}
+            empty={
+              applied.holderDid || applied.status
+                ? "Nothing matches those filters. Clear them to see the rest."
+                : "Your agent has issued nothing yet."
+            }
+          />
+        </>
+      )}
+    </Panel>
+  );
+}
+
+export function CredentialsPane({
+  parties,
+  authority,
+  onOpenAudit,
+}: {
+  parties: Parties;
+  authority: Authority | null;
+  /** The audit trail — still the place that answers "what happened", which the
+   *  issuance list deliberately does not: one is a record of events, the other
+   *  a view of current state. */
+  onOpenAudit: () => void;
+}) {
+  // Set by a row's "Revoke…", read by the revoke form. The id is opaque and
+  // long, and asking an operator to copy one by eye before an irreversible
+  // action is how the wrong credential gets revoked.
+  const [revokeId, setRevokeId] = useState<string | null>(null);
+
+  return (
+    <div style={{ display: "grid", gap: 16, alignContent: "start" }}>
+      <Panel
+        title="Credentials this agent issues"
+        description="Your agent as an issuer: minting credentials for others, and taking them
+          back."
+      >
         <div style={{ fontSize: t.sm, color: c.muted, lineHeight: 1.55 }}>
-          Issuing as <Did value={parties.service.did} size={t.xs} />
+          Issuing as <Did value={parties.service.did} size={t.xs} />. For the history of
+          issuance and revocation events rather than what is current,{" "}
+          <button
+            onClick={onOpenAudit}
+            style={{
+              border: "none",
+              background: "none",
+              padding: 0,
+              color: c.accent,
+              cursor: "pointer",
+              font: "inherit",
+              textDecoration: "underline",
+            }}
+          >
+            open the audit trail
+          </button>
+          .
         </div>
       </Panel>
 
+      <IssuedList parties={parties} authority={authority} onRevoke={setRevokeId} />
+
       <IssueCredential parties={parties} authority={authority} />
-      <RevokeCredential parties={parties} authority={authority} />
+      <RevokeCredential
+        parties={parties}
+        authority={authority}
+        prefillId={revokeId}
+        onConsumed={() => setRevokeId(null)}
+      />
 
       <HeldCredentials parties={parties} authority={authority} />
     </div>

From 2421a63cb5e22917238e4dc9d5edd7c8fed59667 Mon Sep 17 00:00:00 2001
From: Glenn Gore <glenn.g@affinidi.com>
Date: Wed, 2 Sep 2026 07:15:31 +0200
Subject: [PATCH 06/24] ci: refuse key material in any extension bundle,
 console included
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

`vta/seeds/export-mnemonic/1.0` returns a BIP-39 mnemonic — the seed every
derived key in the agent comes from, and the one secret whose disclosure loses
everything at once. `list` and `rotate` are the rest of that family.

A second guard bans all three from anywhere in `dist/`, with **no exception**.
That is the difference from the admin guard beside it: `admin/*` is authority,
which the console is meant to hold, so that guard permits `manager.js`. These
return material, and no browser context should be able to ask for them.

The guard exists rather than simply not building the pane, because not building
it is indistinguishable from not having got round to it. Someone reasonable adds
a seeds view next year, nothing objects, and the refusal was never recorded
anywhere a person would look.

Verified non-vacuous the only way that means anything: a seeds URI imported into
the console, rebuilt, and the guard caught it in `manager.js` — the file the
admin guard would have let through. Reverted.

`vault/release/0.1` is deliberately not listed. It releases a secret to a site
the human just approved, which is the wallet's whole job. The line is not
"touches a secret" but "hands over material the holder cannot revoke, to a
surface that cannot contain it".

Signed-off-by: Glenn Gore <glenn.g@affinidi.com>
---
 .github/workflows/ci.yml | 32 ++++++++++++++++++++++++++++++++
 CLAUDE.md                | 34 ++++++++++++++++++++++++++++++++++
 2 files changed, 66 insertions(+)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index fede3b9..914fbe2 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -92,6 +92,38 @@ jobs:
           done
           echo "OK: admin task URIs appear only in manager.js"
 
+      # A second, stricter guard — and the difference from the one above is the
+      # point.
+      #
+      # That guard is about *authority*: `admin/*` grants and revokes it, and
+      # the console is deliberately the one surface that holds it, so it names
+      # `manager.js` as an exception.
+      #
+      # These tasks are about *material*. `vta/seeds/export-mnemonic/1.0`
+      # returns a BIP-39 mnemonic — the seed every derived key in the agent
+      # comes from — and `list`/`rotate` are the rest of that family's surface.
+      # There is no browser context that should be able to ask for them, so this
+      # guard has **no exception**: not the console, not the wallet, nowhere in
+      # `dist/`.
+      #
+      # It exists because the alternative is an omission, and an omission is
+      # indistinguishable from not having got to it yet. Someone reasonable
+      # could add a seeds pane next year and no one would know it was refused on
+      # purpose. This is what says so.
+      #
+      # `vault/release/0.1` is deliberately NOT here: it releases a secret to a
+      # site the human just approved, which is the wallet's whole job.
+      - name: Assert no key-material surface ships at all
+        run: |
+          for task in 'vta/seeds/list/1.0' 'vta/seeds/rotate/1.0' 'vta/seeds/export-mnemonic/1.0'; do
+            found=$(grep -rlF "$task" packages/extension/dist/ || true)
+            if [ -n "$found" ]; then
+              echo "::error::$found contains $task — this family returns key material and must not ship in any extension bundle, the console included. See CLAUDE.md."
+              exit 1
+            fi
+          done
+          echo "OK: no key-material task URIs anywhere in dist/"
+
       # The console's isolation rests on it being one self-contained file: the
       # guard above names exactly one exception, so a second chunk would be a
       # file nothing checks. Losing `codeSplitting: false` in a future upgrade
diff --git a/CLAUDE.md b/CLAUDE.md
index 212c515..b51852e 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -189,6 +189,40 @@ dispatch table; gating on `sender.id`; or widening the carrier to pass the
 envelope through. `tests/manager-sender.test.mts`,
 `tests/manager-surface.test.mts` and the two CI assertions pin each of these.
 
+## Key material never reaches a browser, and that is enforced
+
+`vta/seeds/*` — `list`, `rotate`, `export-mnemonic` — is the one task family
+this extension refuses outright. `export-mnemonic` returns a BIP-39 mnemonic:
+the seed every derived key in the agent comes from, and the one secret whose
+disclosure loses everything at once. `list` and `rotate` are the rest of that
+family's surface.
+
+**A second CI guard bans all three from anywhere in `dist/`, with no
+exception.** That is the difference from the admin guard above, and the
+difference is the point: `admin/*` is *authority*, which the console is meant to
+hold, so that guard names `manager.js` as its one permitted file. These return
+*material*, and no browser context should be able to ask for them — not the
+console, not the wallet, nowhere.
+
+**Why a guard rather than simply not building it.** Not building a seeds pane is
+indistinguishable from not having got round to one. Someone reasonable adds it
+next year, nothing objects, and the refusal was never recorded anywhere a person
+would look. The guard is what makes the decision legible; verified non-vacuous
+by importing a seeds URI into the console and watching it fail.
+
+`packages/core` has no seeds module and must not gain one. The guard catches
+that too — a core function would be bundled into `manager.js` and grep would
+find it there.
+
+**`vault/release/0.1` is deliberately not on the list.** It releases a secret to
+a site the human has just approved, which is the wallet's entire job. The line
+is not "touches a secret"; it is "hands over material the holder cannot revoke,
+to a surface that cannot contain it".
+
+**What breaks it:** adding a seeds client to `packages/core`; relaxing the guard
+to allow `manager.js` "for symmetry" with the admin one; or reading this as
+advice rather than a refusal.
+
 ## Advertisement is not availability
 
 A VTA's DID document says what it *offers*. `buildVtaSession` skips a channel

From 78549f70af7f6d0424c3d9b703e89c7186cefc48 Mon Sep 17 00:00:00 2001
From: Glenn Gore <glenn.g@affinidi.com>
Date: Wed, 2 Sep 2026 08:32:31 +0200
Subject: [PATCH 07/24] docs: say how to re-verify the key-material guard,
 because the obvious way fails
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The section claimed the guard was "verified non-vacuous by importing a seeds
URI into the console and watching it fail". Re-running that verification is how
I found the sentence is misleading.

An unused `export const SEEDS_PROBE = "vta/seeds/export-mnemonic/1.0"` in
`shell.tsx` does **not** trip the guard. Rollup tree-shakes it, the string never
reaches `dist/`, and the guard stays silent — correctly, since it asserts what
ships rather than what is typed. But someone re-checking the refusal reaches for
exactly that probe, sees nothing happen, and concludes the guard is a no-op.

So the note now says what actually works: put the URI somewhere the console
renders. Verified with a nav `label`, which trips `manager.js` as intended, and
reverted.

Both dist guards re-run against a cold `npm run clean && npm run build`; the
admin one confirmed non-vacuous too (`acl/grant/0.1` really is present in
`manager.js`, so its exclusion clause is doing work rather than matching
nothing). Full suite green: 720 tests across the four workspaces.

Signed-off-by: Glenn Gore <glenn.g@affinidi.com>
---
 CLAUDE.md | 11 +++++++++--
 1 file changed, 9 insertions(+), 2 deletions(-)

diff --git a/CLAUDE.md b/CLAUDE.md
index b51852e..2055451 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -207,8 +207,15 @@ console, not the wallet, nowhere.
 **Why a guard rather than simply not building it.** Not building a seeds pane is
 indistinguishable from not having got round to one. Someone reasonable adds it
 next year, nothing objects, and the refusal was never recorded anywhere a person
-would look. The guard is what makes the decision legible; verified non-vacuous
-by importing a seeds URI into the console and watching it fail.
+would look. The guard is what makes the decision legible.
+
+**Verified non-vacuous — and the way it is verified matters.** A seeds URI
+merely *present* in console source is not enough: Rollup tree-shakes an
+unreferenced export, the string never reaches `dist/`, and the guard correctly
+stays silent. That is the guard being right, not weak — it asserts what
+*ships* — but it means a probe that adds an unused `export const` proves
+nothing and reads like a hole. To re-verify, put the URI somewhere the console
+actually renders (a nav `label`, say), rebuild, and watch `manager.js` trip it.
 
 `packages/core` has no seeds module and must not gain one. The guard catches
 that too — a core function would be bundled into `manager.js` and grep would

From c949b327b59c40c34ed3117ee7f255c27261463d Mon Sep 17 00:00:00 2001
From: Glenn Gore <glenn.g@affinidi.com>
Date: Wed, 2 Sep 2026 09:16:33 +0200
Subject: [PATCH 08/24] feat(console): proof of presence for the irreversible
 controls
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

`requirePresence` runs a WebAuthn assertion and throws if it does not
complete. Backup abort and reload-services will sit behind it.

Three things it deliberately is not, each written into the module because
each is what someone would otherwise assume.

**It is not an authorization of the operation.** Nothing verifies this
assertion against the Trust Task that follows: the agent never sees it,
the document carries no trace of it, and the trail at the far end records
an ordinary request. What it buys is that an unattended console cannot be
used by whoever walks past, and that an irreversible action is deliberate
rather than one click deep. Worth having; not a second factor on the
agent, and the header says so rather than leaving a reader to assume the
stronger claim.

**It does not reuse the PRF ceremony.** `runPrfUnlockCeremony` returns PRF
output — the AES key root, as sensitive as the holder seed. A presence
check needs none of it, and a primitive that hands back key material to
answer "is someone there?" will eventually have that output stored by a
caller who only wanted the boolean. Same assertion, no `prf` extension,
returns `void`. Nothing to leak because nothing is returned.

**It never consults unlock state.** A step-up a prior unlock satisfies is
not a step-up — the wallet may have been unlocked hours ago, and reusing
that means the gate stands open for as long as the console does. Fresh
challenge, fresh assertion, every call. This is the first thing that
breaks if someone later adds a cache because the prompt is annoying.

The challenge is random rather than bound to the action, and that is a
choice rather than a shortcut: binding buys something only where a
verifier checks it against the request, and there is no verifier here.
Calling it "for this bundle" when nothing enforces that would be the
overstatement the rest of the module avoids.

A dismissal and a timeout both raise `NotAllowedError` with no way to
distinguish them — by design, so a site cannot learn that a user refused.
Both surface as `cancelled`, which is the reading a caller acts on: do
nothing, say nothing.

Signed-off-by: Glenn Gore <glenn.g@affinidi.com>
---
 packages/extension/src/manager/step-up.ts | 144 ++++++++++++++++++++++
 1 file changed, 144 insertions(+)
 create mode 100644 packages/extension/src/manager/step-up.ts

diff --git a/packages/extension/src/manager/step-up.ts b/packages/extension/src/manager/step-up.ts
new file mode 100644
index 0000000..1cb84db
--- /dev/null
+++ b/packages/extension/src/manager/step-up.ts
@@ -0,0 +1,144 @@
+// Proof of presence, for the console's two irreversible controls.
+//
+// ## What this proves, and what it does not
+//
+// `requirePresence` runs a WebAuthn assertion and throws if it does not
+// complete. That establishes exactly one thing: **a human with the enrolled
+// authenticator is at this machine right now.** It is a gate on the console's
+// own UI.
+//
+// It is *not* an authorization of the operation, and the distinction is worth
+// stating plainly because the ceremony looks like one. Nothing verifies this
+// assertion against the Trust Task that follows — the agent never sees it, the
+// document carries no trace of it, and the audit trail at the other end records
+// an ordinary request. A caller who reached the extension's own code could send
+// the task without ever calling this.
+//
+// So the honest claim is: this stops an unattended console from being used by
+// whoever walks past, and it makes an irreversible action deliberate rather
+// than one click deep. That is worth having. It is not a second factor on the
+// agent, and anyone reasoning about the agent's security should not count it as
+// one.
+//
+// ## Why it does not reuse the PRF ceremony
+//
+// `runPrfUnlockCeremony` returns PRF output — the AES key root, as sensitive as
+// the holder seed. A presence check needs none of that, and a primitive that
+// hands back key material to answer "is someone there?" is one that will
+// eventually have its output stored by a caller who only wanted the boolean.
+// This runs the same assertion with **no `prf` extension** and returns
+// `void`. There is nothing to leak because there is nothing to return.
+//
+// ## Why it never consults unlock state
+//
+// A step-up that a prior unlock satisfies is not a step-up. The wallet may well
+// be unlocked — that is a fact about this session, established possibly hours
+// ago, and re-using it would mean the gate is open for as long as the console
+// is. Every call runs a fresh assertion with a fresh challenge. That is the
+// whole point, and it is the first thing to break if someone later adds a
+// cache "because the prompt is annoying".
+//
+// ## Where it must run
+//
+// The manager page, in a click handler. `navigator.credentials.get` needs a
+// visible, focused context — the same constraint documented in
+// `webauthn-prf-unlock.ts`, for the same reason: a hidden page hangs forever
+// rather than failing. The console is a normal extension page, so this holds,
+// but it is why the call belongs in the pane and not in the offscreen document
+// that ends up sending the task.
+
+import { base64url } from "@openvtc/vti-didcomm-js";
+import { IndexedDBKVStore } from "@openvtc/pnm-core";
+
+// The credential the wallet enrolled. Same slot `webauthn-prf-unlock.ts` reads;
+// the salt beside it is deliberately not read here, because that is the PRF
+// input and this ceremony evaluates no PRF.
+const CREDENTIAL_KEY = "pnm/holder-prf/credentialId";
+
+/** Why a step-up could not be completed, in terms the operator can act on. */
+export class StepUpError extends Error {
+  readonly reason: "cancelled" | "no-authenticator" | "unexpected";
+  constructor(reason: StepUpError["reason"], message: string) {
+    super(message);
+    this.name = "StepUpError";
+    this.reason = reason;
+  }
+}
+
+/**
+ * Require a fresh proof of presence before an irreversible action.
+ *
+ * Resolves only if the assertion completed. Throws `StepUpError` otherwise —
+ * `cancelled` when the human dismissed the prompt, which is a decision and not
+ * a fault, so callers should abandon the action silently rather than surfacing
+ * it as an error.
+ *
+ * `purpose` is shown to the operator by the caller, not passed to the
+ * authenticator: WebAuthn has no field that renders caller-supplied text, and
+ * pretending otherwise would let a pane imply the prompt says something it does
+ * not. It is taken here so the reason is recorded next to the call site.
+ */
+export async function requirePresence(rpId: string, purpose: string): Promise<void> {
+  void purpose;
+
+  const store = new IndexedDBKVStore();
+  const credentialIdB64u = await store.get<string>(CREDENTIAL_KEY);
+
+  // A fresh random challenge, every time.
+  //
+  // Not bound to the action, and that is not an oversight: binding buys
+  // something only where a verifier checks the challenge against the request,
+  // and there is no verifier here. Claiming the assertion is "for this bundle"
+  // when nothing enforces it would be the kind of overstatement the module
+  // header exists to avoid.
+  const challenge = crypto.getRandomValues(new Uint8Array(32));
+
+  // An enrolled credential is used when there is one, so the prompt names the
+  // authenticator the operator already knows. With none, fall back to whatever
+  // discoverable credential exists for this rpId rather than refusing outright:
+  // enrolment is about encrypting the holder, and an operator who declined that
+  // has not thereby declined to prove they are present.
+  const allowCredentials = credentialIdB64u
+    ? [
+        {
+          type: "public-key" as const,
+          id: base64url.decode(credentialIdB64u).buffer as ArrayBuffer,
+        },
+      ]
+    : [];
+
+  let assertion: Credential | null;
+  try {
+    assertion = await navigator.credentials.get({
+      publicKey: {
+        rpId,
+        challenge: challenge as BufferSource,
+        allowCredentials,
+        // Presence alone is not the bar. `required` asks the authenticator for
+        // the biometric or PIN, which is what makes this a step-up rather than
+        // a touch anyone standing at the machine can supply.
+        userVerification: "required",
+      },
+    });
+  } catch (e) {
+    // `NotAllowedError` is what both a dismissal and a timeout raise, and the
+    // API gives no way to tell them apart — deliberately, so a site cannot
+    // learn whether a user refused. Reported as cancelled because that is the
+    // reading a caller should act on: do nothing, say nothing.
+    const name = e instanceof DOMException ? e.name : "";
+    if (name === "NotAllowedError") {
+      throw new StepUpError("cancelled", "Approval was dismissed. Nothing was sent.");
+    }
+    throw new StepUpError(
+      "unexpected",
+      e instanceof Error ? e.message : "The authenticator could not be reached.",
+    );
+  }
+
+  if (!assertion) {
+    throw new StepUpError(
+      "no-authenticator",
+      "No authenticator answered. Enrol one in Settings, then try again.",
+    );
+  }
+}

From 6df3d8dbf9856f5d89f93add5841e22f0d2f3e35 Mon Sep 17 00:00:00 2001
From: Glenn Gore <glenn.g@affinidi.com>
Date: Wed, 2 Sep 2026 09:19:07 +0200
Subject: [PATCH 09/24] test(console): pin the step-up as a gate, and stop it
 failing where storage is blocked
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Seven tests, all guarding the same failure mode: a step-up that quietly
stops being one. It never breaks loudly — the prompt just stops appearing,
or appears and is not waited for, and the console looks exactly as it did.

Two of them are the ones that matter. **A second call must run a second
assertion with a different challenge**, because a step-up an earlier one
satisfies is not a step-up; and **the module must not name unlock or
session state**, checked against the source, because a cache added later
would leave every runtime assertion here passing on its first call.

That source check strips comments first. The module *discusses* the PRF
ceremony at length, explaining why it deliberately does not reuse it, and
a check matching prose would fail on the very paragraph documenting the
refusal — teaching the next person to delete the explanation to get green.

Writing the tests found a real defect in the module. `IndexedDBKVStore.get`
**throws** where IndexedDB is unavailable rather than returning nothing —
a private window, or a browser set to block site data. Looking up which
credential to name is an optimisation, so letting that propagate turned
"we could not find your credential" into "you cannot approve this action",
which is the wrong failure by a long way. Now caught, falling back to a
discoverable credential.

179 → 186 tests in the extension workspace; 727 across all four.

Signed-off-by: Glenn Gore <glenn.g@affinidi.com>
---
 packages/extension/src/manager/step-up.ts     |  14 +-
 .../extension/tests/manager-step-up.test.mts  | 168 ++++++++++++++++++
 2 files changed, 180 insertions(+), 2 deletions(-)
 create mode 100644 packages/extension/tests/manager-step-up.test.mts

diff --git a/packages/extension/src/manager/step-up.ts b/packages/extension/src/manager/step-up.ts
index 1cb84db..277b44c 100644
--- a/packages/extension/src/manager/step-up.ts
+++ b/packages/extension/src/manager/step-up.ts
@@ -81,8 +81,18 @@ export class StepUpError extends Error {
 export async function requirePresence(rpId: string, purpose: string): Promise<void> {
   void purpose;
 
-  const store = new IndexedDBKVStore();
-  const credentialIdB64u = await store.get<string>(CREDENTIAL_KEY);
+  // Which credential to name is an optimisation, so a failure to answer it
+  // must not become a failure to ask for presence. `IndexedDBKVStore.get`
+  // *throws* where IndexedDB is unavailable rather than returning nothing — a
+  // private window, or a browser set to block site data — and letting that
+  // propagate would turn "we could not look up your credential" into "you
+  // cannot approve this action", which is the wrong failure by a long way.
+  let credentialIdB64u: string | undefined;
+  try {
+    credentialIdB64u = await new IndexedDBKVStore().get<string>(CREDENTIAL_KEY);
+  } catch {
+    credentialIdB64u = undefined;
+  }
 
   // A fresh random challenge, every time.
   //
diff --git a/packages/extension/tests/manager-step-up.test.mts b/packages/extension/tests/manager-step-up.test.mts
new file mode 100644
index 0000000..9c83d8c
--- /dev/null
+++ b/packages/extension/tests/manager-step-up.test.mts
@@ -0,0 +1,168 @@
+// The step-up is a gate, not a formality.
+//
+// Everything here is about one failure mode: a step-up that quietly stops being
+// one. It does not break loudly — the prompt simply stops appearing, or appears
+// and is not waited for, and the console goes on looking exactly as it did. So
+// each property is pinned rather than left to review.
+//
+// `requirePresence` is exercised against a stubbed `navigator.credentials`,
+// which is the only way to assert *that a ceremony ran* rather than that a
+// function returned. The real one needs a visible page and a human.
+
+import { test, beforeEach, afterEach } from "node:test";
+import assert from "node:assert/strict";
+import { readFileSync } from "node:fs";
+import { fileURLToPath } from "node:url";
+
+// Comments stripped before scanning. The module *discusses* the PRF ceremony
+// at length — explaining why it deliberately does not reuse it — and a check
+// that matched prose would fail on the very paragraph documenting the refusal,
+// teaching the next person to delete the explanation to get green.
+const SRC = readFileSync(
+  fileURLToPath(new URL("../src/manager/step-up.ts", import.meta.url)),
+  "utf8",
+)
+  .replace(/\/\*[\s\S]*?\*\//g, "")
+  .replace(/^\s*\/\/.*$/gm, "");
+
+interface GetCall {
+  challenge: Uint8Array;
+  userVerification: string | undefined;
+  extensions: unknown;
+}
+
+let calls: GetCall[] = [];
+let behaviour: () => unknown = () => ({ id: "cred" });
+
+let savedNavigator: PropertyDescriptor | undefined;
+let savedIndexedDB: PropertyDescriptor | undefined;
+
+const define = (name: string, value: unknown) =>
+  Object.defineProperty(globalThis, name, { value, configurable: true, writable: true });
+
+const restore = (name: string, desc: PropertyDescriptor | undefined) => {
+  if (desc) Object.defineProperty(globalThis, name, desc);
+  else delete (globalThis as Record<string, unknown>)[name];
+};
+
+beforeEach(() => {
+  calls = [];
+  behaviour = () => ({ id: "cred" });
+  savedNavigator = Object.getOwnPropertyDescriptor(globalThis, "navigator");
+  savedIndexedDB = Object.getOwnPropertyDescriptor(globalThis, "indexedDB");
+  // `navigator` is an accessor on the Node global, so a plain assignment
+  // throws. Redefining is what a stub needs, and it is restored in afterEach.
+  define("navigator", {
+    credentials: {
+      get: async (opts: { publicKey: Record<string, unknown> }) => {
+        calls.push({
+          challenge: opts.publicKey.challenge as Uint8Array,
+          userVerification: opts.publicKey.userVerification as string | undefined,
+          extensions: opts.publicKey.extensions,
+        });
+        return behaviour();
+      },
+    },
+  });
+  // No IndexedDB in Node: the credential lookup misses, which is the
+  // not-enrolled path. Presence must still be askable there — see the module's
+  // note on why enrolment and presence are different questions.
+  define("indexedDB", undefined);
+});
+
+afterEach(() => {
+  restore("navigator", savedNavigator);
+  restore("indexedDB", savedIndexedDB);
+});
+
+const load = async () => await import("../src/manager/step-up.ts");
+
+test("a completed assertion resolves, and it actually ran one", async () => {
+  const { requirePresence } = await load();
+  await requirePresence("ext-id", "abort a backup bundle");
+  assert.equal(calls.length, 1, "requirePresence must run a WebAuthn assertion");
+});
+
+test("every call runs a fresh assertion — a prior one does not satisfy the next", async () => {
+  const { requirePresence } = await load();
+  await requirePresence("ext-id", "first");
+  await requirePresence("ext-id", "second");
+  assert.equal(
+    calls.length,
+    2,
+    "the second call reused the first — a step-up satisfied by an earlier one is not a step-up",
+  );
+  assert.notDeepEqual(
+    Array.from(calls[0]!.challenge),
+    Array.from(calls[1]!.challenge),
+    "the challenge must be fresh per call, or the ceremony is replayable",
+  );
+});
+
+test("it demands user verification, not a bare touch", async () => {
+  const { requirePresence } = await load();
+  await requirePresence("ext-id", "reload services");
+  assert.equal(
+    calls[0]!.userVerification,
+    "required",
+    "a step-up that accepts presence alone is satisfiable by anyone at the machine",
+  );
+});
+
+test("it asks for no PRF output — there is nothing to return and nothing to leak", async () => {
+  const { requirePresence } = await load();
+  await requirePresence("ext-id", "abort");
+  const ext = calls[0]!.extensions as Record<string, unknown> | undefined;
+  assert.ok(
+    ext === undefined || !("prf" in ext),
+    "the presence check must not evaluate PRF: that output is the AES key root, " +
+      "and a caller wanting a boolean would end up holding key material",
+  );
+});
+
+test("a dismissed prompt aborts, and reports as cancelled rather than as a fault", async () => {
+  const { requirePresence, StepUpError } = await load();
+  behaviour = () => {
+    throw new DOMException("The operation either timed out or was not allowed.", "NotAllowedError");
+  };
+  await assert.rejects(
+    () => requirePresence("ext-id", "abort"),
+    (e: unknown) => {
+      assert.ok(e instanceof StepUpError);
+      assert.equal(
+        (e as InstanceType<typeof StepUpError>).reason,
+        "cancelled",
+        "a dismissal is a decision, not an error to shout about",
+      );
+      return true;
+    },
+  );
+});
+
+test("a null credential is refused rather than read as success", async () => {
+  const { requirePresence, StepUpError } = await load();
+  behaviour = () => null;
+  await assert.rejects(
+    () => requirePresence("ext-id", "abort"),
+    (e: unknown) => {
+      assert.ok(e instanceof StepUpError);
+      assert.equal((e as InstanceType<typeof StepUpError>).reason, "no-authenticator");
+      return true;
+    },
+  );
+});
+
+// A source-level check, because the defect it guards against is an *absence*
+// that no runtime assertion can see: a cache added later would make the tests
+// above pass on their first call and stop the prompt appearing on every one
+// after. Naming the symbols keeps the refusal legible at the place someone
+// would reach for them.
+test("the module consults no unlock or session state", async () => {
+  for (const forbidden of ["cachedKey", "isUnlocked", "sessionStorage", "runPrfUnlockCeremony"]) {
+    assert.ok(
+      !SRC.includes(forbidden),
+      `step-up.ts references \`${forbidden}\` — a step-up must not be satisfiable by ` +
+        `an earlier unlock, and reading session state is how that arrives`,
+    );
+  }
+});

From a3e220df757873588994ca854a2a124511828e34 Mon Sep 17 00:00:00 2001
From: Glenn Gore <glenn.g@affinidi.com>
Date: Wed, 2 Sep 2026 09:50:41 +0200
Subject: [PATCH 10/24] feat(console): backup abort and reload-services, behind
 proof of presence
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Both land on `@openvtc/trust-tasks` 0.16.8, which carries the six specs
from trustoverip/dtgwg-trust-tasks-tf#347.

## Backup is one verb out of five, and the pane says why

`initiate-export` and `finalize-import` both carry a `password` — the key
that protects, or unlocks, a complete copy of the agent. It travels
*inbound*, typed by the operator, and a browser form is reachable by
autofill, by a password manager, by any other extension with host access,
and by anything recording the screen. A step-up does not help: it proves a
human is present for the action, and the password was typed before the
prompt appeared.

So the wallet does not ask for it at all. The CLI collects it in a
terminal, which is not perfect and is much smaller.

That reasoning is on the surface, not just in a comment, because an empty
pane is indistinguishable from an unfinished one — someone would
reasonably "complete" the family next year. The same guard is in
`admin/backup.ts` and in the coverage ratchet's prose, which now records
`vta/backup/*` as the first family whose absence is a decision rather than
a gap upstream.

`abort` is here because it carries no secret and is the only way to close
a window that is otherwise open until it expires, with a fetchable copy of
the agent live at a known address. There is no verb that lists in-flight
bundles, so the operator pastes the id the CLI printed — the pane says
that rather than implying the console lost a picker.

## Two non-failures that would otherwise read as faults

**`aborted: false`** is rendered as "already closed", not an error. Abort
is idempotent precisely because the situation it exists for — a dropped
connection, an operator unsure whether the cancel landed — is the one that
produces duplicates.

**A dropped connection on reload** is the expected shape of *success*: a
reload restarts the transport the response would have travelled on.
Reporting it as an error would send an operator hunting for a fault that
is the agent coming back, and invite a retry that restarts it again.

## Why reload-services is gated at all

It creates, deletes and discloses nothing, which invites a lower bar than
it deserves. What it spends is availability, and that falls on every
counterparty of the agent rather than on the operator who clicked —
including this wallet's own inbound sessions, so approval requests wait at
the mediator while it restarts. The copy says so.

Both guards re-run against a cold `npm run clean && npm run build`: admin
URIs still confined to `manager.js`, no key-material URI anywhere, console
still a single chunk, and the new `vta/backup/*` URIs land only in
`manager.js`. 727 tests green.

Signed-off-by: Glenn Gore <glenn.g@affinidi.com>
---
 package-lock.json                             |  10 +-
 package.json                                  |   2 +-
 packages/core/package.json                    |   2 +-
 packages/core/src/admin/backup.ts             | 104 +++++++++
 packages/core/src/admin/index.ts              |   1 +
 packages/core/src/admin/services.ts           |  60 ++++++
 packages/core/tests/task-surface.mjs          |  29 ++-
 .../extension/src/manager/panes/backup.tsx    | 203 ++++++++++++++++++
 .../extension/src/manager/panes/services.tsx  | 102 ++++++++-
 packages/extension/src/manager/shell.tsx      |   7 +
 10 files changed, 505 insertions(+), 15 deletions(-)
 create mode 100644 packages/core/src/admin/backup.ts
 create mode 100644 packages/extension/src/manager/panes/backup.tsx

diff --git a/package-lock.json b/package-lock.json
index 6e96ede..eaaee11 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -16,7 +16,7 @@
         "packages/reviewer-demo"
       ],
       "dependencies": {
-        "@openvtc/trust-tasks": "^0.16.6"
+        "@openvtc/trust-tasks": "^0.16.8"
       },
       "engines": {
         "node": ">=24"
@@ -2304,9 +2304,9 @@
       "link": true
     },
     "node_modules/@openvtc/trust-tasks": {
-      "version": "0.16.6",
-      "resolved": "https://registry.npmjs.org/@openvtc/trust-tasks/-/trust-tasks-0.16.6.tgz",
-      "integrity": "sha512-Uf1PPzkYAlhtkW04FdwTLbAMoI+xl2ckFs/rigNvsP198Eujr8lJORZX1/DX9yLxRAKqjhP2TumJW5QKDgxx6Q==",
+      "version": "0.16.8",
+      "resolved": "https://registry.npmjs.org/@openvtc/trust-tasks/-/trust-tasks-0.16.8.tgz",
+      "integrity": "sha512-wzwfEcylO91Tr5Cb9UCMqrMOpw1IVuspKHXAGYeOkPQi4LVurv7XH9/NHfRIK9dl7cqpucZ5kmjJRKCI8bD+Gw==",
       "license": "Apache-2.0"
     },
     "node_modules/@openvtc/vti-didcomm-js": {
@@ -7809,7 +7809,7 @@
       "dependencies": {
         "@cfworker/json-schema": "^4.1.1",
         "@noble/curves": "^2.4.0",
-        "@openvtc/trust-tasks": "^0.16.3",
+        "@openvtc/trust-tasks": "^0.16.8",
         "@openvtc/vti-didcomm-js": "^0.7.0",
         "@openvtc/vti-tsp-js": "^0.2.0",
         "@scure/base": "^2.2.0",
diff --git a/package.json b/package.json
index b7854c5..3801843 100644
--- a/package.json
+++ b/package.json
@@ -28,6 +28,6 @@
     "esbuild": "^0.28.1"
   },
   "dependencies": {
-    "@openvtc/trust-tasks": "^0.16.6"
+    "@openvtc/trust-tasks": "^0.16.8"
   }
 }
diff --git a/packages/core/package.json b/packages/core/package.json
index a087975..3c6f2a8 100644
--- a/packages/core/package.json
+++ b/packages/core/package.json
@@ -120,7 +120,7 @@
   "dependencies": {
     "@cfworker/json-schema": "^4.1.1",
     "@noble/curves": "^2.4.0",
-    "@openvtc/trust-tasks": "^0.16.3",
+    "@openvtc/trust-tasks": "^0.16.8",
     "@openvtc/vti-didcomm-js": "^0.7.0",
     "@openvtc/vti-tsp-js": "^0.2.0",
     "@scure/base": "^2.2.0",
diff --git a/packages/core/src/admin/backup.ts b/packages/core/src/admin/backup.ts
new file mode 100644
index 0000000..a17c3bd
--- /dev/null
+++ b/packages/core/src/admin/backup.ts
@@ -0,0 +1,104 @@
+// `vta/backup/*` — and the deliberate absence of most of it.
+//
+// The agent dispatches five verbs: initiate-export, complete-export,
+// initiate-import, finalize-import, abort. **This module exposes one.**
+//
+// ## Why export and import are not here
+//
+// `initiate-export` and `finalize-import` both carry a `password` member: the
+// key-derivation input that protects, or unlocks, a complete copy of the agent
+// — every key, ACL and trust context it holds. It travels *inbound*, chosen by
+// the caller at the moment of asking.
+//
+// The specification classifies it `ingests: secret` and annotates it
+// `writeOnly`, and it says the part that decides this module's shape: the
+// password's exposure is settled by **where it is typed**. A browser form is
+// reachable by autofill, by a password manager, by any other extension with
+// host access, and by screen capture — none of which this wallet controls, and
+// none of which a step-up ceremony reaches. A passkey prompt proves a human is
+// present for the action; it proves nothing about the field, which was filled
+// in before the prompt appeared.
+//
+// So this is not a "not yet". Adding an export pane would be a decision to
+// collect the agent's master password in the least defensible place available,
+// and the CLI already collects it in a better one. Operators export and import
+// there.
+//
+// ## Why `abort` is
+//
+// It carries no secret — one opaque handle in, a boolean out — and it is the
+// only way to close a window that is otherwise open until it expires. An
+// operator who realises mid-export that the download went somewhere it should
+// not have wants the bundle dead now, and the alternative is waiting out the
+// slot with a fetchable copy of the agent live at a known address.
+//
+// It also unwedges: an agent caps how many bundles one operator may hold open,
+// so an abandoned bundle costs a slot until expiry.
+//
+// ## Why there is no bundle list to abort *from*
+//
+// There is no enumerate verb in the family — the agent offers no way to ask
+// what is in flight. So the caller supplies the id the CLI printed. A picker
+// would be nicer and cannot be built without a task that does not exist; the
+// UI says so rather than implying the console lost it.
+
+import type { TaskParty, TrustTaskSender } from "../vta/channel.js";
+import { buildTrustTask } from "../vta/trust-task.js";
+
+import {
+  TYPE_URI as BACKUP_ABORT,
+  RESPONSE_TYPE_URI as BACKUP_ABORT_RESPONSE,
+  type VTABackupAbortPayload,
+  type VTABackupAbortResponsePayload,
+} from "@openvtc/trust-tasks/vta/backup/abort/1.0/payload";
+
+/** Issued by an operator identity, to the agent holding the bundle. */
+export interface BackupCallerParams {
+  /** Envelope `issuer`. Must be the identity that initiated the bundle —
+   *  the agent checks, and answers a mismatch as not-found rather than as a
+   *  refusal, so that a stranger cannot learn a bundle exists by guessing. */
+  holder: TaskParty;
+  /** The agent — envelope `recipient`. */
+  service: TaskParty;
+}
+
+export interface BackupAbortParams extends BackupCallerParams {
+  /** Handle from an initiate-export or initiate-import descriptor. Either kind
+   *  is accepted; the agent already knows which it holds. */
+  bundleId: string;
+}
+
+/** What the agent did, which is not always what was asked. */
+export interface BackupAbortResult {
+  bundleId: string;
+  /** `false` means the bundle was already terminal — completed, expired, or
+   *  aborted by an earlier attempt. A success, not a failure: abort is
+   *  idempotent precisely because the situation it exists for (a dropped
+   *  connection, an operator unsure whether the cancel landed) is the one that
+   *  produces duplicates. Callers should render it as "already closed" rather
+   *  than as an error. */
+  aborted: boolean;
+}
+
+/**
+ * Cancel an in-flight export or import bundle and discard its staged bytes.
+ *
+ * Destructive and irreversible for the bundle: on the export side the
+ * encrypted copy is deleted and cannot be re-minted — a new export re-serialises
+ * the agent and produces different bytes.
+ */
+export async function backupAbort(
+  sender: TrustTaskSender,
+  params: BackupAbortParams,
+): Promise<BackupAbortResult> {
+  const payload: VTABackupAbortPayload = { bundleId: params.bundleId };
+  const envelope = buildTrustTask(BACKUP_ABORT, payload, {
+    issuer: params.holder.did,
+    recipient: params.service.did,
+  });
+  const res = await sender.send<VTABackupAbortResponsePayload>(envelope, {
+    expectedResponseType: BACKUP_ABORT_RESPONSE,
+    operationLabel: "vta/backup/abort/1.0",
+  });
+  return { bundleId: res.bundleId, aborted: res.aborted };
+}
diff --git a/packages/core/src/admin/index.ts b/packages/core/src/admin/index.ts
index 654ce94..786e5bd 100644
--- a/packages/core/src/admin/index.ts
+++ b/packages/core/src/admin/index.ts
@@ -22,3 +22,4 @@ export * from "./consent.js";
 export * from "./contexts.js";
 export * from "./services.js";
 export * from "./credentials.js";
+export * from "./backup.js";
diff --git a/packages/core/src/admin/services.ts b/packages/core/src/admin/services.ts
index d99a154..f391845 100644
--- a/packages/core/src/admin/services.ts
+++ b/packages/core/src/admin/services.ts
@@ -62,6 +62,12 @@ import {
   type VTAServicesDrainCancelPayload,
   type VTAServicesDrainCancelResponsePayload,
 } from "@openvtc/trust-tasks/vta/services/drain/cancel/1.0/payload";
+import {
+  TYPE_URI as MANAGEMENT_RELOAD,
+  RESPONSE_TYPE_URI as MANAGEMENT_RELOAD_RESPONSE,
+  type VTAManagementReloadServicesPayload,
+  type VTAManagementReloadServicesResponsePayload,
+} from "@openvtc/trust-tasks/vta/management/reload-services/1.0/payload";
 
 export type { ServiceState, ServiceKind };
 
@@ -261,3 +267,57 @@ export async function serviceDrainCancel(
   return call(sender, params, SERVICES_DRAIN_CANCEL, SERVICES_DRAIN_CANCEL_RESPONSE,
     "vta/services/drain/cancel/1.0", payload);
 }
+
+/**
+ * Re-read the agent's service configuration and restart its transports.
+ *
+ * Takes no parameters, and the specification argues for the emptiness rather
+ * than leaving it to look unfinished: every member this could carry — a list of
+ * services to reload selectively, inline configuration, a flag to skip
+ * validation — turns "apply what is written down" into "apply what this
+ * document says", which would let a caller put an agent into a state its own
+ * configuration does not describe. So a reload is all-or-nothing, and the
+ * agent's config stays the single account of how the agent runs.
+ *
+ * ## Two outcomes that are not failures
+ *
+ * **No response.** A successful reload drops the very transport the response
+ * would travel on, so the connection may simply close. That is not an error and
+ * **must not be retried as one** — the reload has very likely succeeded. The
+ * reliable check is external to the call: reconnect and see whether the agent
+ * answers.
+ *
+ * **`reloadFailed`.** The agent read its configuration and could not bring
+ * services up on it. What state it is left in is implementation-specific, and
+ * the code deliberately does not assert one: it may hold the previous config
+ * and stay up, come up partially, or not come up at all. Do not report to an
+ * operator that the agent is still serving.
+ *
+ * ## What it costs
+ *
+ * Every open session drops, including this wallet's own inbound sessions. The
+ * cost falls on every counterparty of the agent, none of whom asked — which is
+ * why the console puts it behind a step-up even though the task creates,
+ * deletes and discloses nothing.
+ */
+export async function reloadServices(
+  sender: TrustTaskSender,
+  params: ServicesCallerParams,
+): Promise<{ status: string }> {
+  const payload: VTAManagementReloadServicesPayload = {};
+  const res = await call<
+    VTAManagementReloadServicesPayload,
+    VTAManagementReloadServicesResponsePayload
+  >(
+    sender,
+    params,
+    MANAGEMENT_RELOAD,
+    MANAGEMENT_RELOAD_RESPONSE,
+    "vta/management/reload-services/1.0",
+    payload,
+  );
+  // Advisory free text — shown to a human, never branched on. The reliable
+  // signal is whether the agent answers afterwards, not what it said before
+  // restarting.
+  return { status: res.status };
+}
diff --git a/packages/core/tests/task-surface.mjs b/packages/core/tests/task-surface.mjs
index 9c53021..ef70526 100644
--- a/packages/core/tests/task-surface.mjs
+++ b/packages/core/tests/task-surface.mjs
@@ -201,14 +201,29 @@ test("coverage against the agent's surface is recorded, not discovered", () => {
   // (trustoverip/dtgwg-trust-tasks-tf#338, shipped in @openvtc/trust-tasks
   // 0.16.4) is what produced bindings to implement against.
   //
-  // **All 17 still outstanding are unspecced** — no schema in the registry, so
+  // 161 -> 163 is `vta/backup/abort` and `vta/management/reload-services`,
+  // specced at trustoverip/dtgwg-trust-tasks-tf#347 and shipped in
+  // @openvtc/trust-tasks 0.16.8. Same shape as the eight before them: the
+  // agent was already dispatching both with no schema in the registry.
+  //
+  // **`vta/backup/*` is now specced in full and deliberately implemented in
+  // part**, which makes it the first family whose absence is a decision rather
+  // than a gap upstream. All five verbs have bindings; this library exposes
+  // `abort` alone. `initiate-export` and `finalize-import` carry a `password`
+  // — the key to a complete copy of the agent, travelling inbound — and a
+  // browser is the wrong place to collect it, for reasons `admin/backup.ts`
+  // sets out at length. Do not "finish" the family to make this number
+  // rounder; the four that are missing are missing on purpose.
+  //
+  // **The other 15 outstanding are unspecced** — no schema in the registry, so
   // no binding in @openvtc/trust-tasks to implement against: `vault/*`'s own
   // archive/restore/purge/unarchive (the *secrets* lifecycle, distinct from
-  // the credential one above), `vta/backup/*`, `vta/attestation/*`,
-  // `vta/seeds/*`, `vta/audit/*-retention`, and
-  // `vta/management/reload-services`. That keeps this number a statement about
-  // upstream rather than about this repo: it moves when a spec lands, and the
-  // last eight moved because one did.
+  // the credential one above), `vta/attestation/*`, `vta/seeds/*` and
+  // `vta/audit/*-retention`.
+  //
+  // `vta/seeds/*` is a third category again, and will never move: it returns
+  // key material, and CI bans its URIs from every extension bundle including
+  // the console. A spec landing upstream would not change that.
   //
   // **Nothing is behind any more.** Every implemented family names the newest
   // version `vta-sdk` publishes: `vault/{list,get,upsert}` and
@@ -219,7 +234,7 @@ test("coverage against the agent's surface is recorded, not discovered", () => {
   // the agent does not name, rather than as a deprecation warning. That is the
   // expected shape of a cutover here: nothing is deployed, so neither side
   // keeps an old version alive.
-  const expected = 161;
+  const expected = 163;
   assert.equal(
     implemented.size,
     expected,
diff --git a/packages/extension/src/manager/panes/backup.tsx b/packages/extension/src/manager/panes/backup.tsx
new file mode 100644
index 0000000..7439b76
--- /dev/null
+++ b/packages/extension/src/manager/panes/backup.tsx
@@ -0,0 +1,203 @@
+// Backup — one control, and an honest account of the four that are missing.
+//
+// The agent dispatches five backup verbs. This pane offers `abort`. The rest of
+// the surface is a written explanation of why export and import are not here,
+// because an empty pane is indistinguishable from an unfinished one, and the
+// next person to open this file should find a decision rather than a gap.
+//
+// The short version: `initiate-export` and `finalize-import` carry a `password`
+// member — the key that protects, or unlocks, a complete copy of the agent. It
+// travels inbound, typed by the operator. A browser form is reachable by
+// autofill, by a password manager, by any other extension with host access, and
+// by screen capture, and a passkey step-up does not help: it proves a human is
+// present for the *action*, and says nothing about a field that was filled in
+// before the prompt appeared.
+//
+// Abort carries no secret and is the only way to close a window that is
+// otherwise open until it expires. So it is here, behind the step-up, and the
+// step-up is about deliberateness rather than secrecy — see `step-up.ts` for
+// what that ceremony does and does not prove.
+
+import { useCallback, useState } from "react";
+import { backupAbort, type BackupAbortResult } from "@openvtc/pnm-core/admin";
+import { Button, Note, Panel } from "../../ui.js";
+import { c, t, font } from "../../theme.js";
+import { managerSender } from "../sender.js";
+import { ConsentRequiredError } from "../carrier.js";
+import { ConsentCeremony, runMutation } from "../destructive.js";
+import { requirePresence, StepUpError } from "../step-up.js";
+import { hasRole, type Authority, type Parties } from "../use-vta.js";
+
+const fieldStyle: React.CSSProperties = {
+  boxSizing: "border-box",
+  padding: "6px 9px",
+  background: c.ground,
+  color: c.text,
+  border: `1px solid ${c.line}`,
+  borderRadius: "var(--w-r-sm)",
+  fontSize: t.sm,
+  fontFamily: font.mono,
+};
+
+// The agent generates these, and there is no verb that lists them — so the
+// operator pastes what the CLI printed. Checked here only so an obvious typo is
+// caught before a round trip, never as authorization: the agent decides whether
+// this caller may touch this bundle, and answers a stranger's guess as
+// not-found rather than as a refusal.
+const UUID = /^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$/;
+
+function WhyExportIsAbsent() {
+  return (
+    <Panel
+      title="Export and import are done from the CLI"
+      description="Not missing — declined, and it is worth knowing why before you go looking for them."
+    >
+      <div style={{ display: "grid", gap: 12, fontSize: t.sm, lineHeight: 1.6, color: c.muted }}>
+        <p style={{ margin: 0 }}>
+          Starting an export, and finishing an import, both require the{" "}
+          <strong style={{ color: c.text }}>password that protects the whole bundle</strong> — every
+          key, access-control entry and trust context the agent holds. It is sent{" "}
+          <em>to</em> the agent, which means something has to collect it first.
+        </p>
+        <p style={{ margin: 0 }}>
+          A field in a browser page is reachable by autofill, by a password manager, by any other
+          extension you have granted access to this page, and by anything recording the screen. None
+          of that is under this wallet's control. Asking for the approval prompt first would not
+          change it: that prompt proves a human is here for the action, and the password was typed
+          before it appeared.
+        </p>
+        <p style={{ margin: 0 }}>
+          So the wallet does not ask for it at all. The CLI collects it in a terminal, which is not a
+          perfect place either, but is a much smaller one.
+        </p>
+        <Note tone="accent">
+          <strong>Where the bundle goes.</strong> An export is fetched over HTTPS from an address the
+          agent publishes, so an agent reachable only over DIDComm or TSP cannot produce one at all —
+          it has no address to hand you, and will say so rather than returning a link that does not
+          work. That is a fact about how the agent is deployed, not something the console can work
+          around.
+        </Note>
+      </div>
+    </Panel>
+  );
+}
+
+export function BackupPane({
+  parties,
+  authority,
+}: {
+  parties: Parties;
+  authority: Authority | null;
+}) {
+  const [bundleId, setBundleId] = useState("");
+  const [busy, setBusy] = useState(false);
+  const [error, setError] = useState<string | null>(null);
+  const [pending, setPending] = useState<ConsentRequiredError | null>(null);
+  const [result, setResult] = useState<BackupAbortResult | null>(null);
+
+  const denied =
+    authority && !hasRole(authority, "admin", "super-admin", "operator")
+      ? "Cancelling a backup bundle needs an administrative role at this agent."
+      : null;
+
+  const malformed = bundleId.trim() !== "" && !UUID.test(bundleId.trim());
+
+  const abort = useCallback(async () => {
+    setError(null);
+    setPending(null);
+    setResult(null);
+
+    // The step-up runs FIRST, and nothing is sent if it does not complete.
+    // Dismissing is a decision, not a fault: the pane goes quiet rather than
+    // reporting an error the operator caused on purpose.
+    try {
+      await requirePresence(chrome.runtime.id, "cancel a backup bundle");
+    } catch (e) {
+      if (e instanceof StepUpError && e.reason === "cancelled") return;
+      setError(e instanceof Error ? e.message : String(e));
+      return;
+    }
+
+    setBusy(true);
+    const ok = await runMutation(
+      async () => {
+        setResult(
+          await backupAbort(managerSender, { ...parties, bundleId: bundleId.trim() }),
+        );
+      },
+      { onConsent: setPending, onError: setError },
+    );
+    setBusy(false);
+    if (ok) setBundleId("");
+  }, [parties, bundleId]);
+
+  return (
+    <div style={{ display: "grid", gap: 16, alignContent: "start" }}>
+      <Panel
+        title="Cancel a backup bundle"
+        description="Discards the staged bytes and closes the bundle. On the export side the encrypted
+          copy is deleted and cannot be re-minted — a new export re-reads the agent and produces
+          different bytes."
+      >
+        <div style={{ display: "grid", gap: 12 }}>
+          <Note tone="accent">
+            <strong>There is no list to pick from.</strong> The agent offers no way to ask which
+            bundles are in flight, so paste the bundle id the CLI printed. Nothing is lost by getting
+            it wrong: an id the agent does not recognise, or one belonging to another operator, comes
+            back the same way — not found.
+          </Note>
+
+          <label style={{ display: "grid", gap: 4 }}>
+            <span style={{ fontSize: t.xs, color: c.muted }}>BUNDLE ID</span>
+            <input
+              style={fieldStyle}
+              value={bundleId}
+              onChange={(e) => setBundleId(e.target.value)}
+              placeholder="3f2504e0-4f89-41d3-9a0c-0305e82c3301"
+              spellCheck={false}
+            />
+          </label>
+          {malformed && (
+            <span style={{ fontSize: t.xs, color: c.muted }}>
+              That is not the shape of a bundle id. They are UUIDs, and the agent generates them.
+            </span>
+          )}
+
+          {error && <Note tone="danger">{error}</Note>}
+          {pending && <ConsentCeremony pending={pending} />}
+
+          {result &&
+            (result.aborted ? (
+              <Note tone="accent">
+                Bundle cancelled. Its staged bytes are gone and the download address no longer works.
+              </Note>
+            ) : (
+              // Not an error. Abort is idempotent because the situation it
+              // exists for — a dropped connection, an operator unsure whether
+              // the cancel landed — is the one that produces duplicates.
+              <Note tone="accent">
+                That bundle was already closed: completed, expired, or cancelled earlier. Nothing was
+                left to discard, and nothing changed.
+              </Note>
+            ))}
+
+          <div>
+            <Button
+              kind="danger"
+              disabled={busy || !UUID.test(bundleId.trim()) || Boolean(denied)}
+              {...(denied ? { title: denied } : {})}
+              onClick={() => void abort()}
+            >
+              {busy ? "Cancelling…" : "Approve and cancel bundle"}
+            </Button>
+          </div>
+          <span style={{ fontSize: t.xs, color: c.faint }}>
+            {denied ?? "Your passkey is checked before anything is sent."}
+          </span>
+        </div>
+      </Panel>
+
+      <WhyExportIsAbsent />
+    </div>
+  );
+}
diff --git a/packages/extension/src/manager/panes/services.tsx b/packages/extension/src/manager/panes/services.tsx
index d554a21..69a8d21 100644
--- a/packages/extension/src/manager/panes/services.tsx
+++ b/packages/extension/src/manager/panes/services.tsx
@@ -14,12 +14,13 @@
 // failure and must never be rendered as one; presenting it as a problem is how
 // an operator ends up chasing a transport that is working.
 
-import { servicesList, serviceDisable, serviceEnable, type ServiceState } from "@openvtc/pnm-core/admin";
+import { reloadServices, servicesList, serviceDisable, serviceEnable, type ServiceState } from "@openvtc/pnm-core/admin";
 import { agentPing } from "@openvtc/pnm-core/admin";
 import { useCallback, useState } from "react";
 import { Button, Did, Note, Panel, Pill } from "../../ui.js";
 import { c, t, font } from "../../theme.js";
 import { managerSender } from "../sender.js";
+import { requirePresence, StepUpError } from "../step-up.js";
 import { ConsentRequiredError } from "../carrier.js";
 import { ConsentCeremony, Destructive, runMutation } from "../destructive.js";
 import { Loading, LoadError, Table, type Column } from "../table.js";
@@ -281,6 +282,105 @@ export function ServicesPane({
             including approval requests — until one is."
         />
       </Panel>
+
+      <ReloadServices parties={parties} denied={denied} />
     </div>
   );
 }
+
+/**
+ * Re-read the agent's configuration and restart its transports.
+ *
+ * Behind the step-up despite creating, deleting and disclosing nothing — the
+ * cost here is measured in availability, and it falls on every counterparty of
+ * the agent rather than on the operator who clicked. That includes this
+ * wallet's own inbound sessions, which is the part an operator is most likely
+ * to be surprised by, so the copy says it rather than implying it.
+ */
+function ReloadServices({ parties, denied }: { parties: Parties; denied: string | null }) {
+  const [busy, setBusy] = useState(false);
+  const [error, setError] = useState<string | null>(null);
+  const [pending, setPending] = useState<ConsentRequiredError | null>(null);
+  const [done, setDone] = useState(false);
+
+  const reload = useCallback(async () => {
+    setError(null);
+    setPending(null);
+    setDone(false);
+
+    try {
+      await requirePresence(chrome.runtime.id, "restart this agent's transports");
+    } catch (e) {
+      // A dismissal is a decision. Say nothing and send nothing.
+      if (e instanceof StepUpError && e.reason === "cancelled") return;
+      setError(e instanceof Error ? e.message : String(e));
+      return;
+    }
+
+    setBusy(true);
+    await runMutation(
+      async () => {
+        await reloadServices(managerSender, parties);
+        setDone(true);
+      },
+      {
+        onConsent: setPending,
+        onError: (message) => {
+          // A successful reload drops the transport the response would have
+          // travelled on, so a lost connection is the EXPECTED shape of
+          // success here, not a failure. Reporting it as an error would send
+          // an operator hunting for a fault that is the agent restarting, and
+          // — worse — invite a retry that restarts it again.
+          if (/network|connection|closed|timeout|aborted/i.test(message)) {
+            setDone(true);
+          } else {
+            setError(message);
+          }
+        },
+      },
+    );
+    setBusy(false);
+  }, [parties]);
+
+  return (
+    <Panel
+      title="Reload services"
+      description="Re-reads the agent's configuration and restarts its transports. Use this after
+        changing configuration elsewhere; it applies what is written down and takes no options of
+        its own."
+    >
+      <div style={{ display: "grid", gap: 12 }}>
+        <Note tone="warn">
+          <strong>Every open session drops, including this wallet's.</strong> Your inbound sessions
+          go down while the agent restarts, so anything pushed during that window — approval
+          requests included — waits at the mediator. Every other client of this agent is
+          disconnected at the same moment, and none of them asked.
+        </Note>
+
+        {error && <Note tone="danger">{error}</Note>}
+        {pending && <ConsentCeremony pending={pending} />}
+        {done && (
+          <Note tone="accent">
+            Restart requested. The agent may have dropped this connection to do it, which is normal
+            and not a reason to send it again — reconnect and see whether it answers. If it does not
+            come back, its configuration is the place to look.
+          </Note>
+        )}
+
+        <div>
+          <Button
+            kind="danger"
+            disabled={busy || Boolean(denied)}
+            {...(denied ? { title: denied } : {})}
+            onClick={() => void reload()}
+          >
+            {busy ? "Restarting…" : "Approve and reload services"}
+          </Button>
+        </div>
+        <span style={{ fontSize: t.xs, color: c.faint }}>
+          {denied ?? "Your passkey is checked before anything is sent."}
+        </span>
+      </div>
+    </Panel>
+  );
+}
diff --git a/packages/extension/src/manager/shell.tsx b/packages/extension/src/manager/shell.tsx
index f871a21..e19decf 100644
--- a/packages/extension/src/manager/shell.tsx
+++ b/packages/extension/src/manager/shell.tsx
@@ -26,6 +26,7 @@ import { SessionsPane } from "./panes/sessions.js";
 import { ApprovalsPane } from "./panes/approvals.js";
 import { PolicyPane } from "./panes/policy.js";
 import { ServicesPane } from "./panes/services.js";
+import { BackupPane } from "./panes/backup.js";
 import { AuditPane } from "./panes/audit.js";
 import { CredentialsPane } from "./panes/credentials.js";
 import { MemoryPane } from "./panes/memory.js";
@@ -43,6 +44,7 @@ export type SectionId =
   | "memory"
   | "app-state"
   | "services"
+  | "backup"
   | "audit"
   | "access"
   | "sessions"
@@ -113,6 +115,9 @@ const ACTS: Act[] = [
       // Transports are agent-wide: `servicesList` takes no context, because a
       // transport is not owned by one.
       { id: "services", label: "Transports", contextScoped: false },
+      // Bundles belong to the agent and to the operator who minted them, not
+      // to a context — and there is no context member on any backup task.
+      { id: "backup", label: "Backup", contextScoped: false },
       { id: "audit", label: "Audit", contextScoped: true },
     ],
   },
@@ -334,6 +339,8 @@ export function ManagerShell() {
         );
       case "services":
         return <ServicesPane parties={parties} authority={vta.authority} />;
+      case "backup":
+        return <BackupPane parties={parties} authority={vta.authority} />;
       case "audit":
         return <AuditPane parties={parties} contextId={selected} contextHeading={heading} />;
       case "access":

From bd4ffc0ebfd9a03641b9fc4e0314e4bd231adc65 Mon Sep 17 00:00:00 2001
From: Glenn Gore <glenn.g@affinidi.com>
Date: Wed, 2 Sep 2026 22:06:56 +0200
Subject: [PATCH 11/24] test(console): a section with no pane must fail the
 build, not render blank
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Three lists describe the console's navigation — the `SectionId` union,
the `ACTS` nav data, and the `switch` in `renderPane` — and nothing forced
them to agree. The union makes the switch exhaustive over ids that
*exist*, so a case cannot name a section that was never declared. The
reverse has no guard at all: an id in the union and in the nav, with no
case, compiles clean.

The failure is silent, which is what makes it worth a test. The section
appears in the sidebar, the operator clicks it, and the pane renders
nothing — no error, no console message, no failed request. A blank column
reads as "this agent has none of those" rather than as a bug. It is the
same shape as the panes that died on `unknown field 'ext'`, only quieter,
because at least those said something.

Noticed while adding the Backup section, which is exactly the change that
would introduce it.

Five assertions: nav ⊆ cases, cases ⊆ nav (a pane nothing routes to is
code that reads as live and is not), all three lists name the same set, no
duplicate ids, and a floor so none of it passes vacuously.

Proved non-vacuous rather than assumed — the lesson from the seeds guard,
where the obvious probe was tree-shaken away and proved nothing. Adding a
`probe` section to the union and the nav with no case fails two of the
five; reverted.

186 → 191 tests in the extension workspace.

Signed-off-by: Glenn Gore <glenn.g@affinidi.com>
---
 .../extension/tests/manager-sections.test.mts | 86 +++++++++++++++++++
 1 file changed, 86 insertions(+)
 create mode 100644 packages/extension/tests/manager-sections.test.mts

diff --git a/packages/extension/tests/manager-sections.test.mts b/packages/extension/tests/manager-sections.test.mts
new file mode 100644
index 0000000..691062f
--- /dev/null
+++ b/packages/extension/tests/manager-sections.test.mts
@@ -0,0 +1,86 @@
+// Three lists describe the console's navigation, and they must agree.
+//
+// `SectionId` (the union), `ACTS` (what the nav renders), and the `switch` in
+// `renderPane` (what each id draws). Nothing forces them together: the union
+// makes the *switch* exhaustive, so a case cannot name an id that does not
+// exist — but neither the compiler nor any existing test notices an id that is
+// in the union and the nav and has **no case**.
+//
+// That is the asymmetry worth guarding. The failure is silent: the section
+// appears in the sidebar, the operator clicks it, and the pane renders nothing
+// at all. No error, no console message, no failed request — a blank column that
+// reads as "this agent has none of those" rather than as a bug. It is the same
+// shape as the pane that died on an `unknown field` error, except quieter,
+// because at least that one said something.
+//
+// Reads the source rather than importing it: `shell.tsx` pulls in every pane,
+// and those reach `chrome` at module scope. Same approach as
+// `manager-surface.test.mts`, for the same reason.
+
+import { test } from "node:test";
+import assert from "node:assert/strict";
+import { readFileSync } from "node:fs";
+import { fileURLToPath } from "node:url";
+
+const SRC = readFileSync(
+  fileURLToPath(new URL("../src/manager/shell.tsx", import.meta.url)),
+  "utf8",
+);
+
+const all = (re: RegExp) => [...SRC.matchAll(re)].map((m) => m[1] as string);
+
+/** The `SectionId` union members. */
+const union = () => {
+  const block = /export type SectionId =([\s\S]*?);/.exec(SRC);
+  assert.ok(block, "could not find the SectionId union — has it been renamed?");
+  return [...block[1]!.matchAll(/"([a-z-]+)"/g)].map((m) => m[1] as string);
+};
+
+/** What the nav renders. */
+const sections = () => all(/\{\s*id:\s*"([a-z-]+)",\s*label:/g);
+
+/** What `renderPane` draws. */
+const cases = () => all(/^\s+case "([a-z-]+)":/gm);
+
+const sorted = (xs: string[]) => [...xs].sort();
+
+test("the section list is not empty, so none of this passes vacuously", () => {
+  assert.ok(sections().length > 8, `found only ${sections().length} sections — the regex is stale`);
+  assert.ok(cases().length > 8, `found only ${cases().length} cases — the regex is stale`);
+});
+
+test("every section the nav renders has a pane to draw", () => {
+  const missing = sections().filter((id) => !cases().includes(id));
+  assert.deepEqual(
+    missing,
+    [],
+    `these sections appear in the sidebar and render nothing when clicked: ${missing.join(", ")}. ` +
+      `The union makes the switch exhaustive over ids that EXIST, so nothing else catches an id ` +
+      `that was added to the nav without a case.`,
+  );
+});
+
+test("every pane is reachable from the nav", () => {
+  const orphaned = cases().filter((id) => !sections().includes(id));
+  assert.deepEqual(
+    orphaned,
+    [],
+    `these panes can never be shown, because no section selects them: ${orphaned.join(", ")}. ` +
+      `Either add the section or delete the pane — a pane nothing routes to is code that ` +
+      `reads as live and is not.`,
+  );
+});
+
+test("the union, the nav and the switch name the same set", () => {
+  assert.deepEqual(sorted(union()), sorted(sections()), "SectionId and the nav disagree");
+  assert.deepEqual(sorted(union()), sorted(cases()), "SectionId and renderPane disagree");
+});
+
+test("no section id is declared twice", () => {
+  const seen = sections();
+  assert.equal(
+    new Set(seen).size,
+    seen.length,
+    `a duplicate section id renders two identical-looking entries and the second is unreachable: ${seen.join(", ")}`,
+  );
+});

From 94ba66de228cbd72dc75d87367cd7a86af5af620 Mon Sep 17 00:00:00 2001
From: Glenn Gore <glenn.g@affinidi.com>
Date: Wed, 2 Sep 2026 23:07:20 +0200
Subject: [PATCH 12/24] refactor(core): take task types from the registry, and
 delete two dead casing folds
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Answering "are we on the latest trust-tasks, and can the hand-written
tasks go?" — we are (0.16.8 everywhere), and two categories could go.

## Two compat folds for peers that do not exist

`contexts.ts` folded `base_path`/`created_at`/`updated_at`, and
`list-dids.ts` folded `context_id`/`server_id`, both justified in comments
as "agents migrate later" and "this library talks to agents it does not
control".

CLAUDE.md forbids exactly this: nothing is deployed, so "an older agent is
still a supported peer" names nobody. And it was checkable — `ContextRecord`
and `WebvhDidRecord` in `vta-sdk` both carry `#[serde(rename_all =
"camelCase")]`, so the agent *emits* the canonical spelling. Their `alias`
attributes are deserialize-only: they govern what the agent accepts, which
says nothing about what it sends.

Two tests pinned the folds in place, one of them titled "still folds a
legacy record, because agents migrate later". Both now assert the
canonical spelling instead.

## Two hand-written types that had already drifted

Worse, and the reason this is more than tidying. `ContextRecord` and
`WebvhDidRecord` were declared by hand beside the generated ones, and had
drifted in opposite directions:

- `ContextRecord.did` was `string | null`. The schema makes it OPTIONAL —
  an agent omits it — so a caller guarding `=== null` never matches, and
  TypeScript agrees with the caller.
- `WebvhDidRecord` marked `serverId` and `portable` optional where the
  schema makes them required, and omitted seven members the agent sends
  (`mnemonic`, `scid`, `logEntryCount`, `preRotationCount`,
  `nextFragmentId`, `createdAt`, `updatedAt`). Data a caller could have
  used was simply invisible.

Neither could fail anything. `task-surface.mjs` checks that the URIs are
real and current; it says nothing about payload shapes, and the type is
the one part of a Trust Task checked against a copy rather than a schema.

Both now come from the binding, along with the five `vta/contexts/*` URIs,
`vta/webvh/dids/list`, and `task-consent/request` — plus `WakeHandle`,
`WakeTriggerPolicy`, `Exposure` and `StatePin`, which were byte-identical
to the generated ones. Identical is not reassuring: it is the state a type
is in immediately before it diverges.

## The guard

`schema-types-are-not-restated.mjs` fails if any `export interface` here
shares a name with a generated `_shared/components` type. `NARROWING`
holds the one deliberate exception — `PasskeyVerificationMethod` narrows
`webauthnTransports` from the schema's `string[]` to the DOM's
`AuthenticatorTransport`, which the schema cannot name and a caller passing
these to `navigator.credentials` wants.

Proved non-vacuous: restating `ContextRecord` fails it by name and file.

479 -> 482 tests (two fold tests removed, three added). Cold
clean/lint/build/test green; both dist guards re-run.

Signed-off-by: Glenn Gore <glenn.g@affinidi.com>
---
 packages/core/src/device/set-wake.ts          |  25 ++--
 packages/core/src/inbound/task-consent.ts     |  22 ++-
 packages/core/src/vta/contexts.ts             | 130 ++++++++----------
 packages/core/src/vta/list-dids.ts            |  49 +++----
 .../tests/schema-types-are-not-restated.mjs   | 118 ++++++++++++++++
 packages/core/tests/vault.ops.mjs             |  34 +----
 packages/core/tests/vta.list-dids-casing.mjs  |  12 +-
 7 files changed, 225 insertions(+), 165 deletions(-)
 create mode 100644 packages/core/tests/schema-types-are-not-restated.mjs

diff --git a/packages/core/src/device/set-wake.ts b/packages/core/src/device/set-wake.ts
index a61ddde..813565a 100644
--- a/packages/core/src/device/set-wake.ts
+++ b/packages/core/src/device/set-wake.ts
@@ -18,22 +18,19 @@ import type { RemoteDidcommEndpoint } from "../vta/didcomm.js";
 import { RestChannel, type RestChannelOptions } from "../vta/rest-channel.js";
 import { buildTrustTask } from "../vta/trust-task.js";
 
-const TASK_DEVICE_SET_WAKE = "https://trusttasks.org/spec/device/set-wake/0.2";
-const TASK_DEVICE_SET_WAKE_RESPONSE =
-  "https://trusttasks.org/spec/device/set-wake/0.2#response";
+import {
+  TYPE_URI as TASK_DEVICE_SET_WAKE,
+  RESPONSE_TYPE_URI as TASK_DEVICE_SET_WAKE_RESPONSE,
+  type WakeHandle,
+  type WakeTriggerPolicy,
+} from "@openvtc/trust-tasks/device/set-wake/0.2/payload";
+
+/** Re-exported from the binding rather than restated here: both were declared
+ *  by hand and were byte-identical to the schema's, which is the state just
+ *  before a divergence nobody notices. */
+export type { WakeHandle, WakeTriggerPolicy };
 
-/** The opaque gateway-issued handle — gateway address + handle, no token. */
-export interface WakeHandle {
-  /** Gateway that issued + acts on this handle (DID or https URL). */
-  gateway: string;
-  /** Opaque gateway-issued channel identifier (reveals no token). */
-  handle: string;
-}
 
-/** The VTA's effective allowlist, as provisioned to the gateway. */
-export interface WakeTriggerPolicy {
-  allowedTriggers: string[];
-}
 
 export interface DeviceSetWakeResponse {
   /** Whether the device now has a usable wake channel. */
diff --git a/packages/core/src/inbound/task-consent.ts b/packages/core/src/inbound/task-consent.ts
index 8f443da..4eec8c4 100644
--- a/packages/core/src/inbound/task-consent.ts
+++ b/packages/core/src/inbound/task-consent.ts
@@ -53,12 +53,16 @@ import {
   type PayloadValidator,
 } from "../trust-tasks/validate.js";
 
-import { PAYLOAD_SCHEMA } from "@openvtc/trust-tasks/task-consent/request/0.1/payload";
+import {
+  PAYLOAD_SCHEMA,
+  TYPE_URI as TASK_CONSENT_REQUEST_TYPE_URI,
+  type Exposure,
+  type StatePin,
+} from "@openvtc/trust-tasks/task-consent/request/0.1/payload";
 import { RESPONSE_PAYLOAD_SCHEMA as DECISION_RESPONSE_SCHEMA } from "@openvtc/trust-tasks/task-consent/decision/0.1/payload";
 import type { SigningIdentity } from "../siop/self-issued.js";
 
-export const TASK_CONSENT_REQUEST_TYPE =
-  "https://trusttasks.org/spec/task-consent/request/0.1";
+export const TASK_CONSENT_REQUEST_TYPE = TASK_CONSENT_REQUEST_TYPE_URI;
 export const TASK_CONSENT_DECISION_TYPE =
   "https://trusttasks.org/spec/task-consent/decision/0.1";
 /** VTA → requester: an approval landed and a grant is ready — re-submit now. */
@@ -264,16 +268,13 @@ export function parseTaskConsentGranted(
 /** SPEC §7.3 item 13 — the integrity effect of executing the task. */
 export type SideEffectLevel = "none" | "mutating" | "destructive";
 
-/** SPEC §7.3 item 14 — what leaves the executor, and whose authority is used. */
-export interface Exposure {
-  discloses: "none" | "metadata" | "secret";
-  actsAsSubject: boolean;
-}
 
 /**
  * One consequence of executing the task, authored by the VTA by dry-running the
  * handler it is about to invoke.
  */
+export type { Exposure, StatePin };
+
 export interface ConsentEffect {
   /** Machine discriminator. The set is OPEN — handlers evolve faster than this
    *  type, so a surface MUST tolerate a kind it does not recognise. */
@@ -287,11 +288,6 @@ export interface ConsentEffect {
   detail?: Record<string, unknown>;
 }
 
-/** The prior state the effects were computed against. */
-export interface StatePin {
-  resource: string;
-  version: string;
-}
 
 /** Payload of an inbound `task-consent/request/0.1` (VTA → approver). */
 export interface TaskConsentRequestPayload {
diff --git a/packages/core/src/vta/contexts.ts b/packages/core/src/vta/contexts.ts
index 42a7273..918c6f7 100644
--- a/packages/core/src/vta/contexts.ts
+++ b/packages/core/src/vta/contexts.ts
@@ -1,92 +1,70 @@
-// Contexts — list + create, as dispatcher trust-tasks.
+// Contexts — the `vta/contexts/*` family, as dispatcher trust-tasks.
 //
 // The popup's AddEntryForm fetches the operator's accessible contexts (to
 // populate the context picker) and can create a new context inline. Both run
 // as canonical trust-tasks over a TrustTaskChannel/VtaSession, so they work on
 // a DIDComm-only VTA as well as REST.
 //
-//   list   → https://trusttasks.org/spec/vta/contexts/list/1.0    (payload {})
-//   create → https://trusttasks.org/spec/vta/contexts/create/1.0  (super-admin)
-//
-// Wire shapes mirror `vta-sdk::protocols::context_management::{list,create}`:
-// snake_case fields, `CreateContextResultBody` as the record. The VTA also
-// exposes a bespoke `GET/POST /contexts` REST route (now deprecated) — the
-// trust-task dispatcher form is the canonical one.
+// **Every URI and the record shape come from `@openvtc/trust-tasks`.** They
+// used to be hand-written here, alongside a hand-declared `ContextRecord` and a
+// header claiming the wire was snake_case. None of that was true any more, and
+// two of them were wrong in a way nothing would have caught: the hand-written
+// record typed `did` and `description` as `string | null`, where the published
+// schema makes them OPTIONAL — an agent omits them, so a caller testing
+// `=== null` never matches, and TypeScript agrees with the caller. Taking the
+// type from the binding means the schema is the only place that shape is
+// stated.
 
 import type { TaskParty, TrustTaskSender } from "./channel.js";
 import { RestChannel, type RestChannelOptions } from "./rest-channel.js";
 import { buildTrustTask } from "./trust-task.js";
 
-const TASK_CONTEXTS_LIST = "https://trusttasks.org/spec/vta/contexts/list/1.0";
-const TASK_CONTEXTS_LIST_RESPONSE = `${TASK_CONTEXTS_LIST}#response`;
-const TASK_CONTEXTS_CREATE = "https://trusttasks.org/spec/vta/contexts/create/1.0";
-const TASK_CONTEXTS_GET = "https://trusttasks.org/spec/vta/contexts/get/1.0";
-const TASK_CONTEXTS_GET_RESPONSE = `${TASK_CONTEXTS_GET}#response`;
-const TASK_CONTEXTS_UPDATE = "https://trusttasks.org/spec/vta/contexts/update/1.0";
-const TASK_CONTEXTS_UPDATE_RESPONSE = `${TASK_CONTEXTS_UPDATE}#response`;
-const TASK_CONTEXTS_UPDATE_DID = "https://trusttasks.org/spec/vta/contexts/update-did/1.0";
-const TASK_CONTEXTS_UPDATE_DID_RESPONSE = `${TASK_CONTEXTS_UPDATE_DID}#response`;
-const TASK_CONTEXTS_CREATE_RESPONSE = `${TASK_CONTEXTS_CREATE}#response`;
+import {
+  TYPE_URI as TASK_CONTEXTS_LIST,
+  RESPONSE_TYPE_URI as TASK_CONTEXTS_LIST_RESPONSE,
+  type ContextRecord,
+} from "@openvtc/trust-tasks/vta/contexts/list/1.0/payload";
+import {
+  TYPE_URI as TASK_CONTEXTS_CREATE,
+  RESPONSE_TYPE_URI as TASK_CONTEXTS_CREATE_RESPONSE,
+} from "@openvtc/trust-tasks/vta/contexts/create/1.0/payload";
+import {
+  TYPE_URI as TASK_CONTEXTS_GET,
+  RESPONSE_TYPE_URI as TASK_CONTEXTS_GET_RESPONSE,
+} from "@openvtc/trust-tasks/vta/contexts/get/1.0/payload";
+import {
+  TYPE_URI as TASK_CONTEXTS_UPDATE,
+  RESPONSE_TYPE_URI as TASK_CONTEXTS_UPDATE_RESPONSE,
+} from "@openvtc/trust-tasks/vta/contexts/update/1.0/payload";
+import {
+  TYPE_URI as TASK_CONTEXTS_UPDATE_DID,
+  RESPONSE_TYPE_URI as TASK_CONTEXTS_UPDATE_DID_RESPONSE,
+} from "@openvtc/trust-tasks/vta/contexts/update-did/1.0/payload";
 
-/** One context record — mirrors `CreateContextResultBody` (the shape returned
- *  by both list and create). snake_case on the wire. */
-export interface ContextRecord {
-  id: string;
-  name: string;
-  did: string | null;
-  description: string | null;
-  /** Parent context id, or absent for a top-level context. */
-  parent?: string;
-  /** Resolved path from the root context — derived by the VTA, not settable. */
-  basePath: string;
-  createdAt: string;
-  updatedAt: string;
-}
+/** One context record, as the registry declares it. Re-exported so callers
+ *  need not know which task's binding it happens to live under. */
+export type { ContextRecord };
 
 
-/**
- * Read a member that the agent may still spell in snake_case.
- *
- * SPEC §4.10 makes lowerCamelCase the wire contract, and the VTA now emits it —
- * but an agent that has not taken that change yet still sends the old spelling,
- * and this library talks to agents it does not control. Accepting both on read
- * is Postel's other half; this library emits only the canonical form.
- *
- * Delete once no supported agent predates the fold.
- */
-export function fold(
-  raw: Record<string, unknown>,
-  pairs: readonly (readonly [string, string])[],
-): Record<string, unknown> {
-  const out: Record<string, unknown> = { ...raw };
-  for (const [camel, snake] of pairs) {
-    if (snake in out) {
-      if (!(camel in out)) out[camel] = out[snake];
-      delete out[snake];
-    }
-  }
-  return out;
-}
 
 /**
- * Accept either spelling of the record's members; hand back the canonical one.
+ * A context record as the agent sends it.
+ *
+ * This used to fold `base_path`/`created_at`/`updated_at` into the canonical
+ * spelling, on the reasoning that the library "talks to agents it does not
+ * control". That reasoning does not hold here and the fold was dead code:
+ * nothing is deployed, the wallet has never been published, and `ContextRecord`
+ * in `vta-sdk` carries `#[serde(rename_all = "camelCase")]` — so the agent
+ * *emits* camelCase and has done since the casing change. Its `alias`
+ * attributes are deserialize-only; they let it keep *accepting* the old
+ * spelling, which says nothing about what it sends.
  *
- * Only rewrites what is present: a record that carries neither spelling of a
- * member keeps not carrying it, rather than gaining the key with `undefined`.
+ * A fold kept past its cause is worse than none: it reads as a live constraint,
+ * and the next person maintaining this file has to work out whether some peer
+ * still needs it. SPEC §4.10 names one spelling — match it with `===`.
  */
-function normalizeContext(raw: Record<string, unknown>): ContextRecord {
-  const out: Record<string, unknown> = { ...raw };
-  for (const [camel, snake] of [
-    ["basePath", "base_path"],
-    ["createdAt", "created_at"],
-    ["updatedAt", "updated_at"],
-  ] as const) {
-    if (snake in out) {
-      if (!(camel in out)) out[camel] = out[snake];
-      delete out[snake];
-    }
-  }
-  return out as unknown as ContextRecord;
+function asContextRecord(raw: Record<string, unknown>): ContextRecord {
+  return raw as unknown as ContextRecord;
 }
 
 export interface ContextsListParams {
@@ -115,7 +93,7 @@ export async function contextsList(
     expectedResponseType: TASK_CONTEXTS_LIST_RESPONSE,
     operationLabel: "contexts/list/1.0",
   });
-  return (payload.contexts ?? []).map(normalizeContext);
+  return (payload.contexts ?? []).map(asContextRecord);
 }
 
 export interface ContextsCreateParams {
@@ -153,7 +131,7 @@ export async function contextsCreate(
     expectedResponseType: TASK_CONTEXTS_CREATE_RESPONSE,
     operationLabel: "contexts/create/1.0",
   });
-  return normalizeContext(created);
+  return asContextRecord(created);
 }
 
 /** @deprecated REST-transport options. Kept for existing call sites; prefer
@@ -199,7 +177,7 @@ export async function contextsGet(
     expectedResponseType: TASK_CONTEXTS_GET_RESPONSE,
     operationLabel: "vta/contexts/get/1.0",
   });
-  return normalizeContext(payload);
+  return asContextRecord(payload);
 }
 
 export interface ContextsUpdateParams {
@@ -240,7 +218,7 @@ export async function contextsUpdate(
     expectedResponseType: TASK_CONTEXTS_UPDATE_RESPONSE,
     operationLabel: "vta/contexts/update/1.0",
   });
-  return normalizeContext(payload);
+  return asContextRecord(payload);
 }
 
 export interface ContextsUpdateDidParams {
@@ -266,7 +244,7 @@ export async function contextsUpdateDid(
     expectedResponseType: TASK_CONTEXTS_UPDATE_DID_RESPONSE,
     operationLabel: "vta/contexts/update-did/1.0",
   });
-  return normalizeContext(payload);
+  return asContextRecord(payload);
 }
 
 export function vtaListContexts(opts: VtaListContextsOptions): Promise<ContextRecord[]> {
diff --git a/packages/core/src/vta/list-dids.ts b/packages/core/src/vta/list-dids.ts
index 7a1837b..b753ca4 100644
--- a/packages/core/src/vta/list-dids.ts
+++ b/packages/core/src/vta/list-dids.ts
@@ -20,27 +20,23 @@ import type { TrustTaskSender } from "./channel.js";
 import type { RemoteDidcommEndpoint } from "./didcomm.js";
 import { RestChannel, type RestChannelOptions } from "./rest-channel.js";
 import { buildTrustTask } from "./trust-task.js";
-import { fold } from "./contexts.js";
 
-const TASK_WEBVH_DIDS_LIST_1_0 = "https://trusttasks.org/spec/vta/webvh/dids/list/1.0";
+import {
+  TYPE_URI as TASK_WEBVH_DIDS_LIST_1_0,
+  type WebvhDidRecord,
+} from "@openvtc/trust-tasks/vta/webvh/dids/list/1.0/payload";
 const TASK_WEBVH_DIDS_LIST_1_0_RESPONSE = `${TASK_WEBVH_DIDS_LIST_1_0}#response`;
 
-/** One webvh DID record as returned by `vta/webvh/dids/list/1.0`.
- *  Mirrors `vta-sdk::webvh::WebvhDidRecord` — **snake_case** on the
- *  wire. Only the fields the wallet consumes are typed; the VTA also
- *  sends `mnemonic`, `scid`, `log_entry_count`, timestamps, etc. which
- *  we ignore here. */
-export interface WebvhDidRecord {
-  /** The hosted DID (`did:webvh:…`). The persona a did-self-issued
-   *  entry acts AS — becomes the SIOP `iss`/`sub`. */
-  did: string;
-  /** Context this DID belongs to (matches a `ContextRecord.id`). */
-  contextId: string;
-  /** Hosting server the DID is registered with. */
-  serverId?: string;
-  /** Whether the DID is portable across hosting servers. */
-  portable?: boolean;
-}
+/** A hosted DID as the registry declares it.
+ *
+ *  Taken from the binding rather than declared here. The hand-written version
+ *  this replaces had drifted in both directions at once: it marked `serverId`
+ *  and `portable` OPTIONAL where the schema makes them required, and it omitted
+ *  seven members the agent actually sends (`mnemonic`, `scid`, `logEntryCount`,
+ *  `preRotationCount`, `nextFragmentId`, `createdAt`, `updatedAt`). Neither
+ *  kind of drift announces itself: the first invites guards that can never
+ *  fire, the second hides data a caller would have used. */
+export type { WebvhDidRecord };
 
 interface ListDidsResultBody {
   dids?: WebvhDidRecord[];
@@ -84,16 +80,13 @@ export async function vtaListDids(
     expectedResponseType: TASK_WEBVH_DIDS_LIST_1_0_RESPONSE,
     operationLabel: "webvh/dids/list",
   });
-  // Accept either spelling while agents migrate to the canonical casing
-  // (SPEC §4.10). Changing the type alone would leave `contextId` undefined
-  // against an agent that has not taken the fold.
-  return (result.dids ?? []).map(
-    (d) =>
-      fold(d as unknown as Record<string, unknown>, [
-        ["contextId", "context_id"],
-        ["serverId", "server_id"],
-      ]) as unknown as WebvhDidRecord,
-  );
+  // No casing fold. `WebvhDidRecord` in `vta-sdk` carries
+  // `#[serde(rename_all = "camelCase")]`, so the agent emits `contextId` and
+  // `serverId`; its `alias` attributes are deserialize-only and say nothing
+  // about what it sends. Nothing is deployed, so "an agent that has not taken
+  // the fold" names no peer that exists — and a fold kept past its cause reads
+  // as a live constraint to whoever maintains this next.
+  return (result.dids ?? []) as unknown as WebvhDidRecord[];
 }
 
 /** @deprecated Use {@link vtaListDids} with a channel from a `VtaSession`.
diff --git a/packages/core/tests/schema-types-are-not-restated.mjs b/packages/core/tests/schema-types-are-not-restated.mjs
new file mode 100644
index 0000000..a9bd323
--- /dev/null
+++ b/packages/core/tests/schema-types-are-not-restated.mjs
@@ -0,0 +1,118 @@
+// A type the registry declares must not be declared here as well.
+//
+// ## What went wrong
+//
+// `ContextRecord` and `WebvhDidRecord` were written out by hand in this
+// library, alongside the generated ones in `@openvtc/trust-tasks`. Both had
+// drifted, in opposite directions, and neither drift could fail anything:
+//
+//   * `ContextRecord.did` was typed `string | null`. The schema makes it
+//     OPTIONAL — a conforming agent omits the member — so a caller guarding
+//     with `=== null` never matches, and TypeScript agrees with the caller.
+//   * `WebvhDidRecord` marked `serverId` and `portable` optional where the
+//     schema makes them required, and omitted seven members the agent sends
+//     (`mnemonic`, `scid`, `logEntryCount`, `createdAt`, …). Data the caller
+//     could have used simply was not visible.
+//
+// Nothing else in this repo would have caught either. `task-surface.mjs` checks
+// that the URIs this library names exist and are current; it says nothing about
+// payload SHAPES. The type is the one part of a Trust Task that is checked
+// against a copy rather than against the schema.
+//
+// ## The rule
+//
+// If `@openvtc/trust-tasks` exports a shared component type, this library uses
+// it — it does not restate it. Four more (`WakeHandle`, `WakeTriggerPolicy`,
+// `Exposure`, `StatePin`) were byte-identical to the generated ones when this
+// test was written, which is not reassuring: identical is the state a type is
+// in immediately before it diverges, and a duplicate that has not drifted yet
+// is a duplicate that will.
+//
+// ## The exception, and why it is narrow
+//
+// A local type MAY narrow a generated one where the browser knows more than the
+// schema can say — see `NARROWING`. It must say so, and it must be a
+// restriction, never an addition: the schema is the wider contract and a local
+// type that ADDS a member is asserting something the agent never promised.
+
+import { test } from "node:test";
+import assert from "node:assert/strict";
+import { readFileSync, readdirSync } from "node:fs";
+import { join, dirname } from "node:path";
+import { fileURLToPath } from "node:url";
+
+const SRC = fileURLToPath(new URL("../src", import.meta.url));
+// Located from a real subpath, resolved through ESM.
+//
+// Two traps here, both worth naming. The package's `exports` map does not
+// expose its own `package.json`, so the usual `require.resolve(pkg +
+// "/package.json")` fails; and its subpaths are a bare `./*` pattern, which
+// CJS `require.resolve` will not match even though `import` does. So this uses
+// `import.meta.resolve` — the same resolver the source files use.
+const COMPONENTS = join(
+  dirname(fileURLToPath(import.meta.resolve("@openvtc/trust-tasks/vta/contexts/list/1.0/payload"))),
+  "../../../../_shared/components.d.ts",
+);
+
+/**
+ * Types this library deliberately restates, each with the reason.
+ *
+ * An entry is a claim that the local declaration says something TRUER for a
+ * browser than the schema can — not that importing it would be inconvenient.
+ */
+const NARROWING = {
+  PasskeyVerificationMethod:
+    "narrows `webauthnTransports` from the schema's `string[]` to the DOM's " +
+    "`AuthenticatorTransport` union. The schema cannot name a browser type, and " +
+    "a caller passing these to `navigator.credentials` wants the narrow one.",
+};
+
+const files = (dir) =>
+  readdirSync(dir, { withFileTypes: true }).flatMap((e) =>
+    e.isDirectory() ? files(join(dir, e.name)) : e.name.endsWith(".ts") ? [join(dir, e.name)] : [],
+  );
+
+const generated = new Set(
+  [...readFileSync(COMPONENTS, "utf8").matchAll(/export (?:interface|type) ([A-Za-z0-9_]+)/g)].map(
+    (m) => m[1],
+  ),
+);
+
+test("the generated component list is real, so none of this passes vacuously", () => {
+  assert.ok(
+    generated.size > 100,
+    `found only ${generated.size} generated component types — the path to ` +
+      `components.d.ts is stale and this test now checks nothing`,
+  );
+  assert.ok(generated.has("ContextRecord"), "components.d.ts does not look like the right file");
+});
+
+test("no schema component type is restated by hand", () => {
+  const restated = [];
+  for (const file of files(SRC)) {
+    const rel = file.slice(SRC.length + 1);
+    for (const m of readFileSync(file, "utf8").matchAll(/export interface ([A-Za-z0-9_]+)/g)) {
+      if (generated.has(m[1]) && !(m[1] in NARROWING)) restated.push(`${m[1]}  (${rel})`);
+    }
+  }
+
+  assert.deepEqual(
+    restated.sort(),
+    [],
+    `these types are declared here and also generated from a published schema:\n  ` +
+      `${restated.join("\n  ")}\n\n` +
+      `Import the generated one instead — a hand-written copy drifts silently, ` +
+      `because nothing compares the two. If the local type deliberately NARROWS ` +
+      `the generated one for a browser caller, add it to NARROWING with the reason.`,
+  );
+});
+
+test("every NARROWING entry still names a generated type", () => {
+  const stale = Object.keys(NARROWING).filter((n) => !generated.has(n));
+  assert.deepEqual(
+    stale,
+    [],
+    `these NARROWING entries no longer name a generated component type — the ` +
+      `schema moved, so the exception is either unnecessary or now wrong: ${stale.join(", ")}`,
+  );
+});
diff --git a/packages/core/tests/vault.ops.mjs b/packages/core/tests/vault.ops.mjs
index dc87a5e..dc60644 100644
--- a/packages/core/tests/vault.ops.mjs
+++ b/packages/core/tests/vault.ops.mjs
@@ -76,13 +76,13 @@ test("vaultSignTrustTask forwards the unsigned envelope and returns signedEnvelo
 });
 
 test("vtaListDids scopes by context and unwraps dids[]", async () => {
-  const ch = captureChannel({ dids: [{ did: "did:webvh:a", context_id: "work" }] });
+  const ch = captureChannel({ dids: [{ did: "did:webvh:a", contextId: "work" }] });
   const res = await vtaListDids(ch, { holder, service, contextId: "work" });
   assert.equal(ch.sent[0].envelope.type, "https://trusttasks.org/spec/vta/webvh/dids/list/1.0");
-  // camelCase: the schema names `contextId` and sets additionalProperties:false,
-  // so `context_id` was malformed rather than an accepted synonym. This
-  // assertion pinned the drift in place — the reply is still snake_case above,
-  // because the READ path deliberately folds both while agents migrate.
+  // camelCase both ways: the schema names `contextId` and sets
+  // additionalProperties:false, so `context_id` was malformed rather than an
+  // accepted synonym — and the agent emits the canonical spelling too, so the
+  // read path no longer folds.
   assert.deepEqual(ch.sent[0].envelope.payload, { contextId: "work" });
   assert.deepEqual(res, [{ did: "did:webvh:a", contextId: "work" }]);
 });
@@ -154,30 +154,6 @@ test("setDeviceWake sets the handle; omitting it clears", async () => {
   assert.deepEqual(ch2.sent[0].envelope.payload, {}); // clear
 });
 
-test("a context record still arrives from an agent that predates the casing fold", async () => {
-  // SPEC §4.10 makes lowerCamelCase the wire contract and the VTA now emits it,
-  // but this library talks to agents it does not control. The old spelling is
-  // accepted on read and normalised away — a caller never sees both.
-  const ch = captureChannel({
-    contexts: [
-      { id: "work", name: "Work", base_path: "/work", created_at: "t1", updated_at: "t2" },
-    ],
-  });
-  const [ctx] = await contextsList(ch, { holder, service });
-  assert.equal(ctx.basePath, "/work");
-  assert.equal(ctx.createdAt, "t1");
-  assert.equal(ctx.updatedAt, "t2");
-  assert.ok(!("base_path" in ctx), "the pre-fold spelling must not survive into the result");
-});
-
-test("a webvh DID record likewise", async () => {
-  const ch = captureChannel({ dids: [{ did: "did:webvh:a", context_id: "work", server_id: "prod" }] });
-  const [d] = await vtaListDids(ch, { holder, service });
-  assert.equal(d.contextId, "work");
-  assert.equal(d.serverId, "prod");
-  assert.ok(!("context_id" in d));
-});
-
 test("the canonical spelling is passed through untouched", async () => {
   const ch = captureChannel({ contexts: [{ id: "work", name: "Work", basePath: "/work" }] });
   const [ctx] = await contextsList(ch, { holder, service });
diff --git a/packages/core/tests/vta.list-dids-casing.mjs b/packages/core/tests/vta.list-dids-casing.mjs
index 5073dbe..2c29781 100644
--- a/packages/core/tests/vta.list-dids-casing.mjs
+++ b/packages/core/tests/vta.list-dids-casing.mjs
@@ -47,12 +47,14 @@ test("no filter sends an empty payload rather than an absent key set to undefine
   assert.deepEqual(ch.sent[0].envelope.payload, {});
 });
 
-test("the read path still folds a legacy record, because agents migrate later", async () => {
-  // Emitting the canonical spelling and accepting both are separate moves. An
-  // agent that has not taken the fold still answers `context_id`, and dropping
-  // the fold here would leave `contextId` undefined against it.
+test("the read path passes the canonical spelling straight through", async () => {
+  // The fold this replaced accepted `context_id`/`server_id` too, justified by
+  // "an agent that has not taken the fold". No such agent exists: nothing is
+  // deployed, and `WebvhDidRecord` in `vta-sdk` is `rename_all = "camelCase"`,
+  // so the agent emits the canonical spelling. Its `alias` attributes are
+  // deserialize-only — they govern what it accepts, not what it sends.
   const ch = recorder({
-    dids: [{ did: "did:webvh:QmA:h.example", context_id: "personal", server_id: "prod" }],
+    dids: [{ did: "did:webvh:QmA:h.example", contextId: "personal", serverId: "prod" }],
   });
   const [rec] = await vtaListDids(ch, { holder: HOLDER, service: SERVICE });
   assert.equal(rec.contextId, "personal");

From 0f2b554c498c8658b6e40408598f08f8e8a917cc Mon Sep 17 00:00:00 2001
From: Glenn Gore <glenn.g@affinidi.com>
Date: Wed, 2 Sep 2026 23:13:10 +0200
Subject: [PATCH 13/24] fix(core): swapAcl was reading fields the agent has
 never sent
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Continuing the sweep for hand-written task types, and this one is a live
defect rather than tidying.

`AclSwapResult` was declared here as a flat ACL entry — `did`, `role`,
`allowedContexts`, `createdAt: number`. The agent sends none of that. VTI
#857 made `acl/swap-key/0.1` respond `{ entry, previousSubject }`, and the
entry itself names `subject` not `did`, `scopes` not `allowedContexts`, and
dates as RFC 3339 strings not numbers. Wrong at three levels at once:
wrapping, member names, and types.

So every field a caller read came back `undefined`. It has not bitten
because nothing in the extension calls `swapAcl` yet — the next caller
would have been the one to find out.

**Why nothing caught it.** `sender.send<T>()` is an unchecked cast, so a
wrong `T` costs nothing at compile time. And the one test built its
response fixture from this very type rather than from the schema, then
never read it: it asserted the request and stopped. A fixture derived from
the client's assumption cannot contradict the client. Rebuilt from the
schema, the test's own surviving line `assert.equal(res.did, …)` failed —
which is the drift, demonstrated.

The test now asserts the response too, because the absence of that is what
let the type rot.

Also taken from the binding, both missing only `ext` (SPEC §4.5.1, which
any agent may send): `DeviceSetWakeResponse` and `ContextDeleteResult`,
plus the `vta/contexts/delete` and `acl/swap-key` URIs.

`*Params` and `*Options` types stay local on purpose — they are
caller-facing argument shapes that bundle parties, payload fields and
channel options, not wire types, and no schema describes them.

Cold clean/lint/build/test green; 482 core tests; both dist guards re-run.

Signed-off-by: Glenn Gore <glenn.g@affinidi.com>
---
 packages/core/src/admin/contexts.ts  | 12 ++++++----
 packages/core/src/device/set-wake.ts | 11 ++++-----
 packages/core/src/onboarding/swap.ts | 34 ++++++++++++++++++----------
 packages/core/tests/vault.ops.mjs    | 27 +++++++++++++++++-----
 4 files changed, 54 insertions(+), 30 deletions(-)

diff --git a/packages/core/src/admin/contexts.ts b/packages/core/src/admin/contexts.ts
index d06e5ae..ce3a82b 100644
--- a/packages/core/src/admin/contexts.ts
+++ b/packages/core/src/admin/contexts.ts
@@ -13,7 +13,10 @@
 import type { TaskParty, TrustTaskSender } from "../vta/channel.js";
 import { buildTrustTask } from "../vta/trust-task.js";
 
-const TASK_CONTEXTS_DELETE = "https://trusttasks.org/spec/vta/contexts/delete/1.0";
+import {
+  TYPE_URI as TASK_CONTEXTS_DELETE,
+  type VTAContextsDeleteResponsePayload,
+} from "@openvtc/trust-tasks/vta/contexts/delete/1.0/payload";
 const TASK_CONTEXTS_PREVIEW_DELETE =
   "https://trusttasks.org/spec/vta/contexts/preview-delete/1.0";
 
@@ -26,10 +29,9 @@ export interface ContextDeleteParams {
   force?: boolean;
 }
 
-export interface ContextDeleteResult {
-  id: string;
-  deleted: boolean;
-}
+/** The delete response, from the binding. The hand-written copy omitted
+ *  `ext`, which SPEC §4.5.1 lets any agent send. */
+export type ContextDeleteResult = VTAContextsDeleteResponsePayload;
 
 /**
  * What deleting this context would destroy.
diff --git a/packages/core/src/device/set-wake.ts b/packages/core/src/device/set-wake.ts
index 813565a..89c09c6 100644
--- a/packages/core/src/device/set-wake.ts
+++ b/packages/core/src/device/set-wake.ts
@@ -23,6 +23,7 @@ import {
   RESPONSE_TYPE_URI as TASK_DEVICE_SET_WAKE_RESPONSE,
   type WakeHandle,
   type WakeTriggerPolicy,
+  type DeviceSetWakeResponsePayload,
 } from "@openvtc/trust-tasks/device/set-wake/0.2/payload";
 
 /** Re-exported from the binding rather than restated here: both were declared
@@ -30,15 +31,11 @@ import {
  *  before a divergence nobody notices. */
 export type { WakeHandle, WakeTriggerPolicy };
 
+/** The set-wake response, from the binding. The hand-written copy omitted
+ *  `ext`, which SPEC §4.5.1 lets any agent send. */
+export type DeviceSetWakeResponse = DeviceSetWakeResponsePayload;
 
 
-export interface DeviceSetWakeResponse {
-  /** Whether the device now has a usable wake channel. */
-  pushCapable: boolean;
-  /** The effective allowlist the VTA computed + provisioned (absent on clear). */
-  triggerPolicy?: WakeTriggerPolicy;
-}
-
 export interface DeviceSetWakeParams {
   /** The wallet's holder DIDComm identity (envelope `issuer`). */
   holder: Identity;
diff --git a/packages/core/src/onboarding/swap.ts b/packages/core/src/onboarding/swap.ts
index 6fe134a..d46e091 100644
--- a/packages/core/src/onboarding/swap.ts
+++ b/packages/core/src/onboarding/swap.ts
@@ -24,19 +24,29 @@ import { RestChannel } from "../vta/rest-channel.js";
 import type { DidcommMessageBridge } from "../vta/transport.js";
 import { buildTrustTask } from "../vta/trust-task.js";
 
-const ACL_SWAP_KEY = "https://trusttasks.org/spec/acl/swap-key/0.1";
-const ACL_SWAP_KEY_RESPONSE = "https://trusttasks.org/spec/acl/swap-key/0.1#response";
+import {
+  TYPE_URI as ACL_SWAP_KEY,
+  RESPONSE_TYPE_URI as ACL_SWAP_KEY_RESPONSE,
+  type ACLSwapKeyResponsePayload,
+  type AclEntry,
+} from "@openvtc/trust-tasks/acl/swap-key/0.1/payload";
+
+/** The swap-key response, as the registry declares it: the realized ACL entry
+ *  plus the DID that was swapped out.
+ *
+ *  This was declared by hand as a FLAT entry — `did`, `role`, `allowedContexts`,
+ *  `createdAt: number` — and was wrong in three ways at once. The agent wraps
+ *  the entry (`{ entry, previousSubject }`, VTI #857), and the entry itself
+ *  names `subject` not `did`, `scopes` not `allowedContexts`, and dates as
+ *  RFC 3339 strings not numbers. Every field a caller read came back
+ *  `undefined`.
+ *
+ *  Nothing caught it because `sender.send<T>()` is an unchecked cast and the
+ *  only test built its fixture from this type rather than from the schema — so
+ *  the test asserted the drift and would have gone on doing so. */
+export type AclSwapResult = ACLSwapKeyResponsePayload;
+export type { AclEntry };
 
-/** The ACL entry created for the new DID (the swap-key result body). */
-export interface AclSwapResult {
-  did: string;
-  role: string;
-  label?: string | null;
-  allowedContexts: string[];
-  createdAt: number;
-  createdBy: string;
-  expiresAt?: number | null;
-}
 
 export interface SwapAclParams {
   /** The OLD DID (operator-granted ephemeral). Its DID is `currentSubject` and
diff --git a/packages/core/tests/vault.ops.mjs b/packages/core/tests/vault.ops.mjs
index dc60644..9e79572 100644
--- a/packages/core/tests/vault.ops.mjs
+++ b/packages/core/tests/vault.ops.mjs
@@ -108,12 +108,21 @@ test("contextsCreate defaults name to id and forwards description/parent", async
 
 test("swapAcl sends acl/swap-key with currentSubject/newSubject/linkProof (ephemeral issuer)", async () => {
   const holderSigning = generateSigningIdentity();
+  // The response shape the AGENT sends (VTI #857): the realized entry wrapped,
+  // plus the DID swapped out. This fixture used to be a flat entry with `did`,
+  // `allowedContexts` and a numeric `createdAt` — built from the client's own
+  // hand-written type rather than from the schema, so it agreed with the drift
+  // instead of catching it. Nothing read it either, which is how a response
+  // type can be wrong in three ways and stay green.
   const ch = captureChannel({
-    did: holderSigning.did,
-    role: "admin",
-    allowedContexts: [],
-    createdAt: 1,
-    createdBy: "did:web:vta.example",
+    entry: {
+      subject: holderSigning.did,
+      role: "admin",
+      scopes: [],
+      createdAt: "2026-01-01T00:00:00Z",
+      createdBy: "did:web:vta.example",
+    },
+    previousSubject: "did:key:zEphemeral",
   });
   const res = await swapAcl(ch, {
     ephemeralDid: "did:key:zEphemeral",
@@ -126,12 +135,18 @@ test("swapAcl sends acl/swap-key with currentSubject/newSubject/linkProof (ephem
   assert.equal(envelope.recipient, "did:web:vta.example");
   assert.equal(envelope.payload.currentSubject, "did:key:zEphemeral");
   assert.equal(envelope.payload.newSubject, holderSigning.did);
+
+  // Assert the RESPONSE too. The absence of this is what let the return type
+  // drift: `sender.send<T>()` is an unchecked cast, so a wrong `T` costs
+  // nothing until a caller reads a field and gets `undefined`.
+  assert.equal(res.entry.subject, holderSigning.did);
+  assert.equal(res.entry.role, "admin");
+  assert.equal(res.previousSubject, "did:key:zEphemeral");
   assert.ok(
     typeof envelope.payload.linkProof === "string" && envelope.payload.linkProof.length > 0,
     "linkProof VP-JWT is present",
   );
   assert.equal(opts.expectedResponseType, "https://trusttasks.org/spec/acl/swap-key/0.1#response");
-  assert.equal(res.did, holderSigning.did);
 });
 
 test("ops accept a VtaSession (not just a raw channel) and route through it", async () => {

From 798a115c3c33de322e4764fc60a596a1f0439e36 Mon Sep 17 00:00:00 2001
From: Glenn Gore <glenn.g@affinidi.com>
Date: Thu, 3 Sep 2026 07:32:53 +0200
Subject: [PATCH 14/24] fix(core): the guard could not see a type-alias shadow,
 and one was hiding
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

`schema-types-are-not-restated.mjs` matched `export interface` only. A
schema component restated as `export type X = { … }` walked straight past
it — which is how `PushRegistration` survived the sweep that added the
guard.

The schema declares it `Apns | Fcm | WebPush`. This library restated it as
an inline object modelling webpush alone. The narrowing is right — a
browser extension cannot produce an APNs or FCM registration — but writing
it out by hand states the members again, so a change to the WebPush variant
leaves this behind silently. Now `export type PushRegistration = WebPush`,
taking the generated variant: the narrowing is the only thing the line
says.

The guard now reads `export type` too, and distinguishes the two cases,
which is the part worth getting right:

  export type X = Generated;        // an alias — one source, fine
  export type X = { … };            // a restatement — a second source

`ALIAS_TO_IDENTIFIER` draws that line. Without it the check would have
flagged `KeyRecord`, which correctly aliases `SpecKeyRecord`, and the
obvious way to silence it would have been to add a NARROWING entry for a
type that is not narrowed at all.

Proved both directions: restating `PushRegistration` inline fails the
guard by name; aliasing it passes, and `KeyRecord` still passes untouched.

Cold clean/lint/build/test green; 482 core tests.

Signed-off-by: Glenn Gore <glenn.g@affinidi.com>
---
 packages/core/src/device/register-gateway.ts  | 25 +++++++++++--------
 .../tests/schema-types-are-not-restated.mjs   | 23 ++++++++++++++---
 2 files changed, 35 insertions(+), 13 deletions(-)

diff --git a/packages/core/src/device/register-gateway.ts b/packages/core/src/device/register-gateway.ts
index b768d06..63751b7 100644
--- a/packages/core/src/device/register-gateway.ts
+++ b/packages/core/src/device/register-gateway.ts
@@ -19,19 +19,24 @@ import { withFetchTimeout } from "../http/timeout-fetch.js";
 // push/register/0.2 — the payload is field-identical to 0.1 (no enum values),
 // so this is a pure version-string bump. The gateway accepts both 0.1 and 0.2
 // and mirrors the request version into the `#response`.
-const TASK_PUSH_REGISTER = "https://trusttasks.org/spec/push/register/0.2";
-const TASK_PUSH_REGISTER_RESPONSE =
-  "https://trusttasks.org/spec/push/register/0.2#response";
+import {
+  TYPE_URI as TASK_PUSH_REGISTER,
+  RESPONSE_TYPE_URI as TASK_PUSH_REGISTER_RESPONSE,
+  type WebPush,
+} from "@openvtc/trust-tasks/push/register/0.2/payload";
 
 /** A device's platform push channel — tagged union over `platform`. Only the
  *  Web Push variant is wired today (self-hostable, no Apple/Google account). */
-export type PushRegistration = {
-  platform: "webpush";
-  /** RFC 8030 Web Push subscription endpoint. */
-  endpoint: string;
-  /** RFC 8291 encryption keys. */
-  keys: { p256dh: string; auth: string };
-};
+/** What this wallet registers: a Web Push subscription.
+ *
+ *  A deliberate NARROWING of the schema's `PushRegistration`, which is
+ *  `Apns | Fcm | WebPush` — a browser extension cannot produce the other two.
+ *  Taken as the generated `WebPush` variant rather than restated, so the
+ *  narrowing is the only thing this line says: the members still come from the
+ *  schema, and widening the union later does not silently leave this behind.
+ */
+export type PushRegistration = WebPush;
+
 
 export interface RegisterPushChannelOptions {
   /** Push gateway base URL (the HTTPS transport — `POST {gatewayUrl}/trust-tasks`). */
diff --git a/packages/core/tests/schema-types-are-not-restated.mjs b/packages/core/tests/schema-types-are-not-restated.mjs
index a9bd323..24c0aab 100644
--- a/packages/core/tests/schema-types-are-not-restated.mjs
+++ b/packages/core/tests/schema-types-are-not-restated.mjs
@@ -87,13 +87,28 @@ test("the generated component list is real, so none of this passes vacuously", (
   assert.ok(generated.has("ContextRecord"), "components.d.ts does not look like the right file");
 });
 
+// `export type X = SomeIdentifier;` is the *fix* pattern, not the defect: it
+// aliases the generated type, so the shape still has one source. Only an inline
+// body — `= {`, `= "a" | "b"`, `= Foo[]` — restates it. This distinction was
+// missing when the test was first written, and it hid two: `KeyRecord` (a
+// correct alias) and `PushRegistration` (an inline restatement of a union the
+// schema declares as `Apns | Fcm | WebPush`).
+const ALIAS_TO_IDENTIFIER = /^\s*[A-Za-z0-9_.]+(<[^;]*>)?\s*;/;
+
 test("no schema component type is restated by hand", () => {
   const restated = [];
   for (const file of files(SRC)) {
     const rel = file.slice(SRC.length + 1);
-    for (const m of readFileSync(file, "utf8").matchAll(/export interface ([A-Za-z0-9_]+)/g)) {
+    const src = readFileSync(file, "utf8");
+
+    for (const m of src.matchAll(/export interface ([A-Za-z0-9_]+)/g)) {
       if (generated.has(m[1]) && !(m[1] in NARROWING)) restated.push(`${m[1]}  (${rel})`);
     }
+    for (const m of src.matchAll(/export type ([A-Za-z0-9_]+)\s*=/g)) {
+      if (!generated.has(m[1]) || m[1] in NARROWING) continue;
+      const rhs = src.slice(m.index + m[0].length);
+      if (!ALIAS_TO_IDENTIFIER.test(rhs)) restated.push(`${m[1]}  (${rel})`);
+    }
   }
 
   assert.deepEqual(
@@ -102,8 +117,10 @@ test("no schema component type is restated by hand", () => {
     `these types are declared here and also generated from a published schema:\n  ` +
       `${restated.join("\n  ")}\n\n` +
       `Import the generated one instead — a hand-written copy drifts silently, ` +
-      `because nothing compares the two. If the local type deliberately NARROWS ` +
-      `the generated one for a browser caller, add it to NARROWING with the reason.`,
+      `because nothing compares the two. Aliasing it (\`export type X = Generated;\`) ` +
+      `is fine and is how the narrowing cases are written. If the local type ` +
+      `deliberately NARROWS the generated one for a browser caller, add it to ` +
+      `NARROWING with the reason.`,
   );
 });
 

From 03d9a36793bc328428ff2870bddfe37e23f63bbc Mon Sep 17 00:00:00 2001
From: Glenn Gore <glenn.g@affinidi.com>
Date: Thu, 3 Sep 2026 07:33:46 +0200
Subject: [PATCH 15/24] chore(deps): fast-uri 3.1.5 -> 3.1.7, clearing four
 advisories
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

GitHub flagged this on push. Four advisories against `fast-uri` 3.1.5, one
rated high: host confusion via skipped IDN canonicalization, plus SSRF via
malformed IPv6 normalization, repeated hostname percent-decoding, and
percent-encoded scheme normalization.

**Build tooling only, and worth saying so rather than leaving it to be
assumed.** The path is `packages/pwa -> vite-plugin-pwa -> workbox-build ->
ajv -> fast-uri`, and `fast-uri` appears nowhere in
`packages/extension/dist/` — the wallet does not ship it, so no shipped
surface parses a URI with it. That bounds the exposure to whoever runs the
build; it does not make it a non-issue.

Lockfile only: a patch bump inside the 3.x line, no manifest change and no
transitive resolution moved. `npm audit` now reports zero.

Cold clean/lint/build/test green.

Signed-off-by: Glenn Gore <glenn.g@affinidi.com>
---
 package-lock.json | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/package-lock.json b/package-lock.json
index eaaee11..ec110d5 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -4691,9 +4691,9 @@
       "license": "MIT"
     },
     "node_modules/fast-uri": {
-      "version": "3.1.5",
-      "resolved": "https://registry.npmjs.org/fast-uri/-/fast-uri-3.1.5.tgz",
-      "integrity": "sha512-gHwA1O9LDIcKunMKhObS/HimwtehO1nPUECKAu5TpKgaO19fcWEl4bliWe1jWxVFvIXztJjjQ4L8XQ1EU9f7Jw==",
+      "version": "3.1.7",
+      "resolved": "https://registry.npmjs.org/fast-uri/-/fast-uri-3.1.7.tgz",
+      "integrity": "sha512-dOvZVzjdZdz7phd9v6jCbwxrBW3fK6n8Rc0CtdmM4bumzMnxywBYhuph6J819RRw/ku+rLbelwfMunktuzVVHg==",
       "dev": true,
       "funding": [
         {

From d0b6b2ad6b65870a2074dd991473676db576e41d Mon Sep 17 00:00:00 2001
From: Glenn Gore <glenn.g@affinidi.com>
Date: Thu, 3 Sep 2026 07:45:48 +0200
Subject: [PATCH 16/24] refactor(core): every task URI now comes from the
 registry; correct the stale R4.1
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Closes the two gaps left from the type sweep.

## No hand-written task URI survives in `packages/core/src`

The last ten were `auth/authenticate/0.1` (three call sites),
`auth/step-up/approve-{request,response}`, `task-consent/{decision,granted}`
and `vta/contexts/preview-delete`. All now import `TYPE_URI` /
`RESPONSE_TYPE_URI` from their binding.

Lower stakes than the types were — `task-surface.mjs` already validates
every URI against the agent's live surface and fails on a deprecated
version, so a wrong one could not hide. The value is that there is now one
answer to "which version does this library speak", and it is the
registry's.

`STEP_UP_APPROVE_REQUEST_TYPES` keeps both 0.1 and 0.2, now as imported
constants. That is not a compat fold: the VTA pushes 0.1 over DIDComm
(`messaging/handlers.rs`) while the did-hosting control plane mints 0.2 —
two live producers, checked rather than assumed.

The three `trust-task-error` constants stay written out, as their own
comment already explains: they are historical markers, matching is done on
the slug across every 0.x, and the current version is re-exported from the
package runtime.

## R4.1 named a repo that no longer exists

The rule read "shared code with pnm-relay and vti-didcomm-js is a
liability until extracted: the relay never received this repo's body-first
error-parsing fix". Both halves were out of date.

`pnm-relay` is gone. Its `rest-channel.ts` / `request-task.ts` were
consolidated into `@openvtc/pnm-core` — the copy `pnm-extension` and
`pnm-pwa` both consume — which carries the body-first parse and the
`ConsentRequired` union. Verified in code, not taken from the plan:
`decodeTrustTaskHttpAck` reads the body and builds with `errorFromBody`,
and `errorFromResponse` appears nowhere in the module. Nothing depends on
`@openvtc/pnm-relay`; `rp-sdk-js` is a separate server-side SIOPv2
verifier, not its successor. (D8/F5, resolved by consolidation.)

What survives is the rule rather than the defect, so the note now says
that: `vti-didcomm-js` is still a second implementation of the same wire
contract, and a transport or error-shape fix has to land in both. A third
copy is what R4.1 exists to prevent.

Cold clean/lint/build/test green; 733 tests; all three dist guards re-run.

Signed-off-by: Glenn Gore <glenn.g@affinidi.com>
---
 CLAUDE.md                                 | 22 ++++++++++++++++++----
 packages/core/src/admin/contexts.ts       |  3 +--
 packages/core/src/inbound/task-consent.ts | 12 +++++++-----
 packages/core/src/rp-login/didcomm.ts     |  6 ++++--
 packages/core/src/rp-login/step-up.ts     |  8 +++++---
 packages/core/src/siop/login-client.ts    |  2 +-
 packages/core/src/vta/auth.ts             |  2 +-
 7 files changed, 37 insertions(+), 18 deletions(-)

diff --git a/CLAUDE.md b/CLAUDE.md
index 2055451..3f20fb1 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -15,7 +15,8 @@ interaction code:
 - **`vti-stack-development-guide.md`** — binding rules (R-numbers below);
   paste its pre-merge checklist into PRs.
 - **`vti-networking-remediation-plan.md`** — deliverable **D8** covers this
-  repo (with vti-didcomm-js and pnm-relay).
+  repo (with vti-didcomm-js; `pnm-relay` was the third and no longer exists —
+  see R4.1).
 - **`vti-architectural-direction.md`** — design-level rationale.
 
 Rules that bite hardest here:
@@ -54,9 +55,22 @@ Rules that bite hardest here:
   network helper here takes an optional `fetch` for testability, so a literal
   `grep "fetch("` finds almost nothing — the real calls are spelled `f(...)`,
   `fetchFn(...)`, `this.fetchImpl(...)`.
-- **R4.1 — shared code with pnm-relay and vti-didcomm-js is a liability until
-  extracted**: the relay never received this repo's body-first error-parsing
-  fix. Land contract/transport fixes in all three or extract the shared core.
+- **R4.1 — the shared core is extracted; keep it that way.** This rule used to
+  read "shared code with pnm-relay and vti-didcomm-js is a liability until
+  extracted: the relay never received this repo's body-first error-parsing
+  fix". That is done and the note had gone stale: **`pnm-relay` no longer
+  exists.** Its `rest-channel.ts` / `request-task.ts` were consolidated into
+  `@openvtc/pnm-core` — the copy `pnm-extension` and `pnm-pwa` both consume,
+  which carries the body-first parse (`decodeTrustTaskHttpAck` reads the body,
+  then builds with `errorFromBody`; `errorFromResponse` appears nowhere) and the
+  `ConsentRequired` union. Nothing depends on `@openvtc/pnm-relay`, and
+  `rp-sdk-js` is a separate server-side SIOPv2 verifier, not its successor.
+  (`vti-networking-remediation-plan.md` F5, resolved by consolidation.)
+
+  What survives is the *rule*, not the defect: `vti-didcomm-js` is still a
+  separate implementation of the same wire contract, so a transport or
+  error-shape fix has to land in both. A third copy is what R4.1 exists to
+  prevent — do not reintroduce one.
 
 ## How persist-before-ack is held (R1.6)
 
diff --git a/packages/core/src/admin/contexts.ts b/packages/core/src/admin/contexts.ts
index ce3a82b..be537f4 100644
--- a/packages/core/src/admin/contexts.ts
+++ b/packages/core/src/admin/contexts.ts
@@ -17,8 +17,7 @@ import {
   TYPE_URI as TASK_CONTEXTS_DELETE,
   type VTAContextsDeleteResponsePayload,
 } from "@openvtc/trust-tasks/vta/contexts/delete/1.0/payload";
-const TASK_CONTEXTS_PREVIEW_DELETE =
-  "https://trusttasks.org/spec/vta/contexts/preview-delete/1.0";
+import { TYPE_URI as TASK_CONTEXTS_PREVIEW_DELETE } from "@openvtc/trust-tasks/vta/contexts/preview-delete/1.0/payload";
 
 export interface ContextDeleteParams {
   holder: TaskParty;
diff --git a/packages/core/src/inbound/task-consent.ts b/packages/core/src/inbound/task-consent.ts
index 4eec8c4..076b75b 100644
--- a/packages/core/src/inbound/task-consent.ts
+++ b/packages/core/src/inbound/task-consent.ts
@@ -59,15 +59,17 @@ import {
   type Exposure,
   type StatePin,
 } from "@openvtc/trust-tasks/task-consent/request/0.1/payload";
-import { RESPONSE_PAYLOAD_SCHEMA as DECISION_RESPONSE_SCHEMA } from "@openvtc/trust-tasks/task-consent/decision/0.1/payload";
+import {
+  RESPONSE_PAYLOAD_SCHEMA as DECISION_RESPONSE_SCHEMA,
+  TYPE_URI as TASK_CONSENT_DECISION_TYPE_URI,
+} from "@openvtc/trust-tasks/task-consent/decision/0.1/payload";
+import { TYPE_URI as TASK_CONSENT_GRANTED_TYPE_URI } from "@openvtc/trust-tasks/task-consent/granted/0.1/payload";
 import type { SigningIdentity } from "../siop/self-issued.js";
 
 export const TASK_CONSENT_REQUEST_TYPE = TASK_CONSENT_REQUEST_TYPE_URI;
-export const TASK_CONSENT_DECISION_TYPE =
-  "https://trusttasks.org/spec/task-consent/decision/0.1";
+export const TASK_CONSENT_DECISION_TYPE = TASK_CONSENT_DECISION_TYPE_URI;
 /** VTA → requester: an approval landed and a grant is ready — re-submit now. */
-export const TASK_CONSENT_GRANTED_TYPE =
-  "https://trusttasks.org/spec/task-consent/granted/0.1";
+export const TASK_CONSENT_GRANTED_TYPE = TASK_CONSENT_GRANTED_TYPE_URI;
 /** The executor's acknowledgement of a decision this device sent. */
 export const TASK_CONSENT_DECISION_RESPONSE_TYPE = `${TASK_CONSENT_DECISION_TYPE}#response`;
 
diff --git a/packages/core/src/rp-login/didcomm.ts b/packages/core/src/rp-login/didcomm.ts
index 2750d36..3156d10 100644
--- a/packages/core/src/rp-login/didcomm.ts
+++ b/packages/core/src/rp-login/didcomm.ts
@@ -27,8 +27,10 @@ import type { DidcommMessageBridge } from "../vta/transport.js";
 //
 // Matched with `===` against the spelling the RP declares today; no
 // both-spellings fold, per this repo's rule on compatibility arms.
-const MSG_AUTHENTICATE = "https://trusttasks.org/spec/auth/authenticate/0.1";
-const MSG_AUTH_RESPONSE = "https://trusttasks.org/spec/auth/authenticate/0.1#response";
+import {
+  TYPE_URI as MSG_AUTHENTICATE,
+  RESPONSE_TYPE_URI as MSG_AUTH_RESPONSE,
+} from "@openvtc/trust-tasks/auth/authenticate/0.1/payload";
 
 const DEFAULT_TIMEOUT_MS = 30_000;
 
diff --git a/packages/core/src/rp-login/step-up.ts b/packages/core/src/rp-login/step-up.ts
index 72527c4..1789e37 100644
--- a/packages/core/src/rp-login/step-up.ts
+++ b/packages/core/src/rp-login/step-up.ts
@@ -25,13 +25,15 @@ import { withFetchTimeout } from "../http/timeout-fetch.js";
 
 // Canonical step-up approval spec from trusttasks-tf. The proof on the
 // approve-response is what the RP verifies to elevate the session's acr.
-const MSG_APPROVE_RESPONSE = "https://trusttasks.org/spec/auth/step-up/approve-response/0.2";
+import { TYPE_URI as MSG_APPROVE_RESPONSE } from "@openvtc/trust-tasks/auth/step-up/approve-response/0.2/payload";
+import { TYPE_URI as APPROVE_REQUEST_0_2 } from "@openvtc/trust-tasks/auth/step-up/approve-request/0.2/payload";
+import { TYPE_URI as APPROVE_REQUEST_0_1 } from "@openvtc/trust-tasks/auth/step-up/approve-request/0.1/payload";
 /** The RP→approver request halves this wallet accepts. 0.2 is what the
  *  did-hosting control plane mints on `start`; 0.1 is the VTA-pushed flavor
  *  (same required payload members) — both are gated identically. */
 export const STEP_UP_APPROVE_REQUEST_TYPES = [
-  "https://trusttasks.org/spec/auth/step-up/approve-request/0.2",
-  "https://trusttasks.org/spec/auth/step-up/approve-request/0.1",
+  APPROVE_REQUEST_0_2,
+  APPROVE_REQUEST_0_1,
 ] as const;
 
 /** The RP's `approve-request/0.2` payload, verified out of the signed
diff --git a/packages/core/src/siop/login-client.ts b/packages/core/src/siop/login-client.ts
index 7a21a02..7bb039a 100644
--- a/packages/core/src/siop/login-client.ts
+++ b/packages/core/src/siop/login-client.ts
@@ -11,7 +11,7 @@ import { withFetchTimeout } from "../http/timeout-fetch.js";
 
 /** The canonical authenticate Trust-Task type from trusttasks-tf.
  *  did-hosting + VTA + VTC all dispatch on this same URI. */
-const TASK_AUTH_AUTHENTICATE = "https://trusttasks.org/spec/auth/authenticate/0.1";
+import { TYPE_URI as TASK_AUTH_AUTHENTICATE } from "@openvtc/trust-tasks/auth/authenticate/0.1/payload";
 
 export interface SiopLoginResult {
   accessToken: string;
diff --git a/packages/core/src/vta/auth.ts b/packages/core/src/vta/auth.ts
index d24581f..d745ac2 100644
--- a/packages/core/src/vta/auth.ts
+++ b/packages/core/src/vta/auth.ts
@@ -30,7 +30,7 @@ import { packAuthcrypt, type Identity } from "../didcomm/index.js";
 import type { RemoteDidcommEndpoint } from "./didcomm.js";
 import { withFetchTimeout } from "../http/timeout-fetch.js";
 
-const VTA_AUTHENTICATE = "https://trusttasks.org/spec/auth/authenticate/0.1";
+import { TYPE_URI as VTA_AUTHENTICATE } from "@openvtc/trust-tasks/auth/authenticate/0.1/payload";
 
 /** Reuse window — kept well under the server's ~15-minute token TTL so a
  *  cached token can't be served past expiry (clock-skew safety margin). */

From cb4c3c8624530a85bd36dfb9f4210e9942038a99 Mon Sep 17 00:00:00 2001
From: Glenn Gore <glenn.g@affinidi.com>
Date: Thu, 3 Sep 2026 09:07:36 +0200
Subject: [PATCH 17/24] feat(popup): reach the management console from the
 panel that names the agent
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The console already had an entry point on the options page and none in the
popup, which is the wrong way round. The popup is the surface that tells
you which VTA you are connected to, your role and your transports — so it
is where "and now go administer it" belongs. Reaching it otherwise meant
knowing to open Settings first.

Placed after Role/Transports and before Lock wallet: it is an action about
the agent, and the two below it are teardown.

**A tab, not a pane**, and that is the point rather than a cost. Opening it
closes the popup — but the console is a working surface with a context tree
and thirteen panes, and a 400px popup that vanishes when it loses focus is
no place to destroy a context from. It also ships as its own bundle, which
is what keeps `@openvtc/pnm-core/admin` out of every wallet surface.

**Not role-gated.** Several panes are readable at any role, and the console
already refuses what the caller may not do — with the reason on the
control, rather than by hiding it. Gating here would hide the readable half
from everyone below admin.

This adds no admin code to the popup: it opens a URL. Verified rather than
assumed — the CI guard that confines `admin/*` task URIs to `manager.js`
still passes against a fresh build, as does the key-material guard, and the
console is still a single chunk.

733 tests green.

Signed-off-by: Glenn Gore <glenn.g@affinidi.com>
---
 packages/extension/src/popup.tsx | 30 ++++++++++++++++++++++++++++++
 1 file changed, 30 insertions(+)

diff --git a/packages/extension/src/popup.tsx b/packages/extension/src/popup.tsx
index c28d3a4..34cbff6 100644
--- a/packages/extension/src/popup.tsx
+++ b/packages/extension/src/popup.tsx
@@ -433,6 +433,36 @@ function ConnectedView({
         Role: <b>{connection.role}</b> &nbsp;·&nbsp; Transports: <b>{transports || "—"}</b>
       </div>
 
+      {/* The management console, for the VTA this popup is connected to.
+          It already had an entry point on the options page and none here,
+          which is the wrong way round: this is the surface that tells you
+          which agent you are talking to, so it is where "and now go
+          administer it" belongs.
+
+          A tab, not a pane. Opening it closes the popup — which is the
+          point rather than a cost: the console is a working surface with a
+          context tree and thirteen panes, and a 400px popup that vanishes
+          when it loses focus is no place to destroy a context from.
+
+          Deliberately not role-gated. Several panes are readable at any
+          role, and the console already refuses what the caller may not do,
+          with the reason on the control rather than by hiding it. Gating
+          here would hide the readable half from everyone else.
+
+          This adds no admin code to the popup bundle — it opens a URL. The
+          CI guard that keeps `pnm-core/admin` out of every wallet surface
+          is unaffected, and still passes. */}
+      <button
+        onClick={() => void chrome.tabs.create({ url: chrome.runtime.getURL("manager.html") })}
+        style={{ marginTop: 8 }}
+      >
+        Manage this agent ↗
+      </button>
+      <small style={{ color: "var(--w-muted)" }}>
+        Opens the management console in a new tab — contexts, keys, credentials,
+        access and audit for this VTA.
+      </small>
+
       {encryptOn && (
         <>
           <button onClick={() => void lockWallet()} disabled={lockBusy} style={{ marginTop: 8 }}>

From 17463e61645d54ecb5395eb709e0a4ec4a8411a6 Mon Sep 17 00:00:00 2001
From: Glenn Gore <glenn.g@affinidi.com>
Date: Thu, 3 Sep 2026 09:11:48 +0200
Subject: [PATCH 18/24] feat(console): print the backup commands instead of
 pointing at the CLI
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The pane argued why export and import are not in the browser and then left
the operator to go find `--help`. It already knew the answer; it just was
not saying it.

Four commands, taken from `pnm-cli/src/cli.rs` rather than remembered:

    pnm backup export
    pnm backup export --include-audit
    pnm backup import <file> --preview
    pnm backup import <file>

Two things are called out because a flag list does not convey them.
`--preview` is a real rehearsal — decrypt, validate, report, change
nothing — and it is worth running first, because the common mistake is not
a wrong password (which fails loudly) but the right password on the wrong
bundle. And `--include-audit` widens the bundle beyond the agent's own
state to its dealings with counterparties who were never party to the
export, which is why it is off by default.

The third detail strengthens the argument the pane was already making.
There is **no `--password` flag** — verified, the CLI defines none; it is
prompted, with confirmation, minimum 15 characters. So "the terminal is a
smaller surface" stops being a hand-wave: the password never enters shell
history or the process list. That is a concrete property a browser field
cannot offer, and it belongs next to the claim it supports.

Both dist guards re-run against a fresh build — the pane gained text, not
imports. 733 tests green.

Signed-off-by: Glenn Gore <glenn.g@affinidi.com>
---
 .../extension/src/manager/panes/backup.tsx    | 55 +++++++++++++++++++
 1 file changed, 55 insertions(+)

diff --git a/packages/extension/src/manager/panes/backup.tsx b/packages/extension/src/manager/panes/backup.tsx
index 7439b76..7aaa79b 100644
--- a/packages/extension/src/manager/panes/backup.tsx
+++ b/packages/extension/src/manager/panes/backup.tsx
@@ -46,6 +46,36 @@ const fieldStyle: React.CSSProperties = {
 // not-found rather than as a refusal.
 const UUID = /^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$/;
 
+
+// The CLI half of the answer.
+//
+// Telling an operator "use the CLI" and stopping there sends them to
+// `--help` to find out what this pane already knows. The commands are
+// short enough to print, and the two details worth knowing are not
+// discoverable from a flag list: `--preview` is a real rehearsal, and the
+// password is prompted rather than passed.
+function Cmd({ children, note }: { children: string; note: string }) {
+  return (
+    <div style={{ display: "grid", gap: 3 }}>
+      <code
+        style={{
+          fontFamily: font.mono,
+          fontSize: t.xs,
+          background: c.ground,
+          border: `1px solid ${c.line}`,
+          borderRadius: "var(--w-r-sm)",
+          padding: "6px 9px",
+          overflowX: "auto",
+          whiteSpace: "pre",
+        }}
+      >
+        {children}
+      </code>
+      <span style={{ fontSize: t.xs, color: c.faint }}>{note}</span>
+    </div>
+  );
+}
+
 function WhyExportIsAbsent() {
   return (
     <Panel
@@ -70,6 +100,31 @@ function WhyExportIsAbsent() {
           So the wallet does not ask for it at all. The CLI collects it in a terminal, which is not a
           perfect place either, but is a much smaller one.
         </p>
+        <div style={{ display: "grid", gap: 8, paddingTop: 2 }}>
+          <span style={{ fontSize: t.xs, color: c.muted, letterSpacing: 0.4 }}>
+            WHAT TO RUN
+          </span>
+          <Cmd note="Writes vta-backup-<timestamp>.vtabak. Add -o <path> to choose the file.">
+            pnm backup export
+          </Cmd>
+          <Cmd note="Adds the agent's audit trail — its dealings with counterparties who were never party to this export. Off by default.">
+            pnm backup export --include-audit
+          </Cmd>
+          <Cmd note="Rehearses: decrypts, validates, reports what it found, changes nothing. Worth doing first — the common mistake is the right password on the wrong bundle.">
+            pnm backup import &lt;file&gt; --preview
+          </Cmd>
+          <Cmd note="Applies it. Replaces this agent's keys, access and contexts with the bundle's.">
+            pnm backup import &lt;file&gt;
+          </Cmd>
+          <span style={{ fontSize: t.sm, color: c.muted, lineHeight: 1.55 }}>
+            The password is <strong>prompted, never passed as a flag</strong> — there is no
+            <code style={{ fontFamily: font.mono, fontSize: t.xs }}> --password</code> option to
+            find. That is the concrete reason the terminal is the smaller surface: it keeps the
+            password out of your shell history and out of the process list. Minimum 15
+            characters, and export asks twice.
+          </span>
+        </div>
+
         <Note tone="accent">
           <strong>Where the bundle goes.</strong> An export is fetched over HTTPS from an address the
           agent publishes, so an agent reachable only over DIDComm or TSP cannot produce one at all —

From 17555050563dc2df48b7a05d3a553169d5489fa0 Mon Sep 17 00:00:00 2001
From: Glenn Gore <glenn.g@affinidi.com>
Date: Thu, 3 Sep 2026 09:15:04 +0200
Subject: [PATCH 19/24] =?UTF-8?q?refactor(console):=20Maintenance=20?=
 =?UTF-8?q?=E2=80=94=20the=20operations=20whose=20subject=20is=20the=20age?=
 =?UTF-8?q?nt?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Reload-services was under Transports and read wrong there, which was the
tell. Two facts say it belongs elsewhere:

The task is `vta/management/reload-services`. It re-reads the agent's
entire configuration; the transports going down is what you *observe*, not
what it is. And Transports is per-transport CRUD — enable this one, drain
that one — so an agent-wide restart sits in that list looking like another
row of it, which is exactly what it is not.

Backup was under Wire & execution for want of anywhere better, and was
never really "wire" either.

So: one pane, `Maintenance`, holding both. Everything else in this console
acts on something the agent *holds* — a context, a key, a credential, an
ACL entry. These two act on the agent. That is the grouping.

It also happens to be the step-up boundary: these are the only two controls
gated on proof of presence, precisely because they are the two that act on
the whole agent. That is not a coincidence to design around — it is the
same fact showing up twice, and a pane that matches it will keep matching
it as things are added.

Reload keeps its own role gate (admin), separate from the backup one, since
the two answer to different authority even in the same pane.

`services.tsx` shed its now-dead `reloadServices`, `requirePresence` and
`StepUpError` imports — tsc did not flag them, and a live import of
`reloadServices` in the Transports pane would have left the old path
reachable.

Behaviour is unchanged: same task, same step-up, same copy. Confirmed
working against a live agent before the move.

`manager-sections.test.mts` verified the rename end to end — the union, the
nav and the switch still name one set. Both dist guards re-run; the
reload-services URI still appears in `manager.js` and nowhere else. 733
tests green.

Signed-off-by: Glenn Gore <glenn.g@affinidi.com>
---
 .../panes/{backup.tsx => maintenance.tsx}     | 158 ++++++++++++++++--
 .../extension/src/manager/panes/services.tsx  | 101 +----------
 packages/extension/src/manager/shell.tsx      |  14 +-
 3 files changed, 149 insertions(+), 124 deletions(-)
 rename packages/extension/src/manager/panes/{backup.tsx => maintenance.tsx} (61%)

diff --git a/packages/extension/src/manager/panes/backup.tsx b/packages/extension/src/manager/panes/maintenance.tsx
similarity index 61%
rename from packages/extension/src/manager/panes/backup.tsx
rename to packages/extension/src/manager/panes/maintenance.tsx
index 7aaa79b..4d7172a 100644
--- a/packages/extension/src/manager/panes/backup.tsx
+++ b/packages/extension/src/manager/panes/maintenance.tsx
@@ -1,25 +1,43 @@
-// Backup — one control, and an honest account of the four that are missing.
+// Maintenance — operations whose subject is the agent itself.
 //
-// The agent dispatches five backup verbs. This pane offers `abort`. The rest of
-// the surface is a written explanation of why export and import are not here,
-// because an empty pane is indistinguishable from an unfinished one, and the
-// next person to open this file should find a decision rather than a gap.
+// Everything else in this console acts on something the agent *holds*: a
+// context, a key, a credential, an ACL entry. These two act on the agent. That
+// is the whole reason they share a pane, and it is why neither belongs where it
+// first landed.
 //
-// The short version: `initiate-export` and `finalize-import` carry a `password`
-// member — the key that protects, or unlocks, a complete copy of the agent. It
-// travels inbound, typed by the operator. A browser form is reachable by
-// autofill, by a password manager, by any other extension with host access, and
-// by screen capture, and a passkey step-up does not help: it proves a human is
-// present for the *action*, and says nothing about a field that was filled in
+// Reload-services sat under Transports because restarting transports is what
+// you observe. But the task is `vta/management/reload-services` — it re-reads
+// the agent's entire configuration, and the transports going down is a
+// consequence rather than the subject. Transports is per-transport CRUD:
+// enable this one, drain that one. An agent-wide restart in that pane reads as
+// another row in the same list, which is exactly what it is not.
+//
+// Backup was under Wire & execution for want of anywhere better, and was never
+// really "wire" at all.
+//
+// The grouping also happens to be the step-up boundary: these are the two
+// controls in the console gated on proof of presence, because they are the two
+// that act on the whole agent. That is not a coincidence to design around, it
+// is the same fact stated twice.
+//
+// ## What is here, and what is deliberately not
+//
+// Backup offers `abort` alone. `initiate-export` and `finalize-import` both
+// carry a `password` — the key that protects, or unlocks, a complete copy of
+// the agent. It travels inbound, typed by the operator, and a browser form is
+// reachable by autofill, by a password manager, by any other extension with
+// host access, and by anything recording the screen. A step-up does not help:
+// it proves a human is present for the action, and the password was typed
 // before the prompt appeared.
 //
-// Abort carries no secret and is the only way to close a window that is
-// otherwise open until it expires. So it is here, behind the step-up, and the
-// step-up is about deliberateness rather than secrecy — see `step-up.ts` for
-// what that ceremony does and does not prove.
+// So the wallet does not ask for it. The CLI does, in a terminal, where it is
+// prompted rather than passed as a flag and so never enters shell history or
+// the process list. The pane says all of this on screen, because an empty
+// panel is indistinguishable from an unfinished one and someone would
+// reasonably "complete" the family later.
 
 import { useCallback, useState } from "react";
-import { backupAbort, type BackupAbortResult } from "@openvtc/pnm-core/admin";
+import { backupAbort, reloadServices, type BackupAbortResult } from "@openvtc/pnm-core/admin";
 import { Button, Note, Panel } from "../../ui.js";
 import { c, t, font } from "../../theme.js";
 import { managerSender } from "../sender.js";
@@ -137,7 +155,7 @@ function WhyExportIsAbsent() {
   );
 }
 
-export function BackupPane({
+export function MaintenancePane({
   parties,
   authority,
 }: {
@@ -252,7 +270,113 @@ export function BackupPane({
         </div>
       </Panel>
 
+      <ReloadServices
+        parties={parties}
+        denied={
+          authority && !hasRole(authority, "admin", "super-admin")
+            ? "Restarting this agent needs the admin role."
+            : null
+        }
+      />
+
       <WhyExportIsAbsent />
     </div>
   );
 }
+
+/**
+ * Re-read the agent's configuration and restart its transports.
+ *
+ * Behind the step-up despite creating, deleting and disclosing nothing — the
+ * cost here is measured in availability, and it falls on every counterparty of
+ * the agent rather than on the operator who clicked. That includes this
+ * wallet's own inbound sessions, which is the part an operator is most likely
+ * to be surprised by, so the copy says it rather than implying it.
+ */
+function ReloadServices({ parties, denied }: { parties: Parties; denied: string | null }) {
+  const [busy, setBusy] = useState(false);
+  const [error, setError] = useState<string | null>(null);
+  const [pending, setPending] = useState<ConsentRequiredError | null>(null);
+  const [done, setDone] = useState(false);
+
+  const reload = useCallback(async () => {
+    setError(null);
+    setPending(null);
+    setDone(false);
+
+    try {
+      await requirePresence(chrome.runtime.id, "restart this agent's transports");
+    } catch (e) {
+      // A dismissal is a decision. Say nothing and send nothing.
+      if (e instanceof StepUpError && e.reason === "cancelled") return;
+      setError(e instanceof Error ? e.message : String(e));
+      return;
+    }
+
+    setBusy(true);
+    await runMutation(
+      async () => {
+        await reloadServices(managerSender, parties);
+        setDone(true);
+      },
+      {
+        onConsent: setPending,
+        onError: (message) => {
+          // A successful reload drops the transport the response would have
+          // travelled on, so a lost connection is the EXPECTED shape of
+          // success here, not a failure. Reporting it as an error would send
+          // an operator hunting for a fault that is the agent restarting, and
+          // — worse — invite a retry that restarts it again.
+          if (/network|connection|closed|timeout|aborted/i.test(message)) {
+            setDone(true);
+          } else {
+            setError(message);
+          }
+        },
+      },
+    );
+    setBusy(false);
+  }, [parties]);
+
+  return (
+    <Panel
+      title="Reload services"
+      description="Re-reads the agent's configuration and restarts its transports. Use this after
+        changing configuration elsewhere; it applies what is written down and takes no options of
+        its own."
+    >
+      <div style={{ display: "grid", gap: 12 }}>
+        <Note tone="warn">
+          <strong>Every open session drops, including this wallet's.</strong> Your inbound sessions
+          go down while the agent restarts, so anything pushed during that window — approval
+          requests included — waits at the mediator. Every other client of this agent is
+          disconnected at the same moment, and none of them asked.
+        </Note>
+
+        {error && <Note tone="danger">{error}</Note>}
+        {pending && <ConsentCeremony pending={pending} />}
+        {done && (
+          <Note tone="accent">
+            Restart requested. The agent may have dropped this connection to do it, which is normal
+            and not a reason to send it again — reconnect and see whether it answers. If it does not
+            come back, its configuration is the place to look.
+          </Note>
+        )}
+
+        <div>
+          <Button
+            kind="danger"
+            disabled={busy || Boolean(denied)}
+            {...(denied ? { title: denied } : {})}
+            onClick={() => void reload()}
+          >
+            {busy ? "Restarting…" : "Approve and reload services"}
+          </Button>
+        </div>
+        <span style={{ fontSize: t.xs, color: c.faint }}>
+          {denied ?? "Your passkey is checked before anything is sent."}
+        </span>
+      </div>
+    </Panel>
+  );
+}
diff --git a/packages/extension/src/manager/panes/services.tsx b/packages/extension/src/manager/panes/services.tsx
index 69a8d21..70bcabf 100644
--- a/packages/extension/src/manager/panes/services.tsx
+++ b/packages/extension/src/manager/panes/services.tsx
@@ -14,13 +14,12 @@
 // failure and must never be rendered as one; presenting it as a problem is how
 // an operator ends up chasing a transport that is working.
 
-import { reloadServices, servicesList, serviceDisable, serviceEnable, type ServiceState } from "@openvtc/pnm-core/admin";
+import { servicesList, serviceDisable, serviceEnable, type ServiceState } from "@openvtc/pnm-core/admin";
 import { agentPing } from "@openvtc/pnm-core/admin";
 import { useCallback, useState } from "react";
 import { Button, Did, Note, Panel, Pill } from "../../ui.js";
 import { c, t, font } from "../../theme.js";
 import { managerSender } from "../sender.js";
-import { requirePresence, StepUpError } from "../step-up.js";
 import { ConsentRequiredError } from "../carrier.js";
 import { ConsentCeremony, Destructive, runMutation } from "../destructive.js";
 import { Loading, LoadError, Table, type Column } from "../table.js";
@@ -283,104 +282,6 @@ export function ServicesPane({
         />
       </Panel>
 
-      <ReloadServices parties={parties} denied={denied} />
     </div>
   );
 }
-
-/**
- * Re-read the agent's configuration and restart its transports.
- *
- * Behind the step-up despite creating, deleting and disclosing nothing — the
- * cost here is measured in availability, and it falls on every counterparty of
- * the agent rather than on the operator who clicked. That includes this
- * wallet's own inbound sessions, which is the part an operator is most likely
- * to be surprised by, so the copy says it rather than implying it.
- */
-function ReloadServices({ parties, denied }: { parties: Parties; denied: string | null }) {
-  const [busy, setBusy] = useState(false);
-  const [error, setError] = useState<string | null>(null);
-  const [pending, setPending] = useState<ConsentRequiredError | null>(null);
-  const [done, setDone] = useState(false);
-
-  const reload = useCallback(async () => {
-    setError(null);
-    setPending(null);
-    setDone(false);
-
-    try {
-      await requirePresence(chrome.runtime.id, "restart this agent's transports");
-    } catch (e) {
-      // A dismissal is a decision. Say nothing and send nothing.
-      if (e instanceof StepUpError && e.reason === "cancelled") return;
-      setError(e instanceof Error ? e.message : String(e));
-      return;
-    }
-
-    setBusy(true);
-    await runMutation(
-      async () => {
-        await reloadServices(managerSender, parties);
-        setDone(true);
-      },
-      {
-        onConsent: setPending,
-        onError: (message) => {
-          // A successful reload drops the transport the response would have
-          // travelled on, so a lost connection is the EXPECTED shape of
-          // success here, not a failure. Reporting it as an error would send
-          // an operator hunting for a fault that is the agent restarting, and
-          // — worse — invite a retry that restarts it again.
-          if (/network|connection|closed|timeout|aborted/i.test(message)) {
-            setDone(true);
-          } else {
-            setError(message);
-          }
-        },
-      },
-    );
-    setBusy(false);
-  }, [parties]);
-
-  return (
-    <Panel
-      title="Reload services"
-      description="Re-reads the agent's configuration and restarts its transports. Use this after
-        changing configuration elsewhere; it applies what is written down and takes no options of
-        its own."
-    >
-      <div style={{ display: "grid", gap: 12 }}>
-        <Note tone="warn">
-          <strong>Every open session drops, including this wallet's.</strong> Your inbound sessions
-          go down while the agent restarts, so anything pushed during that window — approval
-          requests included — waits at the mediator. Every other client of this agent is
-          disconnected at the same moment, and none of them asked.
-        </Note>
-
-        {error && <Note tone="danger">{error}</Note>}
-        {pending && <ConsentCeremony pending={pending} />}
-        {done && (
-          <Note tone="accent">
-            Restart requested. The agent may have dropped this connection to do it, which is normal
-            and not a reason to send it again — reconnect and see whether it answers. If it does not
-            come back, its configuration is the place to look.
-          </Note>
-        )}
-
-        <div>
-          <Button
-            kind="danger"
-            disabled={busy || Boolean(denied)}
-            {...(denied ? { title: denied } : {})}
-            onClick={() => void reload()}
-          >
-            {busy ? "Restarting…" : "Approve and reload services"}
-          </Button>
-        </div>
-        <span style={{ fontSize: t.xs, color: c.faint }}>
-          {denied ?? "Your passkey is checked before anything is sent."}
-        </span>
-      </div>
-    </Panel>
-  );
-}
diff --git a/packages/extension/src/manager/shell.tsx b/packages/extension/src/manager/shell.tsx
index e19decf..7d1b530 100644
--- a/packages/extension/src/manager/shell.tsx
+++ b/packages/extension/src/manager/shell.tsx
@@ -26,7 +26,7 @@ import { SessionsPane } from "./panes/sessions.js";
 import { ApprovalsPane } from "./panes/approvals.js";
 import { PolicyPane } from "./panes/policy.js";
 import { ServicesPane } from "./panes/services.js";
-import { BackupPane } from "./panes/backup.js";
+import { MaintenancePane } from "./panes/maintenance.js";
 import { AuditPane } from "./panes/audit.js";
 import { CredentialsPane } from "./panes/credentials.js";
 import { MemoryPane } from "./panes/memory.js";
@@ -44,7 +44,7 @@ export type SectionId =
   | "memory"
   | "app-state"
   | "services"
-  | "backup"
+  | "maintenance"
   | "audit"
   | "access"
   | "sessions"
@@ -115,9 +115,9 @@ const ACTS: Act[] = [
       // Transports are agent-wide: `servicesList` takes no context, because a
       // transport is not owned by one.
       { id: "services", label: "Transports", contextScoped: false },
-      // Bundles belong to the agent and to the operator who minted them, not
-      // to a context — and there is no context member on any backup task.
-      { id: "backup", label: "Backup", contextScoped: false },
+      // Operations whose subject is the agent itself rather than anything it
+      // holds — backup and restart. Agent-wide by definition, so no context.
+      { id: "maintenance", label: "Maintenance", contextScoped: false },
       { id: "audit", label: "Audit", contextScoped: true },
     ],
   },
@@ -339,8 +339,8 @@ export function ManagerShell() {
         );
       case "services":
         return <ServicesPane parties={parties} authority={vta.authority} />;
-      case "backup":
-        return <BackupPane parties={parties} authority={vta.authority} />;
+      case "maintenance":
+        return <MaintenancePane parties={parties} authority={vta.authority} />;
       case "audit":
         return <AuditPane parties={parties} contextId={selected} contextHeading={heading} />;
       case "access":

From 93091f90766a8d760e03192869afced31b9eda1a Mon Sep 17 00:00:00 2001
From: Glenn Gore <glenn.g@affinidi.com>
Date: Thu, 3 Sep 2026 09:27:02 +0200
Subject: [PATCH 20/24] fix(console): a context editor showed the wrong
 context's name, and could save it
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Reported from testing: every context in the tree showed `agent-memory` in
the Name field — the first context's name — while the header, id, DID and
timestamps all showed the right record.

`EditContext` seeds its fields with `useState(record.name)`, which runs on
mount and never again. The detail panel is a single instance that swaps
records as the operator moves through the tree, so React reused it and the
form kept its first value.

**It reads as a display glitch and is not one.** That field is the input to
`contextsUpdate`. An operator pressing Save would have renamed the context
they were looking at to the name of one they were not — a write, from a
screen that showed them the correct record everywhere else. Nothing else on
that panel disagreed.

Fixed with `key={record.id}`, which makes selecting a different context a
different component and re-runs the initialisers.

## The guard found four more, and one of them was itself

`manager-form-state.test.mts` fails when a component seeding state from a
prop is rendered without a `key`. Running it turned up `WriteRecord`
(app state), `WriteMemory` and `PolicyEditor` — same pattern, all now keyed,
including their create call sites so create and edit cannot share an
instance either. Those three were safe only by accident of control flow:
the panes unmount the editor between edits, so nothing had gone wrong yet.
Keyed, they are safe by construction.

It also reported `DeleteContext`, which has no `useState` at all. The scope
detection stopped at `\nfunction ` and ran straight past a component whose
successor is declared `export function`, into a sibling's state. Fixed
rather than exempted — a guard that cries wolf is one people learn to skip,
and adding a meaningless `key` to silence it would have been worse.

`RenameKey` and `ChangeRole` are exempt with the reason recorded: `Table`
renders them per row under `rowKey`, so the key is already on the `<tr>`.

Proved non-vacuous: removing the new key reports `EditContext` by name.

191 -> 194 tests; 736 across the workspaces; dist guards re-run.

Signed-off-by: Glenn Gore <glenn.g@affinidi.com>
---
 .../extension/src/manager/panes/app-state.tsx |   2 +
 .../extension/src/manager/panes/contexts.tsx  |  16 +++
 .../extension/src/manager/panes/memory.tsx    |   2 +
 .../extension/src/manager/panes/policy.tsx    |   2 +
 .../tests/manager-form-state.test.mts         | 129 ++++++++++++++++++
 5 files changed, 151 insertions(+)
 create mode 100644 packages/extension/tests/manager-form-state.test.mts

diff --git a/packages/extension/src/manager/panes/app-state.tsx b/packages/extension/src/manager/panes/app-state.tsx
index 31832e7..b9aa22b 100644
--- a/packages/extension/src/manager/panes/app-state.tsx
+++ b/packages/extension/src/manager/panes/app-state.tsx
@@ -317,6 +317,7 @@ export function AppStatePane({
   if (editing) {
     return (
       <WriteRecord
+        key={`${editing.namespace}/${editing.key}`}
         parties={parties}
         contextId={contextId}
         authority={authority}
@@ -471,6 +472,7 @@ export function AppStatePane({
 
       {creating && (
         <WriteRecord
+          key="new"
           parties={parties}
           contextId={contextId}
           authority={authority}
diff --git a/packages/extension/src/manager/panes/contexts.tsx b/packages/extension/src/manager/panes/contexts.tsx
index 96d5391..befa92f 100644
--- a/packages/extension/src/manager/panes/contexts.tsx
+++ b/packages/extension/src/manager/panes/contexts.tsx
@@ -360,7 +360,23 @@ export function ContextsPane({
 
       {record && (
         <>
+          {/* `key` is load-bearing, not decoration.
+              `EditContext` seeds its `name` and `description` fields with
+              `useState(record.name)`, which runs on mount and never again.
+              This panel is a single instance that swaps records as the
+              operator moves through the tree, so without a key React reuses
+              it — and every context showed the FIRST context's name in an
+              editable field sitting above the right id and DID. An operator
+              pressing Save would have renamed the context they were looking
+              at to the name of one they were not.
+
+              Keying on the record's id makes selecting a different context a
+              different component, which is what re-runs the initialisers.
+              The sibling editors in `keys.tsx` and `access.tsx` use the same
+              seeding pattern and are fine, because `Table` renders them per
+              row under `rowKey` — the key is already there. */}
           <EditContext
+            key={record.id}
             parties={parties}
             record={record}
             authority={authority}
diff --git a/packages/extension/src/manager/panes/memory.tsx b/packages/extension/src/manager/panes/memory.tsx
index e3548a7..c2e4e78 100644
--- a/packages/extension/src/manager/panes/memory.tsx
+++ b/packages/extension/src/manager/panes/memory.tsx
@@ -210,6 +210,7 @@ export function MemoryPane({
   if (editing) {
     return (
       <WriteMemory
+        key={editing.key}
         parties={parties}
         contextId={contextId}
         authority={authority}
@@ -321,6 +322,7 @@ export function MemoryPane({
 
       {creating && (
         <WriteMemory
+          key="new"
           parties={parties}
           contextId={contextId}
           authority={authority}
diff --git a/packages/extension/src/manager/panes/policy.tsx b/packages/extension/src/manager/panes/policy.tsx
index 530c8a4..d4a891b 100644
--- a/packages/extension/src/manager/panes/policy.tsx
+++ b/packages/extension/src/manager/panes/policy.tsx
@@ -289,6 +289,7 @@ export function PolicyPane({
   if (editing) {
     return (
       <PolicyEditor
+        key={editing.name}
         parties={parties}
         existing={editing}
         authority={authority}
@@ -328,6 +329,7 @@ export function PolicyPane({
 
       {creating && (
         <PolicyEditor
+          key="new"
           parties={parties}
           authority={authority}
           onSaved={done}
diff --git a/packages/extension/tests/manager-form-state.test.mts b/packages/extension/tests/manager-form-state.test.mts
new file mode 100644
index 0000000..54aabef
--- /dev/null
+++ b/packages/extension/tests/manager-form-state.test.mts
@@ -0,0 +1,129 @@
+// A form seeded from a prop must be keyed on that prop's identity.
+//
+// ## The bug this exists for
+//
+// `EditContext` seeds its fields with `useState(record.name)`. That runs on
+// mount and never again. The context detail panel is a *single* instance that
+// swaps records as the operator moves through the tree, so React reused it —
+// and every context showed the FIRST context's name, in an editable field,
+// sitting directly above the correct id, DID and timestamps.
+//
+// It reads as a display glitch and is not one. The field is the input to
+// `contextsUpdate`, so an operator pressing Save would have renamed the context
+// they were looking at to the name of one they were not — a write, from a
+// screen that showed them the right record everywhere else.
+//
+// Nothing could have caught it. It typechecks, every unit test passes, and the
+// panel renders perfectly for whichever context you happen to open first.
+//
+// ## The rule
+//
+// If a component seeds state from a prop, its call sites must either pass
+// `key`, or be listed in [`KEYED_ELSEWHERE`] with the reason. There is one
+// legitimate reason today: `Table` renders per-row editors under `rowKey`, so
+// the key is already on the row.
+//
+// Source-level, because the alternative is a DOM and a render loop to catch a
+// bug whose whole nature is that it looks fine on first render.
+
+import { test } from "node:test";
+import assert from "node:assert/strict";
+import { readFileSync, readdirSync } from "node:fs";
+import { join } from "node:path";
+import { fileURLToPath } from "node:url";
+
+const ROOT = fileURLToPath(new URL("../src/manager", import.meta.url));
+
+/**
+ * Components whose call sites need no explicit `key`, with the reason.
+ *
+ * An entry is a claim that something else already establishes identity — not
+ * that adding a key is inconvenient.
+ */
+const KEYED_ELSEWHERE: Record<string, string> = {
+  RenameKey: "rendered per row by `Table`, which keys each <tr> on rowKey",
+  ChangeRole: "rendered per row by `Table`, which keys each <tr> on rowKey",
+};
+
+const files = (dir: string): string[] =>
+  readdirSync(dir, { withFileTypes: true }).flatMap((e) =>
+    e.isDirectory()
+      ? files(join(dir, e.name))
+      : /\.tsx?$/.test(e.name)
+        ? [join(dir, e.name)]
+        : [],
+  );
+
+const sources = files(ROOT).map((f) => ({ rel: f.slice(ROOT.length + 1), src: readFileSync(f, "utf8") }));
+
+/** Components that seed state from one of their props. */
+function seededComponents(): { name: string; where: string }[] {
+  const found: { name: string; where: string }[] = [];
+  for (const { rel, src } of sources) {
+    // `function Name({ a, b }: {...}) {`  … then `useState(a.something)`
+    for (const m of src.matchAll(/function ([A-Z][A-Za-z0-9]*)\(\{([^}]*)\}/g)) {
+      const name = m[1] as string;
+      const props = (m[2] as string)
+        .split(",")
+        .map((p) => p.trim().split(/[:=]/)[0]!.trim())
+        .filter(Boolean);
+      // Scope stops at the NEXT top-level declaration, and that has to include
+      // `export function` — stopping only at `\nfunction ` let one component's
+      // scope run past its own closing brace into a sibling's `useState`, and
+      // report a component with no state at all. A guard that cries wolf is one
+      // people learn to skip.
+      const body = src.slice(m.index + m[0].length);
+      const end = body.search(/\n(?:export )?function /);
+      const scope = end === -1 ? body : body.slice(0, end);
+      const seeds = props.some((p) =>
+        new RegExp(`useState\\(\\s*${p}\\.`).test(scope) || new RegExp(`useState\\(\\s*${p}\\?\\.`).test(scope),
+      );
+      if (seeds) found.push({ name, where: rel });
+    }
+  }
+  return found;
+}
+
+test("the sweep finds the components it is meant to, so it cannot pass vacuously", () => {
+  const names = seededComponents().map((c) => c.name);
+  assert.ok(
+    names.includes("EditContext"),
+    `did not find EditContext among prop-seeded components (${names.join(", ") || "none"}) — ` +
+      `the pattern match is stale and this test now checks nothing`,
+  );
+});
+
+test("every prop-seeded form is keyed at its call site", () => {
+  const offenders: string[] = [];
+
+  for (const { name } of seededComponents()) {
+    if (name in KEYED_ELSEWHERE) continue;
+    for (const { rel, src } of sources) {
+      for (const m of src.matchAll(new RegExp(`<${name}\\b[\\s\\S]{0,400}?/?>`, "g"))) {
+        if (!/\bkey=/.test(m[0])) offenders.push(`${name}  (rendered in ${rel})`);
+      }
+    }
+  }
+
+  assert.deepEqual(
+    [...new Set(offenders)].sort(),
+    [],
+    `these components seed state from a prop and are rendered without a \`key\`:\n  ` +
+      `${[...new Set(offenders)].join("\n  ")}\n\n` +
+      `\`useState(prop.field)\` runs on mount and never again, so React reuses the ` +
+      `instance when the prop changes and the form keeps showing — and saving — the ` +
+      `previous record's values. Pass \`key={record.id}\`, or add the component to ` +
+      `KEYED_ELSEWHERE if something else already establishes identity.`,
+  );
+});
+
+test("every KEYED_ELSEWHERE entry still names a prop-seeded component", () => {
+  const names = new Set(seededComponents().map((c) => c.name));
+  const stale = Object.keys(KEYED_ELSEWHERE).filter((n) => !names.has(n));
+  assert.deepEqual(
+    stale,
+    [],
+    `these exemptions no longer name a component that seeds state from a prop — ` +
+      `remove them: ${stale.join(", ")}`,
+  );
+});

From acedf36268b9e858e3eb179bd5f9565061f6bdac Mon Sep 17 00:00:00 2001
From: Glenn Gore <glenn.g@affinidi.com>
Date: Thu, 3 Sep 2026 09:31:48 +0200
Subject: [PATCH 21/24] feat(console): agent names, reassigning a context DID,
 and a refusal that wrecked its own table
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Three things from testing.

## The agent gets its name back

The console header showed a raw `did:webvh:Qm…` and nothing else. It now
renders the name through `useAgentNames`, which reads `alsoKnownAs` off the
DID document and verifies it — never derived from the DID's host or path,
because a derived name is a guess wearing an identity. No claim, no name:
the DID stands alone, which is the honest fallback. Same hook the setup
pane already uses.

This banner is the line an operator reads to check they are administering
the agent they think they are, so it is the right place for it.

## You can reassign a context's DID

`contextsUpdateDid` was in `pnm-core` and surfaced nowhere. That left the
operator somewhere absurd: deleting a DID a context depends on fails with
the agent's own instruction — "reassign it first: `pnm contexts update
test-vtc --did <new-did>`" — an instruction the console could carry out and
did not offer. Being told the fix and handed no way to apply it is worse
than not being told.

Its own panel, not another field on the name/description form. Those are
labels; this changes which identity the context presents to every
counterparty, and the agent refuses to delete a DID while a context points
at it. One Save button for both would make a rename and an identity change
look like one decision. The button reads "Assign" or "Reassign" depending
on whether there is a DID today, and a context with none says so — that is
a state, not a fault.

## A refusal that destroyed the row explaining it

`Destructive`'s error branch had no `maxWidth` while its preview branch has
carried one all along. Inside a table cell, a long refusal — and the DID
delete refusal is prose, naming the dependant and the fix — set the
column's width, so every identifier column collapsed and DIDs wrapped every
few characters. The most useful message on screen was wrecking the row that
gave it meaning.

`Table` already documents this exact failure at its `minWidth: 760` floor;
760 was not enough for this one. Error capped at 480 to match the preview,
and the DID column given a `26ch` floor. The first attempt used
`minmax(22ch, 1fr)`, which is a grid function and invalid as a table width
— it would have been dropped silently and looked fixed.

736 tests; dist guards re-run.

Signed-off-by: Glenn Gore <glenn.g@affinidi.com>
---
 .../extension/src/manager/destructive.tsx     |  11 +-
 .../extension/src/manager/panes/contexts.tsx  | 123 ++++++++++++++++++
 packages/extension/src/manager/panes/dids.tsx |  12 +-
 .../extension/src/manager/whoami-banner.tsx   |  19 ++-
 4 files changed, 161 insertions(+), 4 deletions(-)

diff --git a/packages/extension/src/manager/destructive.tsx b/packages/extension/src/manager/destructive.tsx
index ac818a5..6ecc9f3 100644
--- a/packages/extension/src/manager/destructive.tsx
+++ b/packages/extension/src/manager/destructive.tsx
@@ -191,7 +191,16 @@ export function Destructive<P>({
 
   if (phase.kind === "error") {
     return (
-      <div style={{ display: "grid", gap: 10 }}>
+      // `maxWidth` because this often renders inside a table cell.
+      //
+      // The agent's refusals are prose, and some are long — a DID delete that
+      // is still depended on comes back naming the dependant and the command
+      // to fix it. Unconstrained, that text sets the column's width, the
+      // browser widens the cell to fit, and every other column in the table
+      // collapses: the DID column ends up a few characters wide, wrapping
+      // mid-identifier. The message is the most useful thing on screen at that
+      // moment, and it was wrecking the row that gave it context.
+      <div style={{ display: "grid", gap: 10, maxWidth: 480 }}>
         <Note tone="danger">{phase.message}</Note>
         <div>
           <Button kind="quiet" onClick={reset}>
diff --git a/packages/extension/src/manager/panes/contexts.tsx b/packages/extension/src/manager/panes/contexts.tsx
index befa92f..c4aa363 100644
--- a/packages/extension/src/manager/panes/contexts.tsx
+++ b/packages/extension/src/manager/panes/contexts.tsx
@@ -9,6 +9,7 @@ import { useCallback, useState } from "react";
 import {
   contextsCreate,
   contextsUpdate,
+  contextsUpdateDid,
   type ContextRecord,
 } from "@openvtc/pnm-core";
 import { contextDelete, contextPreviewDelete } from "@openvtc/pnm-core/admin";
@@ -334,6 +335,121 @@ function DeleteContext({
   );
 }
 
+
+/**
+ * Assign, reassign or clear the DID a context acts as.
+ *
+ * This existed in `pnm-core` and nowhere in the console, which put the
+ * operator in an odd spot: deleting a DID that a context depends on fails
+ * with the agent's own instruction to `pnm contexts update <ctx> --did
+ * <new-did>` — an instruction the console could carry out and did not offer.
+ * Being told the fix and handed no way to apply it is worse than not being
+ * told.
+ *
+ * A separate panel from name/description on purpose. Those are labels; this
+ * changes which identity the context presents to every counterparty, and the
+ * agent refuses to delete a DID while a context still points at it. Same
+ * form, same Save button would have made a rename and an identity change look
+ * like one decision.
+ */
+function ContextDid({
+  parties,
+  record,
+  authority,
+  onChanged,
+}: {
+  parties: Parties;
+  record: ContextRecord;
+  authority: Authority | null;
+  onChanged: () => void;
+}) {
+  const [did, setDid] = useState(record.did ?? "");
+  const [busy, setBusy] = useState(false);
+  const [error, setError] = useState<string | null>(null);
+  const [pending, setPending] = useState<ConsentRequiredError | null>(null);
+
+  const denied =
+    authority && !hasRole(authority, "admin", "super-admin")
+      ? "Changing a context's DID needs the admin role at this agent."
+      : null;
+
+  const save = useCallback(async () => {
+    setBusy(true);
+    setError(null);
+    setPending(null);
+    const ok = await runMutation(
+      async () => {
+        await contextsUpdateDid(managerSender, {
+          ...parties,
+          id: record.id,
+          did: did.trim(),
+        });
+      },
+      { onConsent: setPending, onError: setError },
+    );
+    setBusy(false);
+    if (ok) onChanged();
+  }, [parties, record.id, did, onChanged]);
+
+  const unchanged = did.trim() === (record.did ?? "");
+
+  return (
+    <Panel
+      title="Identity"
+      description="The DID this context acts as. Counterparties see this one, so changing it changes
+        who the context presents itself as — not just what it is called."
+    >
+      <div style={{ display: "grid", gap: 10 }}>
+        {!record.did && (
+          <Note tone="accent">
+            This context has no DID of its own yet. That is a state, not a fault — it simply has no
+            identity to present until one is assigned.
+          </Note>
+        )}
+
+        <label style={{ display: "grid", gap: 4 }}>
+          <span style={{ fontSize: t.xs, color: c.muted }}>DID</span>
+          <input
+            style={{
+              boxSizing: "border-box",
+              padding: "6px 9px",
+              background: c.ground,
+              color: c.text,
+              border: `1px solid ${c.line}`,
+              borderRadius: "var(--w-r-sm)",
+              fontSize: t.sm,
+              fontFamily: font.mono,
+            }}
+            value={did}
+            onChange={(e) => setDid(e.target.value)}
+            placeholder="did:webvh:…"
+            spellCheck={false}
+          />
+        </label>
+        <span style={{ fontSize: t.xs, color: c.faint }}>
+          Create one under <b>DIDs</b> first, then paste it here. Clearing the field leaves the
+          context with no identity of its own.
+        </span>
+
+        {error && <Note tone="danger">{error}</Note>}
+        {pending && <ConsentCeremony pending={pending} />}
+
+        <div>
+          <Button
+            kind="primary"
+            disabled={busy || unchanged || Boolean(denied)}
+            {...(denied ? { title: denied } : {})}
+            onClick={() => void save()}
+          >
+            {busy ? "Saving…" : record.did ? "Reassign DID" : "Assign DID"}
+          </Button>
+        </div>
+        {denied && <span style={{ fontSize: t.sm, color: c.muted }}>{denied}</span>}
+      </div>
+    </Panel>
+  );
+}
+
 export function ContextsPane({
   parties,
   authority,
@@ -382,6 +498,13 @@ export function ContextsPane({
             authority={authority}
             onChanged={onChanged}
           />
+          <ContextDid
+            key={`did:${record.id}`}
+            parties={parties}
+            record={record}
+            authority={authority}
+            onChanged={onChanged}
+          />
           <DeleteContext
             parties={parties}
             record={record}
diff --git a/packages/extension/src/manager/panes/dids.tsx b/packages/extension/src/manager/panes/dids.tsx
index 17857fd..7b935a2 100644
--- a/packages/extension/src/manager/panes/dids.tsx
+++ b/packages/extension/src/manager/panes/dids.tsx
@@ -165,7 +165,17 @@ export function DidsPane({
     : null;
 
   const columns: Column<WebvhDidRecord>[] = [
-    { key: "did", header: "DID", render: (d) => <Did value={d.did} /> },
+    // A floor on the identifier column. A `did:webvh` has no natural break
+    // points, so when something else in the row demands width — a long refusal
+    // from the agent, say — the browser squeezes this one and the DID wraps
+    // every few characters, which is unreadable exactly when you most need to
+    // tell two of them apart.
+    {
+      key: "did",
+      header: "DID",
+      width: "26ch",
+      render: (d) => <Did value={d.did} />,
+    },
     {
       key: "context",
       header: "Context",
diff --git a/packages/extension/src/manager/whoami-banner.tsx b/packages/extension/src/manager/whoami-banner.tsx
index 2108de5..7279b87 100644
--- a/packages/extension/src/manager/whoami-banner.tsx
+++ b/packages/extension/src/manager/whoami-banner.tsx
@@ -7,10 +7,11 @@
 // top of every pane means an operator never has to wonder which identity a
 // change they are about to make will be attributed to.
 
-import { Did, Pill } from "../ui.js";
+import { Did, DidNamed, Pill } from "../ui.js";
 import { c, t } from "../theme.js";
 import { formatInstant } from "./format.js";
 import type { Authority } from "./use-vta.js";
+import { useAgentNames } from "../use-agent-names.js";
 
 function Field({ label, children }: { label: string; children: React.ReactNode }) {
   return (
@@ -32,6 +33,8 @@ export function WhoamiBanner({
   authority: Authority | null;
   error: string | null;
 }) {
+  const agentNames = useAgentNames([agentDid]);
+
   return (
     <header
       style={{
@@ -45,7 +48,19 @@ export function WhoamiBanner({
       }}
     >
       <Field label="Agent">
-        <Did value={agentDid} />
+        {/* A name, where the agent publishes one.
+            `useAgentNames` reads `alsoKnownAs` off the DID document and
+            verifies it — it never derives a name from the DID's host or path.
+            That distinction is the whole point: a derived name is a guess
+            dressed as an identity, and this banner is the line an operator
+            reads to check they are administering the agent they think they
+            are. No claim, no name — the DID stands on its own, which is the
+            honest fallback rather than an inferred one. */}
+        <DidNamed
+          value={agentDid}
+          verified
+          {...(agentNames[agentDid] ? { agentName: agentNames[agentDid] } : {})}
+        />
       </Field>
 
       {authority ? (

From e6b0e8f9a78a405be7310a8425502cd5809c8803 Mon Sep 17 00:00:00 2001
From: Glenn Gore <glenn.g@affinidi.com>
Date: Thu, 3 Sep 2026 09:39:31 +0200
Subject: [PATCH 22/24] feat(console): view a credential, find one at all, and
 switch agent
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Three from testing, plus one non-finding worth recording.

## "I have credentials but the pane says none"

The pane was right and useless. `vault/credentials/query` refuses a search
that constrains nothing, so the answer to "what do I hold?" was behind a
`type` or issuer DID the operator had to know in advance. A wallet holding
credentials looked identical to one holding none.

`status` counts as a filter, so one click gets there. Not a way round the
agent's rule — it is the rule satisfied with the narrowest thing that still
answers the question. The button is named for what it returns ("Show what
is currently valid"), because `valid` excludes expired and revoked and the
button must not imply otherwise; a line underneath says where those are.

## Reading a credential

`View` fetches the document by id through `credVaultGet` and renders it,
with a copy button.

Its own request, deliberately. The search returns metadata — the pane says
so — and rendering full documents from a list would quietly turn "show me
what I hold" into "read everything I hold". Copy hands over exactly what
the agent returned, canonically formatted, because that is the form a
verifier expects rather than a prettified approximation. A refused
clipboard says so instead of showing "Copied" over an unchanged one.

## Switching agent from the console

The console read the active VTA and offered no way to change it, so
switching meant going back to the popup. `setActiveVtaDid` writes the same
`pnm-connection/v3` envelope the readers parse, read-modify-write so a
partial view cannot forget every other agent — the failure the per-agent
inbox map exists to prevent. It refuses a DID the wallet never onboarded.

**Switching reloads the page**, deliberately. Thirteen panes each hold
fetched state; propagating a change of agent is thirteen chances to leave
one showing the previous agent's keys under the new agent's name. That is
not staleness, it is the console asserting something false about who you
are administering — on the surface whose whole job is to answer that. The
control only appears when there is somewhere to switch to.

## App state was not a bug

Its empty state already names the context it searched — "No application has
written anything into <id>". App state is per-context, so OpenVTC's records
are under the `openvtc` context. Left alone.

736 tests; all dist guards re-run.

Signed-off-by: Glenn Gore <glenn.g@affinidi.com>
---
 packages/extension/src/active-vta.ts          |  38 +++++
 .../src/manager/panes/credentials.tsx         | 151 +++++++++++++++++-
 .../extension/src/manager/whoami-banner.tsx   |  86 +++++++++-
 3 files changed, 266 insertions(+), 9 deletions(-)

diff --git a/packages/extension/src/active-vta.ts b/packages/extension/src/active-vta.ts
index 7c73e12..6d07f86 100644
--- a/packages/extension/src/active-vta.ts
+++ b/packages/extension/src/active-vta.ts
@@ -32,6 +32,44 @@ export function parseActiveVtaDid(raw: unknown): string | null {
   }
 }
 
+/**
+ * Make `vtaDid` the active agent, if the wallet has onboarded it.
+ *
+ * Writes the same `pnm-connection/v3` envelope the readers above parse, which
+ * is zustand's persisted blob. Read-modify-write rather than a blind set: the
+ * envelope carries the whole connection map, and replacing it wholesale from a
+ * partial view would forget every other VTA — the same class of bug the
+ * per-agent inbox map exists to prevent (see CLAUDE.md).
+ *
+ * Refuses a DID the wallet does not hold, matching `activateVta` in the store:
+ * activating an agent that was never onboarded would leave the console pointed
+ * at something it has no holder identity for.
+ *
+ * Returns whether the switch happened, so a caller can tell "done" from "that
+ * agent is not on this device" without inspecting storage itself.
+ */
+export async function setActiveVtaDid(vtaDid: string): Promise<boolean> {
+  const KEY = "pnm-connection/v3";
+  const stored = await chrome.storage.local.get(KEY);
+  const raw = stored[KEY];
+  if (typeof raw !== "string") return false;
+
+  let parsed: { state?: { connections?: { activeVtaDid?: string | null; vtas?: Record<string, unknown> } } };
+  try {
+    parsed = JSON.parse(raw);
+  } catch {
+    return false;
+  }
+
+  const connections = parsed.state?.connections;
+  if (!connections?.vtas || !(vtaDid in connections.vtas)) return false;
+  if (connections.activeVtaDid === vtaDid) return true;
+
+  connections.activeVtaDid = vtaDid;
+  await chrome.storage.local.set({ [KEY]: JSON.stringify(parsed) });
+  return true;
+}
+
 /** Enumerate every VTA the wallet has onboarded — keys of the
  *  persisted `vtas` map regardless of which one is active. Background
  *  uses this to drive the multi-listener inbound reconcile. Returns
diff --git a/packages/extension/src/manager/panes/credentials.tsx b/packages/extension/src/manager/panes/credentials.tsx
index 67682e6..ed5fddd 100644
--- a/packages/extension/src/manager/panes/credentials.tsx
+++ b/packages/extension/src/manager/panes/credentials.tsx
@@ -45,12 +45,14 @@ import {
   credVaultArchive,
   credVaultDelete,
   credVaultPurge,
+  credVaultGet,
   credVaultQuery,
   credVaultRestore,
   credVaultUnarchive,
   isRunnableCredentialQuery,
   type CredentialDescriptor,
   type CredentialFilter,
+  type CredentialStatus,
 } from "@openvtc/pnm-core";
 import { Button, Did, Note, Panel, Pill } from "../../ui.js";
 import { c, t, font } from "../../theme.js";
@@ -433,6 +435,7 @@ function HeldCredentials({
   const [includeArchived, setIncludeArchived] = useState(false);
   const [includeDeleted, setIncludeDeleted] = useState(false);
   const [rows, setRows] = useState<CredentialDescriptor[] | null>(null);
+  const [viewing, setViewing] = useState<string | null>(null);
   const [loading, setLoading] = useState(false);
   const [error, setError] = useState<string | null>(null);
 
@@ -514,6 +517,11 @@ function HeldCredentials({
         const state = r.lifecycle ?? "active";
         return (
           <div style={{ display: "grid", gap: 8, minWidth: 200 }}>
+            {/* Reading a credential is its own request. The search returned
+                metadata; this fetches the document by id. */}
+            <Button kind="quiet" onClick={() => setViewing(r.id)}>
+              View
+            </Button>
             {state === "active" && (
               <Button
                 kind="quiet"
@@ -651,10 +659,40 @@ function HeldCredentials({
 
       {!runnable && (
         <Note tone="accent">
-          <strong>Set at least one filter.</strong> Your agent refuses a search that constrains
-          nothing, because the answer would be the shape of everything you hold — every community,
-          every role, every issuer. The two tick-boxes widen a search rather than narrowing one,
-          so they do not count on their own.
+          <div style={{ display: "grid", gap: 8 }}>
+            <span>
+              <strong>Set at least one filter.</strong> Your agent refuses a search that constrains
+              nothing, because the answer would be the shape of everything you hold — every
+              community, every role, every issuer. The two tick-boxes widen a search rather than
+              narrowing one, so they do not count on their own.
+            </span>
+            {/* The refusal is the agent's, and it is reasonable — but "set a
+                filter" is a poor answer to "what do I have?", which is the
+                question almost everyone opens this pane with. Answering it
+                needed a `type` or an issuer DID the operator would have to
+                know in advance, so a wallet holding credentials looked
+                identical to one holding none.
+
+                `status` counts as a filter, so one click gets there. Not a way
+                round the rule — it is the rule satisfied with the narrowest
+                thing that still answers the question. Named for what it
+                returns, because `valid` excludes expired and revoked and the
+                button should not imply otherwise. */}
+            <div>
+              <Button
+                onClick={() => {
+                  const f = { ...filter, status: "valid" as CredentialStatus };
+                  setFilter(f);
+                  void search(f);
+                }}
+              >
+                Show what is currently valid
+              </Button>
+            </div>
+            <span style={{ fontSize: t.xs, color: c.faint }}>
+              Expired and revoked credentials are still held — pick their status above to see them.
+            </span>
+          </div>
         </Note>
       )}
 
@@ -669,6 +707,111 @@ function HeldCredentials({
           empty="Nothing matches that filter. Your agent answered — this is not a failed search."
         />
       )}
+
+      {viewing && (
+        <CredentialView
+          key={viewing}
+          parties={parties}
+          id={viewing}
+          onClose={() => setViewing(null)}
+        />
+      )}
+    </Panel>
+  );
+}
+
+
+/**
+ * Fetch and show one credential's contents.
+ *
+ * Separate from the search on purpose, and the panel says why: a query answers
+ * with metadata, and the contents only ever arrive because someone asked for
+ * this one credential by id. Rendering the whole document from a list would
+ * have quietly turned "show me what I hold" into "read everything I hold".
+ *
+ * The copy button hands over the exact bytes the agent returned, canonically
+ * formatted — this is the form a verifier expects, so it must not be a
+ * prettified approximation of it.
+ */
+function CredentialView({
+  parties,
+  id,
+  onClose,
+}: {
+  parties: Parties;
+  id: string;
+  onClose: () => void;
+}) {
+  const [doc, setDoc] = useState<Record<string, unknown> | null>(null);
+  const [error, setError] = useState<string | null>(null);
+  const [copied, setCopied] = useState(false);
+
+  useEffect(() => {
+    let live = true;
+    setDoc(null);
+    setError(null);
+    credVaultGet(managerSender, { ...parties, id })
+      .then((d) => live && setDoc(d))
+      .catch((e) => live && setError(e instanceof Error ? e.message : String(e)));
+    return () => {
+      live = false;
+    };
+  }, [parties, id]);
+
+  const text = doc ? JSON.stringify(doc, null, 2) : "";
+
+  return (
+    <Panel
+      title="Credential"
+      description={<code style={{ fontFamily: font.mono, fontSize: t.xs }}>{id}</code>}
+    >
+      <div style={{ display: "grid", gap: 10 }}>
+        {error && <LoadError what="this credential" error={error} />}
+        {!doc && !error && <Loading what="this credential" />}
+
+        {doc && (
+          <>
+            <div style={{ display: "flex", gap: 8 }}>
+              <Button
+                onClick={() => {
+                  void navigator.clipboard.writeText(text).then(
+                    () => {
+                      setCopied(true);
+                      setTimeout(() => setCopied(false), 1500);
+                    },
+                    // Clipboard access can be refused — say so rather than
+                    // showing "Copied" over a clipboard that did not change.
+                    () => setError("The browser refused clipboard access."),
+                  );
+                }}
+              >
+                {copied ? "Copied" : "Copy JSON"}
+              </Button>
+              <Button kind="quiet" onClick={onClose}>
+                Close
+              </Button>
+            </div>
+            <pre
+              style={{
+                margin: 0,
+                padding: 12,
+                background: c.ground,
+                border: `1px solid ${c.line}`,
+                borderRadius: "var(--w-r-sm)",
+                fontFamily: font.mono,
+                fontSize: t.xs,
+                lineHeight: 1.5,
+                overflowX: "auto",
+                maxHeight: 460,
+                overflowY: "auto",
+                whiteSpace: "pre",
+              }}
+            >
+              {text}
+            </pre>
+          </>
+        )}
+      </div>
     </Panel>
   );
 }
diff --git a/packages/extension/src/manager/whoami-banner.tsx b/packages/extension/src/manager/whoami-banner.tsx
index 7279b87..3b93fc4 100644
--- a/packages/extension/src/manager/whoami-banner.tsx
+++ b/packages/extension/src/manager/whoami-banner.tsx
@@ -12,6 +12,9 @@ import { c, t } from "../theme.js";
 import { formatInstant } from "./format.js";
 import type { Authority } from "./use-vta.js";
 import { useAgentNames } from "../use-agent-names.js";
+import { displayAgentName, type AgentName } from "../agent-name.js";
+import { readAllVtaDids, setActiveVtaDid } from "../active-vta.js";
+import { useEffect, useState } from "react";
 
 function Field({ label, children }: { label: string; children: React.ReactNode }) {
   return (
@@ -24,6 +27,76 @@ function Field({ label, children }: { label: string; children: React.ReactNode }
   );
 }
 
+
+/**
+ * Switch the console to another onboarded agent.
+ *
+ * Only rendered where there is somewhere to switch *to* — one agent means no
+ * control, rather than a select with a single option that does nothing.
+ *
+ * **Switching reloads the page**, deliberately. Thirteen panes each hold their
+ * own fetched state, and propagating a change of agent through all of them is
+ * thirteen chances to leave one holding the previous agent's keys, credentials
+ * or ACL under the new agent's name in the header. That is not a stale-data
+ * annoyance — it is the console telling the operator something false about who
+ * they are administering, on the surface whose whole job is to answer that. A
+ * reload is provably clean and costs a second.
+ */
+function SwitchAgent({
+  current,
+  names,
+}: {
+  current: string;
+  names: Record<string, AgentName | undefined>;
+}) {
+  const [dids, setDids] = useState<string[]>([]);
+
+  useEffect(() => {
+    void readAllVtaDids().then(setDids);
+  }, []);
+
+  if (dids.length < 2) return null;
+
+  const label = (did: string) => {
+    const n = names[did];
+    if (n) return displayAgentName(n);
+    // No published name — the tail of a `did:webvh` is its host and label,
+    // which is the most recognisable part and is not a derived *name*: it is
+    // the identifier itself, shortened.
+    const tail = did.split(":").slice(-2).join(":");
+    return tail.length < did.length ? `…${tail}` : did;
+  };
+
+  return (
+    <select
+      value={current}
+      aria-label="Switch agent"
+      onChange={(e) => {
+        const next = e.target.value;
+        if (next === current) return;
+        void setActiveVtaDid(next).then((ok) => {
+          if (ok) window.location.reload();
+        });
+      }}
+      style={{
+        fontSize: t.xs,
+        color: c.muted,
+        background: c.ground,
+        border: `1px solid ${c.line}`,
+        borderRadius: "var(--w-r-sm)",
+        padding: "2px 6px",
+        maxWidth: 260,
+      }}
+    >
+      {dids.map((d) => (
+        <option key={d} value={d}>
+          {label(d)}
+        </option>
+      ))}
+    </select>
+  );
+}
+
 export function WhoamiBanner({
   agentDid,
   authority,
@@ -56,11 +129,14 @@ export function WhoamiBanner({
             reads to check they are administering the agent they think they
             are. No claim, no name — the DID stands on its own, which is the
             honest fallback rather than an inferred one. */}
-        <DidNamed
-          value={agentDid}
-          verified
-          {...(agentNames[agentDid] ? { agentName: agentNames[agentDid] } : {})}
-        />
+        <div style={{ display: "flex", alignItems: "baseline", gap: 10, flexWrap: "wrap" }}>
+          <DidNamed
+            value={agentDid}
+            verified
+            {...(agentNames[agentDid] ? { agentName: agentNames[agentDid] } : {})}
+          />
+          <SwitchAgent current={agentDid} names={agentNames} />
+        </div>
       </Field>
 
       {authority ? (

From 0fee453b3cd9e990b3492e93bd510a9a63215138 Mon Sep 17 00:00:00 2001
From: Glenn Gore <glenn.g@affinidi.com>
Date: Thu, 3 Sep 2026 09:49:28 +0200
Subject: [PATCH 23/24] feat(console): pick a context's DID from a list instead
 of pasting one
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Asking an operator to copy a `did:webvh:Qm…` out of the DIDs pane and paste
it here made them do a lookup the console could already do — and a mistyped
identifier is not something anyone catches by reading it back.

Now a select, scoped to this context's own DIDs, which is what a context
acts as. `— none —` clears it, and says what that means rather than leaving
an empty field to be interpreted.

The current DID is always among the options, even when the agent no longer
lists it under this context. Otherwise a DID assigned from elsewhere would
vanish from the list and the select would fall to whatever happened to be
first — turning "open the panel" into "silently propose a change".

## The type system caught the right thing on the way

The obvious lister, `vtaListDids`, is typed on `Identity` — it wants key
material — and refused to compile here. That is the guard working, not an
inconvenience: this console holds no private key, which is why `admin/*`
and `vta/contexts.ts` type their parties as `TaskParty` (CLAUDE.md, "the
console holds no key material"). Weakening the signature to get a list
would have quietly undone the property the whole surface is built on.

`webvhDidList` is the `TaskParty`-typed one the DIDs pane already uses, and
it was the correct call all along.

736 tests; dist guards re-run.

Signed-off-by: Glenn Gore <glenn.g@affinidi.com>
---
 .../extension/src/manager/panes/contexts.tsx  | 54 ++++++++++++++++---
 1 file changed, 48 insertions(+), 6 deletions(-)

diff --git a/packages/extension/src/manager/panes/contexts.tsx b/packages/extension/src/manager/panes/contexts.tsx
index c4aa363..902f806 100644
--- a/packages/extension/src/manager/panes/contexts.tsx
+++ b/packages/extension/src/manager/panes/contexts.tsx
@@ -14,8 +14,14 @@ import {
 } from "@openvtc/pnm-core";
 import { contextDelete, contextPreviewDelete } from "@openvtc/pnm-core/admin";
 import { Button, Did, Empty, Note, Panel } from "../../ui.js";
+import { LoadError } from "../table.js";
 import { c, t, font } from "../../theme.js";
 import { managerSender } from "../sender.js";
+// `webvhDidList`, not `vtaListDids`. The latter is typed on `Identity` —
+// it wants key material — and this console deliberately holds none; that
+// type is the guard, not an inconvenience (see CLAUDE.md on `TaskParty`).
+import { webvhDidList } from "@openvtc/pnm-core/webvh";
+import { useAsync } from "../use-async.js";
 import { ConsentRequiredError } from "../carrier.js";
 import { Destructive, ConsentCeremony, runMutation } from "../destructive.js";
 import { hasRole, type Authority, type Parties } from "../use-vta.js";
@@ -364,6 +370,21 @@ function ContextDid({
   onChanged: () => void;
 }) {
   const [did, setDid] = useState(record.did ?? "");
+
+  const dids = useAsync(
+    () => webvhDidList(managerSender, { ...parties, contextId: record.id }),
+    [parties.holder.did, parties.service.did, record.id],
+  );
+
+  // The current DID is always offered, even if the agent no longer lists it
+  // under this context — otherwise selecting nothing would silently look like
+  // a deliberate change.
+  const options = Array.from(
+    new Set([
+      ...(dids.data?.dids ?? []).map((d) => d.did),
+      ...(record.did ? [record.did] : []),
+    ]),
+  );
   const [busy, setBusy] = useState(false);
   const [error, setError] = useState<string | null>(null);
   const [pending, setPending] = useState<ConsentRequiredError | null>(null);
@@ -407,9 +428,19 @@ function ContextDid({
           </Note>
         )}
 
+        {/* A list, not a paste box.
+            The console already knows which DIDs exist — asking an operator to
+            copy a `did:webvh:Qm…` out of another pane and paste it here made
+            them do the lookup by hand, and a mistyped identifier is not
+            something they could spot by reading it back.
+
+            Scoped to this context's own DIDs, which is what a context acts as.
+            The current value is added to the list even when it is not among
+            them, so a DID assigned from elsewhere is never silently dropped
+            from the options and replaced by whatever happened to be first. */}
         <label style={{ display: "grid", gap: 4 }}>
           <span style={{ fontSize: t.xs, color: c.muted }}>DID</span>
-          <input
+          <select
             style={{
               boxSizing: "border-box",
               padding: "6px 9px",
@@ -422,13 +453,24 @@ function ContextDid({
             }}
             value={did}
             onChange={(e) => setDid(e.target.value)}
-            placeholder="did:webvh:…"
-            spellCheck={false}
-          />
+            disabled={dids.loading && !dids.data}
+          >
+            <option value="">— none —</option>
+            {options.map((d) => (
+              <option key={d} value={d}>
+                {d}
+              </option>
+            ))}
+          </select>
         </label>
+        {dids.error && <LoadError what="this context's DIDs" error={dids.error} />}
+        {dids.data && options.length === 0 && (
+          <span style={{ fontSize: t.xs, color: c.faint }}>
+            This context holds no DIDs yet. Create one under <b>DIDs</b> and it will appear here.
+          </span>
+        )}
         <span style={{ fontSize: t.xs, color: c.faint }}>
-          Create one under <b>DIDs</b> first, then paste it here. Clearing the field leaves the
-          context with no identity of its own.
+          Choosing <b>none</b> leaves the context with no identity of its own.
         </span>
 
         {error && <Note tone="danger">{error}</Note>}

From 9982173ca715951b1d6b34098ac02100e83a6e22 Mon Sep 17 00:00:00 2001
From: Glenn Gore <glenn.g@affinidi.com>
Date: Thu, 3 Sep 2026 09:51:22 +0200
Subject: [PATCH 24/24] fix(console): show a credential under the row you
 clicked, not after the table
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Reported from testing: "I missed that it was rendering under the list."

That is the whole defect. The panel appeared after the table, so clicking
View on the third row put the answer below the fold and the table looked
like it had done nothing. A detail panel the operator does not notice is a
detail panel that does not exist.

`Table` gains an `expanded` prop: detail rendered in the flow, directly
beneath its own row, spanning the columns. The row drops its bottom rule
when a detail follows — the row and its detail are one thing, and a line
between them reads as two.

The button toggles now and says `Hide` when open, because a control that
only ever opens leaves the operator hunting for a close button that is
somewhere else on screen.

Not a new mechanism: the Audit pane already does exactly this, hand-rolling
its own `<table>` and `colSpan` row because the shared component could not.
Putting it in `Table` means the next pane that needs it does not hand-roll
a third one, and Audit has somewhere to converge on when it is next touched.

736 tests; dist guards re-run.

Signed-off-by: Glenn Gore <glenn.g@affinidi.com>
---
 .../src/manager/panes/credentials.tsx         | 27 ++++----
 packages/extension/src/manager/table.tsx      | 66 ++++++++++++++-----
 2 files changed, 65 insertions(+), 28 deletions(-)

diff --git a/packages/extension/src/manager/panes/credentials.tsx b/packages/extension/src/manager/panes/credentials.tsx
index ed5fddd..755b08d 100644
--- a/packages/extension/src/manager/panes/credentials.tsx
+++ b/packages/extension/src/manager/panes/credentials.tsx
@@ -519,8 +519,11 @@ function HeldCredentials({
           <div style={{ display: "grid", gap: 8, minWidth: 200 }}>
             {/* Reading a credential is its own request. The search returned
                 metadata; this fetches the document by id. */}
-            <Button kind="quiet" onClick={() => setViewing(r.id)}>
-              View
+            <Button
+              kind="quiet"
+              onClick={() => setViewing((cur) => (cur === r.id ? null : r.id))}
+            >
+              {viewing === r.id ? "Hide" : "View"}
             </Button>
             {state === "active" && (
               <Button
@@ -704,18 +707,20 @@ function HeldCredentials({
           columns={columns}
           rows={rows}
           rowKey={(r) => r.id}
+          // Under the row it belongs to, not after the table. See `Table`.
+          expanded={(r) =>
+            viewing === r.id ? (
+              <CredentialView
+                key={r.id}
+                parties={parties}
+                id={r.id}
+                onClose={() => setViewing(null)}
+              />
+            ) : null
+          }
           empty="Nothing matches that filter. Your agent answered — this is not a failed search."
         />
       )}
-
-      {viewing && (
-        <CredentialView
-          key={viewing}
-          parties={parties}
-          id={viewing}
-          onClose={() => setViewing(null)}
-        />
-      )}
     </Panel>
   );
 }
diff --git a/packages/extension/src/manager/table.tsx b/packages/extension/src/manager/table.tsx
index 409b484..de62f4b 100644
--- a/packages/extension/src/manager/table.tsx
+++ b/packages/extension/src/manager/table.tsx
@@ -8,7 +8,7 @@
 //
 // So the states are separated here, once, and each says something different.
 
-import type { ReactNode } from "react";
+import { Fragment, type ReactNode } from "react";
 import { c, t } from "../theme.js";
 import { Note } from "../ui.js";
 
@@ -24,11 +24,22 @@ export function Table<R>({
   columns,
   rows,
   rowKey,
+  expanded,
   empty,
 }: {
   columns: Column<R>[];
   rows: R[];
   rowKey: (row: R) => string;
+  /**
+   * Detail to show directly beneath a row, or `null` for rows that have none.
+   *
+   * A detail panel rendered *after* the table is a detail panel the operator
+   * does not notice: they click View on the third row, the content appears
+   * below the fold, and the table looks like it did nothing. Putting it in the
+   * flow under the row it belongs to is the difference between an answer and a
+   * thing that happened somewhere else.
+   */
+  expanded?: (row: R) => ReactNode | null;
   /** What would appear here. An empty state is a chance to explain, so this is
    *  required rather than defaulting to "None". */
   empty: ReactNode;
@@ -80,22 +91,43 @@ export function Table<R>({
           </tr>
         </thead>
         <tbody>
-          {rows.map((row) => (
-            <tr key={rowKey(row)}>
-              {columns.map((col) => (
-                <td
-                  key={col.key}
-                  style={{
-                    padding: "7px 12px 7px 0",
-                    borderBottom: `1px solid ${c.lineSoft}`,
-                    verticalAlign: "top",
-                  }}
-                >
-                  {col.render(row)}
-                </td>
-              ))}
-            </tr>
-          ))}
+          {rows.map((row) => {
+            const detail = expanded?.(row) ?? null;
+            return (
+              <Fragment key={rowKey(row)}>
+                <tr>
+                  {columns.map((col) => (
+                    <td
+                      key={col.key}
+                      style={{
+                        padding: "7px 12px 7px 0",
+                        // No bottom rule when a detail follows: the row and its
+                        // detail are one thing, and a line between them reads
+                        // as two.
+                        ...(detail ? {} : { borderBottom: `1px solid ${c.lineSoft}` }),
+                        verticalAlign: "top",
+                      }}
+                    >
+                      {col.render(row)}
+                    </td>
+                  ))}
+                </tr>
+                {detail && (
+                  <tr>
+                    <td
+                      colSpan={columns.length}
+                      style={{
+                        padding: "0 12px 14px 0",
+                        borderBottom: `1px solid ${c.lineSoft}`,
+                      }}
+                    >
+                      {detail}
+                    </td>
+                  </tr>
+                )}
+              </Fragment>
+            );
+          })}
         </tbody>
       </table>
     </div>