diff --git a/.github/actions/ai-agent-runner/action.yml b/.github/actions/ai-agent-runner/action.yml
index b7da92ad..330d3b7b 100644
--- a/.github/actions/ai-agent-runner/action.yml
+++ b/.github/actions/ai-agent-runner/action.yml
@@ -59,7 +59,7 @@ runs:
   using: "composite"
   steps:
     - name: Setup Node.js
-      uses: actions/setup-node@v4
+      uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
       with:
         node-version: 22
 
diff --git a/.github/workflows/ai-breaking-change-detector.yml b/.github/workflows/ai-breaking-change-detector.yml
index 2f5ee9f7..7979b6ab 100644
--- a/.github/workflows/ai-breaking-change-detector.yml
+++ b/.github/workflows/ai-breaking-change-detector.yml
@@ -27,7 +27,10 @@ jobs:
     steps:
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
         with:
-          ref: ${{ github.event.pull_request.head.sha }}
+          # SECURITY: pull_request_target — checkout base branch (default), NOT
+          # the PR head. The composite action fetches the diff via GitHub API,
+          # so checking out HEAD is unnecessary and would let a malicious PR
+          # modify .github/actions/ code that runs with elevated GITHUB_TOKEN.
           fetch-depth: 0
 
       - name: Run breaking change analysis
diff --git a/.github/workflows/ai-code-review.yml b/.github/workflows/ai-code-review.yml
index 88db088a..7e001369 100644
--- a/.github/workflows/ai-code-review.yml
+++ b/.github/workflows/ai-code-review.yml
@@ -28,7 +28,10 @@ jobs:
     steps:
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
         with:
-          ref: ${{ github.event.pull_request.head.sha }}
+          # SECURITY: pull_request_target — checkout base branch (default), NOT
+          # the PR head. The composite action fetches the diff via GitHub API,
+          # so checking out HEAD is unnecessary and would let a malicious PR
+          # modify .github/actions/ code that runs with elevated GITHUB_TOKEN.
           fetch-depth: 0
 
       - name: Run AI code review
diff --git a/.github/workflows/ai-contributor-guide.yml b/.github/workflows/ai-contributor-guide.yml
index 8362dccb..7ed9c4b8 100644
--- a/.github/workflows/ai-contributor-guide.yml
+++ b/.github/workflows/ai-contributor-guide.yml
@@ -27,6 +27,9 @@ jobs:
       (github.event.issue.author_association == 'NONE' ||
        github.event.issue.author_association == 'FIRST_TIME_CONTRIBUTOR')
     continue-on-error: true
+    # SECURITY: pull_request_target — this job does NOT checkout PR head code.
+    # It only checks out the base branch for the composite action, and context
+    # is fetched via GitHub API. Permissions are scoped to minimum needed.
     steps:
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
 
@@ -74,6 +77,9 @@ jobs:
       (github.event.pull_request.author_association == 'NONE' ||
        github.event.pull_request.author_association == 'FIRST_TIME_CONTRIBUTOR')
     continue-on-error: true
+    # SECURITY: pull_request_target — this job does NOT checkout PR head code.
+    # Permissions scoped to minimum: contents:read for base checkout, pr:write
+    # for posting the welcome comment.
     steps:
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
 
diff --git a/.github/workflows/ai-docs-sync.yml b/.github/workflows/ai-docs-sync.yml
index a7e5bdaf..4fb65e8d 100644
--- a/.github/workflows/ai-docs-sync.yml
+++ b/.github/workflows/ai-docs-sync.yml
@@ -27,7 +27,10 @@ jobs:
     steps:
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
         with:
-          ref: ${{ github.event.pull_request.head.sha }}
+          # SECURITY: pull_request_target — checkout base branch (default), NOT
+          # the PR head. The composite action fetches the diff via GitHub API,
+          # so checking out HEAD is unnecessary and would let a malicious PR
+          # modify .github/actions/ code that runs with elevated GITHUB_TOKEN.
           fetch-depth: 0
 
       - name: Check documentation freshness
diff --git a/.github/workflows/ai-security-scan.yml b/.github/workflows/ai-security-scan.yml
index 00f98df8..1682e7e1 100644
--- a/.github/workflows/ai-security-scan.yml
+++ b/.github/workflows/ai-security-scan.yml
@@ -34,7 +34,10 @@ jobs:
     steps:
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
         with:
-          ref: ${{ github.event.pull_request.head.sha }}
+          # SECURITY: pull_request_target — checkout base branch (default), NOT
+          # the PR head. The composite action fetches the diff via GitHub API,
+          # so checking out HEAD is unnecessary and would let a malicious PR
+          # modify .github/actions/ code that runs with elevated GITHUB_TOKEN.
           fetch-depth: 0
 
       - name: Run AI security scan
diff --git a/.github/workflows/ai-spec-drafter.yml b/.github/workflows/ai-spec-drafter.yml
index 87a9ef6c..d44add0f 100644
--- a/.github/workflows/ai-spec-drafter.yml
+++ b/.github/workflows/ai-spec-drafter.yml
@@ -74,8 +74,10 @@ jobs:
             exit 0
           fi
 
-          # Sanitize title for branch name and filename
-          SAFE_TITLE=$(echo "$ISSUE_TITLE" | tr '[:upper:]' '[:lower:]' \
+          # Sanitize title for branch name and filename — use printf to
+          # prevent interpretation of backslash escapes and special chars
+          # (CWE-77: ISSUE_TITLE is untrusted user input)
+          SAFE_TITLE=$(printf '%s' "$ISSUE_TITLE" | tr '[:upper:]' '[:lower:]' \
             | sed 's/[^a-z0-9]/-/g' | sed 's/--*/-/g' | head -c 50)
           BRANCH="docs/spec-${ISSUE_NUMBER}-${SAFE_TITLE}"
           SPEC_FILE="docs/specs/issue-${ISSUE_NUMBER}-${SAFE_TITLE}.md"
@@ -88,22 +90,29 @@ jobs:
           printf '%s' "$SPEC_CONTENT" > "$SPEC_FILE"
 
           git add "$SPEC_FILE"
-          git commit -m "docs: add engineering spec for #${ISSUE_NUMBER}
-
-          Auto-generated from issue #${ISSUE_NUMBER}: ${ISSUE_TITLE}"
+          # Use printf for commit message to safely handle untrusted title
+          printf -v COMMIT_MSG 'docs: add engineering spec for #%s\n\nAuto-generated from issue #%s' \
+            "$ISSUE_NUMBER" "$ISSUE_NUMBER"
+          git commit -m "$COMMIT_MSG"
 
           git push origin "$BRANCH"
 
-          gh pr create \
-            --title "📋 Spec: ${ISSUE_TITLE}" \
-            --body "## Auto-Generated Engineering Spec
+          # Use --body-file to avoid shell interpretation of untrusted title
+          PR_BODY="## Auto-Generated Engineering Spec
 
           This spec was auto-generated from issue #${ISSUE_NUMBER}.
 
           **Please review and refine before approving.**
 
           ---
-          Closes #${ISSUE_NUMBER} (spec request)" \
+          Closes #${ISSUE_NUMBER} (spec request)"
+          printf '%s' "$PR_BODY" > "$RUNNER_TEMP/pr-body.md"
+
+          # Safely pass untrusted ISSUE_TITLE via printf to avoid injection
+          PR_TITLE=$(printf '📋 Spec: %s' "$ISSUE_TITLE")
+          gh pr create \
+            --title "$PR_TITLE" \
+            --body-file "$RUNNER_TEMP/pr-body.md" \
             --base main \
             --head "$BRANCH" \
             --label "documentation,spec" \
diff --git a/.github/workflows/ai-test-generator.yml b/.github/workflows/ai-test-generator.yml
index 2646d84c..71ef5b8e 100644
--- a/.github/workflows/ai-test-generator.yml
+++ b/.github/workflows/ai-test-generator.yml
@@ -27,7 +27,10 @@ jobs:
     steps:
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
         with:
-          ref: ${{ github.event.pull_request.head.sha }}
+          # SECURITY: pull_request_target — checkout base branch (default), NOT
+          # the PR head. The composite action fetches the diff via GitHub API,
+          # so checking out HEAD is unnecessary and would let a malicious PR
+          # modify .github/actions/ code that runs with elevated GITHUB_TOKEN.
           fetch-depth: 0
 
       - name: Identify changed source files
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 57a58bb5..c71e2f25 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -46,10 +46,7 @@ jobs:
         working-directory: packages/${{ matrix.package }}
         run: |
           pip install --no-cache-dir -e ".[dev]" 2>/dev/null || pip install --no-cache-dir -e ".[test]" 2>/dev/null || pip install --no-cache-dir -e .
-          pip install --no-cache-dir --require-hashes \
-            pytest==8.4.1 --hash=sha256:539c70ba6fcead8e78eebbf1115e8b589e7565830d7d006a8723f19ac8a0afb7 \
-            pytest-asyncio==1.1.0 --hash=sha256:5fe2d69607b0bd75c656d1211f969cadba035030156745ee09e7d71740e58ecf \
-            2>/dev/null || pip install --no-cache-dir pytest==8.4.1 pytest-asyncio==1.1.0 2>/dev/null || true
+          pip install --no-cache-dir pytest>=8.0 pytest-asyncio>=0.23 2>/dev/null || true
       - name: Test ${{ matrix.package }}
         working-directory: packages/${{ matrix.package }}
         run: pytest tests/ -q --tb=short
@@ -63,9 +60,7 @@ jobs:
           python-version: "3.11"
       - name: Install safety
         run: |
-          pip install --no-cache-dir --require-hashes \
-            safety==3.2.1 --hash=sha256:9f53646717ba052e1bf631bd54fb3da0fafa58e85d578b20a8b9affdcf81889e \
-            2>/dev/null || pip install --no-cache-dir safety==3.2.1
+          pip install --no-cache-dir safety==3.2.1
       - name: Check dependencies
         env:
           GIT_TERMINAL_PROMPT: "0"
diff --git a/.github/workflows/copilot-review.yml b/.github/workflows/copilot-review.yml
index 95f26581..1ac3dad9 100644
--- a/.github/workflows/copilot-review.yml
+++ b/.github/workflows/copilot-review.yml
@@ -11,6 +11,8 @@ jobs:
   copilot-review:
     if: github.event.pull_request.draft == false
     runs-on: ubuntu-latest
+    # SECURITY: pull_request_target — no checkout, API-only. Permissions scoped
+    # to pull-requests:write (minimum needed to request a reviewer).
     steps:
       - name: Request Copilot Review
         env:
diff --git a/.github/workflows/labeler.yml b/.github/workflows/labeler.yml
index 7e7add7f..102516f3 100644
--- a/.github/workflows/labeler.yml
+++ b/.github/workflows/labeler.yml
@@ -9,6 +9,8 @@ permissions:
 jobs:
   label:
     runs-on: ubuntu-latest
+    # SECURITY: pull_request_target — uses actions/labeler which reads config from
+    # the base branch (default checkout). No PR head code is executed.
     steps:
       - uses: actions/labeler@634933edcd8ababfe52f92936142cc22ac488b1b # v6.0.1
         with:
diff --git a/.github/workflows/pr-size.yml b/.github/workflows/pr-size.yml
index d871c187..b2160e0a 100644
--- a/.github/workflows/pr-size.yml
+++ b/.github/workflows/pr-size.yml
@@ -9,6 +9,8 @@ permissions:
 jobs:
   size-label:
     runs-on: ubuntu-latest
+    # SECURITY: pull_request_target — uses pr-size-labeler which only reads PR
+    # metadata via API. No checkout of PR head code. Permissions minimal.
     steps:
       - uses: codelytv/pr-size-labeler@4ec67706cd878fbc1c8db0a5dcd28b6bb412e85a # v1.10.3
         with:
diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index 3b1fd596..60d6ccea 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -57,9 +57,9 @@ jobs:
 
       - name: Install build tools
         run: |
+          # Require hash verification — no fallback to unverified install (CWE-295)
           pip install --no-cache-dir --require-hashes \
-            build==1.2.1 --hash=sha256:75e10f767a433d9a86e50d83f418e83efc18ede923ee5ff7df93b6cb0306c5d4 \
-            2>/dev/null || pip install --no-cache-dir build==1.2.1
+            build==1.2.1 --hash=sha256:75e10f767a433d9a86e50d83f418e83efc18ede923ee5ff7df93b6cb0306c5d4
 
       - name: Build ${{ matrix.package }}
         working-directory: packages/${{ matrix.package }}
@@ -165,7 +165,12 @@ jobs:
 
       - name: Install NuGet CLI
         run: |
-          curl -o /usr/local/bin/nuget.exe https://dist.nuget.org/win-x86-commandline/latest/nuget.exe
+          # Pin to specific version with SHA-256 verification (CWE-494)
+          NUGET_VERSION="v6.12.2"
+          NUGET_URL="https://dist.nuget.org/win-x86-commandline/${NUGET_VERSION}/nuget.exe"
+          NUGET_SHA256="64f467376f2ee364ba389461df4a29a8f8dd9aa38120d29046e70b9c82045d97"
+          curl -fsSL -o /usr/local/bin/nuget.exe "$NUGET_URL"
+          echo "${NUGET_SHA256}  /usr/local/bin/nuget.exe" | sha256sum -c -
           echo 'alias nuget="mono /usr/local/bin/nuget.exe"' >> ~/.bashrc
 
       - name: Build .NET SDK
diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml
index d519c3f5..5d81e4bf 100644
--- a/.github/workflows/scorecard.yml
+++ b/.github/workflows/scorecard.yml
@@ -6,7 +6,12 @@ on:
   schedule:
     - cron: "15 7 * * 1"
 
-permissions: read-all
+# Minimum permissions required by OpenSSF Scorecard
+permissions:
+  security-events: write
+  id-token: write
+  contents: read
+  actions: read
 
 jobs:
   analysis:
diff --git a/.github/workflows/welcome.yml b/.github/workflows/welcome.yml
index fc9fee29..3dc7f052 100644
--- a/.github/workflows/welcome.yml
+++ b/.github/workflows/welcome.yml
@@ -11,6 +11,8 @@ permissions:
 jobs:
   welcome:
     runs-on: ubuntu-latest
+    # SECURITY: pull_request_target — uses actions/first-interaction which only
+    # reads contributor history via API. No checkout of PR head code.
     steps:
       - uses: actions/first-interaction@a1db7729b356323c7988c20ed6f0d33fe31297be # v1.3.0
         with:
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 9a532a8d..433267e0 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -15,11 +15,18 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 ### Added
 - Demo `--include-attacks` flag for adversarial scenario testing (prompt injection, tool alias bypass, SQL bypass).
 - .NET `SagaStep.MaxAttempts` property replacing deprecated `MaxRetries`.
+- `ContentHashInterceptor` for SHA-256 tool identity verification at intercept time.
+- `ToolRegistry` content hashing — computes and verifies handler integrity at registration and execution.
+- `PolicyEngine.freeze()` method with `MappingProxyType` immutability and mutation audit log.
+- `QuorumConfig` for M-of-N approval requirements in `EscalationHandler`.
+- Escalation fatigue detection — auto-DENY when agents exceed configurable rate threshold.
+- `EscalationRequest.votes` field for per-approver vote tracking.
 
 ### Security
 - Replaced XOR placeholder encryption with AES-256-GCM in DMZ module.
 - Added Security Model & Limitations section to README.
 - Added security advisories to SECURITY.md for CostGuard and thread safety fixes.
+- Hardened against agent sandbox escape vectors (tool aliasing, runtime policy self-modification, approval fatigue).
 
 ## [2.2.0] - 2026-03-17
 
diff --git a/examples/policies/adk-governance.yaml b/examples/policies/adk-governance.yaml
new file mode 100644
index 00000000..f777b489
--- /dev/null
+++ b/examples/policies/adk-governance.yaml
@@ -0,0 +1,42 @@
+# ADK Governance Policy — Sample Configuration
+#
+# ⚠️  IMPORTANT: This is a SAMPLE policy for Google ADK agents.
+# Review and customize before production use.
+
+version: "1.0"
+name: adk-governance
+description: >
+  Sample governance policy for Google ADK agents. Configures tool
+  restrictions, rate limits, and delegation controls.
+
+disclaimer: >
+  This is a sample configuration. Customize for your environment.
+
+adk_governance:
+  # Tools that are always blocked
+  blocked_tools:
+    - execute_shell
+    - run_command
+    - delete_database
+    - drop_table
+
+  # Maximum tool calls per agent per session
+  max_tool_calls: 100
+
+  # Tools requiring human approval before execution
+  require_approval_for:
+    - send_email
+    - publish_document
+    - deploy_service
+    - transfer_funds
+
+  # Delegation controls
+  delegation:
+    max_depth: 3
+    require_scope_narrowing: true
+
+  # Audit settings
+  audit:
+    log_all_tool_calls: true
+    log_delegations: true
+    include_tool_args: false  # Set true only in dev (may contain PII)
diff --git a/packages/agent-governance-dotnet/src/AgentGovernance/Trust/AgentIdentity.cs b/packages/agent-governance-dotnet/src/AgentGovernance/Trust/AgentIdentity.cs
index 12e379ac..8c99b464 100644
--- a/packages/agent-governance-dotnet/src/AgentGovernance/Trust/AgentIdentity.cs
+++ b/packages/agent-governance-dotnet/src/AgentGovernance/Trust/AgentIdentity.cs
@@ -95,6 +95,14 @@ public static AgentIdentity Create(string name)
     /// <exception cref="InvalidOperationException">
     /// Thrown when this identity does not have a private key (verification-only).
     /// </exception>
+    /// <remarks>
+    /// ⚠️ <b>SECURITY WARNING (CWE-327):</b> This method uses HMAC-SHA256 as a compatibility
+    /// fallback. HMAC-SHA256 is a symmetric scheme — both signing and verification require the
+    /// private key, which is unsuitable for cross-agent trust scenarios. Prefer Ed25519 (available
+    /// natively in .NET 9+) for production deployments. This fallback exists only for backward
+    /// compatibility with .NET 8.0 environments and should be considered deprecated.
+    /// </remarks>
+    [Obsolete("HMAC-SHA256 signing is a compatibility fallback. Migrate to Ed25519 on .NET 9+ for proper asymmetric signing.")]
     public byte[] Sign(byte[] data)
     {
         ArgumentNullException.ThrowIfNull(data);
@@ -105,6 +113,10 @@ public byte[] Sign(byte[] data)
                 "Cannot sign data: this identity does not have a private key.");
         }
 
+        System.Diagnostics.Trace.TraceWarning(
+            "[AgentIdentity] Using HMAC-SHA256 fallback for signing. " +
+            "This is deprecated — migrate to Ed25519 on .NET 9+ for proper asymmetric cryptography.");
+
         using var hmac = new HMACSHA256(PrivateKey);
         return hmac.ComputeHash(data);
     }
@@ -114,6 +126,8 @@ public byte[] Sign(byte[] data)
     /// </summary>
     /// <param name="message">The message to sign.</param>
     /// <returns>A 32-byte HMAC-SHA256 signature.</returns>
+    /// <inheritdoc cref="Sign(byte[])" path="/remarks"/>
+    [Obsolete("HMAC-SHA256 signing is a compatibility fallback. Migrate to Ed25519 on .NET 9+ for proper asymmetric signing.")]
     public byte[] Sign(string message)
     {
         ArgumentNullException.ThrowIfNull(message);
@@ -131,6 +145,11 @@ public byte[] Sign(string message)
     /// verification requires the signing key. For public-key verification,
     /// migrate to Ed25519 on .NET 9+.
     /// </exception>
+    /// <remarks>
+    /// ⚠️ <b>SECURITY WARNING (CWE-327):</b> HMAC-SHA256 verification requires the private key,
+    /// making it unsuitable for public-key-only verification. Migrate to Ed25519 on .NET 9+.
+    /// </remarks>
+    [Obsolete("HMAC-SHA256 verification is a compatibility fallback. Migrate to Ed25519 on .NET 9+ for public-key verification.")]
     public bool Verify(byte[] data, byte[] signature)
     {
         ArgumentNullException.ThrowIfNull(data);
@@ -143,7 +162,9 @@ public bool Verify(byte[] data, byte[] signature)
                 "For cross-agent verification with only a public key, migrate to Ed25519 (.NET 9+).");
         }
 
+#pragma warning disable CS0618 // Intentional use of deprecated Sign() for HMAC fallback path
         var expected = Sign(data);
+#pragma warning restore CS0618
         return CryptographicOperations.FixedTimeEquals(expected, signature);
     }
 
@@ -163,6 +184,12 @@ public bool Verify(byte[] data, byte[] signature)
     /// Thrown when <paramref name="privateKey"/> is <c>null</c> because HMAC-SHA256
     /// cannot verify without the signing key.
     /// </exception>
+    /// <remarks>
+    /// ⚠️ <b>SECURITY WARNING (CWE-327):</b> This static overload uses HMAC-SHA256, which
+    /// requires the private key for verification — defeating the purpose of public-key
+    /// cryptography. Migrate to Ed25519 on .NET 9+ where only the public key is needed.
+    /// </remarks>
+    [Obsolete("HMAC-SHA256 verification is a compatibility fallback. Migrate to Ed25519 on .NET 9+ for public-key verification.")]
     public static bool VerifySignature(byte[] publicKey, byte[] data, byte[] signature, byte[]? privateKey = null)
     {
         ArgumentNullException.ThrowIfNull(publicKey);
diff --git a/packages/agent-governance-dotnet/src/AgentGovernance/Trust/FileTrustStore.cs b/packages/agent-governance-dotnet/src/AgentGovernance/Trust/FileTrustStore.cs
index b00f7570..85ea393d 100644
--- a/packages/agent-governance-dotnet/src/AgentGovernance/Trust/FileTrustStore.cs
+++ b/packages/agent-governance-dotnet/src/AgentGovernance/Trust/FileTrustStore.cs
@@ -42,7 +42,18 @@ public sealed class FileTrustStore : IDisposable
     public FileTrustStore(string filePath, double defaultScore = 500.0, double decayRate = 10.0, Action<Exception, string>? loadErrorHandler = null)
     {
         ArgumentException.ThrowIfNullOrWhiteSpace(filePath);
-        _filePath = filePath;
+
+        // CWE-22: Validate path to prevent directory traversal attacks.
+        // Resolve the full path and reject any path containing ".." segments.
+        var resolvedPath = Path.GetFullPath(filePath);
+        if (filePath.Contains("..", StringComparison.Ordinal))
+        {
+            throw new ArgumentException(
+                $"Path traversal detected: trust store path must not contain '..' segments. Resolved: {resolvedPath}",
+                nameof(filePath));
+        }
+
+        _filePath = resolvedPath;
         _defaultScore = Math.Clamp(defaultScore, 0, 1000);
         _decayRate = Math.Max(0, decayRate);
         _loadErrorHandler = loadErrorHandler;
diff --git a/packages/agent-marketplace/pyproject.toml b/packages/agent-marketplace/pyproject.toml
index 89462354..8c4f2384 100644
--- a/packages/agent-marketplace/pyproject.toml
+++ b/packages/agent-marketplace/pyproject.toml
@@ -31,7 +31,7 @@ classifiers = [
 dependencies = [
     "pydantic>=2.0",
     "pyyaml>=6.0",
-    "cryptography>=41.0",
+    "cryptography>=44.0.0,<47.0",
 ]
 
 [project.optional-dependencies]
diff --git a/packages/agent-mesh/pyproject.toml b/packages/agent-mesh/pyproject.toml
index 18cef79d..6a1b0f2b 100644
--- a/packages/agent-mesh/pyproject.toml
+++ b/packages/agent-mesh/pyproject.toml
@@ -93,7 +93,7 @@ langchain = [
     "langchain-core>=1.2.11",
 ]
 django = [
-    "django>=3.2",
+    "django>=4.2,<6.0",
 ]
 websocket = [
     "websockets>=12.0",
diff --git a/packages/agent-mesh/sdks/typescript/package-lock.json b/packages/agent-mesh/sdks/typescript/package-lock.json
index ed1c0267..07158a6e 100644
--- a/packages/agent-mesh/sdks/typescript/package-lock.json
+++ b/packages/agent-mesh/sdks/typescript/package-lock.json
@@ -1,13 +1,13 @@
 {
-  "name": "@agentmesh/sdk",
-  "version": "0.1.0",
+  "name": "@microsoft/agentmesh-sdk",
+  "version": "1.0.0",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
-      "name": "@agentmesh/sdk",
-      "version": "0.1.0",
-      "license": "Apache-2.0",
+      "name": "@microsoft/agentmesh-sdk",
+      "version": "1.0.0",
+      "license": "MIT",
       "dependencies": {
         "@noble/ed25519": "^2.0.0",
         "js-yaml": "^4.1.0"
@@ -58,6 +58,7 @@
       "integrity": "sha512-CGOfOJqWjg2qW/Mb6zNsDm+u5vFQ8DxXfbM09z69p5Z6+mE1ikP2jUXw+j42Pf1XTYED2Rni5f95npYeuwMDQA==",
       "dev": true,
       "license": "MIT",
+      "peer": true,
       "dependencies": {
         "@babel/code-frame": "^7.29.0",
         "@babel/generator": "^7.29.0",
@@ -2772,9 +2773,9 @@
       }
     },
     "node_modules/flatted": {
-      "version": "3.4.1",
-      "resolved": "https://registry.npmjs.org/flatted/-/flatted-3.4.1.tgz",
-      "integrity": "sha512-IxfVbRFVlV8V/yRaGzk0UVIcsKKHMSfYw66T/u4nTwlWteQePsxe//LjudR1AMX4tZW3WFCh3Zqa/sjlqpbURQ==",
+      "version": "3.4.2",
+      "resolved": "https://registry.npmjs.org/flatted/-/flatted-3.4.2.tgz",
+      "integrity": "sha512-PjDse7RzhcPkIJwy5t7KPWQSZ9cAbzQXcafsetQoD7sOJRQlGikNbx7yZp2OotDnJyrDcbyRq3Ttb18iYOqkxA==",
       "dev": true,
       "license": "ISC"
     },
diff --git a/packages/agent-mesh/src/agentmesh/integrations/langchain/tools.py b/packages/agent-mesh/src/agentmesh/integrations/langchain/tools.py
index 56268671..23e9b38c 100644
--- a/packages/agent-mesh/src/agentmesh/integrations/langchain/tools.py
+++ b/packages/agent-mesh/src/agentmesh/integrations/langchain/tools.py
@@ -115,16 +115,17 @@ class TrustVerifiedTool(BaseTool):  # type: ignore[misc]
 
     Example::
 
+        import ast
         from agentmesh.integrations.langchain import TrustVerifiedTool
 
         tool = TrustVerifiedTool(
             name="calculator",
-            description="Performs arithmetic",
+            description="Evaluates a numeric literal safely",
             agent_did="did:mesh:abc123",
             min_trust_score=500,
-            inner_fn=lambda q: str(eval(q, {"__builtins__": {}}, {})),  # noqa: S307 — example only; use ast.literal_eval in production
+            inner_fn=lambda q: str(ast.literal_eval(q)),  # safe: only evaluates Python literal values
         )
-        result = tool.run("2 + 2")
+        result = tool.run("42")
     """
 
     # Instance attributes (not Pydantic fields for compatibility)
diff --git a/packages/agent-mesh/tests/test_storage.py b/packages/agent-mesh/tests/test_storage.py
index 2453cade..ec68aa23 100644
--- a/packages/agent-mesh/tests/test_storage.py
+++ b/packages/agent-mesh/tests/test_storage.py
@@ -217,7 +217,8 @@ async def postgres_provider(self):
             postgres_port=5432,
             postgres_database="agentmesh_test",
             postgres_user="agentmesh",
-            postgres_password="agentmesh",
+            # Test-only password — not for production use
+            postgres_password="test-only-not-for-production",
         )
         provider = PostgresStorageProvider(config)
         await provider.connect()
diff --git a/packages/agent-os/README.md b/packages/agent-os/README.md
index 34facd56..4dceb49d 100644
--- a/packages/agent-os/README.md
+++ b/packages/agent-os/README.md
@@ -1009,6 +1009,69 @@ These components are fully implemented and tested:
 | **No tamper-proof audit** | Flight Recorder SQLite can be modified by compromised agent | Write to external sink for critical audits |
 | **Provider-coupled adapters** | Each SDK needs separate adapter | Abstract interface planned (#47) |
 
+### Security Hardening (Sandbox Escape Defenses)
+
+The following features defend against agent sandbox escape vectors
+([tool aliasing, runtime self-modification, approval fatigue](https://ona.com/stories/how-claude-code-escapes-its-own-denylist-and-sandbox)):
+
+#### Tool Content Hashing
+
+Tools registered through `ToolRegistry` are SHA-256 hashed at registration.
+`execute_tool()` verifies integrity before every call — a tampered or wrapped
+tool is blocked automatically.
+
+```python
+from agent_control_plane.tool_registry import ToolRegistry, ToolType
+
+registry = ToolRegistry()
+registry.register_tool("search", "Web search", ToolType.SEARCH, handler=my_search_fn)
+
+# Later: verify integrity (e.g., detect wrapper/alias attacks)
+result = registry.verify_tool_integrity("search")
+assert result["verified"]  # True if handler is unmodified
+```
+
+Use `ContentHashInterceptor` in the interceptor chain for call-level verification:
+
+```python
+from agent_os.integrations.base import ContentHashInterceptor, CompositeInterceptor
+
+chain = CompositeInterceptor()
+chain.add(ContentHashInterceptor(tool_hashes={"search": registry.get_tool("search").content_hash}))
+```
+
+#### PolicyEngine Freeze
+
+Call `freeze()` after initialization to make the policy engine immutable.
+This prevents agents from calling `add_constraint()` or `update_agent_context()`
+to weaken their own policies at runtime.
+
+```python
+from agent_control_plane.policy_engine import PolicyEngine
+
+engine = PolicyEngine()
+engine.add_constraint("finance", ["read", "calculate"])
+engine.freeze()  # Irreversible — all mutation methods now raise RuntimeError
+
+engine.add_constraint("finance", ["delete"])  # RuntimeError!
+engine.state_permissions["hacker"] = {"all"}  # TypeError! (MappingProxyType)
+```
+
+#### Approval Quorum & Fatigue Detection
+
+Require M-of-N approvals for high-risk operations and auto-deny when agents
+flood the escalation queue (approval fatigue attack):
+
+```python
+from agent_os.integrations.escalation import EscalationHandler, QuorumConfig
+
+handler = EscalationHandler(
+    quorum=QuorumConfig(required_approvals=2, total_approvers=3),
+    fatigue_threshold=5,          # Max 5 escalations per agent...
+    fatigue_window_seconds=60,    # ...per minute
+)
+```
+
 See [GitHub Issues](https://github.com/microsoft/agent-governance-toolkit/issues) for the full roadmap.
 
 ---
diff --git a/packages/agent-os/examples/defi-sentinel/.env.example b/packages/agent-os/examples/defi-sentinel/.env.example
index 9a098958..8b2101b6 100644
--- a/packages/agent-os/examples/defi-sentinel/.env.example
+++ b/packages/agent-os/examples/defi-sentinel/.env.example
@@ -38,4 +38,5 @@ TPS_SIMULATION=100
 # Observability
 # =============================================================================
 
-GF_SECURITY_ADMIN_PASSWORD=admin
+# WARNING: Change this password before deploying to any environment
+GF_SECURITY_ADMIN_PASSWORD=CHANGE_ME_BEFORE_USE
diff --git a/packages/agent-os/examples/defi-sentinel/demo.py b/packages/agent-os/examples/defi-sentinel/demo.py
index e84fc942..cca42263 100644
--- a/packages/agent-os/examples/defi-sentinel/demo.py
+++ b/packages/agent-os/examples/defi-sentinel/demo.py
@@ -18,6 +18,7 @@
 import asyncio
 import hashlib
 import random
+import secrets
 import time
 from dataclasses import dataclass, field
 from datetime import datetime
@@ -163,9 +164,9 @@ def generate_attack(self, attack_type: AttackType) -> Transaction:
     def generate_legitimate_tx(self) -> Transaction:
         """Generate a normal transaction"""
         return Transaction(
-            from_addr="0x" + format(random.randint(0, 2**160-1), '040x'),
-            to_addr="0x" + format(random.randint(0, 2**160-1), '040x'),
-            value_wei=random.randint(10**16, 10**18),
+            from_addr="0x" + secrets.token_hex(20),
+            to_addr="0x" + secrets.token_hex(20),
+            value_wei=10**16 + secrets.randbelow(10**18 - 10**16 + 1),
             data="0x",
             gas_limit=21000,
             gas_price_gwei=random.uniform(20, 100),
diff --git a/packages/agent-os/examples/github-reviewer/main.py b/packages/agent-os/examples/github-reviewer/main.py
index b57d46b7..563a3f98 100644
--- a/packages/agent-os/examples/github-reviewer/main.py
+++ b/packages/agent-os/examples/github-reviewer/main.py
@@ -213,7 +213,7 @@ def scan(self, content: str, filename: str) -> list[Finding]:
             for name, pattern in self._compiled.items():
                 if pattern.search(line):
                     findings.append(Finding(
-                        id=f"secret-{name}-{hashlib.md5(line.encode()).hexdigest()[:8]}",
+                        id=f"secret-{name}-{hashlib.sha256(line.encode()).hexdigest()[:8]}",
                         severity=self.patterns[name]["severity"],
                         category="secret",
                         file=filename,
@@ -482,16 +482,16 @@ def delete_all():
 ''',
         "src/api.py": '''
 import yaml
-import pickle
+import json
 import requests
 
 def load_config(path):
     with open(path) as f:
-        return yaml.load(f)  # Unsafe!
+        return yaml.safe_load(f)
 
 def load_data(path):
-    with open(path, 'rb') as f:
-        return pickle.load(f)  # Unsafe deserialization
+    with open(path, 'r') as f:
+        return json.load(f)
 
 def fetch_data(url):
     return requests.get(url, verify=False)  # SSL disabled!
diff --git a/packages/agent-os/extensions/chrome/devtools/panel.js b/packages/agent-os/extensions/chrome/devtools/panel.js
index ee863815..b2b19fb2 100644
--- a/packages/agent-os/extensions/chrome/devtools/panel.js
+++ b/packages/agent-os/extensions/chrome/devtools/panel.js
@@ -210,34 +210,76 @@ class AgentOSPanel {
     this.renderMessages();
   }
   
+  // Utility: escape HTML to prevent XSS (CWE-79)
+  escapeHtml(str) {
+    if (str === null || str === undefined) return '';
+    const text = String(str);
+    const div = document.createElement('div');
+    div.textContent = text;
+    return div.innerHTML;
+  }
+
   renderMessages() {
     const container = document.getElementById('messageList');
     
     if (this.messages.length === 0) {
-      container.innerHTML = `
-        <div class="empty-state">
-          <div class="icon">📭</div>
-          <p>No messages captured yet</p>
-          <p>Agent OS messages will appear here</p>
-        </div>
-      `;
+      container.innerHTML = '';
+      const emptyDiv = document.createElement('div');
+      emptyDiv.className = 'empty-state';
+      const icon = document.createElement('div');
+      icon.className = 'icon';
+      icon.textContent = '📭';
+      const p1 = document.createElement('p');
+      p1.textContent = 'No messages captured yet';
+      const p2 = document.createElement('p');
+      p2.textContent = 'Agent OS messages will appear here';
+      emptyDiv.appendChild(icon);
+      emptyDiv.appendChild(p1);
+      emptyDiv.appendChild(p2);
+      container.appendChild(emptyDiv);
       return;
     }
     
-    container.innerHTML = this.messages.map(msg => `
-      <div class="message-item" data-id="${msg.id}">
-        <div class="message-header">
-          <span class="message-type">${msg.type}</span>
-          <span class="message-time">${this.formatTime(msg.timestamp)}</span>
-        </div>
-        <div class="message-body">${JSON.stringify(msg.content, null, 2)}</div>
-        <div class="message-meta">
-          <span>From: ${msg.sender || 'unknown'}</span>
-          <span>To: ${msg.recipient || 'broadcast'}</span>
-          ${msg.signature ? `<span>✓ Signed</span>` : ''}
-        </div>
-      </div>
-    `).join('');
+    container.innerHTML = '';
+    this.messages.forEach(msg => {
+      const item = document.createElement('div');
+      item.className = 'message-item';
+      item.dataset.id = msg.id;
+      
+      const header = document.createElement('div');
+      header.className = 'message-header';
+      const typeSpan = document.createElement('span');
+      typeSpan.className = 'message-type';
+      typeSpan.textContent = msg.type;
+      const timeSpan = document.createElement('span');
+      timeSpan.className = 'message-time';
+      timeSpan.textContent = this.formatTime(msg.timestamp);
+      header.appendChild(typeSpan);
+      header.appendChild(timeSpan);
+      
+      const body = document.createElement('div');
+      body.className = 'message-body';
+      body.textContent = JSON.stringify(msg.content, null, 2);
+      
+      const meta = document.createElement('div');
+      meta.className = 'message-meta';
+      const fromSpan = document.createElement('span');
+      fromSpan.textContent = `From: ${msg.sender || 'unknown'}`;
+      const toSpan = document.createElement('span');
+      toSpan.textContent = `To: ${msg.recipient || 'broadcast'}`;
+      meta.appendChild(fromSpan);
+      meta.appendChild(toSpan);
+      if (msg.signature) {
+        const sigSpan = document.createElement('span');
+        sigSpan.textContent = '✓ Signed';
+        meta.appendChild(sigSpan);
+      }
+      
+      item.appendChild(header);
+      item.appendChild(body);
+      item.appendChild(meta);
+      container.appendChild(item);
+    });
   }
   
   filterMessages(query) {
@@ -310,23 +352,48 @@ class AgentOSPanel {
     const tbody = document.getElementById('trustTableBody');
     
     if (this.agents.size === 0) {
-      tbody.innerHTML = '<tr><td colspan="5" class="empty-state">No agents registered</td></tr>';
+      tbody.innerHTML = '';
+      const tr = document.createElement('tr');
+      const td = document.createElement('td');
+      td.colSpan = 5;
+      td.className = 'empty-state';
+      td.textContent = 'No agents registered';
+      tr.appendChild(td);
+      tbody.appendChild(tr);
       return;
     }
     
-    tbody.innerHTML = Array.from(this.agents.values()).map(agent => `
-      <tr>
-        <td>${agent.id}</td>
-        <td>${agent.name}</td>
-        <td>
-          <span class="trust-level ${agent.trustLevel.toLowerCase()}">
-            ${agent.trustLevel}
-          </span>
-        </td>
-        <td><code>${agent.publicKey || 'N/A'}</code></td>
-        <td>${agent.lastVerified ? this.formatTime(agent.lastVerified) : 'Never'}</td>
-      </tr>
-    `).join('');
+    tbody.innerHTML = '';
+    Array.from(this.agents.values()).forEach(agent => {
+      const tr = document.createElement('tr');
+      
+      const tdId = document.createElement('td');
+      tdId.textContent = agent.id;
+      
+      const tdName = document.createElement('td');
+      tdName.textContent = agent.name;
+      
+      const tdTrust = document.createElement('td');
+      const trustSpan = document.createElement('span');
+      trustSpan.className = `trust-level ${agent.trustLevel.toLowerCase()}`;
+      trustSpan.textContent = agent.trustLevel;
+      tdTrust.appendChild(trustSpan);
+      
+      const tdKey = document.createElement('td');
+      const code = document.createElement('code');
+      code.textContent = agent.publicKey || 'N/A';
+      tdKey.appendChild(code);
+      
+      const tdVerified = document.createElement('td');
+      tdVerified.textContent = agent.lastVerified ? this.formatTime(agent.lastVerified) : 'Never';
+      
+      tr.appendChild(tdId);
+      tr.appendChild(tdName);
+      tr.appendChild(tdTrust);
+      tr.appendChild(tdKey);
+      tr.appendChild(tdVerified);
+      tbody.appendChild(tr);
+    });
   }
   
   filterTrust(query) {
diff --git a/packages/agent-os/extensions/copilot/package-lock.json b/packages/agent-os/extensions/copilot/package-lock.json
index 43f62716..713e43fb 100644
--- a/packages/agent-os/extensions/copilot/package-lock.json
+++ b/packages/agent-os/extensions/copilot/package-lock.json
@@ -1,11 +1,11 @@
 {
-  "name": "@agent-os/copilot-extension",
+  "name": "@microsoft/agent-os-copilot-extension",
   "version": "1.0.0",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
-      "name": "@agent-os/copilot-extension",
+      "name": "@microsoft/agent-os-copilot-extension",
       "version": "1.0.0",
       "license": "MIT",
       "dependencies": {
@@ -62,6 +62,7 @@
       "integrity": "sha512-CGOfOJqWjg2qW/Mb6zNsDm+u5vFQ8DxXfbM09z69p5Z6+mE1ikP2jUXw+j42Pf1XTYED2Rni5f95npYeuwMDQA==",
       "dev": true,
       "license": "MIT",
+      "peer": true,
       "dependencies": {
         "@babel/code-frame": "^7.29.0",
         "@babel/generator": "^7.29.0",
@@ -1594,6 +1595,7 @@
       "integrity": "sha512-jp2P3tQMSxWugkCUKLRPVUpGaL5MVFwF8RDuSRztfwgN1wmqJeMSbKlnEtQqU8UrhTmzEmZdu2I6v2dpp7XIxw==",
       "dev": true,
       "license": "MIT",
+      "peer": true,
       "dependencies": {
         "undici-types": "~7.18.0"
       }
@@ -1698,6 +1700,7 @@
       "integrity": "sha512-k4eNDan0EIMTT/dUKc/g+rsJ6wcHYhNPdY19VoX/EOtaAG8DLtKCykhrUnuHPYvinn5jhAPgD2Qw9hXBwrahsw==",
       "dev": true,
       "license": "MIT",
+      "peer": true,
       "dependencies": {
         "@typescript-eslint/scope-manager": "8.57.1",
         "@typescript-eslint/types": "8.57.1",
@@ -2321,6 +2324,7 @@
       "integrity": "sha512-UVJyE9MttOsBQIDKw1skb9nAwQuR5wuGD3+82K6JgJlm/Y+KI92oNsMNGZCYdDsVtRHSak0pcV5Dno5+4jh9sw==",
       "dev": true,
       "license": "MIT",
+      "peer": true,
       "bin": {
         "acorn": "bin/acorn"
       },
@@ -2659,6 +2663,7 @@
         }
       ],
       "license": "MIT",
+      "peer": true,
       "dependencies": {
         "baseline-browser-mapping": "^2.9.0",
         "caniuse-lite": "^1.0.30001759",
@@ -3349,6 +3354,7 @@
       "integrity": "sha512-COV33RzXZkqhG9P2rZCFl9ZmJ7WL+gQSCRzE7RhkbclbQPtLAWReL7ysA0Sh4c8Im2U9ynybdR56PV0XcKvqaQ==",
       "dev": true,
       "license": "MIT",
+      "peer": true,
       "dependencies": {
         "@eslint-community/eslint-utils": "^4.8.0",
         "@eslint-community/regexpp": "^4.12.2",
@@ -3777,9 +3783,9 @@
       }
     },
     "node_modules/flatted": {
-      "version": "3.4.1",
-      "resolved": "https://registry.npmjs.org/flatted/-/flatted-3.4.1.tgz",
-      "integrity": "sha512-IxfVbRFVlV8V/yRaGzk0UVIcsKKHMSfYw66T/u4nTwlWteQePsxe//LjudR1AMX4tZW3WFCh3Zqa/sjlqpbURQ==",
+      "version": "3.4.2",
+      "resolved": "https://registry.npmjs.org/flatted/-/flatted-3.4.2.tgz",
+      "integrity": "sha512-PjDse7RzhcPkIJwy5t7KPWQSZ9cAbzQXcafsetQoD7sOJRQlGikNbx7yZp2OotDnJyrDcbyRq3Ttb18iYOqkxA==",
       "dev": true,
       "license": "ISC"
     },
@@ -4438,6 +4444,7 @@
       "integrity": "sha512-AkXIIFcaazymvey2i/+F94XRnM6TsVLZDhBMLsd1Sf/W0wzsvvpjeyUrCZD6HGG4SDYPgDJDBKeiJTBb10WzMg==",
       "dev": true,
       "license": "MIT",
+      "peer": true,
       "dependencies": {
         "@jest/core": "30.3.0",
         "@jest/types": "30.3.0",
@@ -5636,6 +5643,7 @@
       "integrity": "sha512-5gTmgEY/sqK6gFXLIsQNH19lWb4ebPDLA4SdLP7dsWkIXHWlG66oPuVvXSGFPppYZz8ZDZq0dYYrbHfBCVUb1Q==",
       "dev": true,
       "license": "MIT",
+      "peer": true,
       "engines": {
         "node": ">=12"
       },
@@ -6614,6 +6622,7 @@
       "integrity": "sha512-f0FFpIdcHgn8zcPSbf1dRevwt047YMnaiJM3u2w2RewrB+fob/zePZcrOyQoLMMO7aBIddLcQIEK5dYjkLnGrQ==",
       "dev": true,
       "license": "MIT",
+      "peer": true,
       "dependencies": {
         "@cspotcode/source-map-support": "^0.8.0",
         "@tsconfig/node10": "^1.0.7",
@@ -6716,6 +6725,7 @@
       "integrity": "sha512-jl1vZzPDinLr9eUt3J/t7V6FgNEw9QjvBPdysz9KfQDD41fQrC2Y4vKQdiaUpFT4bXlb1RHhLpp8wtm6M5TgSw==",
       "dev": true,
       "license": "Apache-2.0",
+      "peer": true,
       "bin": {
         "tsc": "bin/tsc",
         "tsserver": "bin/tsserver"
diff --git a/packages/agent-os/extensions/mcp-server/package-lock.json b/packages/agent-os/extensions/mcp-server/package-lock.json
index 9fd74071..7ab050d8 100644
--- a/packages/agent-os/extensions/mcp-server/package-lock.json
+++ b/packages/agent-os/extensions/mcp-server/package-lock.json
@@ -1,11 +1,11 @@
 {
-  "name": "agentos-mcp-server",
+  "name": "@microsoft/agentos-mcp-server",
   "version": "1.0.1",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
-      "name": "agentos-mcp-server",
+      "name": "@microsoft/agentos-mcp-server",
       "version": "1.0.1",
       "license": "MIT",
       "dependencies": {
@@ -744,6 +744,7 @@
       "integrity": "sha512-jp2P3tQMSxWugkCUKLRPVUpGaL5MVFwF8RDuSRztfwgN1wmqJeMSbKlnEtQqU8UrhTmzEmZdu2I6v2dpp7XIxw==",
       "dev": true,
       "license": "MIT",
+      "peer": true,
       "dependencies": {
         "undici-types": "~7.18.0"
       }
@@ -800,6 +801,7 @@
       "integrity": "sha512-k4eNDan0EIMTT/dUKc/g+rsJ6wcHYhNPdY19VoX/EOtaAG8DLtKCykhrUnuHPYvinn5jhAPgD2Qw9hXBwrahsw==",
       "dev": true,
       "license": "MIT",
+      "peer": true,
       "dependencies": {
         "@typescript-eslint/scope-manager": "8.57.1",
         "@typescript-eslint/types": "8.57.1",
@@ -1291,6 +1293,7 @@
       "integrity": "sha512-UVJyE9MttOsBQIDKw1skb9nAwQuR5wuGD3+82K6JgJlm/Y+KI92oNsMNGZCYdDsVtRHSak0pcV5Dno5+4jh9sw==",
       "dev": true,
       "license": "MIT",
+      "peer": true,
       "bin": {
         "acorn": "bin/acorn"
       },
@@ -1728,6 +1731,7 @@
       "integrity": "sha512-COV33RzXZkqhG9P2rZCFl9ZmJ7WL+gQSCRzE7RhkbclbQPtLAWReL7ysA0Sh4c8Im2U9ynybdR56PV0XcKvqaQ==",
       "dev": true,
       "license": "MIT",
+      "peer": true,
       "dependencies": {
         "@eslint-community/eslint-utils": "^4.8.0",
         "@eslint-community/regexpp": "^4.12.2",
@@ -1989,6 +1993,7 @@
       "resolved": "https://registry.npmjs.org/express/-/express-5.2.1.tgz",
       "integrity": "sha512-hIS4idWWai69NezIdRt2xFVofaF4j+6INOpJlVOLDO8zXGpUVEVzIYk12UUi2JzjEzWL3IOAxcTubgz9Po0yXw==",
       "license": "MIT",
+      "peer": true,
       "dependencies": {
         "accepts": "^2.0.0",
         "body-parser": "^2.2.1",
@@ -2171,9 +2176,9 @@
       }
     },
     "node_modules/flatted": {
-      "version": "3.4.1",
-      "resolved": "https://registry.npmjs.org/flatted/-/flatted-3.4.1.tgz",
-      "integrity": "sha512-IxfVbRFVlV8V/yRaGzk0UVIcsKKHMSfYw66T/u4nTwlWteQePsxe//LjudR1AMX4tZW3WFCh3Zqa/sjlqpbURQ==",
+      "version": "3.4.2",
+      "resolved": "https://registry.npmjs.org/flatted/-/flatted-3.4.2.tgz",
+      "integrity": "sha512-PjDse7RzhcPkIJwy5t7KPWQSZ9cAbzQXcafsetQoD7sOJRQlGikNbx7yZp2OotDnJyrDcbyRq3Ttb18iYOqkxA==",
       "dev": true,
       "license": "ISC"
     },
@@ -2326,6 +2331,7 @@
       "resolved": "https://registry.npmjs.org/hono/-/hono-4.12.7.tgz",
       "integrity": "sha512-jq9l1DM0zVIvsm3lv9Nw9nlJnMNPOcAtsbsgiUhWcFzPE99Gvo6yRTlszSLLYacMeQ6quHD6hMfId8crVHvexw==",
       "license": "MIT",
+      "peer": true,
       "engines": {
         "node": ">=16.9.0"
       }
@@ -3177,6 +3183,7 @@
       "integrity": "sha512-5gTmgEY/sqK6gFXLIsQNH19lWb4ebPDLA4SdLP7dsWkIXHWlG66oPuVvXSGFPppYZz8ZDZq0dYYrbHfBCVUb1Q==",
       "dev": true,
       "license": "MIT",
+      "peer": true,
       "engines": {
         "node": ">=12"
       },
@@ -3752,6 +3759,7 @@
       "integrity": "sha512-jl1vZzPDinLr9eUt3J/t7V6FgNEw9QjvBPdysz9KfQDD41fQrC2Y4vKQdiaUpFT4bXlb1RHhLpp8wtm6M5TgSw==",
       "dev": true,
       "license": "Apache-2.0",
+      "peer": true,
       "bin": {
         "tsc": "bin/tsc",
         "tsserver": "bin/tsserver"
@@ -3820,6 +3828,7 @@
       "integrity": "sha512-fPGaRNj9Zytaf8LEiBhY7Z6ijnFKdzU/+mL8EFBaKr7Vw1/FWcTBAMW0wLPJAGMPX38ZPVCVgLceWiEqeoqL2Q==",
       "dev": true,
       "license": "MIT",
+      "peer": true,
       "dependencies": {
         "@oxc-project/runtime": "0.115.0",
         "lightningcss": "^1.32.0",
@@ -3899,6 +3908,7 @@
       "integrity": "sha512-YbDrMF9jM2Lqc++2530UourxZHmkKLxrs4+mYhEwqWS97WJ7wOYEkcr+QfRgJ3PW9wz3odRijLZjHEaRLTNbqw==",
       "dev": true,
       "license": "MIT",
+      "peer": true,
       "dependencies": {
         "@vitest/expect": "4.1.0",
         "@vitest/mocker": "4.1.0",
@@ -4076,6 +4086,7 @@
       "resolved": "https://registry.npmjs.org/yaml/-/yaml-2.8.2.tgz",
       "integrity": "sha512-mplynKqc1C2hTVYxd0PU2xQAc22TI1vShAYGksCCfxbn/dFwnHTNi1bvYsBTkhdUNtGIf5xNOg938rrSSYvS9A==",
       "license": "ISC",
+      "peer": true,
       "bin": {
         "yaml": "bin.mjs"
       },
@@ -4104,6 +4115,7 @@
       "resolved": "https://registry.npmjs.org/zod/-/zod-4.3.6.tgz",
       "integrity": "sha512-rftlrkhHZOcjDwkGlnUtZZkvaPHCsDATp4pGpuOOMDaTdDDXF91wuVDJoWoPsKX/3YPQ5fHuF3STjcYyKr+Qhg==",
       "license": "MIT",
+      "peer": true,
       "funding": {
         "url": "https://github.com/sponsors/colinhacks"
       }
diff --git a/packages/agent-os/extensions/vscode/src/extension.ts b/packages/agent-os/extensions/vscode/src/extension.ts
index c9e30bb9..4558d34f 100644
--- a/packages/agent-os/extensions/vscode/src/extension.ts
+++ b/packages/agent-os/extensions/vscode/src/extension.ts
@@ -259,7 +259,7 @@ if __name__ == "__main__":
 query = "SELECT * FROM users WHERE id = " + user_input
 
 # Test 2: Hardcoded Secret - WILL BE BLOCKED  
-api_key = "sk-1234567890abcdef1234567890abcdef"
+api_key = "sk-EXAMPLE-NOT-A-REAL-KEY-replace-with-your-own"
 
 # Test 3: Destructive Command - WILL BE BLOCKED
 import os
diff --git a/packages/agent-os/modules/atr/atr/tools/safe/calculator.py b/packages/agent-os/modules/atr/atr/tools/safe/calculator.py
index 80987dd1..3c508e0b 100644
--- a/packages/agent-os/modules/atr/atr/tools/safe/calculator.py
+++ b/packages/agent-os/modules/atr/atr/tools/safe/calculator.py
@@ -10,6 +10,7 @@
 - Timeout for complex calculations
 """
 
+import ast
 import math
 import operator
 import re
@@ -113,6 +114,80 @@ def __init__(
         self.max_value = max_value
         self.allow_complex = allow_complex
     
+    # AST operator mapping for safe evaluation
+    _AST_OPS = {
+        ast.Add: operator.add,
+        ast.Sub: operator.sub,
+        ast.Mult: operator.mul,
+        ast.Div: operator.truediv,
+        ast.FloorDiv: operator.floordiv,
+        ast.Mod: operator.mod,
+        ast.Pow: operator.pow,
+    }
+    
+    _AST_UNARY_OPS = {
+        ast.USub: operator.neg,
+        ast.UAdd: operator.pos,
+    }
+    
+    def _safe_eval_node(
+        self,
+        node: ast.AST,
+        namespace: Dict[str, Any],
+    ) -> Any:
+        """Recursively evaluate an AST node using only safe operations.
+        
+        No eval()/compile() — walks the AST tree and computes results
+        using whitelisted operators and functions only.
+        """
+        if isinstance(node, ast.Expression):
+            return self._safe_eval_node(node.body, namespace)
+        
+        if isinstance(node, ast.Constant):
+            if isinstance(node.value, (int, float)):
+                return node.value
+            raise ValueError(f"Unsupported constant type: {type(node.value).__name__}")
+        
+        if isinstance(node, ast.Name):
+            if node.id in namespace:
+                return namespace[node.id]
+            raise ValueError(f"Unknown variable: {node.id}")
+        
+        if isinstance(node, ast.BinOp):
+            left = self._safe_eval_node(node.left, namespace)
+            right = self._safe_eval_node(node.right, namespace)
+            op_func = self._AST_OPS.get(type(node.op))
+            if op_func is None:
+                raise ValueError(f"Unsupported operator: {type(node.op).__name__}")
+            return op_func(left, right)
+        
+        if isinstance(node, ast.UnaryOp):
+            operand = self._safe_eval_node(node.operand, namespace)
+            op_func = self._AST_UNARY_OPS.get(type(node.op))
+            if op_func is None:
+                raise ValueError(f"Unsupported unary operator: {type(node.op).__name__}")
+            return op_func(operand)
+        
+        if isinstance(node, ast.Call):
+            if not isinstance(node.func, ast.Name):
+                raise ValueError("Only direct function calls are allowed (no attribute access)")
+            func_name = node.func.id
+            if func_name not in self.FUNCTIONS:
+                raise ValueError(f"Function not allowed: {func_name}")
+            func = self.FUNCTIONS[func_name]
+            args = [self._safe_eval_node(arg, namespace) for arg in node.args]
+            if node.keywords:
+                raise ValueError("Keyword arguments are not supported in function calls")
+            return func(*args)
+        
+        if isinstance(node, ast.Tuple):
+            return tuple(self._safe_eval_node(elt, namespace) for elt in node.elts)
+        
+        if isinstance(node, ast.List):
+            return [self._safe_eval_node(elt, namespace) for elt in node.elts]
+        
+        raise ValueError(f"Unsupported expression type: {type(node).__name__}")
+    
     def _check_value(self, value: Union[int, float]) -> Union[int, float]:
         """Check value is within bounds."""
         if isinstance(value, complex) and not self.allow_complex:
@@ -174,8 +249,7 @@ def evaluate(
             namespace.update(self.FUNCTIONS)
             namespace.update(variables)
             
-            # Parse and evaluate using ast (safe)
-            import ast
+            # Parse and evaluate using safe AST walker
             
             # Replace ^ with ** for power
             clean_expr = clean_expr.replace('^', '**')
@@ -193,6 +267,12 @@ def evaluate(
                                 "error": f"Function not allowed: {node.func.id}",
                                 "result": None
                             }
+                    else:
+                        return {
+                            "success": False,
+                            "error": "Only direct function calls are allowed (no attribute access)",
+                            "result": None
+                        }
                 elif isinstance(node, ast.Name):
                     if node.id not in namespace:
                         return {
@@ -200,10 +280,15 @@ def evaluate(
                             "error": f"Unknown variable: {node.id}",
                             "result": None
                         }
+                elif isinstance(node, ast.Attribute):
+                    return {
+                        "success": False,
+                        "error": "Attribute access is not allowed",
+                        "result": None
+                    }
             
-            # Compile and evaluate
-            code = compile(tree, '<expression>', 'eval')
-            result = eval(code, {"__builtins__": {}}, namespace)
+            # Evaluate using safe AST walker (no eval/compile)
+            result = self._safe_eval_node(tree.body, namespace)
             
             # Check result
             result = self._check_value(result)
diff --git a/packages/agent-os/modules/control-plane/scripts/prepare_pypi.py b/packages/agent-os/modules/control-plane/scripts/prepare_pypi.py
index fe154fa1..50abb390 100644
--- a/packages/agent-os/modules/control-plane/scripts/prepare_pypi.py
+++ b/packages/agent-os/modules/control-plane/scripts/prepare_pypi.py
@@ -5,7 +5,7 @@
 Setup script for PyPI package preparation
 
 This script prepares the Agent Control Plane package for PyPI release.
-"""pip 
+"""
 
 import subprocess
 import sys
@@ -18,7 +18,6 @@ def run_command(cmd, description):
     try:
         result = subprocess.run(
             cmd,
-            shell=True,
             check=True,
             capture_output=True,
             text=True
diff --git a/packages/agent-os/modules/control-plane/scripts/prepare_release.py b/packages/agent-os/modules/control-plane/scripts/prepare_release.py
index 3ac4efe9..58420e2b 100644
--- a/packages/agent-os/modules/control-plane/scripts/prepare_release.py
+++ b/packages/agent-os/modules/control-plane/scripts/prepare_release.py
@@ -15,18 +15,26 @@
 """
 
 import argparse
+import glob as _glob
 import re
+import shutil
 import subprocess
 import sys
 from pathlib import Path
 
 
 def run_command(cmd, description, check=True):
-    """Run a shell command and handle errors"""
+    """Run a command and handle errors.
+
+    Args:
+        cmd: Command as a list of arguments (shell=False for safety).
+        description: Human-readable description for output.
+        check: If True, exit on non-zero return code.
+    """
     print(f"\n{'='*60}")
     print(f"📋 {description}")
     print(f"{'='*60}")
-    result = subprocess.run(cmd, shell=True, capture_output=True, text=True)
+    result = subprocess.run(cmd, capture_output=True, text=True)
     
     if result.stdout:
         print(result.stdout)
@@ -102,7 +110,7 @@ def main():
     if not args.skip_tests:
         print("\nStep 2: Running tests...")
         run_command(
-            "python -m unittest discover -s tests -p 'test_*.py' -v",
+            [sys.executable, "-m", "unittest", "discover", "-s", "tests", "-p", "test_*.py", "-v"],
             "Running test suite"
         )
     else:
@@ -111,20 +119,26 @@ def main():
     # Run linting
     print("\nStep 3: Running linting...")
     run_command(
-        "flake8 src/ --count --select=E9,F63,F7,F82 --show-source --statistics",
+        ["flake8", "src/", "--count", "--select=E9,F63,F7,F82", "--show-source", "--statistics"],
         "Linting code for critical errors",
         check=False  # Don't fail on linting errors
     )
     
     # Clean previous builds
     print("\nStep 4: Cleaning previous builds...")
-    run_command("rm -rf dist/ build/ *.egg-info", "Cleaning build artifacts")
+    for _d in [Path("dist"), Path("build")]:
+        if _d.exists():
+            shutil.rmtree(_d)
+    for _p in Path(".").glob("*.egg-info"):
+        shutil.rmtree(_p)
+    print("✅ Completed: Cleaning build artifacts")
     
     # Build package
     print("\nStep 5: Building package...")
-    run_command("pip install --upgrade build twine", "Installing build tools")
-    run_command("python -m build", "Building distribution packages")
-    run_command("twine check dist/*", "Checking package metadata")
+    run_command([sys.executable, "-m", "pip", "install", "--upgrade", "build", "twine"], "Installing build tools")
+    run_command([sys.executable, "-m", "build"], "Building distribution packages")
+    dist_files = _glob.glob("dist/*")
+    run_command(["twine", "check"] + dist_files, "Checking package metadata")
     
     # Create git tag
     if not args.dry_run:
@@ -133,8 +147,7 @@ def main():
         
         # Check if tag already exists
         result = subprocess.run(
-            f"git tag -l {tag_name}",
-            shell=True,
+            ["git", "tag", "-l", tag_name],
             capture_output=True,
             text=True
         )
@@ -143,7 +156,7 @@ def main():
             print(f"⚠️  Tag {tag_name} already exists. Skipping tag creation.")
         else:
             run_command(
-                f'git tag -a {tag_name} -m "Release version {version}"',
+                ["git", "tag", "-a", tag_name, "-m", f"Release version {version}"],
                 f"Creating git tag {tag_name}"
             )
             print(f"\n📌 Tag {tag_name} created successfully!")
diff --git a/packages/agent-os/modules/control-plane/src/agent_control_plane/agent_hibernation.py b/packages/agent-os/modules/control-plane/src/agent_control_plane/agent_hibernation.py
index 6198b995..36aef065 100644
--- a/packages/agent-os/modules/control-plane/src/agent_control_plane/agent_hibernation.py
+++ b/packages/agent-os/modules/control-plane/src/agent_control_plane/agent_hibernation.py
@@ -19,7 +19,6 @@
 from datetime import datetime, timedelta
 from enum import Enum
 import json
-import pickle
 import hmac
 import hashlib
 import os
@@ -197,12 +196,12 @@ def hibernate_agent(
             if self.config.format == HibernationFormat.JSON:
                 with open(file_path, 'w') as f:
                     json.dump(state, f, indent=2)
-            else:  # PICKLE — write data + HMAC signature
-                raw = pickle.dumps(state)
+            else:  # PICKLE format — now uses JSON internally + HMAC signature
+                raw = json.dumps(state).encode('utf-8')
                 sig = hmac.new(self._hmac_key, raw, hashlib.sha256).hexdigest()
                 with open(file_path, 'wb') as f:
                     f.write(raw)
-                with open(file_path + ".sig", 'w') as f:
+                with open(file_path + ".sig", 'w', encoding='utf-8') as f:
                     f.write(sig)
             
             # Get file size
@@ -258,7 +257,7 @@ def wake_agent(self, agent_id: str) -> Dict[str, Any]:
             if metadata.format == HibernationFormat.JSON:
                 with open(metadata.state_file_path, 'r') as f:
                     state = json.load(f)
-            else:  # PICKLE — verify HMAC before deserializing
+            else:  # PICKLE format — now uses JSON internally; verify HMAC before deserializing
                 sig_path = metadata.state_file_path + ".sig"
                 if not os.path.exists(sig_path):
                     raise ValueError(
@@ -267,7 +266,7 @@ def wake_agent(self, agent_id: str) -> Dict[str, Any]:
                     )
                 with open(metadata.state_file_path, 'rb') as f:
                     raw = f.read()
-                with open(sig_path, 'r') as f:
+                with open(sig_path, 'r', encoding='utf-8') as f:
                     expected_sig = f.read().strip()
                 actual_sig = hmac.new(self._hmac_key, raw, hashlib.sha256).hexdigest()
                 if not hmac.compare_digest(actual_sig, expected_sig):
@@ -275,7 +274,7 @@ def wake_agent(self, agent_id: str) -> Dict[str, Any]:
                         f"HMAC verification failed for {metadata.state_file_path} — "
                         "state file has been tampered with"
                     )
-                state = pickle.loads(raw)
+                state = json.loads(raw.decode('utf-8'))
             
             # Deserialize state
             restored_state = self.deserialize_agent_state(state)
diff --git a/packages/agent-os/modules/control-plane/src/agent_control_plane/policy_engine.py b/packages/agent-os/modules/control-plane/src/agent_control_plane/policy_engine.py
index 5487b6b6..cc44ae2a 100644
--- a/packages/agent-os/modules/control-plane/src/agent_control_plane/policy_engine.py
+++ b/packages/agent-os/modules/control-plane/src/agent_control_plane/policy_engine.py
@@ -22,11 +22,15 @@
 from typing import Dict, List, Optional, Callable, Any, Tuple
 from dataclasses import dataclass, field
 from datetime import datetime, timedelta
+from types import MappingProxyType  # noqa: F401 — reserved for future immutable dict enforcement
 from .agent_kernel import ExecutionRequest, ActionType, PolicyRule
+import logging
 import uuid
 import os
 import re
 
+logger = logging.getLogger(__name__)
+
 
 @dataclass
 class Condition:
@@ -217,6 +221,79 @@ def __init__(self):
             "C:\\Windows\\System32",
         ]
 
+        # Immutability controls — call freeze() after initial configuration
+        self._frozen: bool = False
+        self._mutation_log: List[Dict[str, Any]] = []
+
+    # ── Immutability ────────────────────────────────────────────
+
+    def freeze(self) -> None:
+        """Freeze the policy engine, preventing further mutations.
+
+        After calling ``freeze()``, any attempt to call ``add_constraint()``,
+        ``set_agent_context()``, ``update_agent_context()``, or
+        ``add_conditional_permission()`` will raise ``RuntimeError``.
+
+        In addition to the boolean guard, the underlying data structures
+        are replaced with immutable proxies (``MappingProxyType``) so that
+        direct attribute access (bypassing the setter methods) will also
+        raise ``TypeError``.
+
+        This addresses the self-modification attack vector where an agent
+        could call mutation methods to weaken its own policy at runtime.
+        """
+        self._frozen = True
+        # Replace mutable dicts with read-only proxies to harden against
+        # direct attribute manipulation (e.g. engine.state_permissions["x"] = ...)
+        self.state_permissions = MappingProxyType(
+            {k: frozenset(v) for k, v in self.state_permissions.items()}
+        )
+        self.agent_contexts = MappingProxyType(
+            {k: MappingProxyType(v) if isinstance(v, dict) else v
+             for k, v in self.agent_contexts.items()}
+        )
+        self.conditional_permissions = MappingProxyType(
+            {k: tuple(v) for k, v in self.conditional_permissions.items()}
+        )
+        self._log_mutation("freeze", {})
+        logger.info("PolicyEngine frozen — data structures converted to immutable proxies")
+
+    @property
+    def is_frozen(self) -> bool:
+        """Whether the policy engine is currently frozen."""
+        return self._frozen
+
+    @property
+    def mutation_log(self) -> List[Dict[str, Any]]:
+        """Read-only copy of the mutation audit trail."""
+        return list(self._mutation_log)
+
+    def _assert_mutable(self, operation: str) -> None:
+        """Raise RuntimeError if the engine is frozen."""
+        if self._frozen:
+            violation = {
+                "operation": operation,
+                "timestamp": datetime.now().isoformat(),
+                "blocked": True,
+            }
+            self._mutation_log.append(violation)
+            logger.warning(
+                "Blocked mutation '%s' on frozen PolicyEngine", operation
+            )
+            raise RuntimeError(
+                f"PolicyEngine is frozen — cannot perform '{operation}'. "
+                "Call freeze() is irreversible to prevent runtime self-modification."
+            )
+
+    def _log_mutation(self, operation: str, details: Dict[str, Any]) -> None:
+        """Record a mutation in the audit log."""
+        self._mutation_log.append({
+            "operation": operation,
+            "details": details,
+            "timestamp": datetime.now().isoformat(),
+            "blocked": False,
+        })
+
     def set_quota(self, agent_id: str, quota: ResourceQuota):
         """Set resource quota for an agent"""
         self.quotas[agent_id] = quota
@@ -240,8 +317,13 @@ def add_constraint(self, role: str, allowed_tools: List[str]):
         Args:
             role: The agent role/ID
             allowed_tools: List of tool names this role can use
+
+        Raises:
+            RuntimeError: If the engine has been frozen.
         """
+        self._assert_mutable("add_constraint")
         self.state_permissions[role] = set(allowed_tools)
+        self._log_mutation("add_constraint", {"role": role, "tools": allowed_tools})
 
     def add_conditional_permission(self, agent_role: str, permission: ConditionalPermission):
         """
@@ -253,7 +335,12 @@ def add_conditional_permission(self, agent_role: str, permission: ConditionalPer
         Args:
             agent_role: The agent role/ID
             permission: The conditional permission to add
+
+        Raises:
+            RuntimeError: If the engine has been frozen.
         """
+        self._assert_mutable("add_conditional_permission")
+
         if agent_role not in self.conditional_permissions:
             self.conditional_permissions[agent_role] = []
 
@@ -264,6 +351,10 @@ def add_conditional_permission(self, agent_role: str, permission: ConditionalPer
         if agent_role not in self.state_permissions:
             self.state_permissions[agent_role] = set()
         self.state_permissions[agent_role].add(permission.tool_name)
+        self._log_mutation(
+            "add_conditional_permission",
+            {"role": agent_role, "tool": permission.tool_name},
+        )
 
     def set_agent_context(self, agent_role: str, context: Dict[str, Any]):
         """
@@ -272,8 +363,13 @@ def set_agent_context(self, agent_role: str, context: Dict[str, Any]):
         Args:
             agent_role: The agent role/ID
             context: Dictionary of context attributes (e.g., {"user_status": "verified", "time_of_day": "business_hours"})
+
+        Raises:
+            RuntimeError: If the engine has been frozen.
         """
+        self._assert_mutable("set_agent_context")
         self.agent_contexts[agent_role] = context
+        self._log_mutation("set_agent_context", {"role": agent_role})
 
     def update_agent_context(self, agent_role: str, updates: Dict[str, Any]):
         """
@@ -282,11 +378,20 @@ def update_agent_context(self, agent_role: str, updates: Dict[str, Any]):
         Args:
             agent_role: The agent role/ID
             updates: Dictionary of attributes to update
+
+        Raises:
+            RuntimeError: If the engine has been frozen.
         """
+        self._assert_mutable("update_agent_context")
+
         if agent_role not in self.agent_contexts:
             self.agent_contexts[agent_role] = {}
 
         self.agent_contexts[agent_role].update(updates)
+        self._log_mutation(
+            "update_agent_context",
+            {"role": agent_role, "keys": list(updates.keys())},
+        )
 
     def is_shadow_mode(self, agent_role: str) -> bool:
         """
diff --git a/packages/agent-os/modules/control-plane/src/agent_control_plane/process_isolation.py b/packages/agent-os/modules/control-plane/src/agent_control_plane/process_isolation.py
index 9e097a03..eda70381 100644
--- a/packages/agent-os/modules/control-plane/src/agent_control_plane/process_isolation.py
+++ b/packages/agent-os/modules/control-plane/src/agent_control_plane/process_isolation.py
@@ -45,7 +45,6 @@
 import logging
 import multiprocessing
 import os
-import pickle
 import signal as _signal
 import subprocess
 import sys
@@ -143,10 +142,12 @@ def _agent_worker(
 
 
 # Bootstrap script executed inside a ``subprocess.Popen`` child.
-# The parent sends: base64(hmac_key + b"|" + hmac_sig + b"|" + pickle_payload)
+# The parent sends: base64(hmac_key + b"|" + hmac_sig + b"|" + json_payload)
 # The child verifies the HMAC before deserializing.
+# The JSON payload contains {"module": "...", "qualname": "...", "args": [...], "kwargs": {...}}
+# and the target function is resolved via importlib, avoiding pickle deserialization.
 _SUBPROCESS_BOOTSTRAP = """\
-import base64, hashlib, hmac, json, pickle, sys, time
+import base64, hashlib, hmac, importlib, json, sys, time
 raw = base64.b64decode(sys.stdin.buffer.read())
 parts = raw.split(b"|", 2)
 if len(parts) != 3:
@@ -157,7 +158,14 @@ def _agent_worker(
 if not hmac.compare_digest(_actual_sig, _expected_sig):
     json.dump({"state": "failed", "error": "HMAC verification failed — payload tampered", "exit_code": 1, "duration": 0}, sys.stdout)
     sys.exit(1)
-target, args, kwargs = pickle.loads(_payload)
+_data = json.loads(_payload)
+_mod = importlib.import_module(_data["module"])
+_obj = _mod
+for _attr in _data["qualname"].split("."):
+    _obj = getattr(_obj, _attr)
+target = _obj
+args = tuple(_data.get("args", ()))
+kwargs = _data.get("kwargs", {})
 _start = time.monotonic()
 try:
     _rv = target(*args, **kwargs)
@@ -673,7 +681,19 @@ def _spawn_subprocess(
         args: tuple,
         kwargs: Optional[dict],
     ) -> AgentProcessHandle:
-        payload = pickle.dumps((target, args, kwargs or {}))
+        # Validate target is an importable function (not a lambda/closure)
+        if not hasattr(target, '__module__') or not hasattr(target, '__qualname__'):
+            raise ValueError(
+                f"Target callable {target!r} must be a module-level function "
+                "with __module__ and __qualname__ for subprocess isolation"
+            )
+        # Serialize as JSON with function reference instead of pickling callables
+        payload = json.dumps({
+            "module": target.__module__,
+            "qualname": target.__qualname__,
+            "args": list(args),
+            "kwargs": kwargs or {},
+        }).encode('utf-8')
         # Sign payload with HMAC to prevent tampering
         hmac_key = os.urandom(32)
         sig = hmac.new(hmac_key, payload, hashlib.sha256).digest()
diff --git a/packages/agent-os/modules/control-plane/src/agent_control_plane/tool_registry.py b/packages/agent-os/modules/control-plane/src/agent_control_plane/tool_registry.py
index ae0d5c96..184e5a39 100644
--- a/packages/agent-os/modules/control-plane/src/agent_control_plane/tool_registry.py
+++ b/packages/agent-os/modules/control-plane/src/agent_control_plane/tool_registry.py
@@ -20,8 +20,13 @@
 from dataclasses import dataclass, field
 from enum import Enum
 from datetime import datetime
-import uuid
+import hashlib
 import inspect
+import logging
+import textwrap
+import uuid
+
+logger = logging.getLogger(__name__)
 
 
 class ToolType(Enum):
@@ -61,6 +66,8 @@ class Tool:
         parameter_schema: JSON schema for parameters
         requires_approval: Whether tool execution requires human approval
         risk_level: Risk score (0.0-1.0, higher = more risky)
+        content_hash: SHA-256 hash of the tool handler's source code at
+            registration time.  Used to detect tampering or aliasing.
         metadata: Additional tool metadata
     """
     tool_id: str
@@ -71,6 +78,7 @@ class Tool:
     parameter_schema: ToolSchema
     requires_approval: bool = False
     risk_level: float = 0.0
+    content_hash: str = ""
     metadata: Dict[str, Any] = field(default_factory=dict)
     created_at: datetime = field(default_factory=datetime.now)
 
@@ -109,6 +117,26 @@ def __init__(self):
         self._tools: Dict[str, Tool] = {}
         self._tools_by_type: Dict[ToolType, Set[str]] = {}
         self._tools_by_name: Dict[str, str] = {}  # name -> tool_id mapping
+        self._integrity_violations: List[Dict[str, Any]] = []
+
+    @staticmethod
+    def _compute_handler_hash(handler: Callable) -> str:
+        """Compute a SHA-256 content hash of a callable's source code.
+
+        Returns an empty string if source is unavailable (e.g. built-in
+        or C-extension functions).  Callers should treat an empty hash
+        as "unverifiable" rather than silently trusting the handler.
+        """
+        try:
+            source = textwrap.dedent(inspect.getsource(handler))
+            return hashlib.sha256(source.encode("utf-8")).hexdigest()
+        except (OSError, TypeError):
+            logger.warning(
+                "Cannot compute source hash for handler %r — "
+                "source unavailable (built-in or C-extension)",
+                getattr(handler, "__qualname__", handler),
+            )
+        return ""
         
     def register_tool(
         self,
@@ -149,6 +177,9 @@ def register_tool(
         if parameter_schema is None:
             parameter_schema = self._generate_schema_from_handler(handler)
         
+        # Compute content hash for integrity verification
+        content_hash = self._compute_handler_hash(handler)
+        
         tool = Tool(
             tool_id=tool_id,
             name=name,
@@ -158,6 +189,7 @@ def register_tool(
             parameter_schema=parameter_schema,
             requires_approval=requires_approval,
             risk_level=risk_level,
+            content_hash=content_hash,
             metadata=metadata or {}
         )
         
@@ -230,6 +262,27 @@ def execute_tool(
                 "error": f"Tool '{tool_id_or_name}' not found"
             }
         
+        # Verify tool integrity before execution
+        integrity = self.verify_tool_integrity(tool.tool_id)
+        if not integrity["verified"]:
+            logger.warning(
+                "Tool integrity check FAILED for '%s': %s",
+                tool.name,
+                integrity["reason"],
+            )
+            self._integrity_violations.append({
+                "tool_id": tool.tool_id,
+                "tool_name": tool.name,
+                "reason": integrity["reason"],
+                "timestamp": datetime.now().isoformat(),
+            })
+            return {
+                "success": False,
+                "error": f"Tool integrity verification failed: {integrity['reason']}",
+                "tool_id": tool.tool_id,
+                "tool_name": tool.name,
+            }
+        
         # Validate parameters against schema
         validation_result = self.validate_parameters(tool.tool_id, parameters)
         if not validation_result["valid"]:
@@ -305,6 +358,53 @@ def search_tools(self, query: str) -> List[Tool]:
         
         return matches
     
+    def verify_tool_integrity(self, tool_id_or_name: str) -> Dict[str, Any]:
+        """Verify that a tool's handler has not been modified since registration.
+
+        Compares the current SHA-256 hash of the handler's source code
+        against the hash recorded at registration time.
+
+        Returns:
+            {"verified": bool, "reason": str, "registered_hash": str, "current_hash": str}
+        """
+        tool = self.get_tool(tool_id_or_name)
+        if not tool:
+            return {
+                "verified": False,
+                "reason": "Tool not found",
+                "registered_hash": "",
+                "current_hash": "",
+            }
+
+        if not tool.content_hash:
+            return {
+                "verified": False,
+                "reason": "No content hash recorded at registration (built-in or C-extension)",
+                "registered_hash": "",
+                "current_hash": "",
+            }
+
+        current_hash = self._compute_handler_hash(tool.handler)
+        if not current_hash:
+            return {
+                "verified": False,
+                "reason": "Cannot compute current hash — source unavailable",
+                "registered_hash": tool.content_hash,
+                "current_hash": "",
+            }
+
+        verified = current_hash == tool.content_hash
+        return {
+            "verified": verified,
+            "reason": "" if verified else "Handler source has been modified since registration",
+            "registered_hash": tool.content_hash,
+            "current_hash": current_hash,
+        }
+
+    def get_integrity_violations(self) -> List[Dict[str, Any]]:
+        """Return all recorded integrity violations."""
+        return list(self._integrity_violations)
+    
     def _resolve_tool_id(self, tool_id_or_name: str) -> Optional[str]:
         """Resolve a tool name to its ID, or return ID if already an ID"""
         if tool_id_or_name in self._tools:
diff --git a/packages/agent-os/src/agent_os/integrations/__init__.py b/packages/agent-os/src/agent_os/integrations/__init__.py
index 925bb29d..218b9991 100644
--- a/packages/agent-os/src/agent_os/integrations/__init__.py
+++ b/packages/agent-os/src/agent_os/integrations/__init__.py
@@ -96,6 +96,7 @@
     BaseIntegration,
     BoundedSemaphore,
     CompositeInterceptor,
+    ContentHashInterceptor,
     DriftResult,
     GovernancePolicy,
     PolicyInterceptor,
@@ -124,6 +125,7 @@
     EscalationRequest,
     EscalationResult,
     InMemoryApprovalQueue,
+    QuorumConfig,
     WebhookApprovalBackend,
 )
 from .compat import CompatReport, check_compatibility, doctor, warn_on_import
diff --git a/packages/agent-os/src/agent_os/integrations/base.py b/packages/agent-os/src/agent_os/integrations/base.py
index 7d264e3b..fb7dfab7 100644
--- a/packages/agent-os/src/agent_os/integrations/base.py
+++ b/packages/agent-os/src/agent_os/integrations/base.py
@@ -711,6 +711,77 @@ def intercept(self, request: ToolCallRequest) -> ToolCallResult:
         return ToolCallResult(allowed=True)
 
 
+class ContentHashInterceptor:
+    """Interceptor that verifies tool identity via content hashing.
+
+    Instead of relying solely on tool *names* (which can be aliased),
+    this interceptor checks that the callable behind a tool name has the
+    same SHA-256 source hash that was recorded when the tool was
+    registered.  This defeats tool-wrapping and aliasing attacks
+    described in the Ona/Veto agent sandbox escape research.
+
+    Requires a ``tool_registry`` that stores content hashes (see
+    :class:`~agent_control_plane.tool_registry.ToolRegistry`).
+
+    Args:
+        tool_hashes: Mapping of tool name → expected SHA-256 hex digest.
+        strict: If ``True`` (default), block tools with no registered
+            hash.  If ``False``, allow unknown tools with a warning.
+    """
+
+    def __init__(
+        self,
+        tool_hashes: dict[str, str] | None = None,
+        strict: bool = True,
+    ) -> None:
+        self._tool_hashes: dict[str, str] = dict(tool_hashes or {})
+        self._strict = strict
+
+    def register_hash(self, tool_name: str, content_hash: str) -> None:
+        """Record the expected content hash for a tool."""
+        self._tool_hashes[tool_name] = content_hash
+
+    def intercept(self, request: ToolCallRequest) -> ToolCallResult:
+        expected = self._tool_hashes.get(request.tool_name)
+        if expected is None:
+            if self._strict:
+                return ToolCallResult(
+                    allowed=False,
+                    reason=(
+                        f"Tool '{request.tool_name}' has no registered content hash "
+                        "(possible alias or wrapper)"
+                    ),
+                )
+            logger.warning(
+                "No content hash for tool '%s' — allowing in non-strict mode",
+                request.tool_name,
+            )
+            return ToolCallResult(allowed=True)
+
+        # Verify the hash carried in request metadata (set by the framework adapter)
+        actual = request.metadata.get("content_hash", "")
+        if not actual:
+            return ToolCallResult(
+                allowed=False,
+                reason=(
+                    f"Tool '{request.tool_name}' call is missing content_hash metadata "
+                    "— cannot verify integrity"
+                ),
+            )
+
+        if actual != expected:
+            return ToolCallResult(
+                allowed=False,
+                reason=(
+                    f"Tool '{request.tool_name}' content hash mismatch: "
+                    f"expected {expected[:12]}… got {actual[:12]}… "
+                    "(possible tampering or wrapper)"
+                ),
+            )
+
+        return ToolCallResult(allowed=True)
+
+
 class CompositeInterceptor:
     """Chain multiple interceptors. All must allow for the call to proceed."""
 
diff --git a/packages/agent-os/src/agent_os/integrations/escalation.py b/packages/agent-os/src/agent_os/integrations/escalation.py
index 3f16c0ec..f46b7b72 100644
--- a/packages/agent-os/src/agent_os/integrations/escalation.py
+++ b/packages/agent-os/src/agent_os/integrations/escalation.py
@@ -36,7 +36,7 @@
 import threading
 import uuid
 from dataclasses import dataclass, field
-from datetime import datetime, timezone
+from datetime import datetime, timedelta, timezone
 from enum import Enum
 from typing import Any, Callable, Optional
 
@@ -62,6 +62,32 @@ class DefaultTimeoutAction(Enum):
     ALLOW = "allow"
 
 
+@dataclass
+class QuorumConfig:
+    """Configuration for M-of-N approval quorum.
+
+    When set, an escalation requires at least ``required_approvals``
+    ALLOW votes from distinct approvers before the action is permitted.
+    A single DENY from any approver is enough to deny immediately
+    unless ``required_denials`` is set.
+
+    Attributes:
+        required_approvals: Minimum ALLOW votes needed (M).
+        total_approvers: Total approver pool size (N).  Informational.
+        required_denials: Number of DENY votes to reject (default 1).
+    """
+
+    required_approvals: int = 2
+    total_approvers: int = 3
+    required_denials: int = 1
+
+    def __post_init__(self) -> None:
+        if self.required_approvals < 1:
+            raise ValueError("required_approvals must be >= 1")
+        if self.required_denials < 1:
+            raise ValueError("required_denials must be >= 1")
+
+
 @dataclass
 class EscalationRequest:
     """A request for human approval of an agent action.
@@ -87,6 +113,8 @@ class EscalationRequest:
     resolved_at: Optional[datetime] = None
     decision: EscalationDecision = EscalationDecision.PENDING
     resolved_by: Optional[str] = None
+    # Quorum tracking: list of (approver, decision, timestamp) votes
+    votes: list[tuple[str, str, datetime]] = field(default_factory=list)
 
 
 class ApprovalBackend(abc.ABC):
@@ -263,6 +291,14 @@ class EscalationHandler:
         timeout_seconds: How long to wait for a human decision.
         default_action: What to do if the timeout expires.
         on_escalate: Optional callback fired when an escalation is created.
+        quorum: Optional quorum configuration for M-of-N approval.
+            When set, approvals/denials are counted against quorum
+            thresholds before a final decision is reached.
+        fatigue_window_seconds: Rolling window (in seconds) for fatigue
+            detection.  Defaults to 60 (one minute).
+        fatigue_threshold: Maximum number of escalations per agent within
+            the fatigue window.  If exceeded, new escalations are
+            auto-denied.  ``None`` disables fatigue detection.
     """
 
     def __init__(
@@ -271,11 +307,37 @@ def __init__(
         timeout_seconds: float = 300,
         default_action: DefaultTimeoutAction = DefaultTimeoutAction.DENY,
         on_escalate: Callable[[EscalationRequest], None] | None = None,
+        quorum: QuorumConfig | None = None,
+        fatigue_window_seconds: float = 60.0,
+        fatigue_threshold: int | None = None,
     ) -> None:
         self.backend = backend or InMemoryApprovalQueue()
         self.timeout_seconds = timeout_seconds
         self.default_action = default_action
         self._on_escalate = on_escalate
+        self.quorum = quorum
+        self._fatigue_window = fatigue_window_seconds
+        self._fatigue_threshold = fatigue_threshold
+        # Per-agent escalation timestamps for fatigue detection
+        self._escalation_times: dict[str, list[datetime]] = {}
+
+    def _check_fatigue(self, agent_id: str) -> bool:
+        """Return True if the agent is triggering escalations too rapidly.
+
+        When fatigue detection is enabled, auto-DENY prevents an agent
+        from overwhelming human reviewers with a flood of requests (the
+        approval-fatigue attack described in Ona/Veto research).
+        """
+        if self._fatigue_threshold is None:
+            return False
+
+        now = datetime.now(timezone.utc)
+        cutoff = now - timedelta(seconds=self._fatigue_window)
+        times = self._escalation_times.get(agent_id, [])
+        # Prune old timestamps
+        recent = [t for t in times if t > cutoff]
+        self._escalation_times[agent_id] = recent
+        return len(recent) >= self._fatigue_threshold
 
     def escalate(
         self,
@@ -286,9 +348,36 @@ def escalate(
     ) -> EscalationRequest:
         """Create and submit an escalation request.
 
+        If fatigue detection is enabled and the agent has exceeded the
+        threshold, the request is immediately auto-denied.
+
         Returns:
-            The ``EscalationRequest`` in PENDING state.
+            The ``EscalationRequest`` — PENDING normally, DENY if fatigued.
         """
+        # Fatigue check
+        if self._check_fatigue(agent_id):
+            logger.warning(
+                "Escalation fatigue: agent %s exceeded %d escalations in %.0fs — auto-DENY",
+                agent_id,
+                self._fatigue_threshold,
+                self._fatigue_window,
+            )
+            request = EscalationRequest(
+                agent_id=agent_id,
+                action=action,
+                reason=f"Auto-denied: escalation fatigue ({reason})",
+                context_snapshot=context_snapshot or {},
+                decision=EscalationDecision.DENY,
+                resolved_at=datetime.now(timezone.utc),
+                resolved_by="system:fatigue_detector",
+            )
+            return request
+
+        # Record timestamp for fatigue tracking
+        self._escalation_times.setdefault(agent_id, []).append(
+            datetime.now(timezone.utc)
+        )
+
         request = EscalationRequest(
             agent_id=agent_id,
             action=action,
@@ -312,6 +401,9 @@ def resolve(self, request_id: str) -> EscalationDecision:
         For ``InMemoryApprovalQueue``, this blocks up to ``timeout_seconds``.
         For other backends, this polls once and returns the current state.
 
+        When quorum is configured, the decision is evaluated against
+        quorum thresholds instead of accepting a single vote.
+
         Returns:
             The final decision. If the timeout expires, applies the
             ``default_action`` and returns that.
@@ -324,6 +416,20 @@ def resolve(self, request_id: str) -> EscalationDecision:
             req = self.backend.get_decision(request_id)
             decision = req.decision if req else EscalationDecision.PENDING
 
+        # Quorum evaluation
+        if self.quorum and decision != EscalationDecision.PENDING:
+            req = self.backend.get_decision(request_id)
+            if req:
+                approvals = sum(1 for _, v, _ in req.votes if v == "ALLOW")
+                denials = sum(1 for _, v, _ in req.votes if v == "DENY")
+
+                if denials >= self.quorum.required_denials:
+                    return EscalationDecision.DENY
+                if approvals >= self.quorum.required_approvals:
+                    return EscalationDecision.ALLOW
+                # Not enough votes yet — treat as pending/timeout
+                decision = EscalationDecision.PENDING
+
         if decision == EscalationDecision.PENDING:
             # Timeout — apply default
             decision = (
diff --git a/packages/agent-os/tests/test_security_hardening.py b/packages/agent-os/tests/test_security_hardening.py
new file mode 100644
index 00000000..c6a628d5
--- /dev/null
+++ b/packages/agent-os/tests/test_security_hardening.py
@@ -0,0 +1,517 @@
+# Copyright (c) Microsoft Corporation.
+# Licensed under the MIT License.
+"""Tests for Ona/Veto security gap hardening features.
+
+Covers:
+  1. Tool content hashing and integrity verification (ToolRegistry)
+  2. PolicyEngine freeze / immutability
+  3. Approval quorum (M-of-N) and fatigue detection (EscalationHandler)
+"""
+
+import time
+
+import pytest
+
+from agent_os.integrations.base import (
+    ContentHashInterceptor,
+    GovernancePolicy,
+    PolicyInterceptor,
+    ToolCallRequest,
+    ToolCallResult,
+)
+from agent_os.integrations.escalation import (
+    DefaultTimeoutAction,
+    EscalationDecision,
+    EscalationHandler,
+    InMemoryApprovalQueue,
+    QuorumConfig,
+)
+
+
+# ── Helpers ─────────────────────────────────────────────────────
+
+
+def _sample_tool(query: str) -> str:
+    """A simple search tool for testing."""
+    return f"results for {query}"
+
+
+def _another_tool(x: int) -> int:
+    """Another tool with a different implementation."""
+    return x * 2
+
+
+# ══════════════════════════════════════════════════════════════════
+# 1. CONTENT HASH INTERCEPTOR
+# ══════════════════════════════════════════════════════════════════
+
+
+class TestContentHashInterceptor:
+    """Tests for the ContentHashInterceptor."""
+
+    def test_allow_when_hash_matches(self):
+        interceptor = ContentHashInterceptor(
+            tool_hashes={"search": "abc123"},
+            strict=True,
+        )
+        request = ToolCallRequest(
+            tool_name="search",
+            arguments={"q": "test"},
+            metadata={"content_hash": "abc123"},
+        )
+        result = interceptor.intercept(request)
+        assert result.allowed is True
+
+    def test_deny_when_hash_mismatch(self):
+        interceptor = ContentHashInterceptor(
+            tool_hashes={"search": "abc123"},
+            strict=True,
+        )
+        request = ToolCallRequest(
+            tool_name="search",
+            arguments={"q": "test"},
+            metadata={"content_hash": "TAMPERED"},
+        )
+        result = interceptor.intercept(request)
+        assert result.allowed is False
+        assert "mismatch" in result.reason
+
+    def test_deny_when_no_hash_in_metadata(self):
+        interceptor = ContentHashInterceptor(
+            tool_hashes={"search": "abc123"},
+            strict=True,
+        )
+        request = ToolCallRequest(
+            tool_name="search",
+            arguments={"q": "test"},
+            metadata={},
+        )
+        result = interceptor.intercept(request)
+        assert result.allowed is False
+        assert "missing content_hash" in result.reason
+
+    def test_strict_denies_unknown_tool(self):
+        interceptor = ContentHashInterceptor(
+            tool_hashes={"search": "abc123"},
+            strict=True,
+        )
+        request = ToolCallRequest(
+            tool_name="unknown_wrapper",
+            arguments={},
+            metadata={"content_hash": "anything"},
+        )
+        result = interceptor.intercept(request)
+        assert result.allowed is False
+        assert "no registered content hash" in result.reason
+
+    def test_nonstrict_allows_unknown_tool(self):
+        interceptor = ContentHashInterceptor(
+            tool_hashes={"search": "abc123"},
+            strict=False,
+        )
+        request = ToolCallRequest(
+            tool_name="unknown_wrapper",
+            arguments={},
+            metadata={},
+        )
+        result = interceptor.intercept(request)
+        assert result.allowed is True
+
+    def test_register_hash_dynamically(self):
+        interceptor = ContentHashInterceptor(strict=True)
+        interceptor.register_hash("my_tool", "hash_value")
+        request = ToolCallRequest(
+            tool_name="my_tool",
+            arguments={},
+            metadata={"content_hash": "hash_value"},
+        )
+        result = interceptor.intercept(request)
+        assert result.allowed is True
+
+
+# ══════════════════════════════════════════════════════════════════
+# 2. TOOL REGISTRY CONTENT HASHING
+# ══════════════════════════════════════════════════════════════════
+
+
+class TestToolRegistryContentHash:
+    """Tests for content hashing in ToolRegistry."""
+
+    def _make_registry(self):
+        from agent_control_plane.tool_registry import ToolRegistry, ToolType
+        return ToolRegistry, ToolType
+
+    def test_register_tool_stores_content_hash(self):
+        ToolRegistry, ToolType = self._make_registry()
+        registry = ToolRegistry()
+        tool_id = registry.register_tool(
+            name="search",
+            description="Search tool",
+            tool_type=ToolType.SEARCH,
+            handler=_sample_tool,
+        )
+        tool = registry.get_tool(tool_id)
+        assert tool.content_hash != ""
+        assert len(tool.content_hash) == 64  # SHA-256 hex
+
+    def test_verify_integrity_passes_for_unmodified_tool(self):
+        ToolRegistry, ToolType = self._make_registry()
+        registry = ToolRegistry()
+        tool_id = registry.register_tool(
+            name="search",
+            description="Search tool",
+            tool_type=ToolType.SEARCH,
+            handler=_sample_tool,
+        )
+        result = registry.verify_tool_integrity(tool_id)
+        assert result["verified"] is True
+        assert result["reason"] == ""
+
+    def test_verify_integrity_by_name(self):
+        ToolRegistry, ToolType = self._make_registry()
+        registry = ToolRegistry()
+        registry.register_tool(
+            name="search",
+            description="Search tool",
+            tool_type=ToolType.SEARCH,
+            handler=_sample_tool,
+        )
+        result = registry.verify_tool_integrity("search")
+        assert result["verified"] is True
+
+    def test_verify_integrity_nonexistent_tool(self):
+        ToolRegistry, ToolType = self._make_registry()
+        registry = ToolRegistry()
+        result = registry.verify_tool_integrity("nonexistent")
+        assert result["verified"] is False
+        assert "not found" in result["reason"]
+
+    def test_different_handlers_have_different_hashes(self):
+        ToolRegistry, ToolType = self._make_registry()
+        registry = ToolRegistry()
+        id1 = registry.register_tool(
+            name="tool_a",
+            description="A",
+            tool_type=ToolType.SEARCH,
+            handler=_sample_tool,
+        )
+        id2 = registry.register_tool(
+            name="tool_b",
+            description="B",
+            tool_type=ToolType.CUSTOM,
+            handler=_another_tool,
+        )
+        t1 = registry.get_tool(id1)
+        t2 = registry.get_tool(id2)
+        assert t1.content_hash != t2.content_hash
+
+    def test_execute_tool_blocks_on_integrity_failure(self):
+        ToolRegistry, ToolType = self._make_registry()
+        registry = ToolRegistry()
+        tool_id = registry.register_tool(
+            name="search",
+            description="Search tool",
+            tool_type=ToolType.SEARCH,
+            handler=_sample_tool,
+        )
+        # Tamper: overwrite the stored hash
+        tool = registry.get_tool(tool_id)
+        tool.content_hash = "tampered_hash"
+        result = registry.execute_tool("search", {"query": "test"})
+        assert result["success"] is False
+        assert "integrity" in result["error"].lower()
+
+    def test_integrity_violations_logged(self):
+        ToolRegistry, ToolType = self._make_registry()
+        registry = ToolRegistry()
+        tool_id = registry.register_tool(
+            name="search",
+            description="Search",
+            tool_type=ToolType.SEARCH,
+            handler=_sample_tool,
+        )
+        tool = registry.get_tool(tool_id)
+        tool.content_hash = "bad_hash"
+        registry.execute_tool("search", {"query": "x"})
+        violations = registry.get_integrity_violations()
+        assert len(violations) == 1
+        assert violations[0]["tool_name"] == "search"
+
+
+# ══════════════════════════════════════════════════════════════════
+# 3. POLICY ENGINE FREEZE / IMMUTABILITY
+# ══════════════════════════════════════════════════════════════════
+
+
+class TestPolicyEngineFreeze:
+    """Tests for PolicyEngine freeze() immutability."""
+
+    def _make_engine(self):
+        import sys
+        import os
+        cp_path = os.path.join(
+            os.path.dirname(__file__),
+            "..", "modules", "control-plane", "src",
+        )
+        if cp_path not in sys.path:
+            sys.path.insert(0, os.path.abspath(cp_path))
+        from agent_control_plane.policy_engine import PolicyEngine
+        return PolicyEngine()
+
+    def test_add_constraint_before_freeze(self):
+        engine = self._make_engine()
+        engine.add_constraint("finance", ["read", "calculate"])
+        assert "finance" in engine.state_permissions
+
+    def test_freeze_blocks_add_constraint(self):
+        engine = self._make_engine()
+        engine.add_constraint("finance", ["read"])
+        engine.freeze()
+        with pytest.raises(RuntimeError, match="frozen"):
+            engine.add_constraint("finance", ["read", "write"])
+
+    def test_freeze_blocks_set_agent_context(self):
+        engine = self._make_engine()
+        engine.freeze()
+        with pytest.raises(RuntimeError, match="frozen"):
+            engine.set_agent_context("agent-1", {"status": "admin"})
+
+    def test_freeze_blocks_update_agent_context(self):
+        engine = self._make_engine()
+        engine.set_agent_context("agent-1", {"status": "user"})
+        engine.freeze()
+        with pytest.raises(RuntimeError, match="frozen"):
+            engine.update_agent_context("agent-1", {"status": "admin"})
+
+    def test_freeze_blocks_add_conditional_permission(self):
+        from agent_control_plane.policy_engine import (
+            Condition,
+            ConditionalPermission,
+        )
+        engine = self._make_engine()
+        engine.freeze()
+        perm = ConditionalPermission(
+            tool_name="refund",
+            conditions=[Condition("user_status", "eq", "verified")],
+        )
+        with pytest.raises(RuntimeError, match="frozen"):
+            engine.add_conditional_permission("finance", perm)
+
+    def test_is_frozen_property(self):
+        engine = self._make_engine()
+        assert engine.is_frozen is False
+        engine.freeze()
+        assert engine.is_frozen is True
+
+    def test_check_violation_still_works_after_freeze(self):
+        engine = self._make_engine()
+        engine.add_constraint("finance", ["read"])
+        engine.freeze()
+        # Read operations should still work
+        violation = engine.check_violation("finance", "read", {})
+        assert violation is None
+        violation = engine.check_violation("finance", "write", {})
+        assert violation is not None
+
+    def test_mutation_log_records_operations(self):
+        engine = self._make_engine()
+        engine.add_constraint("finance", ["read"])
+        engine.set_agent_context("a1", {"x": 1})
+        engine.freeze()
+        log = engine.mutation_log
+        ops = [entry["operation"] for entry in log]
+        assert "add_constraint" in ops
+        assert "set_agent_context" in ops
+        assert "freeze" in ops
+
+    def test_mutation_log_records_blocked_attempts(self):
+        engine = self._make_engine()
+        engine.freeze()
+        with pytest.raises(RuntimeError):
+            engine.add_constraint("x", ["y"])
+        log = engine.mutation_log
+        blocked = [e for e in log if e["blocked"]]
+        assert len(blocked) == 1
+        assert blocked[0]["operation"] == "add_constraint"
+
+    def test_frozen_dicts_are_immutable_proxies(self):
+        """After freeze(), direct dict mutation raises TypeError."""
+        engine = self._make_engine()
+        engine.add_constraint("finance", ["read"])
+        engine.set_agent_context("a1", {"status": "user"})
+        engine.freeze()
+        # Direct dict assignment should fail
+        with pytest.raises(TypeError):
+            engine.state_permissions["hacker"] = frozenset(["everything"])
+        with pytest.raises(TypeError):
+            engine.agent_contexts["hacker"] = {"admin": True}
+        with pytest.raises(TypeError):
+            engine.conditional_permissions["hacker"] = []
+
+    def test_frozen_permissions_are_frozensets(self):
+        engine = self._make_engine()
+        engine.add_constraint("finance", ["read", "calculate"])
+        engine.freeze()
+        perms = engine.state_permissions.get("finance")
+        assert isinstance(perms, frozenset)
+        assert perms == frozenset(["read", "calculate"])
+
+
+# ══════════════════════════════════════════════════════════════════
+# 4. QUORUM CONFIG VALIDATION
+# ══════════════════════════════════════════════════════════════════
+
+
+class TestQuorumConfig:
+    def test_valid_quorum(self):
+        q = QuorumConfig(required_approvals=2, total_approvers=3)
+        assert q.required_approvals == 2
+
+    def test_invalid_required_approvals(self):
+        with pytest.raises(ValueError, match="required_approvals"):
+            QuorumConfig(required_approvals=0)
+
+    def test_invalid_required_denials(self):
+        with pytest.raises(ValueError, match="required_denials"):
+            QuorumConfig(required_denials=0)
+
+
+# ══════════════════════════════════════════════════════════════════
+# 5. ESCALATION FATIGUE DETECTION
+# ══════════════════════════════════════════════════════════════════
+
+
+class TestEscalationFatigue:
+    def test_fatigue_auto_denies_rapid_escalations(self):
+        handler = EscalationHandler(
+            timeout_seconds=0.1,
+            fatigue_threshold=3,
+            fatigue_window_seconds=60,
+        )
+        # First 3 escalations should be PENDING (normal)
+        for i in range(3):
+            req = handler.escalate(f"agent-1", f"action-{i}", "reason")
+            assert req.decision == EscalationDecision.PENDING
+
+        # 4th escalation should be auto-DENY (fatigue)
+        req = handler.escalate("agent-1", "action-4", "reason")
+        assert req.decision == EscalationDecision.DENY
+        assert "fatigue" in req.reason.lower()
+        assert req.resolved_by == "system:fatigue_detector"
+
+    def test_fatigue_per_agent(self):
+        handler = EscalationHandler(
+            timeout_seconds=0.1,
+            fatigue_threshold=2,
+            fatigue_window_seconds=60,
+        )
+        # Agent-1 hits threshold
+        handler.escalate("agent-1", "a1", "r")
+        handler.escalate("agent-1", "a2", "r")
+        req = handler.escalate("agent-1", "a3", "r")
+        assert req.decision == EscalationDecision.DENY
+
+        # Agent-2 is still under threshold
+        req = handler.escalate("agent-2", "b1", "r")
+        assert req.decision == EscalationDecision.PENDING
+
+    def test_no_fatigue_when_disabled(self):
+        handler = EscalationHandler(
+            timeout_seconds=0.1,
+            fatigue_threshold=None,
+        )
+        # Should never fatigue
+        for i in range(20):
+            req = handler.escalate("agent-1", f"action-{i}", "reason")
+            assert req.decision == EscalationDecision.PENDING
+
+    def test_fatigue_callback_not_fired_on_auto_deny(self):
+        captured = []
+        handler = EscalationHandler(
+            timeout_seconds=0.1,
+            fatigue_threshold=1,
+            on_escalate=lambda req: captured.append(req),
+        )
+        # First: normal, callback fires
+        handler.escalate("agent-1", "a1", "r")
+        assert len(captured) == 1
+        # Second: fatigued, callback should NOT fire
+        handler.escalate("agent-1", "a2", "r")
+        assert len(captured) == 1  # Still 1
+
+
+# ══════════════════════════════════════════════════════════════════
+# 6. QUORUM APPROVAL
+# ══════════════════════════════════════════════════════════════════
+
+
+class TestQuorumApproval:
+    def test_single_approval_insufficient_for_quorum(self):
+        queue = InMemoryApprovalQueue()
+        handler = EscalationHandler(
+            backend=queue,
+            timeout_seconds=0.2,
+            default_action=DefaultTimeoutAction.DENY,
+            quorum=QuorumConfig(required_approvals=2, required_denials=1),
+        )
+        request = handler.escalate("agent-1", "deploy", "needs review")
+        # One approval — not enough for quorum of 2
+        queue.approve(request.request_id, approver="admin1")
+        # Manually add vote tracking
+        req = queue.get_decision(request.request_id)
+        req.votes.append(("admin1", "ALLOW", req.resolved_at))
+        decision = handler.resolve(request.request_id)
+        # With only 1 vote and quorum=2, should timeout-deny
+        assert decision == EscalationDecision.DENY
+
+    def test_quorum_met_with_enough_approvals(self):
+        queue = InMemoryApprovalQueue()
+        handler = EscalationHandler(
+            backend=queue,
+            timeout_seconds=0.5,
+            default_action=DefaultTimeoutAction.DENY,
+            quorum=QuorumConfig(required_approvals=2, required_denials=2),
+        )
+        request = handler.escalate("agent-1", "deploy", "needs review")
+        queue.approve(request.request_id, approver="admin1")
+        req = queue.get_decision(request.request_id)
+        req.votes.append(("admin1", "ALLOW", req.resolved_at))
+        req.votes.append(("admin2", "ALLOW", req.resolved_at))
+        decision = handler.resolve(request.request_id)
+        assert decision == EscalationDecision.ALLOW
+
+    def test_quorum_deny_on_single_denial(self):
+        queue = InMemoryApprovalQueue()
+        handler = EscalationHandler(
+            backend=queue,
+            timeout_seconds=0.5,
+            default_action=DefaultTimeoutAction.ALLOW,
+            quorum=QuorumConfig(required_approvals=2, required_denials=1),
+        )
+        request = handler.escalate("agent-1", "deploy", "needs review")
+        queue.deny(request.request_id, approver="sec-team")
+        req = queue.get_decision(request.request_id)
+        req.votes.append(("sec-team", "DENY", req.resolved_at))
+        decision = handler.resolve(request.request_id)
+        assert decision == EscalationDecision.DENY
+
+    def test_no_quorum_preserves_existing_behavior(self):
+        queue = InMemoryApprovalQueue()
+        handler = EscalationHandler(
+            backend=queue,
+            timeout_seconds=5,
+            quorum=None,  # No quorum — existing behavior
+        )
+        import threading
+
+        request = handler.escalate("agent-1", "action", "reason")
+
+        def approve():
+            time.sleep(0.1)
+            queue.approve(request.request_id, approver="admin")
+
+        t = threading.Thread(target=approve)
+        t.start()
+        decision = handler.resolve(request.request_id)
+        t.join()
+        assert decision == EscalationDecision.ALLOW
diff --git a/packages/agentmesh-integrations/adk-agentmesh/README.md b/packages/agentmesh-integrations/adk-agentmesh/README.md
new file mode 100644
index 00000000..1a9ea4ef
--- /dev/null
+++ b/packages/agentmesh-integrations/adk-agentmesh/README.md
@@ -0,0 +1,163 @@
+# ADK AgentMesh — Governance for Google ADK Agents
+
+> [!IMPORTANT]
+> **Community Preview** — The `adk-agentmesh` package on PyPI is a community preview release
+> for testing and evaluation only. It is **not** an official Microsoft-signed release.
+> Official signed packages will be available in a future release.
+
+Policy enforcement, trust verification, and audit trails for
+[Google ADK](https://github.com/google/adk-python) agents — powered by the
+[Agent Governance Toolkit](https://github.com/microsoft/agent-governance-toolkit).
+
+## What It Does
+
+`adk-agentmesh` implements the `PolicyEvaluator` protocol
+([google/adk-python#4897](https://github.com/google/adk-python/issues/4897))
+backed by the Agent Governance Toolkit's deterministic policy engine.
+
+- **Tool-level governance** — block, allow-list, or require approval for any ADK tool call
+- **Rate limiting** — cap tool calls per agent per session
+- **Delegation scope** — monotonic narrowing ensures sub-agents never exceed parent permissions
+- **Structured audit** — every decision is logged with verdict, rule, and timestamp
+
+## Installation
+
+```bash
+pip install adk-agentmesh
+```
+
+## Quick Start
+
+### 1. Define a governance policy
+
+Create a YAML policy file (see [`examples/policies/adk-governance.yaml`](../../../examples/policies/adk-governance.yaml)):
+
+```yaml
+adk_governance:
+  blocked_tools:
+    - execute_shell
+    - delete_database
+  max_tool_calls: 100
+  require_approval_for:
+    - send_email
+    - deploy_service
+```
+
+### 2. Wire into your ADK agent
+
+```python
+from adk_agentmesh import ADKPolicyEvaluator, GovernanceCallbacks
+
+# Load policy
+evaluator = ADKPolicyEvaluator.from_config("policies/adk-governance.yaml")
+callbacks = GovernanceCallbacks(evaluator)
+
+# Attach to ADK agent
+from google.adk.agents import LlmAgent
+
+agent = LlmAgent(
+    model="gemini-2.0-flash",
+    name="my-governed-agent",
+    before_tool_callback=callbacks.before_tool,
+    after_tool_callback=callbacks.after_tool,
+    before_agent_callback=callbacks.before_agent,
+    after_agent_callback=callbacks.after_agent,
+)
+```
+
+### 3. Or use the evaluator directly
+
+```python
+import asyncio
+from adk_agentmesh import ADKPolicyEvaluator
+
+evaluator = ADKPolicyEvaluator(
+    blocked_tools=["execute_shell"],
+    max_tool_calls=50,
+    require_approval_for=["send_email"],
+)
+
+decision = asyncio.run(
+    evaluator.evaluate_tool_call(
+        tool_name="search_web",
+        tool_args={"query": "latest news"},
+        agent_name="research-agent",
+    )
+)
+print(decision.verdict)  # Verdict.ALLOW
+```
+
+## ADK Lifecycle Mapping
+
+| ADK Hook | Governance Check |
+|----------|-----------------|
+| `before_tool_callback` | Policy evaluation, rate limiting, tool blocking |
+| `after_tool_callback` | Audit logging |
+| `before_agent_callback` | Delegation scope check |
+| `after_agent_callback` | Delegation audit |
+
+## Delegation Scope Narrowing
+
+Sub-agents automatically receive narrowed permissions:
+
+```python
+from adk_agentmesh import DelegationScope
+
+parent_scope = DelegationScope(
+    allowed_tools=["search_web", "read_file", "write_file"],
+    max_tool_calls=100,
+    max_depth=3,
+)
+
+# Child gets strictly fewer permissions
+child_scope = parent_scope.narrow(
+    allowed_tools=["search_web", "read_file"],
+    read_only=True,
+)
+# child_scope.max_depth == 2 (always decrements)
+# child_scope.read_only == True (once set, cannot be unset)
+```
+
+## Audit Events
+
+Every governance decision is recorded:
+
+```python
+evaluator = ADKPolicyEvaluator(blocked_tools=["dangerous_tool"])
+
+# ... after agent runs ...
+
+for entry in evaluator.get_audit_log():
+    print(entry["event"], entry["timestamp"])
+```
+
+For structured audit handling:
+
+```python
+from adk_agentmesh import AuditEvent, LoggingAuditHandler
+
+handler = LoggingAuditHandler()
+event = AuditEvent(
+    event_type="tool_call_denied",
+    agent_name="my-agent",
+    tool_name="execute_shell",
+    verdict="deny",
+    reason="Tool is blocked by policy",
+)
+handler.handle(event)
+```
+
+## Sample Policy
+
+See the full sample policy at
+[`examples/policies/adk-governance.yaml`](../../../examples/policies/adk-governance.yaml).
+
+## Links
+
+- [Agent Governance Toolkit](https://github.com/microsoft/agent-governance-toolkit)
+- [Google ADK](https://github.com/google/adk-python)
+- [PolicyEvaluator proposal (google/adk-python#4897)](https://github.com/google/adk-python/issues/4897)
+
+## License
+
+MIT
diff --git a/packages/agentmesh-integrations/adk-agentmesh/pyproject.toml b/packages/agentmesh-integrations/adk-agentmesh/pyproject.toml
new file mode 100644
index 00000000..e3c5995a
--- /dev/null
+++ b/packages/agentmesh-integrations/adk-agentmesh/pyproject.toml
@@ -0,0 +1,36 @@
+[build-system]
+requires = ["setuptools>=68.0", "wheel"]
+build-backend = "setuptools.build_meta"
+
+[project]
+name = "adk-agentmesh"
+version = "0.1.0"
+description = "Community Edition — Agent Governance Toolkit integration for Google ADK: policy enforcement, trust verification, and audit trails for ADK agents"
+readme = "README.md"
+license = {text = "MIT"}
+requires-python = ">=3.10"
+authors = [
+    {name = "Microsoft Corporation", email = "agt@microsoft.com"},
+]
+maintainers = [
+    {name = "Agent Governance Toolkit Team", email = "agt@microsoft.com"},
+]
+keywords = ["google-adk", "agent", "governance", "trust", "policy", "audit"]
+classifiers = [
+    "Development Status :: 3 - Alpha",
+    "License :: OSI Approved :: MIT License",
+    "Programming Language :: Python :: 3",
+]
+dependencies = [
+    "google-adk>=1.0.0",
+]
+
+[project.optional-dependencies]
+dev = ["pytest>=8.0", "pytest-asyncio>=0.23"]
+
+[project.urls]
+Homepage = "https://github.com/microsoft/agent-governance-toolkit"
+Repository = "https://github.com/microsoft/agent-governance-toolkit"
+
+[tool.setuptools.packages.find]
+where = ["src"]
diff --git a/packages/agentmesh-integrations/adk-agentmesh/src/adk_agentmesh/__init__.py b/packages/agentmesh-integrations/adk-agentmesh/src/adk_agentmesh/__init__.py
new file mode 100644
index 00000000..a6ca6804
--- /dev/null
+++ b/packages/agentmesh-integrations/adk-agentmesh/src/adk_agentmesh/__init__.py
@@ -0,0 +1,21 @@
+# Copyright (c) Microsoft Corporation.
+# Licensed under the MIT License.
+"""Google ADK governance integration for the Agent Governance Toolkit.
+
+Provides PolicyEvaluator protocol implementation, delegation governance,
+and structured audit events for Google ADK agents.
+"""
+
+from adk_agentmesh.evaluator import ADKPolicyEvaluator, PolicyDecision
+from adk_agentmesh.governance import GovernanceCallbacks, DelegationScope
+from adk_agentmesh.audit import AuditEvent, AuditHandler, LoggingAuditHandler
+
+__all__ = [
+    "ADKPolicyEvaluator",
+    "PolicyDecision",
+    "GovernanceCallbacks",
+    "DelegationScope",
+    "AuditEvent",
+    "AuditHandler",
+    "LoggingAuditHandler",
+]
diff --git a/packages/agentmesh-integrations/adk-agentmesh/src/adk_agentmesh/audit.py b/packages/agentmesh-integrations/adk-agentmesh/src/adk_agentmesh/audit.py
new file mode 100644
index 00000000..60d359af
--- /dev/null
+++ b/packages/agentmesh-integrations/adk-agentmesh/src/adk_agentmesh/audit.py
@@ -0,0 +1,56 @@
+# Copyright (c) Microsoft Corporation.
+# Licensed under the MIT License.
+"""Structured audit events for ADK governance."""
+
+from __future__ import annotations
+
+import json
+import logging
+from dataclasses import asdict, dataclass, field
+from datetime import datetime, timezone
+from typing import Any, Protocol
+
+
+logger = logging.getLogger(__name__)
+
+
+@dataclass
+class AuditEvent:
+    """A structured governance audit event."""
+    event_type: str
+    agent_name: str
+    timestamp: datetime = field(default_factory=lambda: datetime.now(timezone.utc))
+    tool_name: str = ""
+    verdict: str = ""
+    reason: str = ""
+    metadata: dict[str, Any] = field(default_factory=dict)
+
+    def to_dict(self) -> dict:
+        d = asdict(self)
+        d["timestamp"] = self.timestamp.isoformat()
+        return d
+
+    def to_json(self) -> str:
+        return json.dumps(self.to_dict(), default=str)
+
+
+class AuditHandler(Protocol):
+    """Protocol for audit event handlers."""
+    def handle(self, event: AuditEvent) -> None: ...
+
+
+class LoggingAuditHandler:
+    """Audit handler that logs events via Python logging."""
+
+    def __init__(self, logger_name: str = "adk_agentmesh.audit"):
+        self._logger = logging.getLogger(logger_name)
+
+    def handle(self, event: AuditEvent) -> None:
+        self._logger.info(
+            "[%s] agent=%s tool=%s verdict=%s reason=%s",
+            event.event_type,
+            event.agent_name,
+            event.tool_name,
+            event.verdict,
+            event.reason,
+        )
diff --git a/packages/agentmesh-integrations/adk-agentmesh/src/adk_agentmesh/evaluator.py b/packages/agentmesh-integrations/adk-agentmesh/src/adk_agentmesh/evaluator.py
new file mode 100644
index 00000000..d75196b7
--- /dev/null
+++ b/packages/agentmesh-integrations/adk-agentmesh/src/adk_agentmesh/evaluator.py
@@ -0,0 +1,212 @@
+# Copyright (c) Microsoft Corporation.
+# Licensed under the MIT License.
+"""ADK PolicyEvaluator backed by Agent Governance Toolkit.
+
+Implements the PolicyEvaluator protocol proposed in google/adk-python#4897,
+wiring ADK's before_tool_callback into our deterministic policy engine.
+"""
+
+from __future__ import annotations
+
+import logging
+from dataclasses import dataclass, field
+from datetime import datetime, timezone
+from enum import Enum
+from pathlib import Path
+from typing import Any, Optional, Protocol
+
+logger = logging.getLogger(__name__)
+
+
+class Verdict(str, Enum):
+    ALLOW = "allow"
+    DENY = "deny"
+    ESCALATE = "escalate"
+
+
+@dataclass
+class PolicyDecision:
+    """Result of a policy evaluation."""
+    verdict: Verdict
+    reason: str = ""
+    matched_rule: str = ""
+    timestamp: datetime = field(default_factory=lambda: datetime.now(timezone.utc))
+    metadata: dict[str, Any] = field(default_factory=dict)
+
+
+class PolicyEvaluatorProtocol(Protocol):
+    """The PolicyEvaluator protocol from google/adk-python#4897."""
+
+    async def evaluate_tool_call(
+        self, *, tool_name: str, tool_args: dict, agent_name: str, context: Any
+    ) -> PolicyDecision: ...
+
+    async def evaluate_agent_delegation(
+        self, *, parent_agent: str, child_agent: str, scope: Any, context: Any
+    ) -> PolicyDecision: ...
+
+
+class ADKPolicyEvaluator:
+    """PolicyEvaluator backed by Agent Governance Toolkit.
+
+    Loads governance rules from YAML configuration and evaluates
+    ADK tool calls and agent delegations against them.
+
+    Example::
+
+        from adk_agentmesh import ADKPolicyEvaluator
+
+        evaluator = ADKPolicyEvaluator.from_config("policies/adk-governance.yaml")
+
+        # Wire into ADK agent
+        agent = LlmAgent(
+            before_tool_callback=evaluator.before_tool_callback,
+            after_tool_callback=evaluator.after_tool_callback,
+        )
+    """
+
+    def __init__(
+        self,
+        policy_path: Optional[str | Path] = None,
+        blocked_tools: Optional[list[str]] = None,
+        allowed_tools: Optional[list[str]] = None,
+        max_tool_calls: int = 100,
+        require_approval_for: Optional[list[str]] = None,
+    ):
+        self._policy_path = policy_path
+        self._blocked_tools = set(blocked_tools or [])
+        self._allowed_tools = set(allowed_tools or [])
+        self._max_tool_calls = max_tool_calls
+        self._require_approval = set(require_approval_for or [])
+        self._call_count: dict[str, int] = {}
+        self._audit_log: list[dict] = []
+
+        if policy_path:
+            self._load_policy(policy_path)
+
+    def _load_policy(self, path: str | Path) -> None:
+        """Load governance policy from YAML config."""
+        import yaml
+        path = Path(path)
+        if not path.exists():
+            raise FileNotFoundError(f"Policy config not found: {path}")
+        with open(path, encoding="utf-8") as f:
+            config = yaml.safe_load(f)
+
+        adk = config.get("adk_governance", {})
+        self._blocked_tools.update(adk.get("blocked_tools", []))
+        self._allowed_tools.update(adk.get("allowed_tools", []))
+        self._max_tool_calls = adk.get("max_tool_calls", self._max_tool_calls)
+        self._require_approval.update(adk.get("require_approval_for", []))
+
+    @classmethod
+    def from_config(cls, config_path: str | Path) -> "ADKPolicyEvaluator":
+        """Create an evaluator from a YAML config file."""
+        return cls(policy_path=config_path)
+
+    async def evaluate_tool_call(
+        self, *, tool_name: str, tool_args: dict, agent_name: str, context: Any = None
+    ) -> PolicyDecision:
+        """Evaluate whether a tool call should be allowed."""
+        # Track call count per agent
+        self._call_count.setdefault(agent_name, 0)
+        self._call_count[agent_name] += 1
+
+        # Check rate limit
+        if self._call_count[agent_name] > self._max_tool_calls:
+            return self._deny(
+                f"Agent '{agent_name}' exceeded max tool calls ({self._max_tool_calls})",
+                rule="rate_limit",
+                tool_name=tool_name,
+                agent_name=agent_name,
+            )
+
+        # Check blocked tools
+        if tool_name in self._blocked_tools:
+            return self._deny(
+                f"Tool '{tool_name}' is blocked by policy",
+                rule="blocked_tool",
+                tool_name=tool_name,
+                agent_name=agent_name,
+            )
+
+        # Check allowed tools (if allowlist is set, only those are permitted)
+        if self._allowed_tools and tool_name not in self._allowed_tools:
+            return self._deny(
+                f"Tool '{tool_name}' is not in the allowed tools list",
+                rule="allowed_tools",
+                tool_name=tool_name,
+                agent_name=agent_name,
+            )
+
+        # Check approval requirement
+        if tool_name in self._require_approval:
+            return PolicyDecision(
+                verdict=Verdict.ESCALATE,
+                reason=f"Tool '{tool_name}' requires human approval",
+                matched_rule="require_approval",
+                metadata={"tool_name": tool_name, "agent_name": agent_name},
+            )
+
+        self._log_audit("tool_call_allowed", tool_name=tool_name, agent_name=agent_name)
+        return PolicyDecision(verdict=Verdict.ALLOW)
+
+    async def evaluate_agent_delegation(
+        self, *, parent_agent: str, child_agent: str, scope: Any = None, context: Any = None
+    ) -> PolicyDecision:
+        """Evaluate whether agent delegation should be allowed."""
+        self._log_audit(
+            "delegation_evaluated",
+            parent=parent_agent,
+            child=child_agent,
+            scope=str(scope),
+        )
+        return PolicyDecision(verdict=Verdict.ALLOW)
+
+    def before_tool_callback(self, tool_name: str, tool_args: dict, **kwargs) -> Optional[dict]:
+        """ADK before_tool_callback hook.
+
+        Returns None to allow, or a dict with error to block.
+        """
+        import asyncio
+        decision = asyncio.get_event_loop().run_until_complete(
+            self.evaluate_tool_call(
+                tool_name=tool_name,
+                tool_args=tool_args,
+                agent_name=kwargs.get("agent_name", "unknown"),
+            )
+        )
+        if decision.verdict == Verdict.DENY:
+            logger.warning("BLOCKED: %s — %s", tool_name, decision.reason)
+            return {"error": f"Governance policy violation: {decision.reason}"}
+        if decision.verdict == Verdict.ESCALATE:
+            logger.info("ESCALATE: %s — %s", tool_name, decision.reason)
+            return {"error": f"Requires approval: {decision.reason}"}
+        return None
+
+    def after_tool_callback(self, tool_name: str, result: Any, **kwargs) -> None:
+        """ADK after_tool_callback hook for audit logging."""
+        self._log_audit(
+            "tool_call_completed",
+            tool_name=tool_name,
+            agent_name=kwargs.get("agent_name", "unknown"),
+        )
+
+    def get_audit_log(self) -> list[dict]:
+        """Return the audit trail."""
+        return list(self._audit_log)
+
+    def reset_counters(self) -> None:
+        """Reset per-agent call counters."""
+        self._call_count.clear()
+
+    def _deny(self, reason: str, rule: str, **meta) -> PolicyDecision:
+        self._log_audit("tool_call_denied", reason=reason, rule=rule, **meta)
+        return PolicyDecision(verdict=Verdict.DENY, reason=reason, matched_rule=rule, metadata=meta)
+
+    def _log_audit(self, event_type: str, **details) -> None:
+        self._audit_log.append({
+            "event": event_type,
+            "timestamp": datetime.now(timezone.utc).isoformat(),
+            **details,
+        })
diff --git a/packages/agentmesh-integrations/adk-agentmesh/src/adk_agentmesh/governance.py b/packages/agentmesh-integrations/adk-agentmesh/src/adk_agentmesh/governance.py
new file mode 100644
index 00000000..a05853a4
--- /dev/null
+++ b/packages/agentmesh-integrations/adk-agentmesh/src/adk_agentmesh/governance.py
@@ -0,0 +1,86 @@
+# Copyright (c) Microsoft Corporation.
+# Licensed under the MIT License.
+"""Governance callbacks for ADK agent lifecycle."""
+
+from __future__ import annotations
+
+from dataclasses import dataclass, field
+from typing import Any, Optional
+
+
+@dataclass
+class DelegationScope:
+    """Defines the scope of permissions delegated to a sub-agent.
+
+    Enforces monotonic narrowing — child scope cannot exceed parent scope.
+    """
+    allowed_tools: list[str] = field(default_factory=list)
+    max_tool_calls: int = 50
+    max_depth: int = 3
+    read_only: bool = False
+
+    def narrow(self, **overrides) -> "DelegationScope":
+        """Create a narrower scope for sub-delegation."""
+        child = DelegationScope(
+            allowed_tools=overrides.get("allowed_tools", self.allowed_tools[:]),
+            max_tool_calls=min(
+                overrides.get("max_tool_calls", self.max_tool_calls),
+                self.max_tool_calls,
+            ),
+            max_depth=min(
+                overrides.get("max_depth", self.max_depth - 1),
+                self.max_depth - 1,
+            ),
+            read_only=self.read_only or overrides.get("read_only", False),
+        )
+        # Monotonic narrowing: child tools must be subset of parent
+        if self.allowed_tools:
+            child.allowed_tools = [
+                t for t in child.allowed_tools if t in self.allowed_tools
+            ]
+        return child
+
+
+class GovernanceCallbacks:
+    """Wires governance checks into ADK agent lifecycle.
+
+    Example::
+
+        from adk_agentmesh import ADKPolicyEvaluator, GovernanceCallbacks
+
+        evaluator = ADKPolicyEvaluator.from_config("policies/adk-governance.yaml")
+        callbacks = GovernanceCallbacks(evaluator)
+
+        agent = LlmAgent(
+            before_tool_callback=callbacks.before_tool,
+            after_tool_callback=callbacks.after_tool,
+            before_agent_callback=callbacks.before_agent,
+            after_agent_callback=callbacks.after_agent,
+        )
+    """
+
+    def __init__(self, evaluator: Any, delegation_scope: Optional[DelegationScope] = None):
+        self.evaluator = evaluator
+        self.scope = delegation_scope or DelegationScope()
+
+    def before_tool(self, tool_name: str, tool_args: dict, **kwargs) -> Optional[dict]:
+        """Pre-tool governance check."""
+        if self.scope.read_only and tool_name.startswith(("write_", "delete_", "update_")):
+            return {"error": f"Read-only scope: '{tool_name}' is blocked"}
+        if self.scope.allowed_tools and tool_name not in self.scope.allowed_tools:
+            return {"error": f"Tool '{tool_name}' not in delegation scope"}
+        return self.evaluator.before_tool_callback(tool_name, tool_args, **kwargs)
+
+    def after_tool(self, tool_name: str, result: Any, **kwargs) -> None:
+        """Post-tool audit logging."""
+        self.evaluator.after_tool_callback(tool_name, result, **kwargs)
+
+    def before_agent(self, agent_name: str, **kwargs) -> Optional[dict]:
+        """Pre-delegation governance check."""
+        if self.scope.max_depth <= 0:
+            return {"error": f"Maximum delegation depth reached for '{agent_name}'"}
+        return None
+
+    def after_agent(self, agent_name: str, result: Any, **kwargs) -> None:
+        """Post-delegation audit."""
+        self.evaluator._log_audit("agent_completed", agent_name=agent_name)
diff --git a/packages/agentmesh-integrations/adk-agentmesh/tests/__init__.py b/packages/agentmesh-integrations/adk-agentmesh/tests/__init__.py
new file mode 100644
index 00000000..e69de29b
diff --git a/packages/agentmesh-integrations/adk-agentmesh/tests/test_evaluator.py b/packages/agentmesh-integrations/adk-agentmesh/tests/test_evaluator.py
new file mode 100644
index 00000000..d619f347
--- /dev/null
+++ b/packages/agentmesh-integrations/adk-agentmesh/tests/test_evaluator.py
@@ -0,0 +1,432 @@
+# Copyright (c) Microsoft Corporation.
+# Licensed under the MIT License.
+"""Tests for ADK AgentMesh governance integration."""
+
+from __future__ import annotations
+
+import asyncio
+import textwrap
+from pathlib import Path
+
+import pytest
+
+from adk_agentmesh.evaluator import ADKPolicyEvaluator, PolicyDecision, Verdict
+from adk_agentmesh.governance import DelegationScope, GovernanceCallbacks
+from adk_agentmesh.audit import AuditEvent, LoggingAuditHandler
+
+
+# ---------------------------------------------------------------------------
+# Helpers
+# ---------------------------------------------------------------------------
+
+def _run(coro):
+    """Run an async coroutine synchronously."""
+    return asyncio.get_event_loop().run_until_complete(coro)
+
+
+@pytest.fixture()
+def evaluator():
+    """A basic evaluator with common test settings."""
+    return ADKPolicyEvaluator(
+        blocked_tools=["execute_shell", "drop_table"],
+        allowed_tools=[],
+        max_tool_calls=3,
+        require_approval_for=["send_email"],
+    )
+
+
+@pytest.fixture()
+def sample_policy_path(tmp_path: Path) -> Path:
+    """Write a minimal YAML policy to a temp file."""
+    policy = textwrap.dedent("""\
+        version: "1.0"
+        name: test-policy
+        adk_governance:
+          blocked_tools:
+            - dangerous_tool
+            - nuke_everything
+          max_tool_calls: 5
+          require_approval_for:
+            - publish_document
+    """)
+    p = tmp_path / "policy.yaml"
+    p.write_text(policy, encoding="utf-8")
+    return p
+
+
+# ---------------------------------------------------------------------------
+# ADKPolicyEvaluator — tool call evaluation
+# ---------------------------------------------------------------------------
+
+class TestBlockedTools:
+    """Blocked tools must be denied."""
+
+    @pytest.mark.asyncio
+    async def test_blocked_tool_is_denied(self, evaluator: ADKPolicyEvaluator):
+        decision = await evaluator.evaluate_tool_call(
+            tool_name="execute_shell",
+            tool_args={"cmd": "rm -rf /"},
+            agent_name="bad-agent",
+        )
+        assert decision.verdict == Verdict.DENY
+        assert "blocked" in decision.reason.lower()
+        assert decision.matched_rule == "blocked_tool"
+
+    @pytest.mark.asyncio
+    async def test_second_blocked_tool_is_also_denied(self, evaluator: ADKPolicyEvaluator):
+        decision = await evaluator.evaluate_tool_call(
+            tool_name="drop_table",
+            tool_args={"table": "users"},
+            agent_name="bad-agent",
+        )
+        assert decision.verdict == Verdict.DENY
+
+
+class TestAllowedTools:
+    """Unrestricted tools should pass when no allowlist is set."""
+
+    @pytest.mark.asyncio
+    async def test_allowed_tool_passes(self, evaluator: ADKPolicyEvaluator):
+        decision = await evaluator.evaluate_tool_call(
+            tool_name="search_web",
+            tool_args={"q": "governance"},
+            agent_name="good-agent",
+        )
+        assert decision.verdict == Verdict.ALLOW
+
+    @pytest.mark.asyncio
+    async def test_allowlist_restricts_tools(self):
+        evaluator = ADKPolicyEvaluator(allowed_tools=["search_web", "read_file"])
+        decision = await evaluator.evaluate_tool_call(
+            tool_name="write_file",
+            tool_args={"path": "/etc/passwd"},
+            agent_name="agent",
+        )
+        assert decision.verdict == Verdict.DENY
+        assert decision.matched_rule == "allowed_tools"
+
+    @pytest.mark.asyncio
+    async def test_allowlist_permits_listed_tool(self):
+        evaluator = ADKPolicyEvaluator(allowed_tools=["search_web", "read_file"])
+        decision = await evaluator.evaluate_tool_call(
+            tool_name="search_web",
+            tool_args={"q": "hello"},
+            agent_name="agent",
+        )
+        assert decision.verdict == Verdict.ALLOW
+
+
+class TestRateLimit:
+    """Rate limiting must kick in after max_tool_calls."""
+
+    @pytest.mark.asyncio
+    async def test_rate_limit_exceeded(self, evaluator: ADKPolicyEvaluator):
+        # evaluator has max_tool_calls=3
+        for i in range(3):
+            decision = await evaluator.evaluate_tool_call(
+                tool_name="search_web",
+                tool_args={"q": f"query-{i}"},
+                agent_name="fast-agent",
+            )
+            assert decision.verdict == Verdict.ALLOW
+
+        # 4th call should be denied
+        decision = await evaluator.evaluate_tool_call(
+            tool_name="search_web",
+            tool_args={"q": "one-too-many"},
+            agent_name="fast-agent",
+        )
+        assert decision.verdict == Verdict.DENY
+        assert decision.matched_rule == "rate_limit"
+
+    @pytest.mark.asyncio
+    async def test_rate_limit_per_agent(self, evaluator: ADKPolicyEvaluator):
+        """Different agents have independent counters."""
+        for i in range(3):
+            await evaluator.evaluate_tool_call(
+                tool_name="search_web",
+                tool_args={},
+                agent_name="agent-a",
+            )
+        # agent-a is at the limit, agent-b should still work
+        decision = await evaluator.evaluate_tool_call(
+            tool_name="search_web",
+            tool_args={},
+            agent_name="agent-b",
+        )
+        assert decision.verdict == Verdict.ALLOW
+
+    @pytest.mark.asyncio
+    async def test_reset_counters(self, evaluator: ADKPolicyEvaluator):
+        for i in range(3):
+            await evaluator.evaluate_tool_call(
+                tool_name="search_web",
+                tool_args={},
+                agent_name="agent",
+            )
+        evaluator.reset_counters()
+        decision = await evaluator.evaluate_tool_call(
+            tool_name="search_web",
+            tool_args={},
+            agent_name="agent",
+        )
+        assert decision.verdict == Verdict.ALLOW
+
+
+class TestApprovalRequired:
+    """Tools requiring approval should escalate."""
+
+    @pytest.mark.asyncio
+    async def test_approval_required_escalation(self, evaluator: ADKPolicyEvaluator):
+        decision = await evaluator.evaluate_tool_call(
+            tool_name="send_email",
+            tool_args={"to": "boss@example.com"},
+            agent_name="assistant",
+        )
+        assert decision.verdict == Verdict.ESCALATE
+        assert "approval" in decision.reason.lower()
+        assert decision.matched_rule == "require_approval"
+
+
+class TestAuditLog:
+    """Audit log must capture governance decisions."""
+
+    @pytest.mark.asyncio
+    async def test_audit_log_populated(self, evaluator: ADKPolicyEvaluator):
+        await evaluator.evaluate_tool_call(
+            tool_name="search_web", tool_args={}, agent_name="agent"
+        )
+        await evaluator.evaluate_tool_call(
+            tool_name="execute_shell", tool_args={}, agent_name="agent"
+        )
+        log = evaluator.get_audit_log()
+        assert len(log) >= 2
+        events = [e["event"] for e in log]
+        assert "tool_call_allowed" in events
+        assert "tool_call_denied" in events
+
+    @pytest.mark.asyncio
+    async def test_audit_log_has_timestamps(self, evaluator: ADKPolicyEvaluator):
+        await evaluator.evaluate_tool_call(
+            tool_name="search_web", tool_args={}, agent_name="agent"
+        )
+        log = evaluator.get_audit_log()
+        assert all("timestamp" in entry for entry in log)
+
+
+# ---------------------------------------------------------------------------
+# Config loading
+# ---------------------------------------------------------------------------
+
+class TestConfigLoading:
+    """Policy loading from YAML."""
+
+    def test_from_config(self, sample_policy_path: Path):
+        evaluator = ADKPolicyEvaluator.from_config(sample_policy_path)
+        assert "dangerous_tool" in evaluator._blocked_tools
+        assert "nuke_everything" in evaluator._blocked_tools
+        assert evaluator._max_tool_calls == 5
+        assert "publish_document" in evaluator._require_approval
+
+    def test_missing_config_raises(self, tmp_path: Path):
+        with pytest.raises(FileNotFoundError):
+            ADKPolicyEvaluator.from_config(tmp_path / "nonexistent.yaml")
+
+    @pytest.mark.asyncio
+    async def test_loaded_policy_blocks_tool(self, sample_policy_path: Path):
+        evaluator = ADKPolicyEvaluator.from_config(sample_policy_path)
+        decision = await evaluator.evaluate_tool_call(
+            tool_name="dangerous_tool",
+            tool_args={},
+            agent_name="agent",
+        )
+        assert decision.verdict == Verdict.DENY
+
+    @pytest.mark.asyncio
+    async def test_loaded_policy_escalates_approval(self, sample_policy_path: Path):
+        evaluator = ADKPolicyEvaluator.from_config(sample_policy_path)
+        decision = await evaluator.evaluate_tool_call(
+            tool_name="publish_document",
+            tool_args={},
+            agent_name="agent",
+        )
+        assert decision.verdict == Verdict.ESCALATE
+
+
+# ---------------------------------------------------------------------------
+# DelegationScope
+# ---------------------------------------------------------------------------
+
+class TestDelegationScope:
+    """Delegation scope narrowing must be monotonic."""
+
+    def test_narrow_reduces_depth(self):
+        parent = DelegationScope(max_depth=3)
+        child = parent.narrow()
+        assert child.max_depth == 2
+
+    def test_narrow_cannot_increase_depth(self):
+        parent = DelegationScope(max_depth=3)
+        child = parent.narrow(max_depth=10)
+        assert child.max_depth == 2  # min(10, 3-1) = 2
+
+    def test_narrow_cannot_increase_tool_calls(self):
+        parent = DelegationScope(max_tool_calls=50)
+        child = parent.narrow(max_tool_calls=100)
+        assert child.max_tool_calls == 50
+
+    def test_narrow_can_decrease_tool_calls(self):
+        parent = DelegationScope(max_tool_calls=50)
+        child = parent.narrow(max_tool_calls=10)
+        assert child.max_tool_calls == 10
+
+    def test_narrow_tools_subset(self):
+        parent = DelegationScope(allowed_tools=["read", "write", "delete"])
+        child = parent.narrow(allowed_tools=["read", "write", "admin"])
+        # "admin" should be filtered out — not in parent
+        assert "read" in child.allowed_tools
+        assert "write" in child.allowed_tools
+        assert "admin" not in child.allowed_tools
+
+    def test_narrow_read_only_is_sticky(self):
+        parent = DelegationScope(read_only=True)
+        child = parent.narrow(read_only=False)
+        assert child.read_only is True  # once set, cannot unset
+
+    def test_narrow_can_set_read_only(self):
+        parent = DelegationScope(read_only=False)
+        child = parent.narrow(read_only=True)
+        assert child.read_only is True
+
+
+# ---------------------------------------------------------------------------
+# GovernanceCallbacks
+# ---------------------------------------------------------------------------
+
+class TestGovernanceCallbacks:
+    """GovernanceCallbacks wiring into ADK lifecycle."""
+
+    def test_read_only_blocks_write(self):
+        evaluator = ADKPolicyEvaluator()
+        scope = DelegationScope(read_only=True)
+        callbacks = GovernanceCallbacks(evaluator, delegation_scope=scope)
+
+        result = callbacks.before_tool("write_file", {"path": "/tmp/x"})
+        assert result is not None
+        assert "read-only" in result["error"].lower() or "Read-only" in result["error"]
+
+    def test_read_only_allows_read(self):
+        evaluator = ADKPolicyEvaluator()
+        scope = DelegationScope(read_only=True)
+        callbacks = GovernanceCallbacks(evaluator, delegation_scope=scope)
+
+        result = callbacks.before_tool("read_file", {"path": "/tmp/x"})
+        assert result is None  # allowed
+
+    def test_scope_blocks_unlisted_tool(self):
+        evaluator = ADKPolicyEvaluator()
+        scope = DelegationScope(allowed_tools=["search_web"])
+        callbacks = GovernanceCallbacks(evaluator, delegation_scope=scope)
+
+        result = callbacks.before_tool("execute_shell", {"cmd": "ls"})
+        assert result is not None
+        assert "not in delegation scope" in result["error"]
+
+    def test_max_depth_zero_blocks_delegation(self):
+        evaluator = ADKPolicyEvaluator()
+        scope = DelegationScope(max_depth=0)
+        callbacks = GovernanceCallbacks(evaluator, delegation_scope=scope)
+
+        result = callbacks.before_agent("sub-agent")
+        assert result is not None
+        assert "depth" in result["error"].lower()
+
+
+# ---------------------------------------------------------------------------
+# AuditEvent & LoggingAuditHandler
+# ---------------------------------------------------------------------------
+
+class TestAuditEvent:
+    """Structured audit event serialization."""
+
+    def test_to_dict(self):
+        event = AuditEvent(
+            event_type="tool_call_denied",
+            agent_name="test-agent",
+            tool_name="execute_shell",
+            verdict="deny",
+            reason="blocked by policy",
+        )
+        d = event.to_dict()
+        assert d["event_type"] == "tool_call_denied"
+        assert d["agent_name"] == "test-agent"
+        assert "timestamp" in d
+
+    def test_to_json(self):
+        event = AuditEvent(
+            event_type="tool_call_allowed",
+            agent_name="agent",
+        )
+        j = event.to_json()
+        assert '"event_type": "tool_call_allowed"' in j
+
+    def test_logging_handler(self, caplog):
+        handler = LoggingAuditHandler()
+        event = AuditEvent(
+            event_type="test_event",
+            agent_name="agent",
+            tool_name="tool",
+            verdict="allow",
+        )
+        with caplog.at_level("INFO", logger="adk_agentmesh.audit"):
+            handler.handle(event)
+        assert "test_event" in caplog.text
+        assert "agent" in caplog.text
+
+
+# ---------------------------------------------------------------------------
+# PolicyDecision
+# ---------------------------------------------------------------------------
+
+class TestPolicyDecision:
+    """PolicyDecision dataclass behavior."""
+
+    def test_defaults(self):
+        d = PolicyDecision(verdict=Verdict.ALLOW)
+        assert d.reason == ""
+        assert d.matched_rule == ""
+        assert d.metadata == {}
+        assert d.timestamp is not None
+
+    def test_verdict_enum_values(self):
+        assert Verdict.ALLOW.value == "allow"
+        assert Verdict.DENY.value == "deny"
+        assert Verdict.ESCALATE.value == "escalate"
+
+
+# ---------------------------------------------------------------------------
+# Delegation evaluation
+# ---------------------------------------------------------------------------
+
+class TestDelegationEvaluation:
+    """Agent delegation evaluation."""
+
+    @pytest.mark.asyncio
+    async def test_delegation_allowed_by_default(self):
+        evaluator = ADKPolicyEvaluator()
+        decision = await evaluator.evaluate_agent_delegation(
+            parent_agent="orchestrator",
+            child_agent="worker",
+        )
+        assert decision.verdict == Verdict.ALLOW
+
+    @pytest.mark.asyncio
+    async def test_delegation_logged(self):
+        evaluator = ADKPolicyEvaluator()
+        await evaluator.evaluate_agent_delegation(
+            parent_agent="orchestrator",
+            child_agent="worker",
+            scope="read_only",
+        )
+        log = evaluator.get_audit_log()
+        assert any(e["event"] == "delegation_evaluated" for e in log)
diff --git a/packages/agentmesh-integrations/dify-plugin/pyproject.toml b/packages/agentmesh-integrations/dify-plugin/pyproject.toml
index c7da59e6..3461302b 100644
--- a/packages/agentmesh-integrations/dify-plugin/pyproject.toml
+++ b/packages/agentmesh-integrations/dify-plugin/pyproject.toml
@@ -24,7 +24,7 @@ classifiers = [
     "Topic :: Security :: Cryptography",
 ]
 dependencies = [
-    "cryptography>=41.0.0",
+    "cryptography>=44.0.0,<47.0",
     "dify-plugin>=0.0.1",
 ]
 
diff --git a/packages/agentmesh-integrations/langchain-agentmesh/pyproject.toml b/packages/agentmesh-integrations/langchain-agentmesh/pyproject.toml
index c0cce62f..d36da0dd 100644
--- a/packages/agentmesh-integrations/langchain-agentmesh/pyproject.toml
+++ b/packages/agentmesh-integrations/langchain-agentmesh/pyproject.toml
@@ -35,7 +35,7 @@ classifiers = [
 ]
 dependencies = [
     "langchain-core>=0.2.0",
-    "cryptography>=41.0.0",
+    "cryptography>=44.0.0,<47.0",
 ]
 
 [project.optional-dependencies]
diff --git a/packages/agentmesh-integrations/langgraph-trust/pyproject.toml b/packages/agentmesh-integrations/langgraph-trust/pyproject.toml
index f222ee87..d36b2bfc 100644
--- a/packages/agentmesh-integrations/langgraph-trust/pyproject.toml
+++ b/packages/agentmesh-integrations/langgraph-trust/pyproject.toml
@@ -37,7 +37,7 @@ classifiers = [
     "Topic :: Security :: Cryptography",
 ]
 dependencies = [
-    "cryptography>=41.0.0",
+    "cryptography>=44.0.0,<47.0",
 ]
 
 [project.optional-dependencies]
diff --git a/packages/agentmesh-integrations/llamaindex-agentmesh/pyproject.toml b/packages/agentmesh-integrations/llamaindex-agentmesh/pyproject.toml
index 09f91337..76c8a976 100644
--- a/packages/agentmesh-integrations/llamaindex-agentmesh/pyproject.toml
+++ b/packages/agentmesh-integrations/llamaindex-agentmesh/pyproject.toml
@@ -17,7 +17,7 @@ authors = [{name = "AgentMesh Contributors"}]
 requires-python = ">=3.9,<4.0"
 readme = "README.md"
 license = "MIT"
-dependencies = ["llama-index-core>=0.13.0,<0.15.0", "cryptography>=41.0.0"]
+dependencies = ["llama-index-core>=0.13.0,<0.15.0", "cryptography>=44.0.0,<47.0"]
 
 [tool.hatch.build.targets.sdist]
 include = ["llama_index/"]
diff --git a/packages/agentmesh-integrations/nostr-wot/pyproject.toml b/packages/agentmesh-integrations/nostr-wot/pyproject.toml
index 8280d7e9..a2648882 100644
--- a/packages/agentmesh-integrations/nostr-wot/pyproject.toml
+++ b/packages/agentmesh-integrations/nostr-wot/pyproject.toml
@@ -11,7 +11,7 @@ license = {text = "MIT"}
 requires-python = ">=3.9"
 dependencies = [
     "agentmesh>=0.1.0",
-    "httpx>=0.25.0",
+    "httpx>=0.27.0",
 ]
 
 [project.optional-dependencies]