diff --git a/adapters/SECURITY.md b/adapters/SECURITY.md
index b45ecdd8..c064ac9e 100644
--- a/adapters/SECURITY.md
+++ b/adapters/SECURITY.md
@@ -19,7 +19,7 @@ below.
 | Adapter middleware (`nat/`) | In-process inside the agent's Python runtime. Same address space as the agent. |
 | Guardian process (`src/acs/guardian/`) | HTTP server. Holds the HMAC secret. Computes the rolling audit chain. |
 | Wire transport | JSON-RPC over HTTP (deployments wrap with HTTPS / mTLS for production). |
-| HMAC shared secret | Loaded from `ACS_HMAC_SECRET_FILE` (preferred) or `ACS_HMAC_SECRET` (env-var fallback). |
+| HMAC shared secret | Loaded from `ACS_HMAC_SECRET_FILE` (preferred) or `ACS_HMAC_SECRET` (env-var fallback), and named by the label in `ACS_HMAC_KEY_ID` (§10). A response signed under any other label fails verification; no other secret is tried. |
 | Cache files | `~/.cache/acs-adapter-handshake/` (ServerHello cache), `~/.cache/acs-adapter-session/` (per-session step-id tracking). |
 | Audit log | `ACS_AUDIT <json>` lines on adapter stderr. |
 
@@ -134,10 +134,10 @@ adding a test would be checking stdlib behavior.
 **T11 — Handshake downgrade.**
 Attacker MITMs the handshake response to claim the Guardian doesn't
 support signing, hoping the adapter then sends unsigned envelopes.
-*Mitigation:* The adapter signs iff its own `ACS_HMAC_SECRET` /
-`_FILE` is set, regardless of what `signature_algorithms_supported`
-the handshake advertised. The handshake's advertised algorithm list
-is informational; it does not control the adapter's signing behavior.
+*Mitigation:* The adapter signs every request with its own secret,
+whatever `signature_algorithms_supported` the handshake advertised,
+and a hook with no secret refuses its session and sends nothing. The
+handshake's advertised algorithm list does not control signing.
 *No test* — this is an absence of behavior. Verified by reading the
 code: `sign_envelope()` consults `load_hmac_secret()` only.
 
diff --git a/adapters/docs/claude_code/README.md b/adapters/docs/claude_code/README.md
index 191f39f2..49b4f5ae 100644
--- a/adapters/docs/claude_code/README.md
+++ b/adapters/docs/claude_code/README.md
@@ -10,7 +10,7 @@ This adapter is that command. On every hook event Claude Code spawns the adapter
 
 1. Reads the Claude Code hook event from stdin.
 2. Translates it to an ACS JSON-RPC envelope ([mapping.md](./mapping.md)).
-3. Signs it with HMAC-SHA256 (`ACS_HMAC_SECRET_FILE`).
+3. Signs it with HMAC-SHA256 (`ACS_HMAC_SECRET_FILE`, under the label `ACS_HMAC_KEY_ID`).
 4. POSTs to the Guardian.
 5. Verifies the response signature.
 6. Translates the verdict back to Claude Code's expected output shape and writes to stdout.
@@ -50,7 +50,7 @@ chmod 600 ~/.acs/hmac.key
 Use the example Guardian for testing; a production Guardian is the same wire protocol with a real policy engine attached.
 
 ```bash
-ACS_HMAC_SECRET_FILE=~/.acs/hmac.key \
+ACS_HMAC_SECRET_FILE=~/.acs/hmac.key ACS_HMAC_KEY_ID=2026-11 \
   acs-example-guardian --port 8787
 ```
 
@@ -66,12 +66,14 @@ Keep this terminal open. You should see `[guardian] listening on 127.0.0.1:8787`
 # Preview the change without touching the file
 acs-claude-code-wire \
   --guardian-url=http://127.0.0.1:8787/acs \
-  --secret-file=~/.acs/hmac.key
+  --secret-file=~/.acs/hmac.key \
+  --key-id=2026-11
 
 # Apply it (creates ~/.claude/settings.json.bak.<timestamp>)
 acs-claude-code-wire \
   --guardian-url=http://127.0.0.1:8787/acs \
   --secret-file=~/.acs/hmac.key \
+  --key-id=2026-11 \
   --write
 ```
 
@@ -174,53 +176,44 @@ Claude should refuse and surface the Guardian's `reasoning` field. The example G
 
 ### Smoke #4 — audit-cause differentiation
 
-Verifies that the adapter's audit log distinguishes "Guardian unreachable" (ops issue) from "Guardian rejected the envelope" (client/operator bug).
+Verifies that the adapter's audit log distinguishes a Guardian that rejected the request (a configuration error) from a Guardian it could not reach (an ops issue). Both commands run against the Guardian started above, on `127.0.0.1:8787` under the label `2026-11`.
 
-Unsigned envelope to a signing-required Guardian:
+A secret the Guardian does not hold, under the Guardian's label:
 
 ```bash
 ACS_GUARDIAN_URL="http://127.0.0.1:8787/acs" \
-ACS_HMAC_SECRET="" \
+ACS_HMAC_SECRET="$(openssl rand -hex 32)" ACS_HMAC_KEY_ID=2026-11 \
 acs-claude-code-hook 2>&1 <<'EOF'
 {"session_id":"11111111-1111-4111-8111-111111111111","transcript_path":"/tmp/t","cwd":"/tmp","permission_mode":"default","hook_event_name":"PreToolUse","tool_name":"Bash","tool_input":{"command":"echo test"}}
 EOF
 ```
 
-Expected stderr — note the `cause` field, and that a signature refusal
-fails CLOSED regardless of posture (a refusal is an alive Guardian
-rejecting the envelope; spec issue #32):
-
-```
-acs-adapter: Guardian returned JSON-RPC error -32004 (signature_invalid_response): SIGNATURE_INVALID
-ACS_AUDIT {"acs_audit_event": "guardian_refusal_fail_closed", "cause": "signature_invalid_response", ...}
-```
-
-And stdout carries a real deny:
+Expected: the Guardian answers the handshake with `-32004 SIGNATURE_INVALID`, signed with its own secret. The hook cannot verify that answer, so it refuses the session whatever the posture (spec issue #32), and stdout carries a deny:
 
 ```
-{"hookSpecificOutput": {"hookEventName": "PreToolUse", "permissionDecision": "deny", ...}}
+ACS_AUDIT {"acs_audit_event": "session_refused", "cause": "error_signature_invalid", "claimed_cause": "signature_invalid_response", "claimed_error_code": -32004, ...}
+ACS_AUDIT {"acs_audit_event": "session_refused_fail_closed", "cause": "error_signature_invalid", ..., "hook": "PreToolUse", ...}
+{"hookSpecificOutput": {"hookEventName": "PreToolUse", "permissionDecision": "deny", "permissionDecisionReason": "ACS adapter: session refused (error_signature_invalid)"}}
 ```
 
-Guardian unreachable (different cause, same disposition):
+Guardian unreachable, with the Guardian's secret and label:
 
 ```bash
 ACS_GUARDIAN_URL="http://127.0.0.1:1/dead" \
+ACS_HMAC_SECRET_FILE=~/.acs/hmac.key ACS_HMAC_KEY_ID=2026-11 \
 acs-claude-code-hook 2>&1 <<'EOF'
 {"session_id":"11111111-1111-4111-8111-111111111111","transcript_path":"/tmp/t","cwd":"/tmp","permission_mode":"default","hook_event_name":"PreToolUse","tool_name":"Bash","tool_input":{"command":"echo test"}}
 EOF
 ```
 
-Expected:
+Expected: the handshake gets no answer, so the session has no negotiated Guardian, and the hook's startup posture settles the step (fail-open when the hook sets no `ACS_DEFAULT_DENY`); stdout is empty, which Claude Code reads as proceed:
 
 ```
-acs-adapter: Guardian unreachable: <urlopen error ...>
-ACS_AUDIT {"acs_audit_event": "fail_open_bypass", "cause": "transport_failure", ...}
+ACS_AUDIT {"acs_audit_event": "session_without_negotiated_guardian", "cause": "transport_failure", "failure_class": "handshake_failure", "posture": "fail_open", ...}
+ACS_AUDIT {"acs_audit_event": "unguarded_session_bypass", "cause": "transport_failure", ..., "hook": "PreToolUse", ...}
 ```
 
-Distinct `acs_audit_event` AND distinct `cause`: refusals are always
-`guardian_refusal_fail_closed`; failures carry the posture
-(`fail_open_bypass` / `decision_failure_fail_closed`). Operators grep
-on either to triage.
+Distinct `acs_audit_event` and `cause`: a rejection refuses the session (`session_refused_fail_closed`) whatever the posture, and an unreachable Guardian follows the startup posture (`unguarded_session_bypass`, or `session_not_started_fail_closed` under a deny posture). Operators grep on either to triage. A hook with no secret sends nothing and refuses the session with `secret_missing`.
 
 ### Smoke #5 — pre-flight inventory (paranoid)
 
@@ -265,6 +258,7 @@ The adapter is configured by environment variables, typically set per-hook by `a
 | `ACS_GUARDIAN_URL` | `http://127.0.0.1:8787/acs` | Guardian endpoint. http/https only; SSRF allowlist refuses other schemes. |
 | `ACS_HMAC_SECRET_FILE` | (unset) | Path to a 0600 file holding the shared HMAC secret. |
 | `ACS_HMAC_SECRET` | (unset) | Inline secret. Less secure (visible in `ps eauxw`). Prefer the file. |
+| `ACS_HMAC_KEY_ID` | (unset) | The label that names the secret (§10); the Guardian holds the same one. Required with a secret: a secret without a label refuses the session, and a response signed under another label fails verification. |
 | `ACS_DEFAULT_DENY` | `0` | Fail-open with audit (§6.4 default). Set to `1` for fail-closed. The ServerHello's `on_decision_failure: deny` also flips it (most-restrictive-wins). Guardian refusals (bad signature, replay, malformed/oversized envelope) always fail closed regardless of this setting — see spec issue #32. |
 | `ACS_STARTUP_POSTURE` | follows `ACS_DEFAULT_DENY` | `proceed` or `refuse`: what this hook does in a session with no negotiated Guardian, because its handshake got no answer (§4.1). `proceed` lets the step run, audited, with nothing sent to the Guardian; `refuse` denies it. The session keeps no negotiated Guardian for its lifetime, and the next session handshakes again. Any other value refuses. |
 | `ACS_REQUIRE_PROFILES` | (unset) | Comma-separated conformance profiles the Guardian must accept, such as `acs-core`. When the session's negotiation leaves one out, this hook's steps are refused and it sends no `sessionStart`; the stored record keeps what the Guardian answered, so each hook applies its own setting, and a later hook without the requirement starts the session. |
@@ -288,14 +282,14 @@ Honest, item-by-item against the ACS-Core baseline in `docs/spec/conformance.md`
 | ACS-Core item | Status |
 |---|---|
 | Handshake (`handshake/hello`) | ✓ adapter sends ClientHello on the first event of a session; the decision (negotiated, refused, or no answer under `ACS_STARTUP_POSTURE`) holds for the session's lifetime (§4.1). |
-| Profiles (`profiles_supported` / `profiles_accepted`) | ✓ claims `acs-core` when a signing secret is configured and no profile without one. A ServerHello accepting a profile the adapter did not claim is not a valid answer, a claimed profile the Guardian leaves out is audited as `profile_not_accepted`, and a hook's `ACS_REQUIRE_PROFILES` turns a left-out profile into a refusal of that hook's steps. |
+| Profiles (`profiles_supported` / `profiles_accepted`) | ✓ always claims `acs-core`: a hook with no usable secret and label refuses its session before the handshake. A ServerHello accepting a profile the adapter did not claim is not a valid answer, a claimed profile the Guardian leaves out is audited as `profile_not_accepted`, and a hook's `ACS_REQUIRE_PROFILES` turns a left-out profile into a refusal of that hook's steps. |
 | JSON-RPC envelope shape (`request-envelope.json`) | ✓ validates against canonical schema for every mapped hook (`tests/test_envelope_schema.py`); format checking enforces `uuid` and `date-time`. |
 | Hook taxonomy (Core minimum set) | ✓ `sessionStart`, `userMessage`, `toolCallRequest`, `toolCallResult`, `agentResponse`, `sessionEnd`; plus `subagentStart`, which ACS-Core requires of a subagent-capable client. Claude Code spawns subagents through the Agent tool (legacy `Task`), and the adapter remaps that PreToolUse to `steps/subagentStart` (see mapping.md). `subagentStop`, which ACS-Core lists as SHOULD-emit, stays deliberately unmapped (see mapping.md). The adapter also emits the turn boundary: `turnStart` (emitted on UserPromptSubmit) / `turnEnd` (Stop). `preCompact` deliberately unmapped — the platform exposes no entry list (mapping.md). |
 | Dispositions (ALLOW/DENY/ASK/DEFER) | ✓ on **pre-execution** hooks (`PreToolUse`, `UserPromptSubmit`, `turnStart`); MODIFY partial (`PreToolUse` with `parameter_overrides`, merged onto the original input). **Post-execution and lifecycle hooks (`PostToolUse`, `Notification → agentResponse`, `Stop → turnEnd`, `SessionEnd`) are observation-only** — Claude Code fires them after the side effect / message / turn has occurred; a Guardian `deny` on those cannot undo it. See `mapping.md`. |
 | Unknown-disposition fail posture | ✓ default-deny honored on unknown verdicts when `ACS_DEFAULT_DENY=1`; spec-default fail-open path emits audit event. |
 | SessionContext + published `chain_hash` | ✓ session_id propagated; Guardian computes rolling SHA-256 chain per §8.2 (`adapters/test_acs_core_conformance.py::Core05_SessionContext`). |
 | Replay protection (`request_id` + `timestamp`) | ✓ adapter sends both; Guardian rejects duplicate `request_id` (REPLAY_DETECTED -32005) and timestamps outside skew window (TIMESTAMP_OUT_OF_WINDOW -32006) per §10.3. |
-| Baseline integrity (HMAC-SHA256 signature) | ✓ HKDF-derived per-session key signs every request and response when `ACS_HMAC_SECRET[_FILE]` is set; Guardian rejects unsigned/tampered with SIGNATURE_INVALID -32004. |
+| Baseline integrity (HMAC-SHA256 signature) | ✓ HKDF-derived per-session key signs every request and response under `ACS_HMAC_KEY_ID`; a hook with no secret of at least 32 bytes, or no label, refuses its session and sends nothing. The Guardian rejects an unsigned or tampered request with SIGNATURE_INVALID -32004. |
 | Decision honoring (§6.4) | ✓ adapter blocks on subprocess return; spec-default fail-open posture emits structured `ACS_AUDIT` event on every bypass; audit `cause` field distinguishes failure modes. |
 | Liveness `system/ping` | ⚠ Guardian-side only. ACS-Core says `system/ping` SHOULD be implemented: the Observed Agent declares it in `methods_implemented` and sends it, and the Guardian answers it (§13). The example Guardian answers ping as an always-allow method outside the chain, replay, and signature checks. The adapter does not declare or send `system/ping`, so a deployment that uses it must name an alternative liveness mechanism in its configuration, such as continuous observed hook traffic. Omitting both is non-conformant. |
 | `nonce` (optional replay field) | ✗ adapter does not emit `nonce`; the envelope field is OPTIONAL in v0.1. |
diff --git a/adapters/docs/claude_code/mapping.md b/adapters/docs/claude_code/mapping.md
index 7de4c2ab..f523ad08 100644
--- a/adapters/docs/claude_code/mapping.md
+++ b/adapters/docs/claude_code/mapping.md
@@ -6,8 +6,8 @@ Each Claude Code hook event maps to an ACS `steps/*` method. The adapter (`src/a
 
 | Claude Code hook | ACS step method | Notes |
 |---|---|---|
-| `SessionStart` | `steps/sessionStart` | Session bounds, sent once per session by the hook process that opens the session and built from its event (see Concurrency). A `SessionStart` with `source: resume` or `compact` in a session that already started sends nothing. A Guardian `deny`, or a refusal of the request, refuses the session: every later step of it is denied in its hook's own shape. A `sessionStart` that gets no decision is recorded, and each later hook settles its step with its own fail posture. Session-level — carries no `turn_id`. |
-| `SessionEnd` | `steps/sessionEnd` | Session close (chain seal). Session-level — no `turn_id`. |
+| `SessionStart` | `steps/sessionStart` | Session bounds, sent once per session by the hook process that opens the session and built from its event (see Concurrency). A `SessionStart` with `source: resume` or `compact` in a session that already started sends nothing. A Guardian `deny`, or a refusal of the request, refuses the session: every later step of it is denied in its hook's own shape. A `sessionStart` that gets no decision is recorded, and each later hook settles its step with its own fail posture; `sessionEnd`, which is audit-only, goes out under either posture and reports that failure (§6.4). Session-level — carries no `turn_id`. |
+| `SessionEnd` | `steps/sessionEnd` | Session close (chain seal). Carries `summary.decision_failures`, the session's decision failures per failure class (§6.4). Session-level — no `turn_id`. |
 | `UserPromptSubmit` | `steps/turnStart` **then** `steps/userMessage` | A prompt OPENS a turn: the adapter first emits a decision-eligible `steps/turnStart` (`triggered_by: user_message`; a Guardian MAY `deny` to block the whole turn), then the `steps/userMessage` carrying the `prompt`. Both — and every in-turn step below — carry `metadata.turn_id`. The `turn_id` is held in per-session state until the matching `Stop`. |
 | `Stop` | `steps/turnEnd` | End of a **turn** (every reply), not the session. `steps/sessionEnd` "seals the chain" once per session, so mapping `Stop` there sealed it after every reply; `steps/turnEnd` (audit-only, `outcome: completed`) is the correct per-turn boundary and echoes the open turn's `turn_id`. A `Stop` with no open turn is skipped + audited (`turn_end_no_open_turn`) rather than emitting a fabricated `turn_id`. |
 | `PreToolUse` | `steps/toolCallRequest` | Fires before the tool runs. Decision gates execution. Carries `metadata.turn_id`. |
@@ -34,7 +34,7 @@ Block-shape hooks are only those where a block actually PREVENTS the action: `Po
 | `ask` | `…"permissionDecision": "ask"` — **native**; Claude Code surfaces its own approval prompt | substituted to `block` |
 | `defer` | substituted to `deny` + `defer_substituted_deny` audit event (no native defer in `permissionDecision`) | substituted to `block` |
 
-An arrived decision the host CANNOT apply is substituted to a block/deny (never silently proceeded) and audited. Note the substitutions here are **deployment behavior, not spec-mandated**: §9.2 places disposition substitution on the Guardian, and §6's `timeout_decision: deny` default governs an *expired* defer, not an instant client-side substitution. A deployment that needs approver-driven resumption should run ACS-Core's ASK/DEFER flow at the Guardian layer and have the Guardian return an effective decision before responding to the adapter. A contradictory `modifications` object (both wholesale + structured, or overlapping targets) fails closed to `deny` per §6.3:146.
+An arrived decision the host CANNOT apply is substituted to a block/deny (never silently proceeded) and audited. A MODIFY the host cannot apply is a DENY recorded as `modify_unsupported` with `reason_codes: ["modify_unsupported"]` (§6.5): redactions or replacement content on a tool call, structured edits on a tool result, and any MODIFY on a prompt. Note the ASK and DEFER substitutions here are **deployment behavior, not spec-mandated**: §9.2 places disposition substitution on the Guardian, and §6's `timeout_decision: deny` default governs an *expired* defer, not an instant client-side substitution. A deployment that needs approver-driven resumption should run ACS-Core's ASK/DEFER flow at the Guardian layer and have the Guardian return an effective decision before responding to the adapter. A contradictory `modifications` object (both wholesale + structured, or overlapping targets) fails closed to `deny` per §6.3:146.
 
 ## Concurrency
 
@@ -42,13 +42,13 @@ Claude Code can run the hooks of parallel tool calls at the same time. The first
 
 ## Conformance posture
 
-The Claude Code adapter covers ACS-Core's mandatory floor as listed below. This is the floor the tests check, not a full ACS-Core conformance claim (see `adapters/README.md`). Three ACS-Core requirements from later specification changes follow in separate PRs: the `key_id` taken from configuration (§10, #272); decision failures recorded with their failure class and counted at `sessionEnd` (§6.4, #273); and a signature on every request, where today an adapter with no secret configured sends unsigned requests (§10). Every row below describes what the code in `adapter.py` actually does — this table drifted from the code once (PR #22 review caught six false claims in it), so treat the code as ground truth and this table as its description:
+The Claude Code adapter covers ACS-Core's mandatory floor as listed below. This is the floor the tests check, not a full ACS-Core conformance claim (see `adapters/README.md`). Every row below describes what the code in `adapter.py` actually does — this table drifted from the code once (PR #22 review caught six false claims in it), so treat the code as ground truth and this table as its description:
 
 - Handshake: `handshake/hello` is performed on the first hook event of a session, and its answer decides the session (§4.1): a verified ServerHello negotiates; a refusal, or an answer that fails its checks, refuses every step; and no answer leaves the session with no negotiated Guardian, so each hook's `ACS_STARTUP_POSTURE` applies (`proceed` lets the step run with nothing sent to the Guardian; `refuse` denies it). The decision is stored in `~/.cache/acs-adapter-handshake/` with an HMAC under the session key over the decision, the session and the Guardian URL, and holds for the session's lifetime, so a dead Guardian costs one timeout per session; a record that fails its checks, or a decision that cannot be stored, refuses the session. The ServerHello's response envelope is signature-verified and bound to the ClientHello before it is stored; its `on_decision_failure` combines with `ACS_DEFAULT_DENY` (deny wins over proceed), and its `timeout_config` replaces the local decision timeout, per method where `per_method_ms` names one (§6.4). The ServerHello must answer the ClientHello: a `negotiated_version` sharing a major version the adapter offered, a `methods_evaluated` list, the one transport the adapter offers (its Guardian URL's scheme), a positive `timeout_config.default_ms`, an `on_decision_failure` of `proceed` or `deny`, and only profiles the adapter claimed; otherwise the session has no negotiated Guardian (`invalid_server_hello`). Its `methods_evaluated` bounds what is sent: a method the Guardian omits resolves as ALLOW-by-default without being sent (handshake.json) and is recorded as `method_not_evaluated`; the hook returns no output, so Claude Code's own permission flow still applies, and a result never cites a request that was not sent. With no negotiated list, every mapped hook is sent. `ACS_HANDSHAKE=0` skips the handshake, and the startup posture settles every step.
 - Turns: a `UserPromptSubmit` opens a turn with an explicit `steps/turnStart` (decision-eligible) before the `steps/userMessage`; `Stop` closes it with `steps/turnEnd`. The `turn_id` is held in per-session state and stamped on `metadata.turn_id` of every in-turn step; session-level steps (`sessionStart`/`sessionEnd`) carry none.
 - Dispositions: ALLOW / DENY / ASK are honored natively on `PreToolUse` (`permissionDecision`); MODIFY via `updatedInput` (overrides merged onto the original input) when a usable `parameter_overrides` object is present; DEFER substitutes to deny with an audit event. **Post-execution and lifecycle hooks (`PostToolUse`, `Notification → agentResponse`, `Stop → turnEnd`, `SessionEnd`, `SubagentStop`) are observation-only**: Claude Code fires them after the action / message / turn / session has completed; a Guardian `deny` cannot undo the side effect. Deployments needing pre-delivery gating must place the gate at `UserPromptSubmit` (prompt / turn start) for prompts or `PreToolUse` for tools.
 - Session context: `session_id` comes from Claude Code's own hook event field on every request; the Guardian-side audit chain accumulates against it. `agent_id` is `ACS_AGENT_ID` when set, else derived as `claude-code:<sha8(cwd)>`.
 - Replay protection: `request_id` (UUID) and `timestamp` are populated on every request. `PreToolUse` request_ids are deterministic (UUID5 of Claude Code's `tool_use_id`) so the matching `PostToolUse` can cite `request_id_ref`.
-- Baseline integrity: HMAC-SHA256 per §10 over the RFC 8785 (JCS) canonical envelope, with an HKDF-derived per-session key from `ACS_HMAC_SECRET_FILE` / `ACS_HMAC_SECRET`. `rfc8785` is a hard dependency (no fallback canonicalization — §10 permits none). Responses are signature-verified AND bound to their request (`id` + `request_id`) under any HTTP status; a mis-bound, badly-signed or unverifiable response fails closed regardless of posture. Without a secret the adapter runs unsigned and says so with a loud `unsigned_mode` audit event.
-- Decision honoring: the fail posture defaults to `proceed` (fail-open with audit event), matching §6.4's default. `ACS_DEFAULT_DENY=1` or a ServerHello `on_decision_failure: deny` flips it to fail-closed (most-restrictive-wins). Guardian **refusals** (`SIGNATURE_INVALID`, `REPLAY_DETECTED`, `TIMESTAMP_OUT_OF_WINDOW`, malformed/oversized envelope) always fail closed regardless of posture — a refusal is an alive Guardian rejecting the envelope, and each refusal is attacker-reachable (spec issue #32).
+- Baseline integrity: HMAC-SHA256 per §10 over the RFC 8785 (JCS) canonical envelope, with an HKDF-derived per-session key from `ACS_HMAC_SECRET_FILE` / `ACS_HMAC_SECRET`. The signature names the configured label `ACS_HMAC_KEY_ID` as `key_id`, and a response under any other label fails verification with no other secret tried; an unsigned `SIGNATURE_INVALID`, a Guardian's answer to a label it does not hold, is recorded as `key_id_rejected` and fails closed. `rfc8785` is a hard dependency (no fallback canonicalization — §10 permits none). Responses are signature-verified AND bound to their request (`id` + `request_id`) under any HTTP status; a mis-bound, badly-signed or unverifiable response fails closed regardless of posture. A hook with no secret, a secret under 32 bytes, or no label refuses its session and sends nothing (`secret_missing`, `secret_too_short`, `key_id_missing`), whatever the posture: ACS-Core signs every request.
+- Decision honoring: the fail posture defaults to `proceed` (fail-open with audit event), matching §6.4's default. `ACS_DEFAULT_DENY=1` or a ServerHello `on_decision_failure: deny` flips it to fail-closed (most-restrictive-wins). Guardian **refusals** (`SIGNATURE_INVALID`, `REPLAY_DETECTED`, `TIMESTAMP_OUT_OF_WINDOW`, malformed/oversized envelope) always fail closed regardless of posture — a refusal is an alive Guardian rejecting the envelope, and each refusal is attacker-reachable (spec issue #32). Every decision failure is audited under either posture with its `failure_class` (`timeout`, `unreachable`, `malformed_response`, `guardian_error`, `observed_agent_error`, `signature_invalid`, `handshake_failure`, `other`) and `posture`, and `sessionEnd` reports the session's count per class in `summary.decision_failures` (§6.4, #273). A handshake that gets no answer is audited as `handshake_failure`; that session sends the Guardian nothing, `sessionEnd` included (§4.1).
 - Audit: every fail-open proceed, refusal, substitution, unevaluated method, and unmapped event emits an `ACS_AUDIT` line to stderr and, when `ACS_AUDIT_FILE` is set, appends to that file (0600).
diff --git a/adapters/docs/claude_code/settings.json.example b/adapters/docs/claude_code/settings.json.example
index e6a33efb..a4b70354 100644
--- a/adapters/docs/claude_code/settings.json.example
+++ b/adapters/docs/claude_code/settings.json.example
@@ -13,9 +13,10 @@
     "Replace ACS_GUARDIAN_URL with your deployment's endpoint and the",
     "/path/to/ placeholders with real absolute paths.",
     "",
-    "ACS_HMAC_SECRET_FILE: REQUIRED for ACS-Core baseline integrity (\u00a710).",
-    "Without a secret both ends run unsigned and any local process that",
-    "binds the Guardian port first becomes the Guardian. Generate one:",
+    "ACS_HMAC_SECRET_FILE: REQUIRED for ACS-Core baseline integrity (\u00a710), at least 32 bytes.",
+    "ACS_HMAC_KEY_ID: REQUIRED with the secret. The label that names it; the Guardian holds the same one.",
+    "Without a secret and its label every hook refuses its session and",
+    "denies every step. Generate one:",
     "  mkdir -p ~/.acs && openssl rand -hex 32 > ~/.acs/hmac.key && chmod 600 ~/.acs/hmac.key",
     "and give the SAME file to the Guardian.",
     "",
@@ -36,7 +37,7 @@
         "hooks": [
           {
             "type": "command",
-            "command": "ACS_GUARDIAN_URL=http://127.0.0.1:8787/acs ACS_HMAC_SECRET_FILE=/path/to/.acs/hmac.key ACS_AUDIT_FILE=/path/to/.acs/audit.log /path/to/acs-claude-code-hook # acs-adapter-wired"
+            "command": "ACS_GUARDIAN_URL=http://127.0.0.1:8787/acs ACS_HMAC_SECRET_FILE=/path/to/.acs/hmac.key ACS_HMAC_KEY_ID=2026-11 ACS_AUDIT_FILE=/path/to/.acs/audit.log /path/to/acs-claude-code-hook # acs-adapter-wired"
           }
         ]
       }
@@ -47,7 +48,7 @@
         "hooks": [
           {
             "type": "command",
-            "command": "ACS_GUARDIAN_URL=http://127.0.0.1:8787/acs ACS_HMAC_SECRET_FILE=/path/to/.acs/hmac.key ACS_DEFAULT_DENY=1 ACS_AUDIT_FILE=/path/to/.acs/audit.log /path/to/acs-claude-code-hook # acs-adapter-wired"
+            "command": "ACS_GUARDIAN_URL=http://127.0.0.1:8787/acs ACS_HMAC_SECRET_FILE=/path/to/.acs/hmac.key ACS_HMAC_KEY_ID=2026-11 ACS_DEFAULT_DENY=1 ACS_AUDIT_FILE=/path/to/.acs/audit.log /path/to/acs-claude-code-hook # acs-adapter-wired"
           }
         ]
       }
@@ -58,7 +59,7 @@
         "hooks": [
           {
             "type": "command",
-            "command": "ACS_GUARDIAN_URL=http://127.0.0.1:8787/acs ACS_HMAC_SECRET_FILE=/path/to/.acs/hmac.key ACS_DEFAULT_DENY=1 ACS_AUDIT_FILE=/path/to/.acs/audit.log /path/to/acs-claude-code-hook # acs-adapter-wired"
+            "command": "ACS_GUARDIAN_URL=http://127.0.0.1:8787/acs ACS_HMAC_SECRET_FILE=/path/to/.acs/hmac.key ACS_HMAC_KEY_ID=2026-11 ACS_DEFAULT_DENY=1 ACS_AUDIT_FILE=/path/to/.acs/audit.log /path/to/acs-claude-code-hook # acs-adapter-wired"
           }
         ]
       }
@@ -69,7 +70,7 @@
         "hooks": [
           {
             "type": "command",
-            "command": "ACS_GUARDIAN_URL=http://127.0.0.1:8787/acs ACS_HMAC_SECRET_FILE=/path/to/.acs/hmac.key ACS_AUDIT_FILE=/path/to/.acs/audit.log /path/to/acs-claude-code-hook # acs-adapter-wired"
+            "command": "ACS_GUARDIAN_URL=http://127.0.0.1:8787/acs ACS_HMAC_SECRET_FILE=/path/to/.acs/hmac.key ACS_HMAC_KEY_ID=2026-11 ACS_AUDIT_FILE=/path/to/.acs/audit.log /path/to/acs-claude-code-hook # acs-adapter-wired"
           }
         ]
       }
@@ -80,7 +81,7 @@
         "hooks": [
           {
             "type": "command",
-            "command": "ACS_GUARDIAN_URL=http://127.0.0.1:8787/acs ACS_HMAC_SECRET_FILE=/path/to/.acs/hmac.key ACS_AUDIT_FILE=/path/to/.acs/audit.log /path/to/acs-claude-code-hook # acs-adapter-wired"
+            "command": "ACS_GUARDIAN_URL=http://127.0.0.1:8787/acs ACS_HMAC_SECRET_FILE=/path/to/.acs/hmac.key ACS_HMAC_KEY_ID=2026-11 ACS_AUDIT_FILE=/path/to/.acs/audit.log /path/to/acs-claude-code-hook # acs-adapter-wired"
           }
         ]
       }
@@ -91,7 +92,7 @@
         "hooks": [
           {
             "type": "command",
-            "command": "ACS_GUARDIAN_URL=http://127.0.0.1:8787/acs ACS_HMAC_SECRET_FILE=/path/to/.acs/hmac.key ACS_AUDIT_FILE=/path/to/.acs/audit.log /path/to/acs-claude-code-hook # acs-adapter-wired"
+            "command": "ACS_GUARDIAN_URL=http://127.0.0.1:8787/acs ACS_HMAC_SECRET_FILE=/path/to/.acs/hmac.key ACS_HMAC_KEY_ID=2026-11 ACS_AUDIT_FILE=/path/to/.acs/audit.log /path/to/acs-claude-code-hook # acs-adapter-wired"
           }
         ]
       }
@@ -102,7 +103,7 @@
         "hooks": [
           {
             "type": "command",
-            "command": "ACS_GUARDIAN_URL=http://127.0.0.1:8787/acs ACS_HMAC_SECRET_FILE=/path/to/.acs/hmac.key ACS_AUDIT_FILE=/path/to/.acs/audit.log /path/to/acs-claude-code-hook # acs-adapter-wired"
+            "command": "ACS_GUARDIAN_URL=http://127.0.0.1:8787/acs ACS_HMAC_SECRET_FILE=/path/to/.acs/hmac.key ACS_HMAC_KEY_ID=2026-11 ACS_AUDIT_FILE=/path/to/.acs/audit.log /path/to/acs-claude-code-hook # acs-adapter-wired"
           }
         ]
       }
diff --git a/adapters/docs/cursor/README.md b/adapters/docs/cursor/README.md
index a49aa490..187c7614 100644
--- a/adapters/docs/cursor/README.md
+++ b/adapters/docs/cursor/README.md
@@ -10,7 +10,7 @@ This adapter is that command. On every hook event Cursor spawns it as a subproce
 
 1. Reads the Cursor hook event from stdin.
 2. Translates it to an ACS JSON-RPC envelope ([mapping.md](./mapping.md)).
-3. Signs it with HMAC-SHA256 (`ACS_HMAC_SECRET_FILE`).
+3. Signs it with HMAC-SHA256 (`ACS_HMAC_SECRET_FILE`, under the label `ACS_HMAC_KEY_ID`).
 4. POSTs to the Guardian.
 5. Verifies the response signature.
 6. Translates the verdict back to Cursor's expected output shape and writes to stdout (or exits with code 2 for `beforeSubmitPrompt`).
@@ -50,7 +50,7 @@ chmod 600 ~/.acs/hmac.key
 Use the example Guardian for testing; a production Guardian is the same wire protocol with a real policy engine attached.
 
 ```bash
-ACS_HMAC_SECRET_FILE=~/.acs/hmac.key \
+ACS_HMAC_SECRET_FILE=~/.acs/hmac.key ACS_HMAC_KEY_ID=2026-11 \
   acs-example-guardian --port 8787
 ```
 
@@ -72,18 +72,21 @@ Cursor runs the hooks from every source below and merges their answers, with any
 # Preview wiring into ~/.cursor/hooks.json (default — user-level)
 acs-cursor-wire \
   --guardian-url=http://127.0.0.1:8787/acs \
-  --secret-file=~/.acs/hmac.key
+  --secret-file=~/.acs/hmac.key \
+  --key-id=2026-11
 
 # Apply user-level wiring
 acs-cursor-wire \
   --guardian-url=http://127.0.0.1:8787/acs \
   --secret-file=~/.acs/hmac.key \
+  --key-id=2026-11 \
   --write
 
 # OR — project-level wiring for a specific workspace
 acs-cursor-wire \
   --guardian-url=http://127.0.0.1:8787/acs \
   --secret-file=~/.acs/hmac.key \
+  --key-id=2026-11 \
   --settings=./.cursor/hooks.json \
   --write
 ```
@@ -185,48 +188,44 @@ The example Guardian's regex matches `rm -rf /...`; Cursor surfaces the Guardian
 
 ### Smoke #4 — audit-cause differentiation
 
-Verifies the adapter's audit log distinguishes "Guardian unreachable" (ops issue) from "Guardian rejected the envelope" (client/operator bug).
+Verifies that the adapter's audit log distinguishes a Guardian that rejected the request (a configuration error) from a Guardian it could not reach (an ops issue). Both commands run against the Guardian started above, on `127.0.0.1:8787` under the label `2026-11`.
 
-Unsigned envelope to a signing-required Guardian:
+A secret the Guardian does not hold, under the Guardian's label:
 
 ```bash
 ACS_GUARDIAN_URL="http://127.0.0.1:8787/acs" \
-ACS_HMAC_SECRET="" \
+ACS_HMAC_SECRET="$(openssl rand -hex 32)" ACS_HMAC_KEY_ID=2026-11 \
 acs-cursor-hook preToolUse 2>&1 <<'EOF'
 {"session_id":"11111111-1111-4111-8111-111111111111","tool_name":"Bash","tool_input":{"command":"echo test"}}
 EOF
 ```
 
-Expected stderr — a signature refusal fails CLOSED regardless of
-posture (a refusal is an alive Guardian rejecting the envelope; spec
-issue #32), and stdout carries `{"permission": "deny", ...}`:
+Expected: the Guardian answers the handshake with `-32004 SIGNATURE_INVALID`, signed with its own secret. The hook cannot verify that answer, so it refuses the session whatever the posture (spec issue #32), and stdout carries a deny:
 
 ```
-acs-adapter: Guardian returned JSON-RPC error -32004 (signature_invalid_response): SIGNATURE_INVALID
-ACS_AUDIT {"acs_audit_event": "guardian_refusal_fail_closed", "cause": "signature_invalid_response", ...}
+ACS_AUDIT {"acs_audit_event": "session_refused", "cause": "error_signature_invalid", "claimed_cause": "signature_invalid_response", "claimed_error_code": -32004, ...}
+ACS_AUDIT {"acs_audit_event": "session_refused_fail_closed", "cause": "error_signature_invalid", ..., "event": "preToolUse", ...}
+{"permission": "deny", "user_message": "ACS adapter: session refused (error_signature_invalid)", "agent_message": "ACS adapter: session refused (error_signature_invalid)"}
 ```
 
-Guardian unreachable (a decision FAILURE, not a refusal — this one
-follows the §6.4 posture, fail-open by default):
+Guardian unreachable, with the Guardian's secret and label:
 
 ```bash
 ACS_GUARDIAN_URL="http://127.0.0.1:1/dead" \
+ACS_HMAC_SECRET_FILE=~/.acs/hmac.key ACS_HMAC_KEY_ID=2026-11 \
 acs-cursor-hook preToolUse 2>&1 <<'EOF'
 {"session_id":"11111111-1111-4111-8111-111111111111","tool_name":"Bash","tool_input":{"command":"echo test"}}
 EOF
 ```
 
-Expected:
+Expected: the handshake gets no answer, so the session has no negotiated Guardian, and the hook's startup posture settles the step (fail-open when the hook sets no `ACS_DEFAULT_DENY`); stdout carries `{"permission": "allow"}`:
 
 ```
-acs-adapter: Guardian unreachable: <urlopen error ...>
-ACS_AUDIT {"acs_audit_event": "fail_open_bypass", "cause": "transport_failure", ...}
+ACS_AUDIT {"acs_audit_event": "session_without_negotiated_guardian", "cause": "transport_failure", "failure_class": "handshake_failure", "posture": "fail_open", ...}
+ACS_AUDIT {"acs_audit_event": "unguarded_session_bypass", "cause": "transport_failure", ..., "event": "preToolUse", ...}
 ```
 
-Distinct `acs_audit_event` AND distinct `cause`: refusals are always
-`guardian_refusal_fail_closed`; failures carry the posture
-(`fail_open_bypass` / `decision_failure_fail_closed`). Operators grep
-on either to triage.
+Distinct `acs_audit_event` and `cause`: a rejection refuses the session (`session_refused_fail_closed`) whatever the posture, and an unreachable Guardian follows the startup posture (`unguarded_session_bypass`, or `session_not_started_fail_closed` under a deny posture). Operators grep on either to triage. A hook with no secret sends nothing and refuses the session with `secret_missing`.
 
 ### Smoke #5 — pre-flight inventory (paranoid)
 
@@ -288,6 +287,7 @@ The adapter is configured by environment variables, typically set per-hook by `a
 | `ACS_GUARDIAN_URL` | `http://127.0.0.1:8787/acs` | Guardian endpoint. http/https only; SSRF allowlist refuses other schemes. |
 | `ACS_HMAC_SECRET_FILE` | (unset) | Path to a 0600 file holding the shared HMAC secret. |
 | `ACS_HMAC_SECRET` | (unset) | Inline secret. Less secure (visible in `ps eauxw`). Prefer the file. |
+| `ACS_HMAC_KEY_ID` | (unset) | The label that names the secret (§10); the Guardian holds the same one. Required with a secret: a secret without a label refuses the session, and a response signed under another label fails verification. |
 | `ACS_DEFAULT_DENY` | `0` | Fail-open with audit (§6.4 default). Set to `1` for fail-closed. The ServerHello's `on_decision_failure: deny` also flips it (most-restrictive-wins). Guardian refusals (bad signature, replay, malformed/oversized envelope) always fail closed regardless of this setting — see spec issue #32. |
 | `ACS_STARTUP_POSTURE` | follows `ACS_DEFAULT_DENY` | `proceed` or `refuse`: what this hook does in a session with no negotiated Guardian, because its handshake got no answer (§4.1). `proceed` lets the step run, audited, with nothing sent to the Guardian; `refuse` denies it. The session keeps no negotiated Guardian for its lifetime, and the next session handshakes again. Any other value refuses. |
 | `ACS_REQUIRE_PROFILES` | (unset) | Comma-separated conformance profiles the Guardian must accept, such as `acs-core`. When the session's negotiation leaves one out, this hook's steps are refused and it sends no `sessionStart`; the stored record keeps what the Guardian answered, so each hook applies its own setting, and a later hook without the requirement starts the session. |
@@ -314,14 +314,14 @@ Honest, item-by-item against the ACS-Core baseline in `docs/spec/conformance.md`
 | ACS-Core item | Status |
 |---|---|
 | Handshake (`handshake/hello`) | ✓ on the first event of a session; the decision (negotiated, refused, or no answer under `ACS_STARTUP_POSTURE`) holds for the session's lifetime (§4.1) |
-| Profiles (`profiles_supported` / `profiles_accepted`) | ✓ claims `acs-core` when a signing secret is configured and no profile without one. A ServerHello accepting a profile the adapter did not claim is not a valid answer, a claimed profile the Guardian leaves out is audited as `profile_not_accepted`, and a hook's `ACS_REQUIRE_PROFILES` turns a left-out profile into a refusal of that hook's steps. |
+| Profiles (`profiles_supported` / `profiles_accepted`) | ✓ always claims `acs-core`: a hook with no usable secret and label refuses its session before the handshake. A ServerHello accepting a profile the adapter did not claim is not a valid answer, a claimed profile the Guardian leaves out is audited as `profile_not_accepted`, and a hook's `ACS_REQUIRE_PROFILES` turns a left-out profile into a refusal of that hook's steps. |
 | JSON-RPC envelope shape (`request-envelope.json`) | ✓ validates against canonical schema for every mapped hook (emission suite), with format checking |
 | Hook taxonomy (Core minimum set) | ✓ the six unconditional hooks are covered, and so is `subagentStart`, which ACS-Core requires of a subagent-capable client. Cursor exposes the spawn boundary, and the default wiring gates it fail-closed. Seventeen Cursor events are mapped in total; `subagentStop` is intentionally omitted — see the honesty table below. |
 | Dispositions | ALLOW / DENY / ASK supported on **permission (pre-execution) events** (`preToolUse`, `beforeShellExecution`, `beforeMCPExecution`, `beforeSubmitPrompt`, `subagentStart`). DEFER substituted to ASK (Cursor has no defer). MODIFY supported on `preToolUse` via `updated_input`. A `deny` on `sessionStart` refuses the session, so every later step of it is denied. **Lifecycle / post-execution hooks (`afterAgentResponse → steps/agentResponse`, `sessionEnd`, `afterShellExecution`, etc.) are observation-only** — Cursor fires them after the message / side effect has occurred; a Guardian `deny` cannot undo it. See `mapping.md`. |
 | Unknown-disposition fail posture | ✓ |
 | SessionContext + published `chain_hash` | ✓ session_id coerced to UUID; Guardian computes rolling SHA-256 chain |
 | Replay protection | ✓ Guardian enforcement (REPLAY_DETECTED -32005, TIMESTAMP_OUT_OF_WINDOW -32006) |
-| Baseline integrity (HMAC-SHA256) | ✓ when `ACS_HMAC_SECRET[_FILE]` is set; SIGNATURE_INVALID -32004 on tamper |
+| Baseline integrity (HMAC-SHA256) | ✓ every request and response signed under `ACS_HMAC_KEY_ID`; a hook with no secret of at least 32 bytes, or no label, refuses its session and sends nothing; SIGNATURE_INVALID -32004 on tamper |
 | Decision honoring (§6.4) | ✓ Cursor blocks on permission deny; adapter answers every decided step in Cursor's documented JSON; fail-open emits `ACS_AUDIT` event; audit `cause` field distinguishes failure modes (transport vs signature vs malformed envelope vs replay vs skew) |
 | Liveness `system/ping` | ⚠ Guardian-side only. ACS-Core says `system/ping` SHOULD be implemented: the Observed Agent declares it in `methods_implemented` and sends it, and the Guardian answers it (§13). The example Guardian answers ping as an always-allow method outside the chain, replay, and signature checks. The adapter does not declare or send `system/ping`, so a deployment that uses it must name an alternative liveness mechanism in its configuration, such as continuous observed hook traffic. Omitting both is non-conformant. |
 | `nonce` (optional replay field) | ✗ adapter does not emit `nonce`; the envelope field is OPTIONAL in v0.1 |
diff --git a/adapters/docs/cursor/hooks.json.example b/adapters/docs/cursor/hooks.json.example
index 57cc11f7..e0c26d25 100644
--- a/adapters/docs/cursor/hooks.json.example
+++ b/adapters/docs/cursor/hooks.json.example
@@ -4,62 +4,62 @@
   "hooks": {
     "sessionStart": [
       {
-        "command": "ACS_GUARDIAN_URL=http://127.0.0.1:8787/acs ACS_HMAC_SECRET_FILE=/path/to/.acs/hmac.key ACS_AUDIT_FILE=/path/to/.acs/audit.log /path/to/acs-cursor-hook sessionStart"
+        "command": "ACS_GUARDIAN_URL=http://127.0.0.1:8787/acs ACS_HMAC_SECRET_FILE=/path/to/.acs/hmac.key ACS_HMAC_KEY_ID=2026-11 ACS_AUDIT_FILE=/path/to/.acs/audit.log /path/to/acs-cursor-hook sessionStart"
       }
     ],
     "beforeSubmitPrompt": [
       {
-        "command": "ACS_GUARDIAN_URL=http://127.0.0.1:8787/acs ACS_HMAC_SECRET_FILE=/path/to/.acs/hmac.key ACS_AUDIT_FILE=/path/to/.acs/audit.log ACS_DEFAULT_DENY=1 /path/to/acs-cursor-hook beforeSubmitPrompt",
+        "command": "ACS_GUARDIAN_URL=http://127.0.0.1:8787/acs ACS_HMAC_SECRET_FILE=/path/to/.acs/hmac.key ACS_HMAC_KEY_ID=2026-11 ACS_AUDIT_FILE=/path/to/.acs/audit.log ACS_DEFAULT_DENY=1 /path/to/acs-cursor-hook beforeSubmitPrompt",
         "failClosed": true
       }
     ],
     "preToolUse": [
       {
-        "command": "ACS_GUARDIAN_URL=http://127.0.0.1:8787/acs ACS_HMAC_SECRET_FILE=/path/to/.acs/hmac.key ACS_AUDIT_FILE=/path/to/.acs/audit.log ACS_DEFAULT_DENY=1 /path/to/acs-cursor-hook preToolUse",
+        "command": "ACS_GUARDIAN_URL=http://127.0.0.1:8787/acs ACS_HMAC_SECRET_FILE=/path/to/.acs/hmac.key ACS_HMAC_KEY_ID=2026-11 ACS_AUDIT_FILE=/path/to/.acs/audit.log ACS_DEFAULT_DENY=1 /path/to/acs-cursor-hook preToolUse",
         "failClosed": true
       }
     ],
     "postToolUse": [
       {
-        "command": "ACS_GUARDIAN_URL=http://127.0.0.1:8787/acs ACS_HMAC_SECRET_FILE=/path/to/.acs/hmac.key ACS_AUDIT_FILE=/path/to/.acs/audit.log /path/to/acs-cursor-hook postToolUse"
+        "command": "ACS_GUARDIAN_URL=http://127.0.0.1:8787/acs ACS_HMAC_SECRET_FILE=/path/to/.acs/hmac.key ACS_HMAC_KEY_ID=2026-11 ACS_AUDIT_FILE=/path/to/.acs/audit.log /path/to/acs-cursor-hook postToolUse"
       }
     ],
     "beforeShellExecution": [
       {
-        "command": "ACS_GUARDIAN_URL=http://127.0.0.1:8787/acs ACS_HMAC_SECRET_FILE=/path/to/.acs/hmac.key ACS_AUDIT_FILE=/path/to/.acs/audit.log ACS_DEFAULT_DENY=1 /path/to/acs-cursor-hook beforeShellExecution",
+        "command": "ACS_GUARDIAN_URL=http://127.0.0.1:8787/acs ACS_HMAC_SECRET_FILE=/path/to/.acs/hmac.key ACS_HMAC_KEY_ID=2026-11 ACS_AUDIT_FILE=/path/to/.acs/audit.log ACS_DEFAULT_DENY=1 /path/to/acs-cursor-hook beforeShellExecution",
         "failClosed": true
       }
     ],
     "afterShellExecution": [
       {
-        "command": "ACS_GUARDIAN_URL=http://127.0.0.1:8787/acs ACS_HMAC_SECRET_FILE=/path/to/.acs/hmac.key ACS_AUDIT_FILE=/path/to/.acs/audit.log /path/to/acs-cursor-hook afterShellExecution"
+        "command": "ACS_GUARDIAN_URL=http://127.0.0.1:8787/acs ACS_HMAC_SECRET_FILE=/path/to/.acs/hmac.key ACS_HMAC_KEY_ID=2026-11 ACS_AUDIT_FILE=/path/to/.acs/audit.log /path/to/acs-cursor-hook afterShellExecution"
       }
     ],
     "beforeMCPExecution": [
       {
-        "command": "ACS_GUARDIAN_URL=http://127.0.0.1:8787/acs ACS_HMAC_SECRET_FILE=/path/to/.acs/hmac.key ACS_AUDIT_FILE=/path/to/.acs/audit.log ACS_DEFAULT_DENY=1 /path/to/acs-cursor-hook beforeMCPExecution",
+        "command": "ACS_GUARDIAN_URL=http://127.0.0.1:8787/acs ACS_HMAC_SECRET_FILE=/path/to/.acs/hmac.key ACS_HMAC_KEY_ID=2026-11 ACS_AUDIT_FILE=/path/to/.acs/audit.log ACS_DEFAULT_DENY=1 /path/to/acs-cursor-hook beforeMCPExecution",
         "failClosed": true
       }
     ],
     "afterMCPExecution": [
       {
-        "command": "ACS_GUARDIAN_URL=http://127.0.0.1:8787/acs ACS_HMAC_SECRET_FILE=/path/to/.acs/hmac.key ACS_AUDIT_FILE=/path/to/.acs/audit.log /path/to/acs-cursor-hook afterMCPExecution"
+        "command": "ACS_GUARDIAN_URL=http://127.0.0.1:8787/acs ACS_HMAC_SECRET_FILE=/path/to/.acs/hmac.key ACS_HMAC_KEY_ID=2026-11 ACS_AUDIT_FILE=/path/to/.acs/audit.log /path/to/acs-cursor-hook afterMCPExecution"
       }
     ],
     "subagentStart": [
       {
-        "command": "ACS_GUARDIAN_URL=http://127.0.0.1:8787/acs ACS_HMAC_SECRET_FILE=/path/to/.acs/hmac.key ACS_AUDIT_FILE=/path/to/.acs/audit.log ACS_DEFAULT_DENY=1 /path/to/acs-cursor-hook subagentStart",
+        "command": "ACS_GUARDIAN_URL=http://127.0.0.1:8787/acs ACS_HMAC_SECRET_FILE=/path/to/.acs/hmac.key ACS_HMAC_KEY_ID=2026-11 ACS_AUDIT_FILE=/path/to/.acs/audit.log ACS_DEFAULT_DENY=1 /path/to/acs-cursor-hook subagentStart",
         "failClosed": true
       }
     ],
     "afterAgentResponse": [
       {
-        "command": "ACS_GUARDIAN_URL=http://127.0.0.1:8787/acs ACS_HMAC_SECRET_FILE=/path/to/.acs/hmac.key ACS_AUDIT_FILE=/path/to/.acs/audit.log /path/to/acs-cursor-hook afterAgentResponse"
+        "command": "ACS_GUARDIAN_URL=http://127.0.0.1:8787/acs ACS_HMAC_SECRET_FILE=/path/to/.acs/hmac.key ACS_HMAC_KEY_ID=2026-11 ACS_AUDIT_FILE=/path/to/.acs/audit.log /path/to/acs-cursor-hook afterAgentResponse"
       }
     ],
     "sessionEnd": [
       {
-        "command": "ACS_GUARDIAN_URL=http://127.0.0.1:8787/acs ACS_HMAC_SECRET_FILE=/path/to/.acs/hmac.key ACS_AUDIT_FILE=/path/to/.acs/audit.log /path/to/acs-cursor-hook sessionEnd"
+        "command": "ACS_GUARDIAN_URL=http://127.0.0.1:8787/acs ACS_HMAC_SECRET_FILE=/path/to/.acs/hmac.key ACS_HMAC_KEY_ID=2026-11 ACS_AUDIT_FILE=/path/to/.acs/audit.log /path/to/acs-cursor-hook sessionEnd"
       }
     ]
   }
diff --git a/adapters/docs/cursor/live_verification.md b/adapters/docs/cursor/live_verification.md
index 171b2144..3c7a6cc1 100644
--- a/adapters/docs/cursor/live_verification.md
+++ b/adapters/docs/cursor/live_verification.md
@@ -11,7 +11,7 @@ The procedure below has been run end-to-end and produced the expected outcomes (
 ```bash
 # 1. Generate a shared signing secret and start the example Guardian
 mkdir -p ~/.acs && openssl rand -hex 32 > ~/.acs/hmac.key && chmod 600 ~/.acs/hmac.key
-ACS_HMAC_SECRET_FILE=~/.acs/hmac.key acs-example-guardian --port 8787
+ACS_HMAC_SECRET_FILE=~/.acs/hmac.key ACS_HMAC_KEY_ID=2026-11 acs-example-guardian --port 8787
 
 # 2. In a new shell, set up a test project with the adapter wired in
 mkdir -p /tmp/acs-cursor-live/.cursor
@@ -20,19 +20,19 @@ cat > /tmp/acs-cursor-live/.cursor/hooks.json <<'EOF'
   "version": 1,
   "hooks": {
     "sessionStart": [
-      { "command": "ACS_GUARDIAN_URL=http://127.0.0.1:8787/acs ACS_HMAC_SECRET_FILE=/path/to/.acs/hmac.key /path/to/acs-cursor-hook sessionStart" }
+      { "command": "ACS_GUARDIAN_URL=http://127.0.0.1:8787/acs ACS_HMAC_SECRET_FILE=/path/to/.acs/hmac.key ACS_HMAC_KEY_ID=2026-11 /path/to/acs-cursor-hook sessionStart" }
     ],
     "beforeSubmitPrompt": [
-      { "command": "ACS_GUARDIAN_URL=http://127.0.0.1:8787/acs ACS_HMAC_SECRET_FILE=/path/to/.acs/hmac.key /path/to/acs-cursor-hook beforeSubmitPrompt" }
+      { "command": "ACS_GUARDIAN_URL=http://127.0.0.1:8787/acs ACS_HMAC_SECRET_FILE=/path/to/.acs/hmac.key ACS_HMAC_KEY_ID=2026-11 /path/to/acs-cursor-hook beforeSubmitPrompt" }
     ],
     "preToolUse": [
-      { "command": "ACS_GUARDIAN_URL=http://127.0.0.1:8787/acs ACS_HMAC_SECRET_FILE=/path/to/.acs/hmac.key /path/to/acs-cursor-hook preToolUse" }
+      { "command": "ACS_GUARDIAN_URL=http://127.0.0.1:8787/acs ACS_HMAC_SECRET_FILE=/path/to/.acs/hmac.key ACS_HMAC_KEY_ID=2026-11 /path/to/acs-cursor-hook preToolUse" }
     ],
     "postToolUse": [
-      { "command": "ACS_GUARDIAN_URL=http://127.0.0.1:8787/acs ACS_HMAC_SECRET_FILE=/path/to/.acs/hmac.key /path/to/acs-cursor-hook postToolUse" }
+      { "command": "ACS_GUARDIAN_URL=http://127.0.0.1:8787/acs ACS_HMAC_SECRET_FILE=/path/to/.acs/hmac.key ACS_HMAC_KEY_ID=2026-11 /path/to/acs-cursor-hook postToolUse" }
     ],
     "beforeShellExecution": [
-      { "command": "ACS_GUARDIAN_URL=http://127.0.0.1:8787/acs ACS_HMAC_SECRET_FILE=/path/to/.acs/hmac.key /path/to/acs-cursor-hook beforeShellExecution" }
+      { "command": "ACS_GUARDIAN_URL=http://127.0.0.1:8787/acs ACS_HMAC_SECRET_FILE=/path/to/.acs/hmac.key ACS_HMAC_KEY_ID=2026-11 /path/to/acs-cursor-hook beforeShellExecution" }
     ]
   }
 }
diff --git a/adapters/docs/cursor/mapping.md b/adapters/docs/cursor/mapping.md
index 4b851703..a2813847 100644
--- a/adapters/docs/cursor/mapping.md
+++ b/adapters/docs/cursor/mapping.md
@@ -8,8 +8,8 @@ Each Cursor hook event maps to an ACS `steps/*` method. The adapter (`src/acs/in
 
 | Cursor hook | ACS step method | Notes |
 |---|---|---|
-| `sessionStart` | `steps/sessionStart` | Session bounds, sent once per session by the hook process that opens the session and built from its event (see Concurrency). `platform_context` carries the real fields: `workspace_roots`, `cursor_version`, and from Cursor's `sessionStart` event, `composer_mode` and `is_background_agent`. A Guardian `deny`, or a refusal of the request, refuses the session: every later step of it is denied in its hook's own shape. A `sessionStart` that gets no decision is recorded, and each later hook settles its step with its own fail posture. Session-level — no `turn_id`. |
-| `sessionEnd` | `steps/sessionEnd` | Session close (chain seal). Cursor reasons map onto the ACS enum: `completed`→`completed`, `aborted`→`cancelled`, `error`→`error`, `window_close`/`user_close`→`abandoned`. Session-level — no `turn_id`. |
+| `sessionStart` | `steps/sessionStart` | Session bounds, sent once per session by the hook process that opens the session and built from its event (see Concurrency). `platform_context` carries the real fields: `workspace_roots`, `cursor_version`, and from Cursor's `sessionStart` event, `composer_mode` and `is_background_agent`. A Guardian `deny`, or a refusal of the request, refuses the session: every later step of it is denied in its hook's own shape. A `sessionStart` that gets no decision is recorded, and each later hook settles its step with its own fail posture; `sessionEnd`, which is audit-only, goes out under either posture and reports that failure (§6.4). Session-level — no `turn_id`. |
+| `sessionEnd` | `steps/sessionEnd` | Session close (chain seal). Cursor reasons map onto the ACS enum: `completed`→`completed`, `aborted`→`cancelled`, `error`→`error`, `window_close`/`user_close`→`abandoned`. Carries `summary.decision_failures`, the session's decision failures per failure class (§6.4). Session-level — no `turn_id`. |
 | `stop` | `steps/turnEnd` | End of a **turn** (each reply), not the session. `steps/sessionEnd` seals the chain once per session, so mapping `stop` there sealed it every reply; `steps/turnEnd` (audit-only) is the per-turn boundary and echoes the open turn's `turn_id`. Cursor's `status` maps to the outcome enum: `completed`→`completed`, `aborted`→`interrupted`, `error`→`error`. A `stop` with no open turn is skipped + audited rather than fabricating a `turn_id`. |
 | `preToolUse` | `steps/toolCallRequest` | Principal interception point; fires for ALL tool types (Shell, Read, Write, MCP, Task, …). `request_id` pinned to uuid5 of `tool_use_id` so the matching result correlates. Carries `metadata.turn_id`. |
 | `postToolUse` | `steps/toolCallResult` | `tool_output` is a JSON-STRINGIFIED result payload ("not raw terminal text"); the adapter parses it into `outputs`, maps a nonzero `exitCode` inside it to `exit_status: failure`, coerces `duration`→`duration_ms` (integer), and cites `request_id_ref` from `tool_use_id`. |
@@ -44,7 +44,7 @@ Cursor's documented response keys are event-specific. The adapter translates ACS
 | `deny` | `{"permission": "deny", "user_message": reasoning, "agent_message": reasoning}` | Cursor displays user_message in UI; agent_message is fed back to the agent's context. |
 | `ask` | `{"permission": "ask", "user_message": reasoning, "agent_message": reasoning}` | Upstream caveat: Cursor documents `ask` as "accepted by the schema but not enforced for preToolUse today", and `subagentStart` treats `ask` as `deny`. On those events ask is a soft signal, not a hard pause. |
 | `defer` | `{"permission": "ask", ...}` | Deployment substitution (not spec-mandated; §9.2 places substitution on the Guardian): Cursor has no defer. |
-| `modify` | `{"permission": "allow", "updated_input": original ⊕ parameter_overrides, "user_message": reasoning}` on `preToolUse` only | `updated_input` REPLACES the whole input, so the adapter MERGES the overrides onto the original arguments. Other permission events have no documented updated-input field; modify substitutes to deny with audit. A contradictory `modifications` object fails closed to deny (§6.3:146). |
+| `modify` | `{"permission": "allow", "updated_input": original ⊕ parameter_overrides, "user_message": reasoning}` on `preToolUse` only | `updated_input` REPLACES the whole input, so the adapter MERGES the overrides onto the original arguments. On the other permission events, which have no documented updated-input field, and for an `MCP:` tool, whose `updated_input` Cursor ignores when an HTTP MCP server runs it, a MODIFY is a DENY recorded as `modify_unsupported` with `reason_codes: ["modify_unsupported"]` (§6.5), as are redactions. A contradictory `modifications` object fails closed to deny (§6.3:146). |
 
 ### `postToolUse` — the only post-tool event with documented output fields
 
@@ -52,12 +52,13 @@ Cursor's documented response keys are event-specific. The adapter translates ACS
 |---|---|
 | `allow` | `{}` (no output; proceed) |
 | `deny` | `{"additional_context": "ACS Guardian denied this result: …"}` + `unenforceable_decision` audit (the tool already ran; feedback is the only channel) |
-| `modify` with `modified_content` | `{"updated_mcp_tool_output": <parsed content>}` — "For MCP tools only: replaces the tool output seen by the model" |
+| `modify` with `modified_content` on an MCP tool | `{"updated_mcp_tool_output": <parsed content>}` — "For MCP tools only: replaces the tool output seen by the model" |
+| `modify` on another tool, on an HTTP MCP server's tool (its `tool_output` is `{"redacted": true}`), or with structured edits | as `deny`, recorded as `modify_unsupported` with `reason_codes: ["modify_unsupported"]` (§6.5) |
 | any other decision with reasoning | `{"additional_context": reasoning}` |
 
 ### Other post-tool events (`postToolUseFailure`, `afterShellExecution`, `afterMCPExecution`, `afterFileEdit`, `afterTabFileEdit`)
 
-"No output fields currently supported" (Cursor docs) — the adapter emits nothing; an arrived restrictive decision is recorded as an `unenforceable_decision` audit event.
+"No output fields currently supported" (Cursor docs) — the adapter emits nothing; an arrived restrictive decision is recorded as an `unenforceable_decision` audit event, and a MODIFY also as `modify_unsupported` with `reason_codes: ["modify_unsupported"]` (§6.5).
 
 ### `beforeSubmitPrompt`
 
@@ -67,7 +68,7 @@ Cursor's documented output is `{"continue": bool, "user_message": str}`. The ada
 |---|---|
 | `allow` | `{"continue": true}`, exit 0 |
 | `deny` | `{"continue": false, "user_message": reasoning}`, exit 0 |
-| `ask` / `defer` / `modify` | same as deny (substituted to block + audit; the prompt hook can't pause or edit) |
+| `ask` / `defer` / `modify` | same as deny (substituted to block + audit; the prompt hook can't pause or edit); a MODIFY is also recorded as `modify_unsupported` with `reason_codes: ["modify_unsupported"]` (§6.5) |
 
 ### Lifecycle events (`sessionEnd`, `stop`, `preCompact`, `afterAgentResponse`, `afterAgentThought`)
 
@@ -95,13 +96,13 @@ Cursor runs the hooks of one session at the same time: in Cursor 3.17.8, a new c
 
 ## Conformance posture
 
-The Cursor adapter covers ACS-Core's mandatory floor in the same shape as the Claude Code adapter. This is the floor the tests check, not a full ACS-Core conformance claim (see `adapters/README.md`). Three ACS-Core requirements from later specification changes follow in separate PRs: the `key_id` taken from configuration (§10, #272); decision failures recorded with their failure class and counted at `sessionEnd` (§6.4, #273); and a signature on every request, where today an adapter with no secret configured sends unsigned requests (§10). The floor it covers:
+The Cursor adapter covers ACS-Core's mandatory floor in the same shape as the Claude Code adapter. This is the floor the tests check, not a full ACS-Core conformance claim (see `adapters/README.md`). The floor it covers:
 
 - Handshake: `handshake/hello` performed on the first event of a session, and its answer decides the session (§4.1): a verified ServerHello negotiates; a refusal, or an answer that fails its checks, refuses every step; and no answer leaves the session with no negotiated Guardian, so each hook's `ACS_STARTUP_POSTURE` applies (`proceed` lets the step run with nothing sent to the Guardian; `refuse` denies it). The decision is stored in `~/.cache/acs-adapter-handshake/` with an HMAC under the session key over the decision, the session and the Guardian URL, and holds for the session's lifetime, so a dead Guardian costs one timeout per session; a record that fails its checks, or a decision that cannot be stored, refuses the session. ServerHello signature-verified, bound to the ClientHello, its `on_decision_failure` combines with `ACS_DEFAULT_DENY` (deny wins over proceed), and its `timeout_config` replaces the local decision timeout, per method where `per_method_ms` names one (§6.4). The ServerHello must answer the ClientHello: a `negotiated_version` sharing a major version the adapter offered, a `methods_evaluated` list, the one transport the adapter offers (its Guardian URL's scheme), a positive `timeout_config.default_ms`, an `on_decision_failure` of `proceed` or `deny`, and only profiles the adapter claimed; otherwise the session has no negotiated Guardian (`invalid_server_hello`). Its `methods_evaluated` bounds what is sent: a method the Guardian omits resolves as ALLOW-by-default without being sent (handshake.json), recorded as `method_not_evaluated`; permission events and `beforeSubmitPrompt` return their explicit allow shapes, since `failClosed` reads an empty reply as a failed hook. With no negotiated list, every mapped event is sent. `ACS_HANDSHAKE=0` skips the handshake, and the startup posture settles every step.
 - Turns: a `beforeSubmitPrompt` opens a turn with an explicit `steps/turnStart` (decision-eligible) before the `steps/userMessage`; `stop` closes it with `steps/turnEnd`. `turn_id` is held in per-session state and stamped on `metadata.turn_id` of every in-turn step.
 - Hook taxonomy minimum: all covered, plus many additional Cursor events. `subagentStop`, `beforeReadFile`, `beforeTabFileRead`, `workspaceOpen` deliberately unmapped with documented reasons; unknown events emit an `unmapped_hook_event` audit line rather than going quiet.
-- Dispositions: ALLOW / DENY / ASK supported on permission events (see the upstream ask-enforcement caveat); MODIFY supported on `preToolUse` (merged overrides); DEFER → ASK substitution (deployment behavior, not spec-mandated).
+- Dispositions: ALLOW / DENY / ASK supported on permission events (see the upstream ask-enforcement caveat); MODIFY supported on `preToolUse` for tools other than MCP tools (merged overrides) and on an MCP tool's `postToolUse` output, and elsewhere a DENY recorded as `modify_unsupported` (§6.5); DEFER → ASK substitution (deployment behavior, not spec-mandated).
 - SessionContext: session_id sent every request (non-UUID `conversation_id` coerced deterministically).
 - Replay protection: ✓
-- Baseline integrity: HMAC-SHA256 per §10 over the RFC 8785 (JCS) canonical envelope, HKDF per-session key (`ACS_HMAC_SECRET_FILE` / `ACS_HMAC_SECRET`); `rfc8785` is a hard dependency. Responses signature-verified and bound to their request under any HTTP status; refusals, binding mismatches, bad response signatures, and responses that cannot be verified fail closed regardless of posture (deliberately stricter than the current §6.4 text — spec issue #32). Unsigned mode is announced with a loud `unsigned_mode` audit event.
-- Decision honoring: ✓ (Cursor enforces the permission verdict; the prompt gate emits the documented `continue:false` JSON with exit code 0)
+- Baseline integrity: HMAC-SHA256 per §10 over the RFC 8785 (JCS) canonical envelope, HKDF per-session key (`ACS_HMAC_SECRET_FILE` / `ACS_HMAC_SECRET`); `rfc8785` is a hard dependency. The signature names the configured label `ACS_HMAC_KEY_ID` as `key_id`, and a response under any other label fails verification with no other secret tried; an unsigned `SIGNATURE_INVALID`, a Guardian's answer to a label it does not hold, is recorded as `key_id_rejected` and fails closed. Responses signature-verified and bound to their request under any HTTP status; refusals, binding mismatches, bad response signatures, and responses that cannot be verified fail closed regardless of posture (deliberately stricter than the current §6.4 text — spec issue #32). A hook with no secret, a secret under 32 bytes, or no label refuses its session and sends nothing (`secret_missing`, `secret_too_short`, `key_id_missing`), whatever the posture: ACS-Core signs every request.
+- Decision honoring: ✓ (Cursor enforces the permission verdict; the prompt gate emits the documented `continue:false` JSON with exit code 0). Every decision failure is audited under either posture with its `failure_class` (`timeout`, `unreachable`, `malformed_response`, `guardian_error`, `observed_agent_error`, `signature_invalid`, `handshake_failure`, `other`) and `posture`, and `sessionEnd` reports the session's count per class in `summary.decision_failures` (§6.4, #273). A handshake that gets no answer is audited as `handshake_failure`; that session sends the Guardian nothing, `sessionEnd` included (§4.1).
diff --git a/adapters/docs/nat/README.md b/adapters/docs/nat/README.md
index 958f4d4f..1f160fb6 100644
--- a/adapters/docs/nat/README.md
+++ b/adapters/docs/nat/README.md
@@ -8,15 +8,15 @@ NAT exposes a `FunctionMiddleware` abstraction that wraps any function — tools
 
 1. Receives the `InvocationContext` (function name, arguments, output) from NAT's middleware pipeline.
 2. Translates it to an ACS JSON-RPC envelope ([mapping.md](./mapping.md)).
-3. Signs it with HMAC-SHA256 (`ACS_HMAC_SECRET` or `ACS_HMAC_SECRET_FILE`).
+3. Signs it with HMAC-SHA256 (`ACS_HMAC_SECRET` or `ACS_HMAC_SECRET_FILE`, under the label `ACS_HMAC_KEY_ID`).
 4. POSTs to the Guardian.
 5. Verifies the response signature and the JSON-RPC error/result shape.
 6. Applies the verdict: `allow` passes through; `deny` raises `ACSGuardianDenied` (or sets `InvocationAction.SKIP` on NAT releases that expose it); `modify` mutates `context.modified_kwargs`; `ask`/`defer` substitute to deny at the middleware boundary.
 7. Records a `steps/toolCallResult` envelope in `post_invoke` and redacts the output on deny.
 
-The handshake/hello fires once per session, cached in process state so subsequent events skip the round-trip.
+Each NAT run is its own ACS session, with a `session_id` derived from the configured one and the run; its `handshake/hello` fires once, at the run's start, and the decision is kept in process state for the run's calls. A call outside any NAT run uses the configured `session_id`, which gets its own `sessionStart` before the first such call and its `sessionEnd` when NAT shuts the middleware down (`mapping.md`).
 
-Independently of the middleware path, the adapter reports each run's `WORKFLOW_START` / `WORKFLOW_END` events as `steps/sessionStart` + `steps/userMessage` (on workflow start with input) and `steps/agentResponse` + `steps/sessionEnd` (on workflow end with output). A run that raises or is cancelled reaches no workflow end, so it sends no `agentResponse` or `sessionEnd` (see `mapping.md`). When NAT builds the middleware, it registers an `acs_lifecycle` telemetry exporter, which NAT starts for every run before `WORKFLOW_START`. A middleware built without NAT's builder subscribes on each run's first call instead, so it reports that run from the call on. **The lifecycle stream is observation-only; it cannot block calls.** Enforcement is the middleware path's job.
+Independently of the middleware path, the adapter reports each run's `WORKFLOW_START` / `WORKFLOW_END` events as `steps/sessionStart` + `steps/userMessage` (on workflow start with input) and `steps/agentResponse` + `steps/sessionEnd` (on workflow end with output). A run that raises or is cancelled reaches no workflow end, so it sends no `agentResponse`, and its `sessionEnd` carries `reason: error` or `cancelled` (see `mapping.md`). A Guardian that denies a run's `sessionStart` refuses that run's calls. When NAT builds the middleware, it registers an `acs_lifecycle` telemetry exporter, which NAT starts for every run before `WORKFLOW_START`. A middleware built without NAT's builder subscribes on each run's first call instead, so it reports that run from the call on. **Apart from the run's `sessionStart` decision, which the middleware applies to the run's calls, the lifecycle stream is observation-only.** Enforcement is the middleware path's job.
 
 ### Decision honoring (§6.4)
 
@@ -50,7 +50,7 @@ chmod 600 ~/.acs/hmac.key
 The example Guardian is for testing; a production Guardian is the same wire protocol with a real policy engine attached.
 
 ```bash
-ACS_HMAC_SECRET_FILE=~/.acs/hmac.key \
+ACS_HMAC_SECRET_FILE=~/.acs/hmac.key ACS_HMAC_KEY_ID=2026-11 \
   acs-example-guardian --port 8787
 ```
 
@@ -124,7 +124,7 @@ NAT's middleware fires per attachment point: the workflow, each function group a
 
 What this gives you: **the same hard-stop guarantee Cursor's `failClosed: true` gives.** The middleware runs *before* the function executes and waits for the Guardian's decision, off the event loop; a Guardian deny raises `ACSGuardianDenied` (or sets `InvocationAction.SKIP`) and NAT does not call the function.
 
-**The lifecycle observer reports workflow boundaries only.** It sends `sessionStart` and `userMessage` for each run, `agentResponse` and `sessionEnd` for each run that returns, and no tool calls, so a function the middleware is not wired to reaches the Guardian neither as a decision nor as an observation. Steps 1 and 2 close that gap: define every function in YAML, and run `acs-nat-wire --check` in CI.
+**The lifecycle observer reports workflow boundaries only.** It sends `sessionStart` and `userMessage` for each run, `agentResponse` for each run that returns, `sessionEnd` for each run, and no tool calls, so a function the middleware is not wired to reaches the Guardian neither as a decision nor as an observation. Steps 1 and 2 close that gap: define every function in YAML, and run `acs-nat-wire --check` in CI.
 
 ## Smoke tests
 
@@ -262,7 +262,7 @@ The shared protocol layer is identical: the Guardian sees the same ACS JSON-RPC
 | `guardian_url` | `http://127.0.0.1:8787/acs` | Guardian endpoint. http/https only. |
 | `default_deny` | `false` | Fail-open with audit (§6.4 default). Set `true` for fail-closed. The ServerHello's `on_decision_failure: deny` also flips it (most-restrictive-wins). Guardian refusals (bad signature, replay, malformed/oversized envelope) always fail closed regardless — input gate blocks, output gate redacts. See spec issue #32. |
 | `timeout_s` | `5.0` | Per-request Guardian round-trip timeout. A ServerHello `timeout_config` replaces it for the session, per method where `per_method_ms` names one. |
-| `session_id` | (auto, per-process) | UUID; auto-generated and stable for the process lifetime. |
+| `session_id` | (auto, per-process) | UUID; auto-generated and stable for the process lifetime. Calls outside a NAT run use it; each run's own `session_id` is derived from it. |
 | `target_function_or_group` | (unset) | Optional metadata label; derives `agent_id` if `ACS_AGENT_ID` env is unset. |
 
 ### Environment variables (read by the adapter at runtime)
@@ -271,6 +271,7 @@ The shared protocol layer is identical: the Guardian sees the same ACS JSON-RPC
 |---|---|---|
 | `ACS_HMAC_SECRET_FILE` | (unset) | Path to a 0600 file holding the shared HMAC secret. |
 | `ACS_HMAC_SECRET` | (unset) | Inline secret. Less secure (visible in `ps eauxw`). Prefer the file. |
+| `ACS_HMAC_KEY_ID` | (unset) | The label that names the secret (§10); the Guardian holds the same one. Required with a secret: a secret without a label refuses the session, and a response signed under another label fails verification. |
 | `ACS_AGENT_ID` | derived from `target_function_or_group` | Stable agent identifier sent in `metadata.agent_id`. |
 | `ACS_SESSION_ID` | derived | Overrides the auto-generated session_id. |
 | `ACS_GUARDIAN_HOST_ALLOWLIST` | (unset) | Optional comma-separated hostname allowlist (defense in depth). |
@@ -282,7 +283,7 @@ The shared protocol layer is identical: the Guardian sees the same ACS JSON-RPC
 
 ## On-disk state
 
-NAT runs the adapter in-process. The middleware keeps its session's handshake decision in memory and stores it in `~/.cache/acs-adapter-handshake/` like the other adapters, so a restarted process with the same `session_id` follows the same decision, and a new session handshakes again. The Guardian-side state (`~/.cache/acs-guardian-state/<sha256(session_id)>.json`) is the same as for the other adapters — chain head + replay set, survives Guardian restart.
+NAT runs the adapter in-process. The middleware keeps each session's handshake decision in memory and stores it in `~/.cache/acs-adapter-handshake/` like the other adapters, so a restarted process with the same `session_id` follows the same decision, and a new session handshakes again. A run's records are removed once its `sessionEnd` has been handled. The Guardian-side state (`~/.cache/acs-guardian-state/<sha256(session_id)>.json`) is the same as for the other adapters — chain head + replay set, survives Guardian restart.
 
 ## Conformance status
 
@@ -290,16 +291,16 @@ Honest, item-by-item against the ACS-Core baseline in `docs/spec/conformance.md`
 
 | ACS-Core item | Status |
 |---|---|
-| Handshake (`handshake/hello`) | ✓ on the first `pre_invoke`; the decision (negotiated, refused, or no answer under `ACS_STARTUP_POSTURE`) holds for the session's lifetime (§4.1) |
-| Profiles (`profiles_supported` / `profiles_accepted`) | ✓ claims `acs-core` when a signing secret is configured and no profile without one. A ServerHello accepting a profile the adapter did not claim is not a valid answer, a claimed profile the Guardian leaves out is audited as `profile_not_accepted`, and a hook's `ACS_REQUIRE_PROFILES` turns a left-out profile into a refusal of that hook's steps. |
+| Handshake (`handshake/hello`) | ✓ once per session: each NAT run's at its start, and the configured session's when NAT builds the middleware; the decision (negotiated, refused, or no answer under `ACS_STARTUP_POSTURE`) holds for the session's lifetime (§4.1) |
+| Profiles (`profiles_supported` / `profiles_accepted`) | ✓ always claims `acs-core`: the middleware refuses a session with no usable secret and label before the handshake. A ServerHello accepting a profile the adapter did not claim is not a valid answer, a claimed profile the Guardian leaves out is audited as `profile_not_accepted`, and a hook's `ACS_REQUIRE_PROFILES` turns a left-out profile into a refusal of that hook's steps. |
 | JSON-RPC envelope shape (`request-envelope.json`) | ✓ validates against canonical schema (`test_envelope_schema.py`) |
-| Hook taxonomy (Core minimum set) | ⚠ emitted, but read the enforcement split. **Decision-eligible** coverage: `toolCallRequest` / `toolCallResult`, via the `FunctionMiddleware` path — these can actually block/redact. The other four — `sessionStart`, `userMessage`, `agentResponse`, `sessionEnd` — are emitted **observation-only** from the `IntermediateStepManager` subscription (fire-and-forget; the Guardian's verdict is not applied), so they provide audit/trace coverage, **not** enforcement, and should not be counted as decision-eligible Core coverage. ACS-Core requires a subagent-capable client to emit `subagentStart` when it spawns a sub-agent, and a framework with no sub-agent abstraction has nothing to emit. The adapter emits no `subagentStart`: nested workflow functions reach the Guardian as generic tool calls. The Guardian decides by deployment-defined means whether a NAT deployment counts as subagent-capable. Where sub-workflows act as sub-agents, this is a known gap. See `mapping.md`. Verified in `test_lifecycle.py`. |
+| Hook taxonomy (Core minimum set) | ⚠ emitted, but read the enforcement split. **Decision-eligible** coverage: `toolCallRequest` / `toolCallResult`, via the `FunctionMiddleware` path — these can actually block/redact. `sessionStart` (ALLOW / DENY) is applied too: a deny refuses the run's calls. The other three — `userMessage`, `agentResponse`, `sessionEnd` — are emitted **observation-only** from the `IntermediateStepManager` subscription (fire-and-forget; the Guardian's verdict is not applied), so they provide audit/trace coverage, **not** enforcement, and should not be counted as decision-eligible Core coverage. ACS-Core requires a subagent-capable client to emit `subagentStart` when it spawns a sub-agent, and a framework with no sub-agent abstraction has nothing to emit. The adapter emits no `subagentStart`: nested workflow functions reach the Guardian as generic tool calls. The Guardian decides by deployment-defined means whether a NAT deployment counts as subagent-capable. Where sub-workflows act as sub-agents, this is a known gap. See `mapping.md`. Verified in `test_lifecycle.py`. |
 | Dispositions | ALLOW / DENY / MODIFY supported on **function-middleware (pre-execution)** hooks (`pre_invoke` for every wrapped function — tools, sub-workflows, LLM, retrievers). ASK/DEFER substituted to DENY at the middleware boundary; deployments wanting pause-and-resume should compose with NAT's HITL middleware (`nat.middleware.hitl`). **Lifecycle hooks from the `IntermediateStepManager` subscription (`steps/sessionStart`, `steps/userMessage`, `steps/agentResponse`, `steps/sessionEnd`) are observation-only** — subscription callbacks cannot veto a NAT event after it fires. See `mapping.md`. |
 | Unknown-disposition fail posture | ✓ |
 | Post-tool deny redaction | ✓ `post_invoke` clears `context.output = None` and emits an `ACS_AUDIT` `post_invoke_redacted` event per §6.4 output-redaction gate. (NAT's `InvocationContext` is a strict Pydantic model with `validate_assignment=True` — ad-hoc attributes like `acs_post_invoke_redacted` would crash; downstream consumers MUST read the audit event for the redaction signal, not an extra attribute.) |
 | SessionContext + published `chain_hash` | ✓ session_id coerced to UUID; Guardian computes rolling chain |
 | Replay protection | ✓ Guardian enforcement (REPLAY_DETECTED -32005, TIMESTAMP_OUT_OF_WINDOW -32006); audit cause distinguishes both |
-| Baseline integrity (HMAC-SHA256) | ✓ when `ACS_HMAC_SECRET[_FILE]` is set; signed responses verified by adapter (pre_invoke + post_invoke reject SIGNATURE_INVALID) |
+| Baseline integrity (HMAC-SHA256) | ✓ every request and response signed under `ACS_HMAC_KEY_ID`; a middleware with no secret of at least 32 bytes, or no label, refuses its session and denies every call; signed responses verified by adapter (pre_invoke + post_invoke reject SIGNATURE_INVALID) |
 | Decision honoring (§6.4) | ✓ NAT's middleware contract guarantees the function will not execute if `pre_invoke` raises or sets SKIP — verified in `test_live.py` (deny tests assert `executed["count"] == 0`); fail-open emits `ACS_AUDIT` events |
 | `cause` field on every audit event | ✓ `transport_failure`, `adapter_exception`, `response_signature_invalid`, plus a cause for every §17 JSON-RPC error code (for example `session_refused_response`, `signature_invalid_response`, `replay_detected_response`, `internal_error_response`) with `guardian_error_response` as the catch-all fallback for unknown codes |
 | Liveness `system/ping` | ⚠ Guardian-side only. ACS-Core says `system/ping` SHOULD be implemented: the Observed Agent declares it in `methods_implemented` and sends it, and the Guardian answers it (§13). The example Guardian answers ping as an always-allow method outside the chain, replay, and signature checks. The adapter does not declare or send `system/ping`, so a deployment that uses it must name an alternative liveness mechanism in its configuration, such as continuous observed hook traffic. Omitting both is non-conformant. |
diff --git a/adapters/docs/nat/mapping.md b/adapters/docs/nat/mapping.md
index feebedbd..7fd96f15 100644
--- a/adapters/docs/nat/mapping.md
+++ b/adapters/docs/nat/mapping.md
@@ -14,19 +14,24 @@ The ACS adapter is implemented as a `FunctionMiddleware` that, for each wrapped
 |---|---|---|
 | Any wrapped function `pre_invoke` (tools, LLMs, retrievers, memory — all of them) | `steps/toolCallRequest` | **Yes** — every wrapped call, with the function name as the tool name |
 | Any wrapped function `post_invoke` | `steps/toolCallResult` | **Yes** |
-| Workflow start (via the `acs_lifecycle` exporter NAT starts for every run) | `steps/sessionStart` + `steps/userMessage` | **Yes** — observation-only, see below |
+| Workflow start (via the `acs_lifecycle` exporter NAT starts for every run) | `steps/sessionStart` + `steps/userMessage` | **Yes** — a `sessionStart` deny refuses the run's calls; see below |
 | Workflow end (same exporter), for a run that returns | `steps/agentResponse` + `steps/sessionEnd` | **Yes** — observation-only, see below |
+| The end of a run that raises or is cancelled (NAT stops the run's exporter) | `steps/sessionEnd` with `reason: error` or `cancelled` | **Yes** — observation-only, see below |
 | Retriever calls as `steps/knowledgeRetrieval` | — | **No.** Retrievers surface as `toolCallRequest` with the retriever's function name; the Guardian dispatches on name. A dedicated `knowledgeRetrieval` emission is possible future work. |
 | Memory read / write as `steps/memoryContextRetrieval` / `steps/memoryStore` | — | **No.** Same status: memory functions surface as generic tool calls. Documented gap — a Guardian keying policy on the memory-specific hooks will not see them from this adapter. |
 | Sub-workflow invocation as `steps/subagentStart` / `steps/subagentStop` | — | **No.** Nested workflow functions surface as generic tool calls; NAT exposes no distinct spawn boundary to the middleware. ACS-Core requires `subagentStart` only of a subagent-capable client, and the Guardian determines that capability by deployment-defined means. The requirement is vacuous for NAT only when sub-workflows are genuinely not distinguishable at this seam. Otherwise this is a mapping gap. |
 
 The Guardian can dispatch on the tool name to apply retriever-, memory-, or subagent-specific policy to the generic `toolCallRequest` stream; what it cannot get from this adapter is the dedicated ACS step methods for those events.
 
-### Lifecycle hooks are observation-only
+### Lifecycle hooks after `sessionStart` are observation-only
 
 The adapter's `_on_intermediate_step` callback emits `steps/sessionStart` + `steps/userMessage` on `WORKFLOW_START` and `steps/agentResponse` + `steps/sessionEnd` on `WORKFLOW_END` via `_emit_lifecycle_hook`. NAT creates a new step stream for each run, so the builder registers an `acs_lifecycle` telemetry exporter that NAT starts for every run before `WORKFLOW_START`; a middleware built without NAT's builder subscribes on each run's first call instead and reports that run from the call on. **This path is fire-and-forget.** NAT's `IntermediateStepManager` subscription model is a notification stream — a subscriber callback cannot veto the event after the fact. So although ACS-Core §hooks.md lists `agentResponse` as decision-eligible (ALLOW / DENY / MODIFY), the adapter cannot actually block or rewrite the workflow's output through this path. The envelopes are for trace + audit; enforcement on outputs must be placed at `pre_invoke` / `post_invoke` of the function that produced them, or as a separate review function in the YAML the workflow calls before returning.
 
-**A failed run has no end.** NAT 1.7.0 pushes `WORKFLOW_END` only after the workflow returns. A run that raises or is cancelled pushes none, so the Guardian receives that run's `steps/sessionStart` and `steps/userMessage` and no `steps/agentResponse` or `steps/sessionEnd`, and the session stays open on the Guardian. Every call the middleware governed during the run was still decided. A separate PR closes such a run with `steps/sessionEnd` (`reason: error` or `cancelled`).
+**Each NAT run is its own ACS session.** `sessionStart` fires once per session, before any other `steps/*` hook for its `session_id`, and `sessionEnd` seals it (hooks.md), so a run's steps carry a `session_id` of their own: a UUIDv5 of the configured `session_id` and NAT's `workflow_run_id`. The run's session opens at its `WORKFLOW_START`, or at its first call when NAT ran the middleware without its exporter, with its own `handshake/hello` and then its `steps/sessionStart`, and closes with its `steps/sessionEnd`, which waits for the run's Guardian exchanges still in flight, a cancelled call's included; its stored records are removed then, and a later step of the run is refused and sends nothing. The adapter remembers the last 4096 runs to end, so a step that arrives after that many more runs have ended is the one case it would open again; a late step comes only from a cancelled call's worker, within moments of its run's end. A call outside any NAT run uses the configured `session_id`, whose handshake runs when NAT builds the middleware: the first such step sends that session's `sessionStart` before it, NAT's shutdown of the middleware waits for a session still opening and then sends its `sessionEnd` and removes its records, and a step after that end is refused and sends nothing. A function a workflow calls, a sub-agent included, belongs to the run that called it.
+
+**The run's `sessionStart` decides the run.** The Guardian's `deny` of a run's `steps/sessionStart`, or a refusal of that request, refuses the run's session (hooks.md sessionStart: ALLOW / DENY): each later call of the run is blocked and its output withheld, and nothing more of the run is sent, `sessionEnd` included (§4.1). A `sessionStart` that gets no decision is counted once, and each later step of the run follows the fail posture: under `default_deny` it is blocked, and otherwise it goes to the Guardian. The run's `sessionEnd`, which is audit-only, goes out under either posture and reports that count (§6.4). A call waits until the run's `sessionStart` has been answered.
+
+**A failed run still ends.** NAT 1.7.0 pushes `WORKFLOW_END` only after the workflow returns, so a run that raises or is cancelled sends no `steps/agentResponse`. NAT stops the run's `acs_lifecycle` exporter and completes the run's step stream either way, and for a run with no `WORKFLOW_END` the adapter then sends `steps/sessionEnd` with `reason: cancelled` when the run's task was cancelled and `reason: error` otherwise, carrying the run's decision failures. A middleware built without NAT's builder learns of the end from the stream it subscribed to on the run's first call.
 
 **Deliberately not mapped — the skill lifecycle set (`steps/skillRegister`, `steps/skillLoad`, `steps/skillUnload`).** NAT composes workflows from functions declared in the workflow YAML; the middleware surface exposes no runtime skill registration, activation, or unload events. Function *invocations* are governed at `pre_invoke`/`post_invoke` (`steps/toolCallRequest`/`toolCallResult`); lifecycle wiring becomes possible when NAT exposes lifecycle events for loadable components.
 
@@ -36,7 +41,7 @@ The adapter's `_on_intermediate_step` callback emits `steps/sessionStart` + `ste
 |---|---|
 | `allow` | `pre_invoke` returns `None` (proceed unchanged) |
 | `deny` | `pre_invoke` raises `ACSGuardianDenied` (NAT 1.7.0) or sets `context.action = InvocationAction.SKIP` (NAT dev). NAT's runtime documents both: *"Raises: Any exception to abort execution"* and the action-based equivalent. |
-| `modify` | If `modifications.parameter_overrides` is present and is a dict, the adapter updates `context.modified_kwargs` in place and returns the context. NAT's runtime invokes the function with the modified kwargs. If `modified_content` is present on a post-tool result, the adapter sets `context.output`. |
+| `modify` | If `modifications.parameter_overrides` is present and is a dict, the adapter updates `context.modified_kwargs` in place and returns the context. NAT's runtime invokes the function with the modified kwargs. If `modified_content` is present on a post-tool result, the adapter sets `context.output`. Redactions, a call's MODIFY without a `parameter_overrides` object, and structured edits on a result cannot be applied: the call is blocked or the output withheld, recorded as `modify_unsupported` with `reason_codes: ["modify_unsupported"]` (§6.5). |
 | `ask` | Substituted to block at the middleware boundary in v1 (NAT has no native pause primitive at the function-middleware layer). Deployments wanting ASK should compose with NAT's HITL middleware (`nat.middleware.hitl`) and have the Guardian resolve before responding. |
 | `defer` | Substituted to block in v1 (same reason). |
 
@@ -61,7 +66,7 @@ middleware:
     default_deny: true
     target_function_or_group: my_tools   # optional; otherwise applied via group/workflow membership
     target_location: input          # NAT-standard field
-    session_id: null                # adapter generates one per process
+    session_id: null                # adapter generates one per process; each run's session derives from it
 
 function_groups:
   my_tools:
@@ -82,12 +87,12 @@ NAT can invoke several wrapped functions at once in one process. The builder ope
 
 ## Conformance posture
 
-The NAT adapter covers ACS-Core's mandatory floor. This is the floor the tests check, not a full ACS-Core conformance claim (see `adapters/README.md`). Three ACS-Core requirements from later specification changes follow in separate PRs: the `key_id` taken from configuration (§10, #272); decision failures recorded with their failure class and counted at `sessionEnd` (§6.4, #273); and a signature on every request, where today an adapter with no secret configured sends unsigned requests (§10). The floor it covers:
+The NAT adapter covers ACS-Core's mandatory floor. This is the floor the tests check, not a full ACS-Core conformance claim (see `adapters/README.md`). The floor it covers:
 
 - Hook taxonomy: every wrapped function call surfaces as `toolCallRequest` + `toolCallResult`.
 - Dispositions: ALLOW / DENY / MODIFY supported normatively; ASK / DEFER substituted to DENY with audit (HITL composition is the recommended path).
-- SessionContext: `session_id` sent on every request.
+- SessionContext: `session_id` sent on every request: the run's own, or the configured one for a call outside any run.
 - Replay protection: `request_id` UUID + timestamp.
-- Handshake: the first `pre_invoke` of a session performs `handshake/hello`, and its answer decides the session (§4.1). The ServerHello must answer the ClientHello: a `negotiated_version` sharing a major version the adapter offered, a `methods_evaluated` list, the one transport the adapter offers (its Guardian URL's scheme), a positive `timeout_config.default_ms`, an `on_decision_failure` of `proceed` or `deny`, and only profiles the adapter claimed; otherwise the session has no negotiated Guardian (`invalid_server_hello`). Per-method timeouts bound their own methods. The answer: a refusal blocks every call, and no answer leaves the session with no negotiated Guardian for its lifetime, so `ACS_STARTUP_POSTURE` (unset follows `default_deny`) settles each call with no Guardian traffic.
-- Decision honoring: NAT's middleware contract guarantees the function does not execute if `pre_invoke` raises or sets SKIP. The fail posture is `workflow.yml`'s `default_deny` OR the ServerHello's `on_decision_failure` (most-restrictive-wins); Guardian refusals (signature invalid, replay, malformed/oversized envelope) fail closed regardless of posture, on both the input gate (block) and the output gate (redact) — spec issue #32. Methods absent from the ServerHello's `methods_evaluated` resolve as ALLOW-by-default without being sent (handshake.json) and are recorded as `method_not_evaluated`.
-- Baseline integrity: HMAC-SHA256 per §10 over the RFC 8785 (JCS) canonical envelope with an HKDF-derived per-session key (`ACS_HMAC_SECRET_FILE` / `ACS_HMAC_SECRET`); `rfc8785` is a hard runtime dependency. Responses are signature-verified and bound to their request under any HTTP status; a mis-bound, badly-signed or unverifiable response fails closed regardless of posture. Unsigned mode (no secret) is announced with a loud `unsigned_mode` audit event.
+- Handshake: each session performs `handshake/hello` once, a run's at its start and the configured session's when NAT builds the middleware, and its answer decides the session (§4.1). The ServerHello must answer the ClientHello: a `negotiated_version` sharing a major version the adapter offered, a `methods_evaluated` list, the one transport the adapter offers (its Guardian URL's scheme), a positive `timeout_config.default_ms`, an `on_decision_failure` of `proceed` or `deny`, and only profiles the adapter claimed; otherwise the session has no negotiated Guardian (`invalid_server_hello`). Per-method timeouts bound their own methods. The answer: a refusal blocks every call, and no answer leaves the session with no negotiated Guardian for its lifetime, so `ACS_STARTUP_POSTURE` (unset follows `default_deny`) settles each call with no Guardian traffic.
+- Decision honoring: NAT's middleware contract guarantees the function does not execute if `pre_invoke` raises or sets SKIP. The fail posture is `workflow.yml`'s `default_deny` OR the ServerHello's `on_decision_failure` (most-restrictive-wins); Guardian refusals (signature invalid, replay, malformed/oversized envelope) fail closed regardless of posture, on both the input gate (block) and the output gate (redact) — spec issue #32. Methods absent from the ServerHello's `methods_evaluated` resolve as ALLOW-by-default without being sent (handshake.json) and are recorded as `method_not_evaluated`. Every decision failure is audited under either posture with its `failure_class` (`timeout`, `unreachable`, `malformed_response`, `guardian_error`, `observed_agent_error`, `signature_invalid`, `handshake_failure`, `other`) and `posture`, and each run's `sessionEnd` reports that run's count per class in `summary.decision_failures` (§6.4, #273). A handshake that gets no answer is audited as `handshake_failure`; that session sends the Guardian nothing, `sessionEnd` included (§4.1).
+- Baseline integrity: HMAC-SHA256 per §10 over the RFC 8785 (JCS) canonical envelope with an HKDF-derived per-session key (`ACS_HMAC_SECRET_FILE` / `ACS_HMAC_SECRET`); `rfc8785` is a hard runtime dependency. The signature names the configured label `ACS_HMAC_KEY_ID` as `key_id`, and a response under any other label fails verification with no other secret tried; an unsigned `SIGNATURE_INVALID`, a Guardian's answer to a label it does not hold, is recorded as `key_id_rejected` and fails closed. Responses are signature-verified and bound to their request under any HTTP status; a mis-bound, badly-signed or unverifiable response fails closed regardless of posture. A middleware with no secret, a secret under 32 bytes, or no label refuses its session, so every call is denied, and sends nothing (`secret_missing`, `secret_too_short`, `key_id_missing`), whatever the posture: ACS-Core signs every request.
diff --git a/adapters/docs/nat/workflow.yml.example b/adapters/docs/nat/workflow.yml.example
index f7f7a6bf..8b3ff161 100644
--- a/adapters/docs/nat/workflow.yml.example
+++ b/adapters/docs/nat/workflow.yml.example
@@ -5,9 +5,11 @@
 #
 # Environment (set on the NAT process — the adapter is in-process):
 #   ACS_HMAC_SECRET_FILE=/path/to/.acs/hmac.key
-#       REQUIRED for ACS-Core baseline integrity (§10). Without a secret
-#       both ends run unsigned and any local process that binds the
-#       Guardian port becomes the Guardian. Generate:
+#   ACS_HMAC_KEY_ID=2026-11
+#       REQUIRED with the secret: the label that names it (§10); the Guardian holds the same one.
+#       REQUIRED for ACS-Core baseline integrity (§10), at least 32 bytes.
+#       Without a secret and its label the middleware refuses its session
+#       and denies every call. Generate:
 #         mkdir -p ~/.acs && openssl rand -hex 32 > ~/.acs/hmac.key && chmod 600 ~/.acs/hmac.key
 #       and give the SAME file to the Guardian.
 #   ACS_AUDIT_FILE=/path/to/.acs/audit.log
@@ -23,7 +25,7 @@ middleware:
     guardian_url: http://127.0.0.1:8787/acs
     default_deny: true
     timeout_s: 5.0
-    # session_id is auto-generated per process if omitted
+    # session_id is auto-generated per process if omitted; each NAT run's session derives from it
     # target_function_or_group: my_tools
 
 function_groups:
diff --git a/adapters/scripts/check_wheel.py b/adapters/scripts/check_wheel.py
index eaed1745..9270c2ec 100644
--- a/adapters/scripts/check_wheel.py
+++ b/adapters/scripts/check_wheel.py
@@ -98,6 +98,7 @@ def base_checks(env_dir: Path, wheel_version: str, cwd: Path) -> None:
 
     guardian_env = {k: v for k, v in os.environ.items() if k != "ACS_SPEC_DIR"}
     guardian_env["ACS_HMAC_SECRET"] = "ab" * 32
+    guardian_env["ACS_HMAC_KEY_ID"] = "check-wheel"
     guardian = subprocess.Popen([str(bindir / "acs-example-guardian"), "--port", "0"], cwd=cwd,
                                 stdout=subprocess.PIPE, stderr=subprocess.PIPE, text=True,
                                 env=guardian_env)
diff --git a/adapters/src/acs/client/__init__.py b/adapters/src/acs/client/__init__.py
index 5312dcf3..5c84caeb 100644
--- a/adapters/src/acs/client/__init__.py
+++ b/adapters/src/acs/client/__init__.py
@@ -4,6 +4,11 @@
 
 # Exports load on first use, so _config, _outcome and _audit import without the signing dependency.
 _EXPORTS = {
+    "FAILURE_CLASSES": "_config",
+    "failure_class": "_config",
+    "decision_failure_counts": "_store",
+    "discard_session": "_handshake",
+    "count_decision_failure": "_store",
     "Config": "_config",
     "Decided": "_outcome",
     "FailPosture": "_config",
@@ -16,14 +21,18 @@
     "Resolution": "_config",
     "SecretFilePermissionsError": "_secrets",
     "SecretFileUnreadableError": "_secrets",
+    "SigningMaterialMissing": "_secrets",
     "SessionRefused": "_outcome",
     "Undecided": "_outcome",
     "audit_event": "_audit",
+    "audit_modify_unsupported": "_audit",
     "classify_response": "_exchange",
     "close_turn": "_store",
     "current_turn": "_store",
     "exchange": "_exchange",
     "load_hmac_secret": "_secrets",
+    "load_key_id": "_secrets",
+    "load_signing_material": "_secrets",
     "load_session_state": "_store",
     "mark_once": "_store",
     "open_session": "_handshake",
@@ -34,6 +43,7 @@
     "record_step": "_store",
     "round_trip": "_exchange",
     "save_session_state": "_store",
+    "session_start_outcome": "_handshake",
     "sign_envelope": "_signing",
     "update_session_state": "_store",
     "validate_guardian_url": "_urls",
diff --git a/adapters/src/acs/client/_audit.py b/adapters/src/acs/client/_audit.py
index 97944d0e..a36323bd 100644
--- a/adapters/src/acs/client/_audit.py
+++ b/adapters/src/acs/client/_audit.py
@@ -39,3 +39,8 @@ def audit_event(event_type: str, **fields: Any) -> None:
             sys.stderr.write(
                 f"ACS_AUDIT_SINK_ERROR cannot append to {audit_file!r}: {e}\n")
             sys.stderr.flush()
+
+
+def audit_modify_unsupported(detail: str, **fields: Any) -> None:
+    """Record a MODIFY the client cannot apply and treats as DENY, under reason code modify_unsupported (§6.5)."""
+    audit_event("modify_unsupported", reason_codes=["modify_unsupported"], detail=detail, **fields)
diff --git a/adapters/src/acs/client/_config.py b/adapters/src/acs/client/_config.py
index 77562e02..ce37edf0 100644
--- a/adapters/src/acs/client/_config.py
+++ b/adapters/src/acs/client/_config.py
@@ -10,7 +10,32 @@
 DEFAULT_TIMEOUT_S = 5.0
 
 
-# The deny message's label for each audit type that blocks.
+# §6.4 failure classes, the acs.failure.class values in trace/otel-mapping.json.
+FAILURE_CLASSES = ("timeout", "unreachable", "malformed_response", "guardian_error", "observed_agent_error",
+                   "signature_invalid", "handshake_failure", "other")
+
+_OBSERVED_AGENT_CAUSES = {"adapter_exception", "adapter_build_failed", "adapter_translate_exception",
+                          "invalid_stdin_json", "guardian_url_rejected", "request_exceeds_max_payload"}
+_SIGNATURE_CAUSES = {"response_signature_invalid", "error_signature_invalid", "response_unverifiable",
+                     "server_hello_signature_invalid"}
+
+
+def failure_class(cause: str) -> str:
+    if cause in ("decision_timeout", "handshake_timeout"):
+        return "timeout"
+    if cause == "transport_failure":
+        return "unreachable"
+    if cause in ("malformed_response", "response_binding_mismatch"):
+        return "malformed_response"
+    if cause in _SIGNATURE_CAUSES:
+        return "signature_invalid"
+    if cause in _OBSERVED_AGENT_CAUSES:
+        return "observed_agent_error"
+    if cause.endswith("_response") or cause.startswith("http_") or cause == "key_id_rejected":
+        return "guardian_error"
+    return "other"
+
+
 _DENY_LABELS = {
     "guardian_refusal_fail_closed": "refused",
     "session_refused_fail_closed": "session refused",
@@ -26,6 +51,8 @@ class Resolution:
     cause: str
     fields: Mapping[str, Any]
     message: str = ""
+    # This step's own decision failure (§6.4), counted once; a session gate restating one is not.
+    decision_failure: bool = False
 
     @property
     def label(self) -> str:
@@ -65,11 +92,14 @@ def negotiated(self, server_hello: Mapping[str, Any] | None) -> FailPosture:
 
     def resolve(self, outcome: Undecided | Refused) -> Resolution:
         """The one place a step without a usable decision is settled: a refusal blocks, anything else follows the posture."""
+        proceed = not isinstance(outcome, Refused) and not self.deny_on_failure
+        fields = {**outcome.fields, "failure_class": failure_class(outcome.cause),
+                  "posture": "fail_open" if proceed else "fail_closed"}
         if isinstance(outcome, Refused):
-            return Resolution(False, "guardian_refusal_fail_closed", outcome.cause, outcome.fields, outcome.message)
-        if self.deny_on_failure:
-            return Resolution(False, "decision_failure_fail_closed", outcome.cause, outcome.fields, outcome.message)
-        return Resolution(True, "fail_open_bypass", outcome.cause, outcome.fields, outcome.message)
+            audit_type = "guardian_refusal_fail_closed"
+        else:
+            audit_type = "fail_open_bypass" if proceed else "decision_failure_fail_closed"
+        return Resolution(proceed, audit_type, outcome.cause, fields, outcome.message, decision_failure=True)
 
 
 @dataclass(frozen=True)
@@ -102,14 +132,15 @@ def startup_proceeds(self) -> bool:
             return not self.posture.deny_on_failure
         return self.startup_posture == "proceed"
 
-    def gate(self, handshake: Handshake) -> Resolution | None:
+    def gate(self, handshake: Handshake, method: str | None = None) -> Resolution | None:
         """None when this step goes to the Guardian; otherwise how it ends without one (§4.1), a session whose sessionStart got no decision included."""
         if isinstance(handshake, Negotiated):
             failure = handshake.start_failure
-            if failure is None or not self.posture.negotiated(handshake.server_hello).deny_on_failure:
+            # sessionEnd is audit-only and reports the session's decision failures (§6.4), the start's among them.
+            if failure is None or method == "steps/sessionEnd" or not self.posture.negotiated(handshake.server_hello).deny_on_failure:
                 return None
             return Resolution(False, "decision_failure_fail_closed", failure["cause"],
-                              {**failure["fields"], "method": "steps/sessionStart"})
+                              {**failure["fields"], "method": "steps/sessionStart", "posture": "fail_closed"})
         if isinstance(handshake, SessionRefused):
             return Resolution(False, "session_refused_fail_closed", handshake.cause, handshake.fields)
         if self.startup_proceeds:
diff --git a/adapters/src/acs/client/_exchange.py b/adapters/src/acs/client/_exchange.py
index 2e0da788..fde39830 100644
--- a/adapters/src/acs/client/_exchange.py
+++ b/adapters/src/acs/client/_exchange.py
@@ -238,6 +238,11 @@ def exchange(request: dict[str, Any], *, guardian_url: str, timeout_s: float,
     return replace(outcome, fields={**outcome.fields, "http_status": http_status})
 
 
+def key_id_rejected(error: Any) -> bool:
+    """An unsigned SIGNATURE_INVALID error: how a Guardian answers a key_id it holds no secret for (§10)."""
+    return isinstance(error, dict) and error.get("code") == -32004 and "signature" not in error
+
+
 def classify_response(request: dict[str, Any], response: Any, *, session_id: str | None) -> Outcome:
     """Classify a decoded Guardian answer; mis-bound or unverifiable answers and refusal codes fail closed."""
     params = request.get("params") or {}
@@ -255,6 +260,10 @@ def classify_response(request: dict[str, Any], response: Any, *, session_id: str
         code = err.get("code")
         # Errors are signed too; an unverifiable error under fail-open would be an allow.
         if not verify_signature(response, session_id=session_id):
+            if key_id_rejected(err):
+                return Refused("key_id_rejected", {"claimed_error_code": code},
+                               "Guardian answered an unsigned SIGNATURE_INVALID, how it reports a key_id it does not "
+                               "hold (§10); check ACS_HMAC_KEY_ID")
             return Refused("error_signature_invalid",
                            {"claimed_error_code": code, "claimed_cause": guardian_error_cause(code)},
                            "error response signature invalid")
diff --git a/adapters/src/acs/client/_handshake.py b/adapters/src/acs/client/_handshake.py
index 2609e7a9..b2af4c6e 100644
--- a/adapters/src/acs/client/_handshake.py
+++ b/adapters/src/acs/client/_handshake.py
@@ -16,9 +16,9 @@
 
 from acs.client._audit import audit_event
 from acs.client._config import Config, Resolution
-from acs.client._exchange import GuardianHTTPError, is_jsonrpc_response, post
+from acs.client._exchange import GuardianHTTPError, is_jsonrpc_response, key_id_rejected, post
 from acs.client._outcome import Decided, Handshake, Negotiated, NoAnswer, SessionRefused, Undecided
-from acs.client._secrets import load_hmac_secret
+from acs.client._secrets import SigningMaterialMissing, load_signing_material
 from acs.client._signing import sign_envelope, verify_signature
 from acs.client._store import _locked
 from acs.client._urls import validate_guardian_url
@@ -57,6 +57,13 @@ def _handshake_cache_path(session_id: str, guardian_url: str, directory: Path |
     return (directory or _HANDSHAKE_CACHE_DIR) / f"{key}.json"
 
 
+def discard_session(session_id: str, guardian_url: str) -> None:
+    path = _handshake_cache_path(session_id, guardian_url)
+    for record in (path, Path(f"{path}.started"), Path(f"{path}.lock")):
+        with contextlib.suppress(OSError):
+            record.unlink()
+
+
 def open_session(*, config: Config, session_id: str | None, agent_id: str, platform: str,
                  methods_implemented: list[str], wrapped_protocols: list[str] | None = None,
                  timeout: float | None = None, profiles_supported: list[str] | None = None,
@@ -81,8 +88,11 @@ def open_session(*, config: Config, session_id: str | None, agent_id: str, platf
     """
     if not session_id:
         return NoAnswer("missing_session_id")
+    # §10: every request is signed, so a session with no usable secret and label is refused before any stored one is read.
     try:
-        ikm = load_hmac_secret()
+        ikm, _ = load_signing_material()
+    except SigningMaterialMissing as e:
+        return SessionRefused(e.cause, {"error": str(e)})
     except Exception as e:  # noqa: BLE001
         return SessionRefused("secret_unavailable", {"error": str(e)})
     path = _handshake_cache_path(session_id, config.guardian_url)
@@ -132,10 +142,16 @@ def _start_session(decision: Negotiated, start: Callable[[Negotiated], Decided |
     except Exception as e:  # noqa: BLE001
         result = config.posture.negotiated(decision.server_hello).resolve(
             Undecided("adapter_exception", {"error": str(e)}, f"adapter error: {e}"))
+    return session_start_outcome(decision, result, session_id=session_id, guardian_url=config.guardian_url)
+
+
+def session_start_outcome(decision: Negotiated, result: Decided | Resolution | None, *, session_id: str,
+                          guardian_url: str) -> Handshake:
+    """The session's decision after its sessionStart answered with result, audited (hooks.md sessionStart: ALLOW / DENY)."""
     if result is None:
         # The Guardian does not evaluate sessionStart.
         return decision
-    common = {"method": "steps/sessionStart", "session_id": session_id, "guardian_url": config.guardian_url}
+    common = {"method": "steps/sessionStart", "session_id": session_id, "guardian_url": guardian_url}
     if isinstance(result, Resolution):
         audit_event(result.audit_type, **{**result.fields, "cause": result.cause, **common})
         if result.audit_type == "guardian_refusal_fail_closed":
@@ -158,8 +174,7 @@ def _decide(path: Path, ikm: bytes, *, config: Config, session_id: str, agent_id
     stored = _read_record(path, ikm, session_id, config.guardian_url)
     if stored is not None:
         return stored
-    # An unsigned session does not meet acs-core's signed-envelope floor (§10), so it claims no profile.
-    claimed = (profiles_supported if profiles_supported is not None else ["acs-core"]) if ikm else []
+    claimed = profiles_supported if profiles_supported is not None else ["acs-core"]
     if not config.handshake_enabled:
         decision: Handshake = NoAnswer("handshake_disabled")
     else:
@@ -167,7 +182,7 @@ def _decide(path: Path, ikm: bytes, *, config: Config, session_id: str, agent_id
             guardian_url=config.guardian_url, session_id=session_id, agent_id=agent_id,
             platform=platform, methods_implemented=methods_implemented,
             wrapped_protocols=wrapped_protocols, profiles_supported=claimed,
-            transports_supported=transports_supported, signed=bool(ikm),
+            transports_supported=transports_supported,
             timeout=_HANDSHAKE_TIMEOUT_S if timeout is None else timeout,
         )
     decision, ours = _store_first(path, decision, ikm, session_id, config.guardian_url)
@@ -196,7 +211,7 @@ def store_session_decision(directory: Path, session_id: str, guardian_url: str,
 def _hello(*, guardian_url: str, session_id: str, agent_id: str, platform: str,
            methods_implemented: list[str], wrapped_protocols: list[str] | None,
            profiles_supported: list[str], transports_supported: list[str] | None,
-           signed: bool, timeout: float) -> Handshake:
+           timeout: float) -> Handshake:
     # The client POSTs to the Guardian URL, so that URL's scheme is the one transport it offers.
     scheme = urllib.parse.urlsplit(guardian_url).scheme
     client_hello = {
@@ -217,7 +232,7 @@ def _hello(*, guardian_url: str, session_id: str, agent_id: str, platform: str,
                 "provenance_producer": "none",
                 "wrapped_protocols": wrapped_protocols or [],
                 "profiles_supported": profiles_supported,
-                "signature_algorithms_supported": ["HMAC-SHA256"] if signed else [],
+                "signature_algorithms_supported": ["HMAC-SHA256"],
             },
         },
     }
@@ -258,6 +273,8 @@ def _classify_hello(client_hello: Mapping[str, Any], response: Any, session_id:
     verified = verify_signature(response, session_id=session_id)
     if error is not None:
         if not verified:
+            if key_id_rejected(error):
+                return SessionRefused("key_id_rejected", {"claimed_error_code": code})
             return SessionRefused("error_signature_invalid",
                                   {"claimed_error_code": code, "claimed_cause": guardian_error_cause(code)})
         fields = {"error_code": code, "error_message": error.get("message")}
@@ -384,7 +401,7 @@ def _verified(path: Path, ikm: bytes, session_id: str, guardian_url: str, marker
         return SessionRefused("session_record_invalid", {"record": str(path)})
     body = {k: v for k, v in record.items() if k != "mac"}
     try:
-        authentic = not ikm or hmac.compare_digest(str(record.get("mac")), _mac(body, ikm, session_id))
+        authentic = hmac.compare_digest(str(record.get("mac")), _mac(body, ikm, session_id))
     except Exception:  # noqa: BLE001
         authentic = False
     if not (authentic and body.get("session_id") == session_id and body.get("guardian_url") == guardian_url):
@@ -405,7 +422,7 @@ def _write_startup(path: Path, outcome: Handshake | None, ikm: bytes, session_id
             decision = _encode(outcome, session_id, guardian_url)
             body.update({k: v for k, v in decision.items() if k not in body and k != "acs_session_record"},
                         state="done")
-        record = {**body, "mac": _mac(body, ikm, session_id) if ikm else None}
+        record = {**body, "mac": _mac(body, ikm, session_id)}
         fd, temporary = tempfile.mkstemp(dir=path.parent, prefix=".startup-")
         with os.fdopen(fd, "w") as f:
             json.dump(record, f)
@@ -434,7 +451,7 @@ def _store_first(path: Path, decision: Handshake, ikm: bytes, session_id: str,
     temporary = None
     try:
         body = _encode(decision, session_id, guardian_url)
-        record = {**body, "mac": _mac(body, ikm, session_id) if ikm else None}
+        record = {**body, "mac": _mac(body, ikm, session_id)}
         path.parent.mkdir(parents=True, exist_ok=True, mode=0o700)
         os.chmod(path.parent, 0o700)
         fd, temporary = tempfile.mkstemp(dir=path.parent, prefix=".record-")
diff --git a/adapters/src/acs/client/_profiles.py b/adapters/src/acs/client/_profiles.py
index 2e292d2e..bbde80c5 100644
--- a/adapters/src/acs/client/_profiles.py
+++ b/adapters/src/acs/client/_profiles.py
@@ -1,18 +1,12 @@
 from __future__ import annotations
 
 from acs.client._audit import audit_event
-from acs.client._secrets import load_hmac_secret
 from acs.client._store import mark_once
 
 
 def record_mcp_use(session_id: str | None, *, tool: str, workspace: str | None = None) -> None:
     """Record, once per session, that using MCP leaves its acs-core claim partial: protocols/MCP/* is not wrapped."""
-    try:
-        # The ClientHello claims acs-core exactly when a signing secret is configured.
-        claimed = bool(load_hmac_secret())
-    except Exception:  # noqa: BLE001
-        claimed = False
-    if claimed and session_id and mark_once(session_id, "profile_claim_degraded", workspace=workspace):
+    if session_id and mark_once(session_id, "profile_claim_degraded", workspace=workspace):
         audit_event("profile_claim_degraded", profile="acs-core", session_id=session_id, tool=tool,
                     detail="the session uses MCP; the adapter governs MCP tools/call through the "
                            "tool hooks and does not wrap protocols/MCP/*")
diff --git a/adapters/src/acs/client/_secrets.py b/adapters/src/acs/client/_secrets.py
index 915ee257..6b142ef1 100644
--- a/adapters/src/acs/client/_secrets.py
+++ b/adapters/src/acs/client/_secrets.py
@@ -12,10 +12,19 @@ class SecretFilePermissionsError(RuntimeError):
 
 
 class SecretFileUnreadableError(RuntimeError):
-    """ACS_HMAC_SECRET_FILE is configured but cannot be read.
+    """ACS_HMAC_SECRET_FILE is configured but cannot be read, or is empty."""
 
-    Raised loudly: silently downgrading to unsigned mode would turn
-    off the only integrity control ACS-Core mandates."""
+
+class SigningMaterialMissing(RuntimeError):
+    """No usable secret or label, so nothing may be sent: ACS-Core signs every request (§10)."""
+
+    def __init__(self, cause: str, message: str) -> None:
+        super().__init__(message)
+        self.cause = cause
+
+
+# §10: the secret MUST be at least 32 bytes from a cryptographically secure random source.
+MIN_SECRET_BYTES = 32
 
 
 def _check_secret_file_perms(path: str) -> None:
@@ -40,36 +49,44 @@ def _check_secret_file_perms(path: str) -> None:
 
 
 def load_hmac_secret() -> bytes:
-    """Read the HMAC input keying material.
-
-    Resolution order (first hit wins):
-    1. `ACS_HMAC_SECRET_FILE` — path to a file containing the secret.
-       Preferred for production. Permissions MUST be 0600 (or 0400) and
-       the file MUST be owned by the running user. The file's content
-       (stripped of trailing whitespace) is the secret. Symlinks are
-       rejected. Insecure permissions raise SecretFilePermissionsError —
-       the adapter refuses to use a leaked secret rather than silently
-       proceed.
-    2. `ACS_HMAC_SECRET` — env-var fallback. Quick for dev, less secure
-       (visible in `ps eauxw`, child-process envs, core dumps).
-    3. Empty bytes — caller decides whether that means dev-mode or fail.
-
-    Generate a secret: `openssl rand -hex 32 > /etc/acs/hmac.key && chmod 600 /etc/acs/hmac.key`
-    """
+    """The input keying material from ACS_HMAC_SECRET_FILE (owner-only, no symlink) or ACS_HMAC_SECRET; b"" when neither is set."""
     path = os.environ.get("ACS_HMAC_SECRET_FILE", "").strip()
     if path:
         try:
             _check_secret_file_perms(path)
             with open(path, "rb") as f:
-                return f.read().rstrip(b"\r\n\t ")
+                secret = f.read().rstrip(b"\r\n\t ")
+            if not secret:
+                raise OSError(f"{path} is empty")
+            return secret
         except SecretFilePermissionsError:
             raise
         except OSError as e:
-            # Configured-but-unreadable is an incident, not dev mode.
+            # Configured-but-unreadable is an incident, not a missing secret.
             audit_event("hmac_secret_file_unreadable", path=path, error=str(e))
             raise SecretFileUnreadableError(
                 f"ACS_HMAC_SECRET_FILE {path!r} is configured but cannot "
-                f"be read ({e}); refusing to continue unsigned"
+                f"be read ({e})"
             ) from e
     env_val = os.environ.get("ACS_HMAC_SECRET", "")
     return env_val.encode("utf-8") if env_val else b""
+
+
+def load_key_id() -> str:
+    """ACS_HMAC_KEY_ID, the deployment's label for the secret (§10); "" when unset."""
+    return os.environ.get("ACS_HMAC_KEY_ID", "").strip()
+
+
+def load_signing_material() -> tuple[bytes, str]:
+    """The secret and the label that names it; raises SigningMaterialMissing when either is missing or the secret is under 32 bytes (§10)."""
+    secret = load_hmac_secret()
+    if not secret:
+        raise SigningMaterialMissing("secret_missing", "no ACS_HMAC_SECRET_FILE or ACS_HMAC_SECRET is configured; "
+                                                       "ACS-Core signs every request (§10)")
+    if len(secret) < MIN_SECRET_BYTES:
+        raise SigningMaterialMissing("secret_too_short", f"the secret is {len(secret)} bytes; "
+                                                         f"§10 requires at least {MIN_SECRET_BYTES}")
+    label = load_key_id()
+    if not label:
+        raise SigningMaterialMissing("key_id_missing", "ACS_HMAC_KEY_ID is not set; it names the configured secret (§10)")
+    return secret, label
diff --git a/adapters/src/acs/client/_signing.py b/adapters/src/acs/client/_signing.py
index b7b2a8cc..0e72e66e 100644
--- a/adapters/src/acs/client/_signing.py
+++ b/adapters/src/acs/client/_signing.py
@@ -1,68 +1,43 @@
-"""Signing and verifying with the configured secret, and the one-time unsigned-mode warning."""
 from __future__ import annotations
 
-from acs.client._audit import audit_event
-from acs.client._secrets import load_hmac_secret
+from acs.client._secrets import load_hmac_secret, load_key_id, load_signing_material
 from acs.core import container_key, derive_session_key, sign_with_key, verify_with_key
 
 
-_warned_unsigned_mode = False
-
-
-def _warn_unsigned_once() -> None:
-    """One loud warning per process when operating without key material.
-
-    Unsigned mode is an authentication failure, not just a
-    confidentiality one: any local process that binds the Guardian port
-    first becomes the Guardian and allows everything.
-    Fine for a first local experiment; never fine silently."""
-    global _warned_unsigned_mode
-    if not _warned_unsigned_mode:
-        _warned_unsigned_mode = True
-        audit_event(
-            "unsigned_mode",
-            detail=(
-                "no ACS_HMAC_SECRET / ACS_HMAC_SECRET_FILE configured — "
-                "envelopes are UNSIGNED and any local process that binds "
-                "the Guardian address is trusted"
-            ),
-        )
-
-
 def sign_envelope(envelope: dict, *, key: bytes | None = None,
-                  session_id: str | None = None, key_id: str = "default") -> dict:
-    """Add a signature to the envelope. Returns the envelope unchanged
-    (after a loud one-time audit event) if no key material is available."""
+                  session_id: str | None = None, key_id: str | None = None) -> dict:
+    """Add a signature under key_id, the configured ACS_HMAC_KEY_ID unless given; raises SigningMaterialMissing without a usable secret and label."""
     if key is None:
-        ikm = load_hmac_secret()
-        if not ikm:
-            _warn_unsigned_once()
-            return envelope
+        ikm, _ = load_signing_material()
         if not session_id:
             params = envelope.get("params") or envelope.get("result") or {}
             meta = params.get("metadata") or {}
             session_id = meta.get("session_id") or params.get("request_id") or ""
         key = derive_session_key(ikm, session_id)
-    return sign_with_key(envelope, key, key_id=key_id)
+    label = key_id if key_id is not None else load_key_id()
+    if not label:
+        raise ValueError("ACS_HMAC_KEY_ID is not set; it names the configured secret (§10)")
+    return sign_with_key(envelope, key, key_id=label)
 
 
 def verify_signature(envelope: dict, *, key: bytes | None = None,
-                     session_id: str | None = None) -> bool:
-    """Verify a signed envelope (request, decision response, or error
-    response). Returns True if valid (or if no signature present and no
-    key material configured — local-dev mode)."""
+                     session_id: str | None = None, key_id: str | None = None) -> bool:
+    """Whether the envelope carries a valid signature under key_id (default ACS_HMAC_KEY_ID); an unsigned envelope is not valid."""
     container = envelope.get(container_key(envelope)) or {}
     if not isinstance(container, dict):
         return False
     sig = container.get("signature")
     if sig is None:
-        # No signature on the wire; valid only if local-dev (no key configured)
-        return not bool(load_hmac_secret())
+        return False
 
     if not isinstance(sig, dict) or sig.get("algorithm") != "HMAC-SHA256":
         return False
     if not sig.get("value"):
         return False
+    # §10: an unknown key_id is rejected, with no fallback to another secret.
+    label = key_id if key_id is not None else load_key_id()
+    if not label or sig.get("key_id") != label:
+        return False
 
     if key is None:
         ikm = load_hmac_secret()
diff --git a/adapters/src/acs/client/_store.py b/adapters/src/acs/client/_store.py
index 912b17fa..07ce35cc 100644
--- a/adapters/src/acs/client/_store.py
+++ b/adapters/src/acs/client/_store.py
@@ -161,7 +161,30 @@ def change(state: dict) -> bool:
     return first is not False
 
 
-# ----- The open turn -----
+def count_decision_failure(session_id: str | None, failure: str, *, workspace: str | None = None) -> None:
+    """Count one decision failure for sessionEnd's summary; never raises, so a count cannot stop a deny."""
+    if not session_id:
+        return
+
+    def change(state: dict) -> None:
+        counts = state.get("decision_failures")
+        counts = counts if isinstance(counts, dict) else {}
+        counts[failure] = int(counts.get(failure, 0)) + 1
+        state["decision_failures"] = counts
+
+    try:
+        update_session_state(session_id, change, workspace=workspace)
+    except Exception:  # noqa: BLE001
+        # The failure itself is already audited; sessionEnd's count is a lower bound (trace/events.md).
+        pass
+
+
+def decision_failure_counts(session_id: str | None, *, workspace: str | None = None) -> dict[str, int]:
+    counts = load_session_state(session_id, workspace=workspace).get("decision_failures") if session_id else None
+    if not isinstance(counts, dict):
+        return {}
+    return {k: v for k, v in counts.items() if isinstance(k, str) and isinstance(v, int) and v >= 0}
+
 
 def current_turn(session_id: str | None, *, workspace: str | None = None) -> str | None:
     if not session_id:
diff --git a/adapters/src/acs/core/_signing.py b/adapters/src/acs/core/_signing.py
index 53570996..c05c8711 100644
--- a/adapters/src/acs/core/_signing.py
+++ b/adapters/src/acs/core/_signing.py
@@ -38,8 +38,8 @@ def container_key(envelope: dict) -> str:
     return "result"
 
 
-def sign_with_key(envelope: dict, key: bytes, *, key_id: str = "default") -> dict:
-    """Add an HMAC-SHA256 signature made with `key` over JCS(envelope without its signature), in place."""
+def sign_with_key(envelope: dict, key: bytes, *, key_id: str) -> dict:
+    """Sign in place with HMAC-SHA256 over JCS(envelope without its signature), labelled key_id (§10)."""
     ckey = container_key(envelope)
     container = envelope.get(ckey, {})
     # Strip any existing signature before signing
diff --git a/adapters/src/acs/guardian/example_guardian.py b/adapters/src/acs/guardian/example_guardian.py
index f0f5fb7c..241211d3 100755
--- a/adapters/src/acs/guardian/example_guardian.py
+++ b/adapters/src/acs/guardian/example_guardian.py
@@ -1,54 +1,5 @@
 #!/usr/bin/env python3
-"""
-Minimal local Guardian for testing the reference adapters.
-
-Implements the ACS v0.1.0 spec features the adapters exercise:
-
-- Wire envelope per `request-envelope.json` / `response-envelope.json`.
-- HMAC-SHA256 baseline signing (§10) with HKDF-derived per-session key.
-- Rolling SHA-256 audit chain per §8.2 (`entry_hash = sha256(JCS(entry) || previous_hash)`).
-- Replay rejection on duplicate `request_id` (§10.3, error -32005).
-- Timestamp skew rejection (§10.3, error -32006).
-- `handshake/hello` with ClientHello/ServerHello (§4).
-- `system/ping` always returns allow, never enters the chain (§13).
-- Subagent gating: blocks `Task` tool by default.
-- Destructive-Bash regex + protected-system-path Write blocks.
-
-This is NOT a production Guardian. It is a teaching artifact and a test
-substrate for the reference adapters.
-
-Wire format ground truth:
-  `specification/v0.1.0/request-envelope.json`
-  `specification/v0.1.0/response-envelope.json`
-  `specification/v0.1.0/handshake.json`
-  `specification/v0.1.0/hooks/*.json`
-
-Usage:
-  python3 example_guardian.py [--port 8787]
-
-Environment variables:
-  ACS_HMAC_SECRET / ACS_HMAC_SECRET_FILE
-                      Shared secret for HMAC-SHA256 signing per §10. The
-                      Guardian verifies every signed request and signs
-                      every response. **The Guardian refuses to start
-                      unless one of these is set, or `ACS_DEV_MODE=1`.**
-                      File path is preferred for production (no exposure
-                      in `ps aux`); use `chmod 600`.
-                      Generate: `openssl rand -hex 32 > /etc/acs/hmac.key`
-  ACS_DEV_MODE        "1" allows starting without a signing secret. Local
-                      development only. ACS-Core baseline integrity (§10)
-                      is not satisfied in dev mode.
-  ACS_SKEW_WINDOW_MS  Timestamp skew tolerance (default 300_000 = 5 min).
-  ACS_ALLOW_SUBAGENT  "1" allows the Task tool. Default "0" gates it.
-  ACS_GUARDIAN_STATE_DIR
-                      Directory where per-session state (chain head +
-                      seen request_ids) is persisted. Survives Guardian
-                      restart so §10.3 replay protection isn't reset by
-                      crashes / deploys / autoscaling. Defaults to
-                      ~/.cache/acs-guardian-state/. Set to "" to disable
-                      persistence (RAM-only; dev/test only — opens a
-                      replay window across restarts).
-"""
+"""Example Guardian for testing the reference adapters, not a production Guardian; docs/guardian/README.md describes it."""
 from __future__ import annotations
 
 import argparse
@@ -65,7 +16,7 @@
 from pathlib import Path
 from typing import Any
 
-from acs.client import load_hmac_secret, sign_envelope, verify_signature  # noqa: E402
+from acs.client import load_key_id, load_signing_material, sign_envelope, verify_signature  # noqa: E402
 from acs.examples.destructive_bash import DESTRUCTIVE_SCAN_MAX_LEN, matches_destructive_bash  # noqa: E402
 from acs.core import (  # noqa: E402
     ACS_VERSION,
@@ -132,18 +83,9 @@
 ALLOW_SUBAGENT = os.environ.get("ACS_ALLOW_SUBAGENT", "0") == "1"
 
 
-def _hmac_secret() -> bytes:
-    """Re-read on every call so operators can rotate the secret without
-    restarting the Guardian."""
-    return load_hmac_secret()
-
-
 PROTECTED_PATH_PREFIXES: tuple[str, ...] = ("/etc/", "/usr/", "/bin/", "/sbin/", "/boot/")
 
-# Methods this teaching policy acknowledges with unconditional allow.
-# steps/subagentStart is deliberately NOT here — it is the confused-deputy
-# gate and gets a real policy branch in evaluate_step; steps/subagentStop
-# is audit-only per hooks.md.
+# Acknowledged with an unconditional allow; subagentStart is absent because it is the confused-deputy gate.
 INFORMATIONAL_METHODS = {
     "steps/sessionStart", "steps/sessionEnd", "steps/userMessage",
     "steps/toolCallResult", "steps/agentResponse",
@@ -382,10 +324,12 @@ def append_to_chain(session_id: str, method: str, request_id: str,
 # ----- Replay + skew checks (§10.3 normative) -----
 
 class GuardianError(Exception):
-    def __init__(self, code: int, message: str) -> None:
+    def __init__(self, code: int, message: str, *, signed: bool = True) -> None:
         super().__init__(message)
         self.code = code
         self.message = message
+        # §10: the error for a key_id no configured secret matches is unsigned.
+        self.signed = signed
 
 
 def check_replay(session_id: str, request_id: str) -> None:
@@ -419,14 +363,10 @@ def check_skew(timestamp: str) -> None:
 
 
 def check_signature(envelope: dict, session_id: str) -> None:
-    if not _hmac_secret():
-        return  # local-dev mode
     if not verify_signature(envelope, session_id=session_id):
         raise GuardianError(-32004, "SIGNATURE_INVALID")
 
 
-# ----- Method evaluators -----
-
 def _major(version: str) -> str | None:
     """Major component of an X.Y.Z version string, or None if unparseable."""
     parts = str(version).split(".")
@@ -464,7 +404,7 @@ def evaluate_handshake(params: dict, request_id: str) -> dict:
         "negotiated_version": ACS_VERSION,
         "methods_evaluated": client_hello.get("methods_implemented") or [],
         "selected_transport": transport,
-        "signature_algorithms_supported": (["HMAC-SHA256"] if _hmac_secret() else []),
+        "signature_algorithms_supported": ["HMAC-SHA256"],
         "timeout_config": {"default_ms": 5000},
         "skew_window_ms": SKEW_WINDOW_MS,
         "on_decision_failure": "proceed",  # spec default per §6.4
@@ -564,16 +504,14 @@ def evaluate_step(method: str, params: dict, request_id: str, chain_hash: str) -
             "reason_codes": ["unknown_method"]}
 
 
-# ----- Request dispatch -----
-
-def _error_envelope(request_id, session_id: str, code: int, message: str) -> dict:
+def _error_envelope(request_id, session_id: str, code: int, message: str, *, signed: bool = True) -> dict:
     """Build a SIGNED JSON-RPC error envelope — conformance.md:23 covers
     error responses too (an unsigned spoofable error under fail-open is
     an allow). Signed whenever session_id makes the per-session key
     derivable; earlier failures surface as HTTP refusals in do_POST."""
     envelope = {"jsonrpc": "2.0", "id": request_id,
                 "error": {"code": code, "message": message}}
-    if _hmac_secret() and session_id:
+    if signed and session_id:
         sign_envelope(envelope, session_id=session_id)
     return envelope
 
@@ -587,8 +525,19 @@ def handle_request(request: dict) -> dict:
     acs_request_id = params.get("request_id", "")
     timestamp = params.get("timestamp", "")
 
-    # Schema-validate before policy code; system/ping and handshake/hello
-    # have their own payload shapes and are exempt.
+    # system/ping is the only unsigned method (§13), so liveness probes survive a key outage.
+    if method == "system/ping":
+        result = evaluate_ping(params, acs_request_id)
+        envelope = {"jsonrpc": "2.0", "id": request_id, "result": result}
+        return envelope
+
+    # §10: a request under a key_id this Guardian holds no secret for gets an unsigned
+    # SIGNATURE_INVALID before any other check, since no response to it can be signed.
+    signature = params.get("signature")
+    if isinstance(signature, dict) and signature.get("key_id") != load_key_id():
+        return _error_envelope(request_id, session_id, -32004, "SIGNATURE_INVALID: unknown key_id", signed=False)
+
+    # Validated before policy; ping and handshake have their own payload shapes.
     if (_SPEC_VALIDATION_AVAILABLE
             and method not in ("system/ping", "handshake/hello")):
         errors = list(_REQUEST_ENVELOPE_VALIDATOR.iter_errors(request))
@@ -600,13 +549,6 @@ def handle_request(request: dict) -> dict:
             return _error_envelope(request_id, session_id, -32600,
                                    f"Invalid Request: envelope failed schema: {paths}")
 
-    # system/ping is the ONLY signature-exempt method (§13), so liveness
-    # probing survives key-resolution outages.
-    if method == "system/ping":
-        result = evaluate_ping(params, acs_request_id)
-        envelope = {"jsonrpc": "2.0", "id": request_id, "result": result}
-        return envelope
-
     if method == "handshake/hello":
         # NOT signature-exempt: §10 / conformance.md:23 cover every
         # request, and the per-session key (pre-shared secret +
@@ -616,10 +558,9 @@ def handle_request(request: dict) -> dict:
             check_signature(request, session_id)
             result = evaluate_handshake(params, acs_request_id)
         except GuardianError as e:
-            return _error_envelope(request_id, session_id, e.code, e.message)
+            return _error_envelope(request_id, session_id, e.code, e.message, signed=e.signed)
         envelope = {"jsonrpc": "2.0", "id": request_id, "result": result}
-        if _hmac_secret():
-            sign_envelope(envelope, session_id=session_id)
+        sign_envelope(envelope, session_id=session_id)
         return envelope
 
     # Standard hook traffic — full pipeline
@@ -628,7 +569,7 @@ def handle_request(request: dict) -> dict:
         check_skew(timestamp)
         check_replay(session_id, acs_request_id)
     except GuardianError as e:
-        return _error_envelope(request_id, session_id, e.code, e.message)
+        return _error_envelope(request_id, session_id, e.code, e.message, signed=e.signed)
 
     # Compute chain entry BEFORE evaluating, then include head in result.
     payload_canonical = jcs_canonicalize(params).decode("utf-8")
@@ -640,8 +581,7 @@ def handle_request(request: dict) -> dict:
         return _error_envelope(request_id, session_id, e.code, e.message)
 
     envelope = {"jsonrpc": "2.0", "id": request_id, "result": result}
-    if _hmac_secret():
-        sign_envelope(envelope, session_id=session_id)
+    sign_envelope(envelope, session_id=session_id)
     return envelope
 
 
@@ -723,27 +663,20 @@ def main() -> int:
     parser.add_argument("--host", default="127.0.0.1")
     args = parser.parse_args()
 
-    # §10 baseline integrity: refuse to start without a signing secret
-    # unless the operator explicitly opted into dev mode.
-    if not load_hmac_secret() and os.environ.get("ACS_DEV_MODE", "0") != "1":
+    # §10: every request and response is signed, so the Guardian starts only with a usable secret and label.
+    try:
+        load_signing_material()
+    except Exception as e:  # noqa: BLE001
         sys.stderr.write(
-            "[guardian] REFUSING TO START: no signing secret configured.\n"
-            "  Configure one of:\n"
+            f"[guardian] REFUSING TO START: {e}\n"
+            "  Configure a secret of at least 32 bytes and the label that names it:\n"
             "    ACS_HMAC_SECRET_FILE=/path/to/key   (preferred; chmod 600)\n"
-            "    ACS_HMAC_SECRET=<hex>               (env-var fallback)\n"
+            "    ACS_HMAC_KEY_ID=<label>             (the same label the adapters use)\n"
             "  Generate a key:\n"
             "    openssl rand -hex 32 > /etc/acs/hmac.key && chmod 600 /etc/acs/hmac.key\n"
-            "  For local development without a secret (NON-CONFORMANT per §10):\n"
-            "    ACS_DEV_MODE=1\n"
         )
         return 1
 
-    if not load_hmac_secret():
-        sys.stderr.write(
-            "[guardian] WARNING: running in ACS_DEV_MODE — envelope signing disabled.\n"
-            "  ACS-Core baseline integrity (§10) is NOT satisfied.\n"
-        )
-
     class ReusableServer(socketserver.ThreadingMixIn, socketserver.TCPServer):
         allow_reuse_address = True
         daemon_threads = True
diff --git a/adapters/src/acs/integrations/claude_code/adapter.py b/adapters/src/acs/integrations/claude_code/adapter.py
index 1a50473f..84e0314b 100755
--- a/adapters/src/acs/integrations/claude_code/adapter.py
+++ b/adapters/src/acs/integrations/claude_code/adapter.py
@@ -27,9 +27,9 @@
                       is attacker-reachable (see GUARDIAN_REFUSAL_CODES).
   ACS_HMAC_SECRET     Shared secret for baseline HMAC-SHA256 envelope
                       signing per §10 (or ACS_HMAC_SECRET_FILE, preferred
-                      for production). If unset, requests are unsigned
-                      (local-dev mode, loud audit event). ACS-Core
-                      conformance requires one of these to be set.
+                      for production), at least 32 bytes, named by
+                      ACS_HMAC_KEY_ID. Without both, the session is refused
+                      and every step denied: ACS-Core signs every request.
   ACS_AGENT_ID        Explicit agent_id for metadata. If unset, derived
                       from cwd as `claude-code:<sha8(cwd)>`.
   ACS_STARTUP_POSTURE "proceed" or "refuse": what this hook does in a
@@ -67,6 +67,8 @@
 
 from acs.client import (
     Config,
+    count_decision_failure,
+    decision_failure_counts,
     Decided,
     FailPosture,
     Handshake,
@@ -75,6 +77,7 @@
     Resolution,
     Undecided,
     audit_event,
+    audit_modify_unsupported,
     close_turn,
     current_turn,
     open_session,
@@ -272,7 +275,9 @@ def _payload_session_start(event: dict[str, Any]) -> dict[str, Any]:
 def _payload_session_end(event: dict[str, Any]) -> dict[str, Any]:
     name = event.get("hook_event_name", "")
     raw_reason = event.get("reason") or ("completed" if name == "Stop" else "other")
-    return {"reason": SESSION_END_REASON_MAP.get(raw_reason, "completed")}
+    # §6.4: the session's decision failures per failure class; an empty count says none were recorded.
+    counts = decision_failure_counts(event.get("session_id"), workspace=_turn_ws(event))
+    return {"reason": SESSION_END_REASON_MAP.get(raw_reason, "completed"), "summary": {"decision_failures": counts}}
 
 
 # ─── Turn tracking ────────────────────────────────────────────────────────
@@ -469,6 +474,8 @@ def _send_session_start(event: dict[str, Any], session: Negotiated, config: Conf
                         session_id=session_id)
     if isinstance(result, Decided) and started is not None:
         started.append(result)
+    elif isinstance(result, Resolution):
+        count_decision_failure(session_id, result.fields.get("failure_class", "other"), workspace=_turn_ws(event))
     return result
 
 
@@ -495,12 +502,8 @@ def _translate_pretool(decision: Decision, original_input: dict) -> dict[str, An
             return _pretool_response(
                 "deny", f"MODIFY refused ({violation}); failing closed per §6.3:146")
         if decision.modifications.get("redactions"):
-            # Claude's updatedInput can replace arguments, but it exposes no
-            # native JSON-Pointer redaction operation.  Applying sibling
-            # parameter_overrides while dropping redactions would change the
-            # Guardian's decision. Treat the valid-but-unrealizable compound
-            # edit as DENY until the whole modification can be applied.
-            audit_event("modify_unapplied_redactions", hook="PreToolUse")
+            # updatedInput has no redaction operation, and dropping the redactions would change the decision, so the MODIFY is a DENY.
+            audit_modify_unsupported("redactions", hook="PreToolUse")
             return _pretool_response(
                 "deny", "MODIFY refused: Claude Code cannot apply the "
                 "requested redactions without dropping part of the decision")
@@ -512,6 +515,7 @@ def _translate_pretool(decision: Decision, original_input: dict) -> dict[str, An
             # argument overrides (modifications.json) onto the original.
             merged = {**original_input, **overrides}
             return _pretool_response("allow", decision.reasoning, updated_input=merged)
+        audit_modify_unsupported("no parameter_overrides object", hook="PreToolUse")
         return _pretool_response(
             "deny",
             f"MODIFY substituted to DENY (no usable parameter_overrides): {decision.reasoning}",
@@ -538,6 +542,7 @@ def _translate_posttool(decision: Decision, original_input: dict) -> dict[str, A
             if decision.reasoning:
                 hso["additionalContext"] = decision.reasoning
             return {"hookSpecificOutput": hso}
+        audit_modify_unsupported("structured edits on a tool result", hook="PostToolUse")
         return _block_response(
             f"MODIFY substituted to DENY (no modified_content): {decision.reasoning}")
     if decision.disposition in ("ask", "defer"):
@@ -554,6 +559,8 @@ def _translate_user_prompt(decision: Decision, original_input: dict) -> dict[str
     # The prompt hook can only allow or block, so ask, defer and modify block, audited (§6.4).
     audit_event("prompt_decision_substituted_block",
                 disposition=decision.disposition, hook="UserPromptSubmit")
+    if decision.disposition == "modify":
+        audit_modify_unsupported("the prompt cannot be rewritten", hook="UserPromptSubmit")
     return _block_response(
         f"{decision.disposition} on user prompt not applicable at this hook — blocking: {decision.reasoning}")
 
@@ -657,9 +664,9 @@ def main() -> int:
     # §4.1: a refused or unanswered session sends the Guardian nothing; each step is settled here.
     started: list = []
     session = _open_session(event, config, started)
-    gated = config.gate(session)
+    gated = config.gate(session, HOOK_MAP.get(hook_name))
     if gated is not None:
-        return _settle(gated, hook_name, session_id)
+        return _settle(gated, hook_name, session_id, workspace=_turn_ws(event))
     if hook_name == "SessionStart":
         # The session's sessionStart went out when the session opened, from this hook or an earlier one.
         if started:
@@ -675,7 +682,7 @@ def main() -> int:
         # Settled with the session's effective posture; an exit 1 would let the host proceed.
         sys.stderr.write(f"acs-adapter: adapter error: {e}\n")
         return _settle(posture.resolve(Undecided("adapter_exception", {"error": str(e)})),
-                       hook_name, session_id)
+                       hook_name, session_id, workspace=_turn_ws(event))
 
 
 def _govern(event: dict[str, Any], hook_name: str, session_id: str | None,
@@ -693,7 +700,7 @@ def _govern(event: dict[str, Any], hook_name: str, session_id: str | None,
             result = round_trip(build_turn_start_request(event, turn_id), guardian_url=config.guardian_url,
                                 posture=posture, session_id=session_id)
             if isinstance(result, Resolution):
-                return _settle(result, "UserPromptSubmit", session_id)
+                return _settle(result, "UserPromptSubmit", session_id, workspace=_turn_ws(event))
             turn_start = normalize_decision(result.response.get("result"))
             if turn_start.disposition != "allow":
                 # Only allow applies to a turn start, so any other disposition blocks the prompt.
@@ -712,7 +719,7 @@ def _govern(event: dict[str, Any], hook_name: str, session_id: str | None,
     except Exception as e:  # noqa: BLE001
         sys.stderr.write(f"acs-adapter: adapter error: {e}\n")
         return _settle(posture.resolve(Undecided("adapter_exception", {"error": str(e)})),
-                       hook_name, session_id)
+                       hook_name, session_id, workspace=_turn_ws(event))
     if not request:
         if hook_name == "Stop":
             # turnEnd with no open turn: audit it rather than fabricate
@@ -720,7 +727,7 @@ def _govern(event: dict[str, Any], hook_name: str, session_id: str | None,
             audit_event("turn_end_no_open_turn", session_id=session_id)
             return 0
         sys.stderr.write(f"acs-adapter: could not build request for {hook_name}\n")
-        return _settle(posture.resolve(Undecided("adapter_build_failed")), hook_name, session_id)
+        return _settle(posture.resolve(Undecided("adapter_build_failed")), hook_name, session_id, workspace=_turn_ws(event))
 
     method = request.get("method", "")
     if not method_evaluated(server_hello, method):
@@ -740,7 +747,7 @@ def _govern(event: dict[str, Any], hook_name: str, session_id: str | None,
 
     result = round_trip(request, guardian_url=config.guardian_url, posture=posture, session_id=session_id)
     if isinstance(result, Resolution):
-        return _settle(result, hook_name, session_id)
+        return _settle(result, hook_name, session_id, workspace=_turn_ws(event))
     response = result.response
 
     # A translation bug would exit 1, which the host reads as proceed, so it fails closed here.
@@ -750,7 +757,7 @@ def _govern(event: dict[str, Any], hook_name: str, session_id: str | None,
     except Exception as e:  # noqa: BLE001
         sys.stderr.write(f"acs-adapter: translate error: {e}\n")
         return _settle(posture.resolve(Refused("adapter_translate_exception", {"error": str(e)})),
-                       hook_name, session_id)
+                       hook_name, session_id, workspace=_turn_ws(event))
 
     # Close the turn after the turnEnd has been emitted/recorded.
     if hook_name == "Stop":
@@ -758,7 +765,7 @@ def _govern(event: dict[str, Any], hook_name: str, session_id: str | None,
     return 0
 
 
-def _settle(resolution: Resolution, hook_name: str, session_id: str | None) -> int:
+def _settle(resolution: Resolution, hook_name: str, session_id: str | None, *, workspace: str | None = None) -> int:
     """Carry out a resolution: block in the hook's native shape unless it proceeds, and record why per §6.4.
 
     The audit type says which rule decided (fail_open_bypass,
@@ -774,6 +781,8 @@ def _settle(resolution: Resolution, hook_name: str, session_id: str | None) -> i
         _emit_deny(hook_name, f"ACS adapter: {resolution.label} ({resolution.cause})")
     audit_event(resolution.audit_type, cause=resolution.cause, hook=hook_name,
                 session_id=session_id, **resolution.fields)
+    if resolution.decision_failure:
+        count_decision_failure(session_id, resolution.fields.get("failure_class", "other"), workspace=workspace)
     return 0
 
 
diff --git a/adapters/src/acs/integrations/claude_code/wire.py b/adapters/src/acs/integrations/claude_code/wire.py
index f159eeb1..4228bd13 100644
--- a/adapters/src/acs/integrations/claude_code/wire.py
+++ b/adapters/src/acs/integrations/claude_code/wire.py
@@ -136,6 +136,7 @@ def wired_elsewhere(target: Path, *, home: Path, cwd: Path, cursor_imports: bool
 def build_command(*, hook_command: str, guardian_url: str,
                    secret_file: str | None,
                    secret_env: str | None,
+                   key_id: str | None = None,
                    default_deny: bool,
                    host_allowlist: str | None,
                    audit_file: str | None = None) -> str:
@@ -153,6 +154,8 @@ def build_command(*, hook_command: str, guardian_url: str,
         env_pairs.append(f"ACS_HMAC_SECRET_FILE={_expand(secret_file)}")
     elif secret_env:
         env_pairs.append(f"ACS_HMAC_SECRET={secret_env}")
+    if key_id:
+        env_pairs.append(f"ACS_HMAC_KEY_ID={shlex.quote(key_id)}")
     if default_deny:
         env_pairs.append("ACS_DEFAULT_DENY=1")
     if host_allowlist:
@@ -318,13 +321,6 @@ def validate_inputs(args: argparse.Namespace) -> list[str]:
                 "WARNING: --secret-env-inline embeds the secret directly in "
                 "settings.json (visible in `ps aux`). For production, prefer "
                 "--secret-file with a 0600 key file.")
-        else:
-            warnings.append(
-                "WARNING: no HMAC secret configured (neither --secret-file "
-                "nor --secret-env-inline). Adapter will run unsigned — Guardian "
-                "will reject every request unless it's also unconfigured "
-                "(ACS_DEV_MODE=1). ACS-Core baseline integrity (§10) "
-                "REQUIRES signing.")
 
         if not args.guardian_url.startswith(("http://", "https://")):
             warnings.append(
@@ -368,6 +364,9 @@ def main(argv: list[str] | None = None) -> int:
                     help="Guardian endpoint (http:// or https://). Required unless --unwire.")
     p.add_argument("--secret-file",
                     help="Path to the HMAC secret file (preferred). The adapter reads it lazily.")
+    p.add_argument("--key-id", metavar="LABEL",
+                    help="The label that names the secret (§10), the same one the Guardian has; "
+                         "required with --secret-file or --secret-env-inline.")
     p.add_argument("--secret-env-inline", metavar="HEX",
                     help="HMAC secret inlined into settings.json env (visible in `ps aux`; "
                          "dev only). Use --secret-file for production.")
@@ -416,6 +415,10 @@ def main(argv: list[str] | None = None) -> int:
         p.error("--guardian-url is required (unless --unwire)")
     if args.secret_file and args.secret_env_inline:
         p.error("provide --secret-file OR --secret-env-inline, not both")
+    if not args.unwire and not (args.secret_file or args.secret_env_inline):
+        p.error("a secret is required (--secret-file or --secret-env-inline): ACS-Core signs every request (§10)")
+    if (args.secret_file or args.secret_env_inline) and not (args.key_id or "").strip():
+        p.error("--key-id is required with a secret: it names the secret, and the Guardian must hold the same label")
 
     settings_path = _expand(args.settings)
     # A hook command that cannot run makes the host proceed with no audit record.
@@ -458,6 +461,7 @@ def main(argv: list[str] | None = None) -> int:
                 guardian_url=args.guardian_url,
                 secret_file=args.secret_file,
                 secret_env=args.secret_env_inline,
+                key_id=args.key_id,
                 default_deny=hook_deny,
                 host_allowlist=args.host_allowlist,
                 audit_file=args.audit_file,
diff --git a/adapters/src/acs/integrations/cursor/adapter.py b/adapters/src/acs/integrations/cursor/adapter.py
index 2fff0c42..d6c39ba0 100755
--- a/adapters/src/acs/integrations/cursor/adapter.py
+++ b/adapters/src/acs/integrations/cursor/adapter.py
@@ -72,6 +72,8 @@
 
 from acs.client import (
     Config,
+    count_decision_failure,
+    decision_failure_counts,
     Decided,
     FailPosture,
     Handshake,
@@ -80,6 +82,7 @@
     Resolution,
     Undecided,
     audit_event,
+    audit_modify_unsupported,
     close_turn,
     current_turn,
     load_session_state,
@@ -462,7 +465,8 @@ def _payload_session_end(event: dict[str, Any]) -> dict[str, Any]:
         # Legacy/unknown value: accept it if it happens to be an ACS enum
         # member already, else default to completed.
         mapped = raw if raw in SESSION_END_REASONS else "completed"
-    return {"reason": mapped}
+    counts = decision_failure_counts(_session_id(event), workspace=_workspace(event))
+    return {"reason": mapped, "summary": {"decision_failures": counts}}
 
 
 # Cursor stop.status → ACS turn-end outcome enum
@@ -662,24 +666,15 @@ def _send_session_start(event: dict[str, Any], session: Negotiated, config: Conf
     if not method_evaluated(session.server_hello, "steps/sessionStart"):
         audit_event("method_not_evaluated", method="steps/sessionStart", session_id=session_id)
         return None
-    return round_trip(build_request("sessionStart", event), guardian_url=config.guardian_url,
-                      posture=config.posture.negotiated(session.server_hello), session_id=session_id)
-
-
-# ─── Response translation — dispatch table by event category ──────────────
-#
-# Cursor's response shapes group naturally into 4 categories:
-#   - permission events (preToolUse, subagentStart, beforeShellExecution,
-#     beforeMCPExecution): {"permission": ..., "user_message": ..., "agent_message": ...,
-#     "updated_input": ...}
-#   - post-tool events (postToolUse, postToolUseFailure, afterShellExecution,
-#     afterMCPExecution, afterFileEdit, afterTabFileEdit): {"additional_context": ...,
-#     "updated_mcp_tool_output": ...}
-#   - beforeSubmitPrompt: blocks with {"continue": false, "user_message"}; carries
-#     internal __exit_code/_reasoning keys consumed by main()
-#   - everything else: no response shape (Stop, SessionStart, SessionEnd, etc.)
-
-def _translate_permission(decision: Decision, event_name: str, original_input: dict) -> dict[str, Any]:
+    result = round_trip(build_request("sessionStart", event), guardian_url=config.guardian_url,
+                        posture=config.posture.negotiated(session.server_hello), session_id=session_id)
+    if isinstance(result, Resolution):
+        count_decision_failure(session_id, result.fields.get("failure_class", "other"), workspace=_workspace(event))
+    return result
+
+
+def _translate_permission(decision: Decision, event_name: str, original_input: dict,
+                          tool_name: str = "") -> dict[str, Any]:
     if decision.disposition in PERMISSION_MAP:
         return _permission_response(PERMISSION_MAP[decision.disposition], decision.reasoning)
     if decision.disposition == "modify":
@@ -693,44 +688,62 @@ def _translate_permission(decision: Decision, event_name: str, original_input: d
             return _permission_response(
                 "deny", f"MODIFY refused ({violation}); failing closed per §6.3:146")
         if decision.modifications.get("redactions"):
-            # updated_input cannot express JSON-Pointer redactions; never
-            # apply only the override half of a compound decision.
-            audit_event("modify_unapplied_redactions", event=event_name)
+            # updated_input cannot express redactions, so the override half is never applied alone.
+            audit_modify_unsupported("redactions", event=event_name)
             return _permission_response(
                 "deny", "MODIFY refused: Cursor cannot apply the requested "
                 "redactions without dropping part of the decision")
         overrides = decision.modifications.get("parameter_overrides")
-        # A non-dict override cannot be applied — fail closed per §6.3:146.
-        if isinstance(overrides, dict) and event_name == "preToolUse":
-            # parameter_overrides are per-argument EDITS while Cursor's
-            # updated_input REPLACES the whole input, so merge onto the
-            # original.
+        if event_name != "preToolUse":
+            unsupported = "no updated_input on this event"
+        elif _is_mcp_tool(tool_name):
+            # Cursor ignores updated_input for an HTTP MCP server's tool, and the name does not say which kind it is.
+            unsupported = "updated_input on an MCP tool"
+        elif not isinstance(overrides, dict):
+            unsupported = "no parameter_overrides object"
+        else:
+            # updated_input replaces the whole input.
             merged = {**original_input, **overrides}
             return _permission_response("allow", decision.reasoning, updated_input=merged)
+        audit_modify_unsupported(unsupported, event=event_name, tool=tool_name)
         return _permission_response("deny",
                                      f"MODIFY substituted to DENY: {decision.reasoning}")
     return {}
 
 
-def _translate_post_tool(decision: Decision, event_name: str) -> dict[str, Any]:
+def _is_mcp_tool(tool_name: Any) -> bool:
+    return isinstance(tool_name, str) and tool_name.startswith("MCP:")
+
+
+def _mcp_output_replaceable(tool_name: Any, tool_output: Any) -> bool:
+    """updated_mcp_tool_output replaces an MCP tool's output, except an HTTP MCP server's, whose tool_output arrives as {"redacted": true} (hooks docs)."""
+    parsed = _parse_json_field(tool_output)
+    return _is_mcp_tool(tool_name) and not (isinstance(parsed, dict) and parsed.get("redacted") is True)
+
+
+def _post_tool_deny(event_name: str, reason: str) -> dict[str, Any]:
+    # postToolUse fires after execution — no block exists; the denial
+    # reaches the conversation as additional_context and is audited.
+    audit_event("unenforceable_decision", decision="deny", event=event_name, reason=reason or "(none)")
+    return _post_tool_response(additional_context=f"ACS Guardian denied this result: {reason or '(no reasoning)'}")
+
+
+def _translate_post_tool(decision: Decision, event_name: str, tool_name: str = "",
+                         tool_output: Any = None) -> dict[str, Any]:
     """Only `postToolUse` documents output fields (`additional_context`,
     and `updated_mcp_tool_output` for MCP tools); every other post-tool
     event documents "No output fields currently supported" (docs
     2026-08-22), so an arrived restrictive decision there is recorded and
     nothing is emitted."""
     if event_name != "postToolUse":
+        if decision.disposition == "modify":
+            audit_modify_unsupported("no output field on this event", event=event_name, tool=tool_name)
         if decision.disposition in ("deny", "modify", "ask", "defer"):
             audit_event("unenforceable_decision", decision=decision.disposition,
                         event=event_name, reason=decision.reasoning or "(none)")
         return {}
     if decision.disposition == "deny":
-        # postToolUse fires after execution — no block exists; the denial
-        # reaches the conversation as additional_context and is audited.
-        audit_event("unenforceable_decision", decision="deny",
-                    event=event_name, reason=decision.reasoning or "(none)")
-        return _post_tool_response(
-            additional_context=f"ACS Guardian denied this result: "
-                               f"{decision.reasoning or '(no reasoning)'}")
+        return _post_tool_deny(event_name, decision.reasoning)
     if decision.disposition == "modify":
         violation = modify_composition_violation(decision.modifications)
         if violation:
@@ -739,13 +752,14 @@ def _translate_post_tool(decision: Decision, event_name: str) -> dict[str, Any]:
             return _post_tool_response(
                 additional_context=f"MODIFY refused ({violation})")
         updated = decision.modifications.get("modified_content")
-        if updated is not None:
+        if updated is not None and _mcp_output_replaceable(tool_name, tool_output):
             # Docs show an OBJECT value; ACS modified_content is a string.
             # Parse JSON content when it is JSON, else pass the string.
             return _post_tool_response(
                 updated_mcp_tool_output=_parse_json_field(updated))
-        return _post_tool_response(
-            additional_context=f"MODIFY received: {decision.reasoning}")
+        audit_modify_unsupported("structured edits on a tool result" if updated is None
+                                 else "updated_mcp_tool_output on this tool", event=event_name, tool=tool_name)
+        return _post_tool_deny(event_name, f"MODIFY substituted to DENY: {decision.reasoning}")
     if decision.reasoning:
         return _post_tool_response(additional_context=decision.reasoning)
     return {}
@@ -758,14 +772,15 @@ def _translate_before_submit_prompt(decision: Decision, event_name: str) -> dict
     if decision.disposition != "deny":
         audit_event("prompt_decision_substituted_block",
                     disposition=decision.disposition, event="beforeSubmitPrompt")
+        if decision.disposition == "modify":
+            audit_modify_unsupported("the prompt cannot be rewritten", event="beforeSubmitPrompt")
     return {"__exit_code": 2,
             "_reasoning": decision.reasoning or f"{decision.disposition} on prompt not applicable — blocking"}
 
 
 def translate_response(acs_response: dict[str, Any], event_name: str,
-                       original_input: dict | None = None) -> dict[str, Any]:
-    # normalize_decision coerces every field to a safe type and never
-    # raises — an uncaught throw here would exit 1 and Cursor would proceed.
+                       original_input: dict | None = None, tool_name: str = "",
+                       tool_output: Any = None) -> dict[str, Any]:
     decision = normalize_decision(acs_response.get("result"))
     original_input = original_input or {}
 
@@ -786,9 +801,9 @@ def translate_response(acs_response: dict[str, Any], event_name: str,
         return {}
 
     if event_name in PERMISSION_EVENTS:
-        return _translate_permission(decision, event_name, original_input)
+        return _translate_permission(decision, event_name, original_input, tool_name)
     if event_name in POST_TOOL_EVENTS:
-        return _translate_post_tool(decision, event_name)
+        return _translate_post_tool(decision, event_name, tool_name, tool_output)
     if event_name == "beforeSubmitPrompt":
         return _translate_before_submit_prompt(decision, event_name)
 
@@ -840,9 +855,9 @@ def main() -> int:
 
     # §4.1: a refused or unanswered session sends the Guardian nothing; each step is settled here.
     session = _open_session(event, config)
-    gated = config.gate(session)
+    gated = config.gate(session, HOOK_MAP.get(event_name))
     if gated is not None:
-        return _settle(gated, event_name, session_id)
+        return _settle(gated, event_name, session_id, workspace=_workspace(event))
     if event_name == "sessionStart":
         # The session's sessionStart went out when the session opened, from this hook or an earlier one.
         return 0
@@ -856,7 +871,7 @@ def main() -> int:
         # Settled with the session's effective posture; an exit 1 would let the host proceed.
         sys.stderr.write(f"acs-adapter: adapter error: {e}\n")
         return _settle(posture.resolve(Undecided("adapter_exception", {"error": str(e)})),
-                       event_name, session_id)
+                       event_name, session_id, workspace=_workspace(event))
 
 
 def _govern(event_name: str, event: dict[str, Any], session_id: str | None,
@@ -873,7 +888,7 @@ def _govern(event_name: str, event: dict[str, Any], session_id: str | None,
             result = round_trip(build_turn_start_request(event, turn_id), guardian_url=config.guardian_url,
                                 posture=posture, session_id=session_id)
             if isinstance(result, Resolution):
-                return _settle(result, "beforeSubmitPrompt", session_id)
+                return _settle(result, "beforeSubmitPrompt", session_id, workspace=_workspace(event))
             turn_start = normalize_decision(result.response.get("result"))
             if turn_start.disposition != "allow":
                 # Only allow applies to a turn start, so any other disposition blocks the prompt.
@@ -896,14 +911,14 @@ def _govern(event_name: str, event: dict[str, Any], session_id: str | None,
     except Exception as e:  # noqa: BLE001
         sys.stderr.write(f"acs-adapter: adapter error: {e}\n")
         return _settle(posture.resolve(Undecided("adapter_exception", {"error": str(e)})),
-                       event_name, session_id)
+                       event_name, session_id, workspace=_workspace(event))
     if not request:
         if event_name == "stop":
             # turnEnd with no open turn: nothing to close honestly.
             audit_event("turn_end_no_open_turn", session_id=session_id)
             return 0
         sys.stderr.write(f"acs-adapter: could not build request for {event_name}\n")
-        return _settle(posture.resolve(Undecided("adapter_build_failed")), event_name, session_id)
+        return _settle(posture.resolve(Undecided("adapter_build_failed")), event_name, session_id, workspace=_workspace(event))
 
     method = request.get("method", "")
     if not method_evaluated(server_hello, method):
@@ -929,18 +944,18 @@ def _govern(event_name: str, event: dict[str, Any], session_id: str | None,
 
     result = round_trip(request, guardian_url=config.guardian_url, posture=posture, session_id=session_id)
     if isinstance(result, Resolution):
-        return _settle(result, event_name, session_id)
+        return _settle(result, event_name, session_id, workspace=_workspace(event))
     response = result.response
 
     # A bug escaping translate_response would exit 1 = Cursor proceeds;
     # this guard makes any translation bug fail closed instead.
     try:
-        out = translate_response(response, event_name,
-                                 original_input=event.get("tool_input") or {})
+        out = translate_response(response, event_name, original_input=event.get("tool_input") or {},
+                                 tool_name=event.get("tool_name") or "", tool_output=event.get("tool_output"))
     except Exception as e:  # noqa: BLE001
         sys.stderr.write(f"acs-adapter: translate error: {e}\n")
         return _settle(posture.resolve(Refused("adapter_translate_exception", {"error": str(e)})),
-                       event_name, session_id)
+                       event_name, session_id, workspace=_workspace(event))
 
     # Close the turn after the turnEnd has been emitted/recorded.
     if event_name == "stop":
@@ -973,7 +988,7 @@ def _explicit_allow(event_name: str) -> int:
     return 0
 
 
-def _settle(resolution: Resolution, event_name: str, session_id: str | None) -> int:
+def _settle(resolution: Resolution, event_name: str, session_id: str | None, *, workspace: str | None = None) -> int:
     """Carry out a resolution in the event's native shape, allow or deny, and record why per §6.4.
 
     A proceed carries Cursor's explicit allow: failClosed covers hook crashes
@@ -981,6 +996,8 @@ def _settle(resolution: Resolution, event_name: str, session_id: str | None) ->
     """
     if resolution.message:
         sys.stderr.write(f"acs-adapter: {resolution.message}\n")
+    if resolution.decision_failure:
+        count_decision_failure(session_id, resolution.fields.get("failure_class", "other"), workspace=workspace)
     if resolution.proceed:
         audit_event(resolution.audit_type, cause=resolution.cause, event=event_name,
                     session_id=session_id, **resolution.fields)
diff --git a/adapters/src/acs/integrations/cursor/wire.py b/adapters/src/acs/integrations/cursor/wire.py
index 109932a7..aa67f501 100644
--- a/adapters/src/acs/integrations/cursor/wire.py
+++ b/adapters/src/acs/integrations/cursor/wire.py
@@ -138,6 +138,7 @@ def build_command(*, hook_command: str, event_name: str,
                    guardian_url: str,
                    secret_file: str | None,
                    secret_env: str | None,
+                   key_id: str | None = None,
                    default_deny: bool,
                    host_allowlist: str | None) -> str:
     """Compose the hook command string used inside hooks.json.
@@ -150,6 +151,8 @@ def build_command(*, hook_command: str, event_name: str,
         env_pairs.append(f"ACS_HMAC_SECRET_FILE={_expand(secret_file)}")
     elif secret_env:
         env_pairs.append(f"ACS_HMAC_SECRET={secret_env}")
+    if key_id:
+        env_pairs.append(f"ACS_HMAC_KEY_ID={shlex.quote(key_id)}")
     if default_deny:
         env_pairs.append("ACS_DEFAULT_DENY=1")
     if host_allowlist:
@@ -297,13 +300,6 @@ def validate_inputs(args: argparse.Namespace) -> list[str]:
                 "WARNING: --secret-env-inline embeds the secret directly in "
                 "hooks.json (visible in `ps aux`). For production, prefer "
                 "--secret-file with a 0600 key file.")
-        else:
-            warnings.append(
-                "WARNING: no HMAC secret configured (neither --secret-file "
-                "nor --secret-env-inline). Adapter will run unsigned — Guardian "
-                "will reject every request unless it's also unconfigured "
-                "(ACS_DEV_MODE=1). ACS-Core baseline integrity (§10) "
-                "REQUIRES signing.")
 
         if not args.guardian_url.startswith(("http://", "https://")):
             warnings.append(
@@ -349,6 +345,9 @@ def main(argv: list[str] | None = None) -> int:
                     help="Guardian endpoint (http:// or https://). Required unless --unwire.")
     p.add_argument("--secret-file",
                     help="Path to the HMAC secret file (preferred). The adapter reads it lazily.")
+    p.add_argument("--key-id", metavar="LABEL",
+                    help="The label that names the secret (§10), the same one the Guardian has; "
+                         "required with --secret-file or --secret-env-inline.")
     p.add_argument("--secret-env-inline", metavar="HEX",
                     help="HMAC secret inlined into hooks.json env (visible in `ps aux`; "
                          "dev only). Use --secret-file for production.")
@@ -390,6 +389,10 @@ def main(argv: list[str] | None = None) -> int:
         p.error("--guardian-url is required (unless --unwire)")
     if args.secret_file and args.secret_env_inline:
         p.error("provide --secret-file OR --secret-env-inline, not both")
+    if not args.unwire and not (args.secret_file or args.secret_env_inline):
+        p.error("a secret is required (--secret-file or --secret-env-inline): ACS-Core signs every request (§10)")
+    if (args.secret_file or args.secret_env_inline) and not (args.key_id or "").strip():
+        p.error("--key-id is required with a secret: it names the secret, and the Guardian must hold the same label")
 
     settings_path = _expand(args.settings)
     # A hook command that cannot run makes the host proceed with no audit record.
@@ -437,6 +440,7 @@ def main(argv: list[str] | None = None) -> int:
                 guardian_url=args.guardian_url,
                 secret_file=args.secret_file,
                 secret_env=args.secret_env_inline,
+                key_id=args.key_id,
                 default_deny=hook_deny,
                 host_allowlist=args.host_allowlist,
             )
diff --git a/adapters/src/acs/integrations/nat/adapter.py b/adapters/src/acs/integrations/nat/adapter.py
index b8d940eb..1c67bb27 100644
--- a/adapters/src/acs/integrations/nat/adapter.py
+++ b/adapters/src/acs/integrations/nat/adapter.py
@@ -57,7 +57,7 @@
 import weakref
 from collections.abc import Callable
 from concurrent.futures import Future
-from dataclasses import asdict, is_dataclass, replace
+from dataclasses import asdict, dataclass, field, is_dataclass, replace
 from typing import Any, Optional
 
 from acs import __version__
@@ -71,8 +71,11 @@
         Handshake,
         Negotiated,
         Resolution,
+        SessionRefused,
         Undecided,
         audit_event,
+        audit_modify_unsupported,
+        discard_session,
         open_session,
         round_trip,
     )
@@ -186,7 +189,7 @@ class ACSMiddlewareConfig(FunctionMiddlewareBaseConfig, name="acs_guardian"):  #
         )
         session_id: Optional[str] = Field(
             default=None,
-            description="Session id sent on every request. Auto-generated per-process if absent. Coerced to UUID format.",
+            description="Session id of calls outside a NAT run; each run's own session id derives from it. Auto-generated per-process if absent. Coerced to UUID format.",
         )
         timeout_s: float = Field(
             default=5.0,
@@ -379,6 +382,12 @@ def _apply_overrides_to_context(context: Any, overrides: dict[str, Any]) -> None
 
 # ----- Middleware class -----
 
+# Untracked runs whose decision failures wait for a sessionEnd; past this many, the oldest of them ages out.
+_MAX_COUNTED_RUNS = 256
+# Ended runs remembered so a late step of one is refused; past this many, the oldest is forgotten.
+_MAX_ENDED_RUNS = 4096
+
+
 class _LifecycleSender:
     """Sends lifecycle hooks on one thread, in the order they are accepted.
 
@@ -386,7 +395,7 @@ class _LifecycleSender:
     hooks that arrive meanwhile, and then accepts no more.
     """
 
-    def __init__(self, send: Callable[[str, dict], None]) -> None:
+    def __init__(self, send: Callable[[str, dict, str | None], None]) -> None:
         self._send = send
         self._pending: collections.deque = collections.deque()
         self._changed = threading.Condition()
@@ -395,12 +404,12 @@ def __init__(self, send: Callable[[str, dict], None]) -> None:
         self._thread: threading.Thread | None = None
         _OPEN_SENDERS.add(self)
 
-    def submit(self, method: str, payload: dict) -> bool:
-        """Queue a hook behind the ones already accepted; False once closed."""
+    def submit(self, method: str, payload: dict, run: str | None = None) -> bool:
+        """Queue a hook of a run behind the ones already accepted; False once closed."""
         with self._changed:
             if self._closed:
                 return False
-            self._pending.append((method, payload))
+            self._pending.append((method, payload, run))
             self._wake()
             return True
 
@@ -459,6 +468,31 @@ def _run(self) -> None:
 atexit.register(lambda: [sender.close() for sender in list(_OPEN_SENDERS)])
 
 
+@dataclass
+class _Run:
+    """One NAT run, which is its own ACS session: the task running it, whether its sessionEnd is queued, and the session's decision."""
+    session_id: str
+    task: asyncio.Task | None = None
+    ended: bool = False
+    decision: Handshake | None = None
+    lock: threading.Lock = field(default_factory=threading.Lock)
+    # The run's Guardian exchanges still running, and whether its sessionEnd has begun; both under `idle`.
+    in_flight: int = 0
+    closed: bool = False
+    idle: threading.Condition = field(default_factory=threading.Condition)
+    # Set once the sessionEnd has been handled; only the middleware's own session is kept after it.
+    finished: bool = False
+
+
+@dataclass(frozen=True)
+class _Step:
+    """The session a step belongs to: its id, the handshake's decision, and what that handshake negotiated."""
+    session_id: str
+    decision: Handshake
+    server_hello: dict | None
+    posture: FailPosture
+
+
 class ACSMiddleware(FunctionMiddleware):  # type: ignore[misc, valid-type]
     """NAT middleware that defers each call's allow/deny/modify decision to an ACS Guardian."""
 
@@ -496,6 +530,15 @@ def __init__(self, config):
         # would collide once GC recycles addresses.
         self._frozen_ctx_rids: weakref.WeakKeyDictionary = weakref.WeakKeyDictionary()
         self._frozen_ctx_lock = threading.Lock()
+        # §6.4: decision failures per run and failure class; each run's sessionEnd reports its own run's.
+        # Calls and the lifecycle thread both count; a run no sessionEnd will report ages out once it is no longer tracked.
+        self._decision_failures: collections.OrderedDict = collections.OrderedDict()
+        self._decision_failures_lock = threading.Lock()
+        # The runs whose WORKFLOW_START was seen, each kept until its sessionEnd has been handled.
+        self._runs: collections.OrderedDict = collections.OrderedDict()
+        # Runs whose sessionEnd has been handled, so a late step of one is refused rather than opening its id again.
+        self._ended_runs: collections.OrderedDict = collections.OrderedDict()
+        self._runs_lock = threading.Lock()
 
     def _ensure_handshake(self) -> Handshake:
         """The session's decision, opened once under a lock so concurrent first calls share one handshake."""
@@ -506,20 +549,24 @@ def _ensure_handshake(self) -> Handshake:
                 self._session = self._open_session()
         return self._session
 
-    def _open_session(self) -> Handshake:
+    @staticmethod
+    def _methods() -> list[str]:
         methods = ["steps/toolCallRequest", "steps/toolCallResult"]
         if _HAS_LIFECYCLE:
             methods += [
                 "steps/sessionStart", "steps/userMessage",
                 "steps/agentResponse", "steps/sessionEnd",
             ]
+        return methods
+
+    def _open_session(self) -> Handshake:
         # The stored decision keeps the session's gate across middleware instances and processes.
         session = open_session(
             config=self._acs,
             session_id=self._session_id,
             agent_id=self._agent_id,
             platform="nat",
-            methods_implemented=methods,
+            methods_implemented=self._methods(),
         )
         if isinstance(session, Negotiated):
             # §6.4: deny wins over proceed, and a negotiated default timeout replaces the local one.
@@ -527,18 +574,23 @@ def _open_session(self) -> Handshake:
             self._server_hello = dict(session.server_hello)
         return session
 
-    async def _session_decision(self) -> Handshake:
-        """The session's decision, opened off the event loop when the builder has not opened it yet."""
-        if self._session is not None:
-            return self._session
-        return await asyncio.to_thread(self._ensure_handshake)
-
     async def _lifecycle_sent(self) -> None:
         """Wait until the lifecycle hooks NAT reported earlier have gone out, so the Guardian sees steps in event order."""
         await asyncio.wrap_future(self._lifecycle.sent())
 
     def close(self) -> None:
-        """Send the lifecycle hooks still queued, including any that arrive meanwhile, then accept no more."""
+        """End the middleware's own session if a step outside any run started it, send the lifecycle hooks still queued,
+        including any that arrive meanwhile, then accept no more."""
+        with self._runs_lock:
+            own = self._runs.get(None)
+        if own is not None:
+            # A session still opening finishes first, so its sessionStart is not left without a sessionEnd.
+            with own.lock:
+                opened = own.decision is not None
+                if not opened:
+                    own.finished = True
+            if opened and self._end_run(None):
+                self._queue_lifecycle_hook("steps/sessionEnd", payload={"reason": "completed"}, run=None)
         self._lifecycle.close()
 
     def _ensure_lifecycle_subscribed(self) -> None:
@@ -564,12 +616,15 @@ def _ensure_lifecycle_subscribed(self) -> None:
             except Exception:  # noqa: BLE001
                 # No active Context; function-call hooks still fire via FunctionMiddleware.
                 return
+            run = self._current_run()
             try:
+                # NAT completes a run's stream when the run ends, whether or not it pushed WORKFLOW_END.
                 mgr.subscribe(
                     on_next=self._on_intermediate_step,
                     on_error=lambda e: audit_event(
                         "lifecycle_subscription_error",
                         session_id=self._session_id, error=str(e)),
+                    on_complete=lambda: self._run_stopped(run),
                 )
                 self._lifecycle_streams.add(stream)
             except Exception as e:  # noqa: BLE001
@@ -586,42 +641,176 @@ def _on_intermediate_step(self, step) -> None:
         except AttributeError:
             return
 
+        run = self._current_run()
         if event_type == IntermediateStepType.WORKFLOW_START:
+            self._track_run(run)
             # Workflow input becomes both sessionStart (boundary marker)
             # and userMessage (the input itself).
             self._queue_lifecycle_hook(
                 "steps/sessionStart",
-                payload={"platform_context": {"workflow_name": payload.name or ""}})
+                payload={"platform_context": {"workflow_name": payload.name or ""}}, run=run)
             input_text = _stringify_step_data(payload.data)
             if input_text:
                 self._queue_lifecycle_hook(
                     "steps/userMessage",
-                    payload={"content": [{"type": "text", "value": input_text}]})
+                    payload={"content": [{"type": "text", "value": input_text}]}, run=run)
         elif event_type == IntermediateStepType.WORKFLOW_END:
+            self._end_run(run)
             # Workflow output becomes agentResponse; sessionEnd closes the boundary.
             output_text = _stringify_step_data(payload.data)
             if output_text:
                 self._queue_lifecycle_hook(
                     "steps/agentResponse",
-                    payload={"content": [{"type": "text", "value": output_text}]})
+                    payload={"content": [{"type": "text", "value": output_text}]}, run=run)
             self._queue_lifecycle_hook(
                 "steps/sessionEnd",
-                payload={"reason": "completed"})
+                payload={"reason": "completed"}, run=run)
+
+    def _run_session_id(self, run: str | None) -> str:
+        """Each NAT run is its own ACS session, named from the configured session and the run; a step outside any run uses the configured one."""
+        if run is None:
+            return self._session_id
+        return str(uuid.uuid5(uuid.NAMESPACE_URL, f"acs-nat-run:{self._session_id}:{run}"))
+
+    def _run_state(self, run: str | None) -> _Run:
+        """The run's state, created by its WORKFLOW_START or, for a run seen from its first call, by that call."""
+        try:
+            task = asyncio.current_task()
+        except RuntimeError:
+            task = None
+        with self._runs_lock:
+            if run in self._ended_runs:
+                return _Run(session_id=self._run_session_id(run), finished=True)
+            state = self._runs.get(run)
+            if state is None:
+                state = self._runs[run] = _Run(session_id=self._run_session_id(run))
+            if state.task is None:
+                state.task = task
+            return state
+
+    def _track_run(self, run: str | None) -> None:
+        """Record a run at its WORKFLOW_START, which NAT pushes in the task running it."""
+        if run is not None:
+            self._run_state(run)
+
+    def _step(self, run: str | None, workflow_name: str = "") -> _Step:
+        """The session a step belongs to, opened with its sessionStart: the run's own, or the middleware's for a step outside any run."""
+        state = self._run_state(run)
+        ended = _Step(state.session_id, SessionRefused("session_ended", {"session_id": state.session_id}), None,
+                      self._acs.posture)
+        with state.lock:
+            # Checked under the lock, so a session that shutdown found unopened is never opened after it.
+            if state.finished:
+                return ended
+            if state.decision is None:
+                state.decision = open_session(
+                    config=self._acs, session_id=state.session_id, agent_id=self._agent_id, platform="nat",
+                    methods_implemented=self._methods(),
+                    start=lambda session: self._send_session_start(run, state.session_id, session, workflow_name))
+            decision = state.decision
+        if isinstance(decision, Negotiated):
+            # §6.4: deny wins over proceed, and a negotiated default timeout replaces the local one.
+            return _Step(state.session_id, decision, dict(decision.server_hello),
+                         self._acs.posture.negotiated(decision.server_hello))
+        return _Step(state.session_id, decision, None, self._acs.posture)
+
+    def _send_session_start(self, run: str | None, session_id: str, session: Negotiated, workflow_name: str):
+        """The run's one sessionStart, sent as its session opens (hooks.md sessionStart: ALLOW / DENY)."""
+        if not method_evaluated(session.server_hello, "steps/sessionStart"):
+            audit_event("method_not_evaluated", method="steps/sessionStart", session_id=session_id)
+            return None
+        request = request_envelope("steps/sessionStart", request_id=str(uuid.uuid4()),
+                                   metadata=self._metadata(session_id),
+                                   payload={"platform_context": {"workflow_name": workflow_name}})
+        result = round_trip(request, guardian_url=self._acs.guardian_url,
+                            posture=self._acs.posture.negotiated(session.server_hello), session_id=session_id)
+        if isinstance(result, Resolution):
+            self._count_failure(result, run)
+        return result
+
+    def _end_run(self, run: str | None) -> bool:
+        """Mark the run's sessionEnd as queued; False only when a tracked run's already was."""
+        with self._runs_lock:
+            state = self._runs.get(run)
+            if state is None or state.ended:
+                return state is None
+            state.ended = True
+            return True
 
-    def _queue_lifecycle_hook(self, method: str, payload: dict) -> None:
-        """Hand a lifecycle hook to the lifecycle thread, so NAT's step callback returns without waiting on the Guardian."""
-        if not self._lifecycle.submit(method, payload):
+    def _run_stopped(self, run: str | None) -> None:
+        """NAT stopped the run's exporter: a run that started and pushed no WORKFLOW_END failed or was cancelled."""
+        with self._runs_lock:
+            state = self._runs.get(run)
+            task = state.task if state is not None else None
+        if state is None or not self._end_run(run):
+            return
+        cancelled = task is not None and (task.cancelled() or task.cancelling() > 0)
+        self._queue_lifecycle_hook("steps/sessionEnd", payload={"reason": "cancelled" if cancelled else "error"}, run=run)
+
+    def _close_run(self, run: str | None) -> None:
+        """Before the run's sessionEnd: refuse its exchanges from now on, and wait for those already running, which a cancelled call leaves behind."""
+        with self._runs_lock:
+            state = self._runs.get(run)
+        if state is None:
+            return
+        with state.idle:
+            state.closed = True
+            while state.in_flight:
+                state.idle.wait()
+
+    def _exchange(self, request: dict, step: _Step, run: str | None):
+        """A call's round trip, counted so the run's sessionEnd goes out after it; refused once that sessionEnd has begun."""
+        ended = Resolution(False, "session_ended_fail_closed", "session_ended",
+                           {"session_id": step.session_id, "method": request.get("method", "")})
+        with self._runs_lock:
+            state = self._runs.get(run)
+        # A worker that starts after the session's end finds its state gone or finished.
+        if state is None or state.finished:
+            return ended
+        with state.idle:
+            if state.closed:
+                return ended
+            state.in_flight += 1
+        try:
+            return self._round_trip(request, step)
+        finally:
+            with state.idle:
+                state.in_flight -= 1
+                state.idle.notify_all()
+
+    def _forget_run(self, run: str | None) -> None:
+        """Drop a run once its sessionEnd has been handled, sent or not; the middleware's own session stays, ended, so a later step outside a run cannot open its id again."""
+        with self._runs_lock:
+            state = self._runs.get(run) if run is None else self._runs.pop(run, None)
+            if state is not None:
+                state.finished = True
+            if run is not None:
+                self._ended_runs[run] = None
+                while len(self._ended_runs) > _MAX_ENDED_RUNS:
+                    self._ended_runs.popitem(last=False)
+        self._take_failure_counts(run)
+        if state is not None:
+            discard_session(state.session_id, self._acs.guardian_url)
+
+    def _queue_lifecycle_hook(self, method: str, payload: dict, run: str | None = None) -> None:
+        """Hand a lifecycle hook of a run to the lifecycle thread, so NAT's step callback returns without waiting on the Guardian."""
+        if not self._lifecycle.submit(method, payload, run):
             audit_event("lifecycle_hook_not_sent", cause="middleware_closed", method=method,
                         session_id=self._session_id)
+            if method == "steps/sessionEnd":
+                self._forget_run(run)
 
-    def _send_lifecycle_hook(self, method: str, payload: dict) -> None:
+    def _send_lifecycle_hook(self, method: str, payload: dict, run: str | None = None) -> None:
         try:
-            self._emit_lifecycle_hook(method, payload)
+            self._emit_lifecycle_hook(method, payload, run)
         except Exception as e:  # noqa: BLE001
             audit_event("lifecycle_hook_failed", cause="adapter_exception", error=str(e),
                         method=method, session_id=self._session_id)
+        finally:
+            if method == "steps/sessionEnd":
+                self._forget_run(run)
 
-    def _emit_lifecycle_hook(self, method: str, payload: dict) -> None:
+    def _emit_lifecycle_hook(self, method: str, payload: dict, run: str | None = None) -> None:
         """Build, sign, and POST a lifecycle hook; errors are audited but
         never interrupt the workflow (enforcement lives in
         pre_invoke/post_invoke)."""
@@ -629,29 +818,36 @@ def _emit_lifecycle_hook(self, method: str, payload: dict) -> None:
             audit_event("acs_disabled_bypass", session_id=self._session_id, method=method,
                         detail="ACS_DISABLED=1 — lifecycle hook not sent")
             return
-        gated = self._acs.gate(self._ensure_handshake())
+        if method == "steps/sessionStart":
+            # The session opens here, and its sessionStart goes out as it does.
+            self._step(run, (payload.get("platform_context") or {}).get("workflow_name", ""))
+            return
+        if method == "steps/sessionEnd":
+            self._close_run(run)
+        step = self._step(run)
+        gated = self._acs.gate(step.decision, method)
         if gated is not None:
             # §4.1: a refused or unanswered session sends the Guardian nothing.
             audit_event(gated.audit_type, **{**gated.fields, "cause": gated.cause,
-                                             "session_id": self._session_id, "method": method})
+                                             "session_id": step.session_id, "method": method})
             return
-        if not method_evaluated(self._server_hello, method):
+        if not method_evaluated(step.server_hello, method):
             audit_event("method_not_evaluated", method=method,
-                        session_id=self._session_id)
+                        session_id=step.session_id)
             return
-        request = request_envelope(method, request_id=str(uuid.uuid4()), metadata=self._metadata(),
+        if method == "steps/sessionEnd":
+            # Built as it is sent, so it counts the failures of every hook sent before it.
+            payload = {**payload, "summary": {"decision_failures": self._take_failure_counts(run)}}
+        request = request_envelope(method, request_id=str(uuid.uuid4()), metadata=self._metadata(step.session_id),
                                    payload=payload)
-        result = self._round_trip(request)
+        result = self._round_trip(request, step)
         if isinstance(result, Resolution):
             audit_event("lifecycle_hook_failed", **{**result.fields, "cause": result.cause,
-                                                    "method": method, "session_id": self._session_id})
+                                                    "method": method, "session_id": step.session_id})
+            self._count_failure(result, run)
 
     def _correlation_request_id(self, context) -> str:
-        """Return a request_id unique per invocation but stable across
-        pre_invoke + post_invoke: stash a uuid4 on the shared context,
-        falling back to a WeakKeyDictionary for frozen contexts (id()
-        would collide once GC recycles addresses).
-        """
+        """A uuid4 per invocation, stable from pre_invoke to post_invoke: stashed on the context, else in a WeakKeyDictionary, since id() repeats after GC."""
         existing = getattr(context, "_acs_correlation_request_id", None)
         if existing:
             return existing
@@ -688,15 +884,17 @@ async def pre_invoke(self, context):
                         method="steps/toolCallRequest",
                         detail="ACS_DISABLED=1 — pre_invoke bypassed ungoverned")
             return None
-        gated = self._acs.gate(await self._session_decision())
         self._ensure_lifecycle_subscribed()
+        run = self._current_run()
+        step = await self._step_of(run)
+        gated = self._acs.gate(step.decision)
         if gated is not None:
             # §4.1: a refused or unanswered session sends the Guardian nothing.
-            return self._settle_pre(context, gated, f"{gated.label} ({gated.cause})")
-        if not method_evaluated(self._server_hello, "steps/toolCallRequest"):
+            return self._settle_pre(context, gated, step, f"{gated.label} ({gated.cause})")
+        if not method_evaluated(step.server_hello, "steps/toolCallRequest"):
             # ALLOW-by-default (handshake.json): the call proceeds unsent.
             audit_event("method_not_evaluated", method="steps/toolCallRequest",
-                        session_id=self._session_id)
+                        session_id=step.session_id)
             return None
         correlation_id = self._correlation_request_id(context)
         try:
@@ -705,15 +903,16 @@ async def pre_invoke(self, context):
                 tool_name=context.function_context.name,
                 tool_arguments=_extract_arguments(context),
                 request_id=correlation_id,
+                session_id=step.session_id,
             )
         except Exception as e:  # noqa: BLE001
-            result = self._posture.resolve(Undecided("adapter_exception", {"error": str(e)},
+            result = step.posture.resolve(Undecided("adapter_exception", {"error": str(e)},
                                                      f"adapter error: {e}"))
         else:
             await self._lifecycle_sent()
-            result = await asyncio.to_thread(self._round_trip, request)
+            result = await asyncio.to_thread(self._exchange, request, step, run)
         if isinstance(result, Resolution):
-            return self._settle_pre(context, result)
+            return self._settle_pre(context, result, step)
         response = result.response
 
         decision = normalize_decision((response or {}).get("result"))
@@ -726,17 +925,15 @@ async def pre_invoke(self, context):
             violation = modify_composition_violation(decision.modifications)
             if violation:
                 audit_event("modify_composition_invalid",
-                            session_id=self._session_id,
+                            session_id=step.session_id,
                             method="steps/toolCallRequest", detail=violation)
                 return self._block(
                     context,
                     f"MODIFY refused ({violation}); failing closed per §6.3:146")
             if decision.modifications.get("redactions"):
-                # NAT has no JSON-Pointer redaction primitive; applying only
-                # parameter_overrides would drop part of the compound decision.
-                audit_event("modify_unapplied_redactions",
-                            session_id=self._session_id,
-                            method="steps/toolCallRequest")
+                # NAT has no redaction primitive, and applying only the overrides would drop part of the decision.
+                audit_modify_unsupported("redactions", session_id=step.session_id,
+                                         method="steps/toolCallRequest")
                 return self._block(
                     context, "MODIFY refused: NAT cannot apply the requested "
                     "redactions without dropping part of the decision")
@@ -744,6 +941,8 @@ async def pre_invoke(self, context):
             if isinstance(overrides, dict):
                 _apply_overrides_to_context(context, overrides)
                 return context
+            audit_modify_unsupported("no parameter_overrides object", session_id=step.session_id,
+                                     method="steps/toolCallRequest")
             return self._block(context, f"MODIFY substituted to DENY: {decision.reasoning}")
         if decision.disposition in ("ask", "defer"):
             # No pause primitive here, so ask and defer block; NAT's HITL middleware composes for approvals.
@@ -753,7 +952,7 @@ async def pre_invoke(self, context):
         # basis is tracked in issue #32.
         audit_event("unusable_disposition",
                     disposition=decision.disposition or "(missing)",
-                    session_id=self._session_id,
+                    session_id=step.session_id,
                     method="steps/toolCallRequest")
         return self._block(
             context,
@@ -767,18 +966,20 @@ async def post_invoke(self, context):
                         method="steps/toolCallResult",
                         detail="ACS_DISABLED=1 — post_invoke bypassed ungoverned")
             return None
-        gated = self._acs.gate(await self._session_decision())
+        run = self._current_run()
+        step = await self._step_of(run)
+        gated = self._acs.gate(step.decision)
         if gated is not None:
-            return self._settle_post(context, gated)
-        if not method_evaluated(self._server_hello, "steps/toolCallResult"):
+            return self._settle_post(context, gated, step)
+        if not method_evaluated(step.server_hello, "steps/toolCallResult"):
             audit_event("method_not_evaluated", method="steps/toolCallResult",
-                        session_id=self._session_id)
+                        session_id=step.session_id)
             return None
         # request_id_ref correlates the result with its originating
         # toolCallRequest (tool-call-result.json:19-23); an unsent request
         # is never cited.
         correlation_id = self._correlation_request_id(context)
-        request_sent = method_evaluated(self._server_hello, "steps/toolCallRequest")
+        request_sent = method_evaluated(step.server_hello, "steps/toolCallRequest")
         try:
             request = self._build_request(
                 method="steps/toolCallResult",
@@ -786,15 +987,16 @@ async def post_invoke(self, context):
                 tool_arguments=_extract_arguments(context),
                 result=context.output,
                 request_id_ref=correlation_id if request_sent else None,
+                session_id=step.session_id,
             )
         except Exception as e:  # noqa: BLE001
-            result = self._posture.resolve(Undecided("adapter_exception", {"error": str(e)},
+            result = step.posture.resolve(Undecided("adapter_exception", {"error": str(e)},
                                                      f"adapter error: {e}"))
         else:
             await self._lifecycle_sent()
-            result = await asyncio.to_thread(self._round_trip, request)
+            result = await asyncio.to_thread(self._exchange, request, step, run)
         if isinstance(result, Resolution):
-            return self._settle_post(context, result)
+            return self._settle_post(context, result, step)
         response = result.response
 
         decision = normalize_decision((response or {}).get("result"))
@@ -803,7 +1005,7 @@ async def post_invoke(self, context):
             _redact_output(context)
             audit_event("post_invoke_redacted",
                         cause="guardian_deny",
-                        session_id=self._session_id,
+                        session_id=step.session_id,
                         method="steps/toolCallResult",
                         reasoning=decision.reasoning or "output redacted by Guardian")
             return context
@@ -811,35 +1013,36 @@ async def post_invoke(self, context):
             violation = modify_composition_violation(decision.modifications)
             if violation:
                 audit_event("modify_composition_invalid",
-                            session_id=self._session_id,
+                            session_id=step.session_id,
                             method="steps/toolCallResult", detail=violation)
                 _redact_output(context)
                 audit_event("post_invoke_redacted",
                             cause="modify_composition_invalid",
-                            session_id=self._session_id,
+                            session_id=step.session_id,
                             method="steps/toolCallResult")
                 return context
             modified_content = decision.modifications.get("modified_content")
             if modified_content is not None:
                 context.output = modified_content
                 return context
-            # A structured MODIFY on a result cannot be realized generically;
-            # redact the whole result rather than silently ignore the Guardian.
+            # A structured MODIFY on a result has no generic form, so the whole result is withheld.
+            audit_modify_unsupported("structured edits on a tool result", session_id=step.session_id,
+                                     method="steps/toolCallResult")
             _redact_output(context)
             audit_event("post_invoke_redacted",
                         cause="modify_unapplied_structured_edits",
-                        session_id=self._session_id,
+                        session_id=step.session_id,
                         method="steps/toolCallResult")
             return context
         if not decision.known:
             audit_event("unusable_disposition",
                         disposition=decision.disposition or "(missing)",
-                        session_id=self._session_id,
+                        session_id=step.session_id,
                         method="steps/toolCallResult")
             _redact_output(context)
             audit_event("post_invoke_redacted",
                         cause="unusable_disposition",
-                        session_id=self._session_id,
+                        session_id=step.session_id,
                         method="steps/toolCallResult",
                         decision=decision.disposition)
             return context
@@ -847,36 +1050,68 @@ async def post_invoke(self, context):
 
     # ----- helpers -----
 
-    def _round_trip(self, request: dict):
-        return round_trip(request, guardian_url=self._acs.guardian_url, posture=self._posture,
-                          session_id=self._session_id)
+    def _round_trip(self, request: dict, step: _Step):
+        return round_trip(request, guardian_url=self._acs.guardian_url, posture=step.posture,
+                          session_id=step.session_id)
+
+    async def _step_of(self, run: str | None) -> _Step:
+        """A call's session, opened off the event loop after the lifecycle hooks reported before the call, so a run's sessionStart carries its workflow's name."""
+        self._run_state(run)
+        await self._lifecycle_sent()
+        return await asyncio.to_thread(self._step, run)
 
-    def _metadata(self) -> dict[str, Any]:
-        """The envelope metadata every step of this middleware carries."""
-        return {"agent_id": self._agent_id, "session_id": self._session_id,
+    def _metadata(self, session_id: str | None = None) -> dict[str, Any]:
+        return {"agent_id": self._agent_id, "session_id": session_id or self._session_id,
                 "platform": "nat", "adapter_version": ADAPTER_VERSION}
 
-    def _settle_pre(self, context, resolution: Resolution, message: str = ""):
-        """Settle a pre_invoke step without a usable decision: block unless the resolution proceeds, and record why."""
+    @staticmethod
+    def _current_run() -> str | None:
+        """The NAT run the current call or workflow event belongs to; None outside a Runner."""
+        try:
+            return _NATContextState.get().workflow_run_id.get() if _NATContextState is not None else None
+        except Exception:  # noqa: BLE001
+            return None
+
+    def _count_failure(self, resolution: Resolution, run: str | None = None) -> None:
+        """Count a step's own decision failure under its run and failure class (§6.4)."""
+        if not resolution.decision_failure:
+            return
+        with self._runs_lock:
+            tracked = set(self._runs)
+        with self._decision_failures_lock:
+            counts = self._decision_failures.setdefault(run, collections.Counter())
+            counts[resolution.fields.get("failure_class", "other")] += 1
+            # A tracked run keeps its counts until its sessionEnd; only untracked runs age out.
+            untracked = [r for r in self._decision_failures if r not in tracked]
+            for stale in untracked[:max(0, len(untracked) - _MAX_COUNTED_RUNS)]:
+                del self._decision_failures[stale]
+
+    def _take_failure_counts(self, run: str | None) -> dict[str, int]:
+        """The run's decision failures per failure class, removed now that its sessionEnd reports them."""
+        with self._decision_failures_lock:
+            return dict(self._decision_failures.pop(run, {}))
+
+    def _settle_pre(self, context, resolution: Resolution, step: _Step, message: str = ""):
         audit_event(resolution.audit_type, **{**resolution.fields, "cause": resolution.cause,
-                                              "session_id": self._session_id,
+                                              "session_id": step.session_id,
                                               "method": "steps/toolCallRequest"})
+        self._count_failure(resolution, self._current_run())
         if resolution.proceed:
             return None
         return self._block(context, message or resolution.message or resolution.cause)
 
-    def _settle_post(self, context, resolution: Resolution):
+    def _settle_post(self, context, resolution: Resolution, step: _Step):
         """Settle a post_invoke step without a usable decision: redact the output the Guardian never vetted unless the resolution lets it through, and record why."""
         if not resolution.proceed:
             _redact_output(context)
         audit_event(resolution.audit_type, **{**resolution.fields, "cause": resolution.cause,
-                                              "session_id": self._session_id,
+                                              "session_id": step.session_id,
                                               "method": "steps/toolCallResult"})
+        self._count_failure(resolution, self._current_run())
         return None if resolution.proceed else context
 
     def _block(self, context, reason: str):
-        """Block the invocation. Prefer InvocationAction when available,
-        fall back to raising for NAT releases that don't expose it."""
+        """Block with InvocationAction when NAT has it, else raise."""
         if _HAS_INVOCATION_ACTION:
             context.action = InvocationAction.SKIP  # type: ignore[attr-defined]
             context.acs_block_reason = reason
@@ -891,8 +1126,8 @@ def _build_request(
         result: Any = None,
         request_id: str | None = None,
         request_id_ref: str | None = None,
+        session_id: str | None = None,
     ) -> dict:
-        """Build an ACS request envelope matching request-envelope.json; the round trip signs it."""
         if method == "steps/toolCallRequest":
             payload: dict[str, Any] = {
                 "tool": {"name": tool_name},
@@ -914,9 +1149,8 @@ def _build_request(
                 payload["request_id_ref"] = request_id_ref
 
         return request_envelope(method, request_id=request_id or str(uuid.uuid4()),
-                                metadata=self._metadata(), payload=payload)
+                                metadata=self._metadata(session_id), payload=payload)
 
-# ----- NAT registration -----
 
 if _NAT_AVAILABLE and _HAS_REGISTRATION:
     @register_middleware(config_type=ACSMiddlewareConfig)  # type: ignore[misc]
@@ -951,16 +1185,24 @@ class ACSLifecycleExporterConfig(TelemetryExporterBaseConfig, name="acs_lifecycl
     class _LifecycleExporter(BaseExporter):  # type: ignore[misc, valid-type]
         """Hands every step of a run to the middleware's lifecycle callback; NAT subscribes it before WORKFLOW_START."""
 
+        # The run this exporter instance reports; NAT copies the exporter for each run.
+        _run: str | None = None
+
         def __init__(self, middleware: ACSMiddleware) -> None:
             super().__init__()
             self._middleware = middleware
 
         def export(self, event) -> None:
+            if self._run is None:
+                self._run = self._middleware._current_run()
             self._middleware._on_intermediate_step(event)
 
+        async def _cleanup(self) -> None:
+            # NAT stops a run's exporter when the run ends, whether or not it pushed WORKFLOW_END.
+            self._middleware._run_stopped(self._run)
+
     @register_telemetry_exporter(config_type=ACSLifecycleExporterConfig)  # type: ignore[misc]
     async def build_acs_lifecycle_exporter(config: "ACSLifecycleExporterConfig", builder):  # type: ignore[name-defined]
-        """Build the exporter that feeds one `acs_guardian` middleware."""
         middleware = _LIFECYCLE_MIDDLEWARES.get(config.middleware_key)
         if middleware is None:
             raise ValueError("acs_lifecycle is added by the acs_guardian middleware; it is not configured on its own")
diff --git a/adapters/src/acs/testing/harness.py b/adapters/src/acs/testing/harness.py
index d9ef6aa8..4ddf5589 100644
--- a/adapters/src/acs/testing/harness.py
+++ b/adapters/src/acs/testing/harness.py
@@ -43,6 +43,8 @@
 from acs.core import schemas_dir
 
 _HERE = Path(__file__).resolve().parent
+# The ACS_HMAC_KEY_ID the test setups configure, and the label the test Guardian signs with by default.
+TEST_KEY_ID = "test-key"
 
 
 # ────────────────────────────────────────────────────────────────────
@@ -119,6 +121,7 @@ def make_envelope(
     agent_id: str = "test",
     platform: str = "test",
     sign_with_secret: str | bytes | None = None,
+    key_id: str = TEST_KEY_ID,
 ) -> dict:
     """Build a canonical request envelope ready for the wire.
 
@@ -147,7 +150,7 @@ def make_envelope(
     if sign_with_secret is not None:
         secret = sign_with_secret.encode() if isinstance(sign_with_secret, str) else sign_with_secret
         key = core.derive_session_key(secret, sid)
-        client.sign_envelope(env, key=key, session_id=sid)
+        client.sign_envelope(env, key=key, session_id=sid, key_id=key_id)
     return env
 
 
@@ -289,6 +292,18 @@ def post_envelope(url: str, envelope: dict, *, timeout: float = 5.0) -> dict:
 }
 
 
+def signing_env() -> dict[str, str]:
+    """The test secret and the label that names it, as the adapters and the example Guardian read them (§10)."""
+    return {"ACS_HMAC_SECRET": ProgrammableGuardian.DEFAULT_TEST_HMAC_SECRET, "ACS_HMAC_KEY_ID": TEST_KEY_ID}
+
+
+def sign_for_test(envelope: dict) -> dict:
+    """Sign a hand-built request with the test secret under its label, as an adapter would (§10)."""
+    session_id = envelope["params"]["metadata"]["session_id"]
+    key = core.derive_session_key(ProgrammableGuardian.DEFAULT_TEST_HMAC_SECRET.encode(), session_id)
+    return core.sign_with_key(envelope, key, key_id=TEST_KEY_ID)
+
+
 def seed_negotiated_session(cache_dir: str | Path, *, session_id: str, guardian_url: str,
                             hmac_secret: str | None = None,
                             server_hello: dict | None = None) -> None:
@@ -312,9 +327,12 @@ class ProgrammableGuardian:
     DEFAULT_TEST_HMAC_SECRET = "shared-test-harness-secret-not-for-production"
 
     def __init__(self, *, hmac_secret: str | None = None,
-                  sign_responses: bool = True, port: int = 0, threaded: bool = False) -> None:
+                  sign_responses: bool = True, port: int = 0, threaded: bool = False,
+                  key_id: str = TEST_KEY_ID) -> None:
         import http.server
         self.hmac_secret = hmac_secret or self.DEFAULT_TEST_HMAC_SECRET
+        # The label of hmac_secret (§10): requests under another label get an unsigned SIGNATURE_INVALID.
+        self.key_id = key_id
         self.sign_responses = sign_responses
         self.received: list[dict] = []
         self.sent: list[dict] = []
@@ -430,7 +448,7 @@ def do_POST(self_h):  # noqa: N802
                     sid = req.get("params", {}).get("metadata", {}).get("session_id", "")
                     key = core.derive_session_key(
                         guardian.hmac_secret.encode(), sid)
-                    if not client.verify_signature(req, key=key, session_id=sid):
+                    if not client.verify_signature(req, key=key, session_id=sid, key_id=guardian.key_id):
                         self_h._reply({
                             "jsonrpc": "2.0", "id": req.get("id"),
                             "error": {"code": -32004, "message": "SIGNATURE_INVALID"},
@@ -447,7 +465,7 @@ def do_POST(self_h):  # noqa: N802
                     sid = req["params"]["metadata"]["session_id"]
                     key = core.derive_session_key(
                         guardian.hmac_secret.encode(), sid)
-                    client.sign_envelope(resp, key=key, session_id=sid)
+                    client.sign_envelope(resp, key=key, session_id=sid, key_id=guardian.key_id)
                 self_h._reply(resp)
 
             def _reply(self_h, resp: dict):
diff --git a/adapters/tests/client/test_config.py b/adapters/tests/client/test_config.py
index c2b59d94..7b04fbcd 100644
--- a/adapters/tests/client/test_config.py
+++ b/adapters/tests/client/test_config.py
@@ -1,11 +1,13 @@
 from __future__ import annotations
 
+import json
 import os
 import unittest
 from unittest import mock
 
 from acs.client import Config, FailPosture, Negotiated, NoAnswer, Refused, Resolution, SessionRefused, Undecided
-from acs.client._config import DEFAULT_GUARDIAN_URL, DEFAULT_TIMEOUT_S
+from acs.client._config import DEFAULT_GUARDIAN_URL, DEFAULT_TIMEOUT_S, FAILURE_CLASSES, failure_class
+from acs.core import schemas_dir
 
 PROCEED = FailPosture(deny_on_failure=False, timeout_s=1.0)
 DENY = FailPosture(deny_on_failure=True, timeout_s=1.0)
@@ -71,17 +73,66 @@ class Resolve(unittest.TestCase):
     def test_resolution_table(self) -> None:
         refused = Refused("replay_detected_response", self.FIELDS)
         undecided = Undecided("transport_failure", self.FIELDS)
+        closed = {"posture": "fail_closed"}
+        refusal = {**self.FIELDS, "failure_class": "guardian_error", **closed}
+        unreachable = {**self.FIELDS, "failure_class": "unreachable"}
         table = [
-            (PROCEED, refused, Resolution(False, "guardian_refusal_fail_closed", refused.cause, self.FIELDS)),
-            (DENY, refused, Resolution(False, "guardian_refusal_fail_closed", refused.cause, self.FIELDS)),
-            (DENY, undecided, Resolution(False, "decision_failure_fail_closed", undecided.cause, self.FIELDS)),
-            (PROCEED, undecided, Resolution(True, "fail_open_bypass", undecided.cause, self.FIELDS)),
+            (PROCEED, refused, Resolution(False, "guardian_refusal_fail_closed", refused.cause, refusal,
+                                          decision_failure=True)),
+            (DENY, refused, Resolution(False, "guardian_refusal_fail_closed", refused.cause, refusal,
+                                       decision_failure=True)),
+            (DENY, undecided, Resolution(False, "decision_failure_fail_closed", undecided.cause,
+                                         {**unreachable, **closed}, decision_failure=True)),
+            (PROCEED, undecided, Resolution(True, "fail_open_bypass", undecided.cause,
+                                            {**unreachable, "posture": "fail_open"}, decision_failure=True)),
         ]
         for posture, outcome, expected in table:
             with self.subTest(deny=posture.deny_on_failure, outcome=type(outcome).__name__):
                 self.assertEqual(posture.resolve(outcome), expected)
 
 
+class FailureClasses(unittest.TestCase):
+    """§6.4: every decision failure carries one of the failure classes sessionEnd counts."""
+
+    def test_the_classes_are_the_ones_session_end_counts(self) -> None:
+        schema = json.loads((schemas_dir() / "hooks" / "session-end.json").read_text())
+        counted = schema["properties"]["summary"]["properties"]["decision_failures"]["propertyNames"]["enum"]
+        self.assertEqual(sorted(FAILURE_CLASSES), sorted(counted))
+
+    def test_each_cause_maps_to_its_class(self) -> None:
+        table = {
+            "decision_timeout": "timeout", "transport_failure": "unreachable",
+            "malformed_response": "malformed_response", "response_binding_mismatch": "malformed_response",
+            "response_signature_invalid": "signature_invalid", "error_signature_invalid": "signature_invalid",
+            "response_unverifiable": "signature_invalid",
+            "internal_error_response": "guardian_error", "replay_detected_response": "guardian_error",
+            "http_503_error": "guardian_error", "http_403_refusal": "guardian_error", "key_id_rejected": "guardian_error",
+            "adapter_exception": "observed_agent_error", "adapter_build_failed": "observed_agent_error",
+            "adapter_translate_exception": "observed_agent_error", "request_exceeds_max_payload": "observed_agent_error",
+            "guardian_url_rejected": "observed_agent_error", "invalid_stdin_json": "observed_agent_error",
+            "something_new": "other",
+        }
+        for cause, expected in table.items():
+            with self.subTest(cause):
+                self.assertEqual(failure_class(cause), expected)
+                self.assertIn(expected, FAILURE_CLASSES)
+
+    def test_a_gate_restating_a_start_failure_is_not_counted_again(self) -> None:
+        session = Negotiated({"on_decision_failure": "proceed"},
+                             {"cause": "decision_timeout", "fields": {"failure_class": "timeout", "posture": "fail_open"}})
+        gated = Config.from_env({"ACS_DEFAULT_DENY": "1"}).gate(session)
+        self.assertEqual((gated.decision_failure, gated.fields["posture"]), (False, "fail_closed"))
+
+    def test_a_session_end_goes_out_after_a_start_without_a_decision(self) -> None:
+        """sessionEnd is audit-only and reports the session's decision failures (§6.4), so a fail-closed posture sends it."""
+        failed = Negotiated({"on_decision_failure": "deny"}, {"cause": "decision_timeout", "fields": {}})
+        deny = Config.from_env({"ACS_DEFAULT_DENY": "1"})
+        self.assertIsNone(deny.gate(failed, "steps/sessionEnd"))
+        self.assertFalse(deny.gate(failed, "steps/toolCallRequest").proceed)
+        self.assertFalse(deny.gate(SessionRefused("session_start_denied", {}), "steps/sessionEnd").proceed,
+                         "a refused session sends nothing, sessionEnd included (§4.1)")
+
+
 class Gate(unittest.TestCase):
     """§4.1: only a negotiated session reaches the Guardian; the others settle each step locally."""
 
diff --git a/adapters/tests/client/test_exchange.py b/adapters/tests/client/test_exchange.py
index 65298834..88930b57 100644
--- a/adapters/tests/client/test_exchange.py
+++ b/adapters/tests/client/test_exchange.py
@@ -14,7 +14,7 @@
 from acs.client import _exchange
 from acs.core import MAX_REQUEST_BODY_BYTES, derive_session_key, sign_with_key
 
-SECRET = "exchange-test-secret"
+SECRET = "exchange-test-secret-padded-to-32-bytes"
 SESSION = "session-exchange"
 URL = "http://127.0.0.1:8787/acs"
 
@@ -26,7 +26,7 @@ def _request(**payload: Any) -> dict:
 
 
 def _signed(response: dict) -> dict:
-    return sign_with_key(response, derive_session_key(SECRET.encode(), SESSION))
+    return sign_with_key(response, derive_session_key(SECRET.encode(), SESSION), key_id="test-key")
 
 
 def _result(**overrides: Any) -> dict:
@@ -151,7 +151,7 @@ def _http(status: int, body: Any = None):
 ]
 
 
-@mock.patch.dict(os.environ, {"ACS_HMAC_SECRET": SECRET, "ACS_HMAC_SECRET_FILE": ""})
+@mock.patch.dict(os.environ, {"ACS_HMAC_SECRET": SECRET, "ACS_HMAC_KEY_ID": "test-key", "ACS_HMAC_SECRET_FILE": "", "ACS_HMAC_KEY_ID": "test-key"})
 class ExchangeCauses(unittest.TestCase):
     def _exchange(self, urlopen: Any, *, request: dict | None = None, url: str = URL,
                   timeout_s: float = 2.5):
@@ -206,7 +206,7 @@ def test_a_secret_that_cannot_be_loaded_refuses_the_answer(self) -> None:
             secret_file = Path(d) / "hmac.key"
             secret_file.write_text(SECRET)
             secret_file.chmod(0o644)
-            with mock.patch.dict(os.environ, {"ACS_HMAC_SECRET_FILE": str(secret_file)}):
+            with mock.patch.dict(os.environ, {"ACS_HMAC_SECRET_FILE": str(secret_file), "ACS_HMAC_KEY_ID": "test-key"}):
                 outcome, _ = self._exchange(_json(_signed(_result())))
         self.assertIsInstance(outcome, Refused)
         self.assertEqual(outcome.cause, "response_unverifiable")
@@ -256,7 +256,7 @@ def close(self) -> None:
         self.server.server_close()
 
 
-@mock.patch.dict(os.environ, {"ACS_HMAC_SECRET": SECRET, "ACS_HMAC_SECRET_FILE": ""})
+@mock.patch.dict(os.environ, {"ACS_HMAC_SECRET": SECRET, "ACS_HMAC_KEY_ID": "test-key", "ACS_HMAC_SECRET_FILE": "", "ACS_HMAC_KEY_ID": "test-key"})
 class OverallDeadline(unittest.TestCase):
     """§6.4: the negotiated timeout bounds the whole wait, including a body that arrives slowly."""
 
@@ -460,7 +460,7 @@ def _answer(self, tls: ssl.SSLSocket) -> None:
         return f"https://127.0.0.1:{server.server_address[1]}/acs"
 
     def _exchange(self, url: str, timeout_s: float):
-        env = {"ACS_HMAC_SECRET": SECRET, "ACS_HMAC_SECRET_FILE": "", "SSL_CERT_FILE": self.cert}
+        env = {"ACS_HMAC_SECRET": SECRET, "ACS_HMAC_KEY_ID": "test-key", "ACS_HMAC_SECRET_FILE": "", "ACS_HMAC_KEY_ID": "test-key", "SSL_CERT_FILE": self.cert}
         with mock.patch.dict(os.environ, env):
             return exchange(_request(), guardian_url=url, timeout_s=timeout_s, session_id=SESSION)
 
@@ -489,7 +489,8 @@ def test_a_stalled_tls_handshake_ends_at_the_deadline(self) -> None:
 STATUSES = (200, 400, 413, 500, 503)
 MATRIX = [
     ("unsigned non-refusal error", lambda: _error(-32603), Refused, "error_signature_invalid"),
-    ("unsigned refusal error", lambda: _error(-32004), Refused, "error_signature_invalid"),
+    ("unsigned refusal error", lambda: _error(-32005), Refused, "error_signature_invalid"),
+    ("unsigned SIGNATURE_INVALID, an unknown key_id", lambda: _error(-32004), Refused, "key_id_rejected"),
     ("error with a forged signature", lambda: _forged_error(-32603), Refused, "error_signature_invalid"),
     ("signed error for another request", lambda: _signed({**_error(-32603), "id": "rpc-2"}),
      Refused, "response_binding_mismatch"),
@@ -513,7 +514,7 @@ def test_a_stalled_tls_handshake_ends_at_the_deadline(self) -> None:
 ]
 
 
-@mock.patch.dict(os.environ, {"ACS_HMAC_SECRET": SECRET, "ACS_HMAC_SECRET_FILE": ""})
+@mock.patch.dict(os.environ, {"ACS_HMAC_SECRET": SECRET, "ACS_HMAC_KEY_ID": "test-key", "ACS_HMAC_SECRET_FILE": "", "ACS_HMAC_KEY_ID": "test-key"})
 class HttpStatusMatrix(unittest.TestCase):
     def test_every_envelope_under_every_status(self) -> None:
         for status in STATUSES:
diff --git a/adapters/tests/client/test_round_trip.py b/adapters/tests/client/test_round_trip.py
index 1128c974..6e5033c7 100644
--- a/adapters/tests/client/test_round_trip.py
+++ b/adapters/tests/client/test_round_trip.py
@@ -15,7 +15,7 @@
 from acs.client import _exchange, _store
 from acs.core import derive_session_key, request_envelope, sign_with_key
 
-SECRET = "round-trip-secret"
+SECRET = "round-trip-secret-padded-to-32-bytes"
 SESSION = "44444444-4444-4444-8444-444444444444"
 URL = "http://127.0.0.1:8787/acs"
 PROCEED = FailPosture(deny_on_failure=False, timeout_s=2.0, per_method_timeout_s={"steps/toolCallResult": 0.3})
@@ -28,7 +28,7 @@ def _request(**payload: Any) -> dict:
                             payload=payload)
 
 
-@mock.patch.dict(os.environ, {"ACS_HMAC_SECRET": SECRET, "ACS_HMAC_SECRET_FILE": ""})
+@mock.patch.dict(os.environ, {"ACS_HMAC_SECRET": SECRET, "ACS_HMAC_KEY_ID": "test-key", "ACS_HMAC_SECRET_FILE": "", "ACS_HMAC_KEY_ID": "test-key"})
 class RoundTrip(unittest.TestCase):
     def _send(self, request: dict, answer, posture: FailPosture = PROCEED):
         sent: list[tuple[dict, float]] = []
@@ -46,7 +46,7 @@ def urlopen(req: Any, timeout: float):
     def _signed_allow(body: dict):
         response = sign_with_key({"jsonrpc": "2.0", "id": body["id"], "result": {
             "request_id": body["params"]["request_id"], "decision": "allow"}},
-            derive_session_key(SECRET.encode(), SESSION))
+            derive_session_key(SECRET.encode(), SESSION), key_id="test-key")
         return io.BytesIO(json.dumps(response).encode())
 
     def test_an_edit_after_building_is_covered_by_the_one_signature(self) -> None:
diff --git a/adapters/tests/client/test_session.py b/adapters/tests/client/test_session.py
index ce050d1c..f014c8b8 100644
--- a/adapters/tests/client/test_session.py
+++ b/adapters/tests/client/test_session.py
@@ -19,7 +19,7 @@
 from acs.client import _handshake
 from acs.core import derive_session_key, sign_with_key
 
-SECRET = "session-gate-test-secret"
+SECRET = "session-gate-test-secret-padded-to-32-bytes"
 URL = "http://127.0.0.1:8787/acs"
 HELLO = {"negotiated_version": "0.1.0", "methods_evaluated": ["steps/toolCallRequest"],
          "selected_transport": "http", "timeout_config": {"default_ms": 5000},
@@ -28,7 +28,7 @@
 
 
 def _signed(response: dict, session_id: str) -> dict:
-    return sign_with_key(response, derive_session_key(SECRET.encode(), session_id))
+    return sign_with_key(response, derive_session_key(SECRET.encode(), session_id), key_id="test-key")
 
 
 def _answer(build, status: int = 200):
@@ -96,7 +96,7 @@ def _forged_hello(hello: dict, **extra: Any) -> dict:
 
 
 class _SessionTest(unittest.TestCase):
-    ENV = {"ACS_HMAC_SECRET": SECRET}
+    ENV = {"ACS_HMAC_SECRET": SECRET, "ACS_HMAC_KEY_ID": "test-key"}
 
     def setUp(self) -> None:
         temporary = tempfile.TemporaryDirectory(prefix="acs-session-")
@@ -151,7 +151,7 @@ def test_a_secret_that_cannot_be_loaded_refuses_the_session(self) -> None:
         secret_file = self.cache / "hmac.key"
         secret_file.write_text(SECRET)
         secret_file.chmod(0o644)
-        with mock.patch.dict(os.environ, {"ACS_HMAC_SECRET_FILE": str(secret_file)}):
+        with mock.patch.dict(os.environ, {"ACS_HMAC_SECRET_FILE": str(secret_file), "ACS_HMAC_KEY_ID": "test-key"}):
             decision, calls = self._open()
         self.assertIsInstance(decision, SessionRefused)
         self.assertEqual((decision.cause, calls), ("secret_unavailable", 0))
@@ -515,18 +515,13 @@ def hook() -> None:
         self.assertEqual([c.args[0] for c in self.audit.call_args_list], ["session_record_unwritable"] * 2)
 
 
-class UnsignedMode(_SessionTest):
+class NoSecret(_SessionTest):
     ENV: dict = {}
 
-    def test_an_unsigned_client_claims_no_profile_so_a_required_one_refuses(self) -> None:
-        unsigned_hello = _answer(lambda h: _result(h, {**HELLO, "profiles_accepted": []}, sign=False))
-        decision, _ = self._open(unsigned_hello, session_id="dev-required", ACS_REQUIRE_PROFILES="acs-core")
-        self.assertEqual(decision.cause, "required_profile_not_accepted")
-
-    def test_records_carry_no_mac_and_still_hold_the_session(self) -> None:
-        first, _ = self._open(_raises(urllib.error.URLError("down")), session_id="dev")
-        self.assertIsNone(json.loads(self._record("dev").read_text())["mac"])
-        self.assertEqual(self._open(session_id="dev"), (first, 0))
+    def test_a_session_with_no_secret_is_refused_sends_nothing_and_stores_nothing(self) -> None:
+        decision, calls = self._open(session_id="no-secret")
+        self.assertEqual((decision.cause, calls), ("secret_missing", 0))
+        self.assertFalse(self._record("no-secret").exists())
 
 
 if __name__ == "__main__":
diff --git a/adapters/tests/client/test_store.py b/adapters/tests/client/test_store.py
index 2b382741..0155c5d8 100644
--- a/adapters/tests/client/test_store.py
+++ b/adapters/tests/client/test_store.py
@@ -101,10 +101,8 @@ def _record(self, env: dict, session: str = "session", tool: str = "mcp__srv__to
             _profiles.record_mcp_use(session, tool=tool)
         return audit.call_args_list
 
-    def test_a_signed_session_records_its_degraded_claim_once(self) -> None:
-        calls = self._record({"ACS_HMAC_SECRET": "s", "ACS_HMAC_SECRET_FILE": ""})
+    def test_a_session_records_its_degraded_claim_once(self) -> None:
+        calls = self._record({})
         self.assertEqual([c.args[0] for c in calls], ["profile_claim_degraded"])
         self.assertEqual((calls[0].kwargs["profile"], calls[0].kwargs["tool"]), ("acs-core", "mcp__srv__tool"))
 
-    def test_an_unsigned_session_claims_nothing_to_degrade(self) -> None:
-        self.assertEqual(self._record({"ACS_HMAC_SECRET": "", "ACS_HMAC_SECRET_FILE": ""}), [])
diff --git a/adapters/tests/common/test_capture_guardian.py b/adapters/tests/common/test_capture_guardian.py
index fbd81de9..b0dc8960 100644
--- a/adapters/tests/common/test_capture_guardian.py
+++ b/adapters/tests/common/test_capture_guardian.py
@@ -42,7 +42,7 @@ def _signed_tool_call(secret: str, **overrides) -> dict:
     key = core.derive_session_key(secret.encode(),
                                         env["params"]["metadata"].get("session_id", ""))
     client.sign_envelope(env, key=key,
-                             session_id=env["params"]["metadata"].get("session_id", ""))
+                             session_id=env["params"]["metadata"].get("session_id", ""), key_id="test-key")
     return env
 
 
@@ -105,7 +105,7 @@ def test_independent_of_acs_core(self):
         from acs.testing.capture_guardian import independent_verify
         env = self._envelope()
         key = core.derive_session_key(self.SECRET, self.SID)
-        client.sign_envelope(env, key=key, session_id=self.SID)
+        client.sign_envelope(env, key=key, session_id=self.SID, key_id="test-key")
         self.assertTrue(independent_verify(env, self.SECRET, self.SID),
             "independent verifier and acs.core disagree on a valid envelope")
 
diff --git a/adapters/tests/common/test_edge_cases.py b/adapters/tests/common/test_edge_cases.py
index 6033456a..3fb4bc45 100644
--- a/adapters/tests/common/test_edge_cases.py
+++ b/adapters/tests/common/test_edge_cases.py
@@ -29,7 +29,7 @@
 from acs.client import _handshake as client_handshake  # noqa: E402
 from acs.client import _store as client_store  # noqa: E402
 
-from acs.testing.harness import launch_guardian  # noqa: E402
+from acs.testing.harness import launch_guardian, sign_for_test, signing_env  # noqa: E402
 
 HERE = Path(__file__).resolve().parent
 GUARDIAN = HERE.parent.parent / "src" / "acs" / "guardian" / "example_guardian.py"
@@ -82,8 +82,7 @@ class Item02_GuardianRegexInputCap(unittest.TestCase):
     @classmethod
     def setUpClass(cls) -> None:
         env = os.environ.copy()
-        env["ACS_DEV_MODE"] = "1"
-        env.pop("ACS_HMAC_SECRET", None)
+        env.update(signing_env())
         env.pop("ACS_HMAC_SECRET_FILE", None)
         # Use a unique state dir per run to avoid leftover replay state
         cls.statedir = tempfile.mkdtemp(prefix="acs-guardian-state-")
@@ -105,7 +104,7 @@ def test_huge_bash_command_is_capped_not_scanned(self) -> None:
         NOT iterate the destructive-bash patterns over the full input."""
         # 500 KiB command; would burn CPU on naive regex matching
         huge = "a " * (250 * 1024)
-        body = json.dumps({
+        body = json.dumps(sign_for_test({
             "jsonrpc": "2.0", "id": "ed1",
             "method": "steps/toolCallRequest",
             "params": {
@@ -116,8 +115,7 @@ def test_huge_bash_command_is_capped_not_scanned(self) -> None:
                 "payload": {"tool": {"name": "Bash"},
                             "arguments": {"command": {"value": huge}}},
             },
-        }).encode()
-        # Send under a strict time bound
+        })).encode()
         req = urllib.request.Request(self.url, data=body,
             headers={"Content-Type": "application/json"}, method="POST")
         start = time.monotonic()
@@ -184,10 +182,11 @@ def test_a_config_change_reaches_the_next_session_only(self) -> None:
 
         def respond(request, timeout=None):
             incoming = json.loads(request.data)
-            return io.BytesIO(json.dumps({"jsonrpc": "2.0", "id": incoming["id"],
-                                          "result": next(hellos)}).encode())
+            answer = {"jsonrpc": "2.0", "id": incoming["id"], "result": next(hellos)}
+            client.sign_envelope(answer, session_id=incoming["params"]["metadata"]["session_id"])
+            return io.BytesIO(json.dumps(answer).encode())
 
-        env = {k: v for k, v in os.environ.items() if not k.startswith("ACS_")}
+        env = {**{k: v for k, v in os.environ.items() if not k.startswith("ACS_")}, **signing_env()}
         config = client.Config.from_env({"ACS_GUARDIAN_URL": "http://127.0.0.1:1/acs"})
         with tempfile.TemporaryDirectory() as tmp, \
                 mock.patch.dict(os.environ, env, clear=True), \
@@ -272,21 +271,21 @@ def _make_envelope(self, value):
     def test_emoji_round_trip(self) -> None:
         env = self._make_envelope("🚀 from agent — ✨")
         key = core.derive_session_key(b"test-secret", "sess")
-        client.sign_envelope(env, key=key, session_id="sess")
-        self.assertTrue(client.verify_signature(env, key=key, session_id="sess"))
+        client.sign_envelope(env, key=key, session_id="sess", key_id="test-key")
+        self.assertTrue(client.verify_signature(env, key=key, session_id="sess", key_id="test-key"))
 
     def test_null_byte_round_trip(self) -> None:
         env = self._make_envelope("before\x00after")
         key = core.derive_session_key(b"test-secret", "sess")
-        client.sign_envelope(env, key=key, session_id="sess")
-        self.assertTrue(client.verify_signature(env, key=key, session_id="sess"))
+        client.sign_envelope(env, key=key, session_id="sess", key_id="test-key")
+        self.assertTrue(client.verify_signature(env, key=key, session_id="sess", key_id="test-key"))
 
     def test_bmp_and_supplementary_planes_round_trip(self) -> None:
         # Hebrew (BMP) + emoji (supplementary plane)
         env = self._make_envelope("שלום 🌍 こんにちは")
         key = core.derive_session_key(b"test-secret", "sess")
-        client.sign_envelope(env, key=key, session_id="sess")
-        self.assertTrue(client.verify_signature(env, key=key, session_id="sess"))
+        client.sign_envelope(env, key=key, session_id="sess", key_id="test-key")
+        self.assertTrue(client.verify_signature(env, key=key, session_id="sess", key_id="test-key"))
 
 
 # ===== #8: ISO 8601 parse resilience =====
@@ -393,8 +392,7 @@ class Item03_HaGuardianFileLock(unittest.TestCase):
 
     def _start(self, statedir: str) -> tuple[subprocess.Popen, int]:
         env = os.environ.copy()
-        env["ACS_DEV_MODE"] = "1"
-        env.pop("ACS_HMAC_SECRET", None)
+        env.update(signing_env())
         env.pop("ACS_HMAC_SECRET_FILE", None)
         env["ACS_GUARDIAN_STATE_DIR"] = statedir
         return launch_guardian(env=env)
@@ -409,14 +407,14 @@ def _post(self, port: int, body: dict) -> dict:
             return json.loads(resp.read().decode())
 
     def _envelope(self, sid, rid):
-        return {"jsonrpc": "2.0", "id": str(uuid.uuid4()),
+        return sign_for_test({"jsonrpc": "2.0", "id": str(uuid.uuid4()),
                 "method": "steps/sessionStart",
                 "params": {
                     "acs_version": "0.1.0", "request_id": rid,
                     "timestamp": core.iso8601_now(),
                     "metadata": {"agent_id": "ha", "session_id": sid, "platform": "t"},
                     "payload": {},
-                }}
+                }})
 
     def test_second_guardian_sees_first_guardians_replay_state(self) -> None:
         with tempfile.TemporaryDirectory() as statedir:
@@ -452,8 +450,7 @@ class Item13_LaunchGuardianOwnsThePort(unittest.TestCase):
     @staticmethod
     def _dev_env() -> dict:
         env = os.environ.copy()
-        env["ACS_DEV_MODE"] = "1"
-        env.pop("ACS_HMAC_SECRET", None)
+        env.update(signing_env())
         env.pop("ACS_HMAC_SECRET_FILE", None)
         return env
 
@@ -483,10 +480,7 @@ def test_port_dies_with_the_returned_process(self) -> None:
             self._stop(proc)
 
     def test_child_that_exits_before_binding_raises(self) -> None:
-        """A Guardian that refuses to start (no secret, no dev mode) must
-        surface as RuntimeError, never as someone else's port."""
         env = os.environ.copy()
-        env.pop("ACS_DEV_MODE", None)
         env.pop("ACS_HMAC_SECRET", None)
         env.pop("ACS_HMAC_SECRET_FILE", None)
         with self.assertRaises(RuntimeError) as ctx:
diff --git a/adapters/tests/common/test_hook_command.py b/adapters/tests/common/test_hook_command.py
index 9ba63e0b..d00f5166 100644
--- a/adapters/tests/common/test_hook_command.py
+++ b/adapters/tests/common/test_hook_command.py
@@ -15,6 +15,9 @@
 from acs.integrations.claude_code import wire as claude_wire
 from acs.integrations.cursor import wire as cursor_wire
 
+# The wire tools refuse to wire without a secret and its label (§10).
+SECRET_ARGS = ["--secret-env-inline=" + "0" * 64, "--key-id=test-key"]
+
 
 def _executable(path: Path) -> Path:
     path.parent.mkdir(parents=True, exist_ok=True)
@@ -84,7 +87,8 @@ def test_nonexistent_override_exits_without_writing(self) -> None:
             with self.subTest(wire=module.__name__), tempfile.TemporaryDirectory() as tmp:
                 settings = Path(tmp) / name
                 rc = self._main(module, ["--guardian-url=http://127.0.0.1:8787/acs",
-                                         f"--settings={settings}", f"--hook-command={tmp}/absent", "--write"])
+                                         f"--settings={settings}", f"--hook-command={tmp}/absent", "--write",
+                                         *SECRET_ARGS])
                 self.assertEqual(rc, 2)
                 self.assertFalse(settings.exists())
 
@@ -94,7 +98,8 @@ def test_written_command_runs_the_resolved_path_even_with_spaces(self) -> None:
                 hook = _executable(Path(tmp) / "dir with space" / script)
                 settings = Path(tmp) / name
                 rc = self._main(module, ["--guardian-url=http://127.0.0.1:8787/acs",
-                                         f"--settings={settings}", f"--hook-command={hook}", "--write"])
+                                         f"--settings={settings}", f"--hook-command={hook}", "--write",
+                                         *SECRET_ARGS])
                 self.assertEqual(rc, 0)
                 commands = [h["command"] for h in _commands(json.loads(settings.read_text()))]
                 self.assertTrue(commands)
diff --git a/adapters/tests/common/test_key_id.py b/adapters/tests/common/test_key_id.py
new file mode 100644
index 00000000..0e85aed0
--- /dev/null
+++ b/adapters/tests/common/test_key_id.py
@@ -0,0 +1,209 @@
+"""§10's HMAC key derivation and key_id rules."""
+from __future__ import annotations
+
+import json
+import os
+import re
+import subprocess
+import sys
+import tempfile
+import unittest
+import urllib.request
+import uuid
+from pathlib import Path
+from unittest import mock
+
+from acs import client
+from acs.client import Config, SigningMaterialMissing, _exchange
+from acs.client import _handshake
+from acs.core import derive_session_key, sign_with_key
+from acs.integrations.claude_code import wire as claude_wire
+from acs.integrations.cursor import wire as cursor_wire
+from acs.testing.harness import ProgrammableGuardian, launch_guardian, make_envelope
+
+SPEC = Path(__file__).resolve().parents[3] / "docs" / "spec" / "instrument" / "specification.md"
+SECRET = "key-id-test-secret-0123456789abcdef"
+BIN = Path(sys.executable).parent
+
+
+def _audits(text: str) -> list[dict]:
+    return [json.loads(line[len("ACS_AUDIT "):]) for line in text.splitlines() if line.startswith("ACS_AUDIT ")]
+
+
+class KeyDerivation(unittest.TestCase):
+    def test_the_spec_example_derives_the_spec_key(self) -> None:
+        example = re.search(r"the `session_id` `(?P<sid>[0-9a-f-]{36})` give the key `(?P<key>[0-9a-f]{64})`",
+                            SPEC.read_text(encoding="utf-8"))
+        self.assertIsNotNone(example, "§10 no longer carries the HKDF example in the expected form")
+        self.assertEqual(derive_session_key(bytes(range(32)), example["sid"]).hex(), example["key"])
+        for spelling in (example["sid"].upper(), f"urn:uuid:{example['sid']}"):
+            self.assertNotEqual(derive_session_key(bytes(range(32)), spelling).hex(), example["key"],
+                                "info is the session_id as sent, not normalized")
+
+
+class ConfiguredLabel(unittest.TestCase):
+    def setUp(self) -> None:
+        env = {k: v for k, v in os.environ.items() if not k.startswith("ACS_")}
+        patcher = mock.patch.dict(os.environ, {**env, "ACS_HMAC_SECRET": SECRET, "ACS_HMAC_KEY_ID": "2026-11"},
+                                  clear=True)
+        patcher.start()
+        self.addCleanup(patcher.stop)
+        self.session = str(uuid.uuid4())
+        self.key = derive_session_key(SECRET.encode(), self.session)
+
+    def _response(self, label: str) -> dict:
+        return sign_with_key({"jsonrpc": "2.0", "id": "rpc-1", "result": {"decision": "allow"}}, self.key, key_id=label)
+
+    def test_requests_carry_the_configured_label(self) -> None:
+        signed = client.sign_envelope(make_envelope("steps/toolCallRequest", session_id=self.session),
+                                      session_id=self.session)
+        self.assertEqual(signed["params"]["signature"]["key_id"], "2026-11")
+
+    def test_there_is_no_default_label(self) -> None:
+        with self.assertRaises(TypeError):
+            sign_with_key({"jsonrpc": "2.0", "id": "x", "result": {}}, self.key)  # type: ignore[call-arg]
+        del os.environ["ACS_HMAC_KEY_ID"]
+        with self.assertRaisesRegex(SigningMaterialMissing, "ACS_HMAC_KEY_ID"):
+            client.sign_envelope(make_envelope("steps/toolCallRequest", session_id=self.session),
+                                 session_id=self.session)
+
+    def test_a_response_under_another_label_fails_without_a_fallback(self) -> None:
+        self.assertTrue(client.verify_signature(self._response("2026-11"), session_id=self.session))
+        self.assertFalse(client.verify_signature(self._response("2026-10"), session_id=self.session),
+                         "the right key under another label is still rejected")
+        del os.environ["ACS_HMAC_KEY_ID"]
+        self.assertFalse(client.verify_signature(self._response("2026-11"), session_id=self.session))
+
+    def _open(self, records: str) -> tuple[client.Handshake, int]:
+        with mock.patch.object(_handshake, "_HANDSHAKE_CACHE_DIR", Path(records)), \
+                mock.patch.object(_exchange, "_open") as network:
+            session = client.open_session(config=Config.from_env({"ACS_GUARDIAN_URL": "http://127.0.0.1:9/acs"}),
+                                          session_id=self.session, agent_id="key-id", platform="test",
+                                          methods_implemented=["steps/toolCallRequest"])
+        return session, network.call_count
+
+    def test_a_secret_without_a_label_refuses_the_session_and_sends_nothing(self) -> None:
+        with tempfile.TemporaryDirectory() as records:
+            del os.environ["ACS_HMAC_KEY_ID"]
+            session, calls = self._open(records)
+            self.assertEqual((session.cause, calls), ("key_id_missing", 0))
+
+    def test_a_stored_session_is_refused_once_its_label_is_gone(self) -> None:
+        with tempfile.TemporaryDirectory() as records:
+            _handshake.store_session_decision(Path(records), self.session, "http://127.0.0.1:9/acs",
+                                              client.Negotiated({"negotiated_version": "0.1.0"}), SECRET.encode())
+            del os.environ["ACS_HMAC_KEY_ID"]
+            session, calls = self._open(records)
+            self.assertEqual((session.cause, calls), ("key_id_missing", 0),
+                             "the label is checked before a stored session is followed")
+
+    def test_a_missing_short_or_empty_secret_refuses_the_session_and_sends_nothing(self) -> None:
+        with tempfile.TemporaryDirectory() as d:
+            empty = Path(d) / "empty.key"
+            empty.write_text("")
+            empty.chmod(0o600)
+            cases = {"secret_missing": {"ACS_HMAC_SECRET": ""},
+                     "secret_too_short": {"ACS_HMAC_SECRET": "x" * 31},
+                     "secret_unavailable": {"ACS_HMAC_SECRET": "", "ACS_HMAC_SECRET_FILE": str(empty)}}
+            for cause, env in cases.items():
+                with self.subTest(cause), mock.patch.dict(os.environ, env), tempfile.TemporaryDirectory() as records:
+                    session, calls = self._open(records)
+                    self.assertEqual((session.cause, calls), (cause, 0))
+
+    def test_an_unknown_label_at_the_guardian_never_runs_a_tool(self) -> None:
+        guardian = ProgrammableGuardian(hmac_secret=SECRET, key_id="2026-10")
+        guardian.start()
+        self.addCleanup(guardian.stop)
+        with tempfile.TemporaryDirectory() as root:
+            env = {**os.environ, "ACS_GUARDIAN_URL": guardian.url(), "ACS_HANDSHAKE_CACHE": root,
+                   "ACS_SESSION_STATE_DIR": root}
+            event = {"session_id": self.session, "cwd": "/tmp", "hook_event_name": "PreToolUse",
+                     "tool_name": "Bash", "tool_input": {"command": "rm -rf /srv"}}
+            for _ in range(2):
+                p = subprocess.run([str(BIN / "acs-claude-code-hook")], input=json.dumps(event),
+                                   capture_output=True, text=True, env=env, timeout=30)
+                self.assertEqual(json.loads(p.stdout)["hookSpecificOutput"]["permissionDecision"], "deny",
+                                 "fail-open does not turn an unverifiable rejection into an allow")
+        self.assertIn("key_id_rejected", [r.get("cause") for r in _audits(p.stderr)])
+        self.assertEqual(guardian.methods_seen(), ["handshake/hello"], "the refusal holds; nothing more is sent")
+
+
+class ExampleGuardianLabel(unittest.TestCase):
+    def _guardian(self, **extra: str) -> str:
+        state = tempfile.TemporaryDirectory()
+        self.addCleanup(state.cleanup)
+        env = {**{k: v for k, v in os.environ.items() if not k.startswith("ACS_")},
+               "ACS_HMAC_SECRET": SECRET, "ACS_HMAC_KEY_ID": "2026-11", "ACS_GUARDIAN_STATE_DIR": state.name, **extra}
+        proc, port = launch_guardian(env=env)
+        self.addCleanup(proc.wait, 3)
+        self.addCleanup(proc.terminate)
+        return f"http://127.0.0.1:{port}/acs"
+
+    def _post(self, url: str, label: str) -> dict:
+        hello = {"acs_versions_supported": ["0.1.0"], "methods_implemented": ["steps/toolCallRequest"],
+                 "transports_supported": ["http"], "provenance_producer": "none", "wrapped_protocols": [],
+                 "profiles_supported": ["acs-core"]}
+        envelope = make_envelope("handshake/hello", hello, sign_with_secret=SECRET, key_id=label)
+        request = urllib.request.Request(url, data=json.dumps(envelope).encode(), method="POST",
+                                         headers={"Content-Type": "application/json"})
+        with urllib.request.urlopen(request, timeout=5) as response:
+            return json.loads(response.read())
+
+    def test_an_unknown_label_gets_an_unsigned_signature_invalid(self) -> None:
+        answer = self._post(self._guardian(), "2026-10")
+        self.assertEqual(answer["error"]["code"], -32004)
+        self.assertNotIn("signature", answer["error"], "no configured secret matches, so the error is unsigned")
+
+    def test_a_malformed_step_under_an_unknown_label_still_gets_an_unsigned_signature_invalid(self) -> None:
+        envelope = make_envelope("steps/toolCallRequest", {"not": "a toolCallRequest payload"},
+                                 sign_with_secret=SECRET, key_id="2026-10")
+        request = urllib.request.Request(self._guardian(), data=json.dumps(envelope).encode(), method="POST",
+                                         headers={"Content-Type": "application/json"})
+        with urllib.request.urlopen(request, timeout=5) as response:
+            answer = json.loads(response.read())
+        self.assertEqual(answer["error"]["code"], -32004, "the label is settled before the envelope's schema")
+        self.assertNotIn("signature", answer["error"])
+
+    def test_a_response_carries_the_requests_label(self) -> None:
+        answer = self._post(self._guardian(), "2026-11")
+        self.assertEqual(answer["result"]["signature"]["key_id"], "2026-11")
+
+    def test_a_guardian_with_a_secret_and_no_label_does_not_start(self) -> None:
+        with self.assertRaisesRegex(RuntimeError, "ACS_HMAC_KEY_ID"):
+            self._guardian(ACS_HMAC_KEY_ID="")
+
+
+class WireToolsNameTheSecret(unittest.TestCase):
+    def test_wiring_needs_a_secret(self) -> None:
+        for name, module in (("claude-code", claude_wire), ("cursor", cursor_wire)):
+            with self.subTest(name), tempfile.TemporaryDirectory() as d:
+                hook = Path(d) / "hook"
+                hook.write_text("#!/bin/sh\n")
+                hook.chmod(0o755)
+                with mock.patch.dict(os.environ, {"HOME": d}), mock.patch("sys.stderr"), \
+                        self.assertRaises(SystemExit) as stop:
+                    module.main(["--guardian-url=http://127.0.0.1:8787/acs", f"--settings={d}/settings.json",
+                                 f"--hook-command={hook}", "--write"])
+                self.assertEqual(stop.exception.code, 2)
+                self.assertFalse((Path(d) / "settings.json").exists())
+
+    def test_a_secret_needs_a_label_and_the_command_carries_it(self) -> None:
+        for name, module in (("claude-code", claude_wire), ("cursor", cursor_wire)):
+            with self.subTest(name), tempfile.TemporaryDirectory() as d:
+                hook = Path(d) / "hook"
+                hook.write_text("#!/bin/sh\n")
+                hook.chmod(0o755)
+                base = ["--guardian-url=http://127.0.0.1:8787/acs", f"--settings={d}/settings.json",
+                        f"--hook-command={hook}", "--secret-env-inline=ab" * 1]
+                with mock.patch.dict(os.environ, {"HOME": d}), mock.patch("sys.stderr"), \
+                        self.assertRaises(SystemExit):
+                    module.main(base)
+                command = module.build_command(
+                    hook_command=str(hook), guardian_url="http://127.0.0.1:8787/acs", secret_file=None,
+                    secret_env="ab", key_id="2026-11", default_deny=False, host_allowlist=None,
+                    **({"event_name": "preToolUse"} if module is cursor_wire else {}))
+                self.assertIn("ACS_HMAC_KEY_ID=2026-11 ", command)
+
+
+if __name__ == "__main__":
+    unittest.main()
diff --git a/adapters/tests/common/test_methods_evaluated.py b/adapters/tests/common/test_methods_evaluated.py
index d39a0e72..69990e33 100644
--- a/adapters/tests/common/test_methods_evaluated.py
+++ b/adapters/tests/common/test_methods_evaluated.py
@@ -64,7 +64,7 @@ def __init__(self, guardian: ProgrammableGuardian, *, fail_closed: bool = True)
         self.env = {k: v for k, v in os.environ.items()
                     if k not in ("ACS_HMAC_SECRET_FILE", "ACS_DEFAULT_DENY", "ACS_HANDSHAKE")}
         self.env.update(
-            ACS_GUARDIAN_URL=guardian.url(), ACS_HMAC_SECRET=guardian.hmac_secret,
+            ACS_GUARDIAN_URL=guardian.url(), ACS_HMAC_SECRET=guardian.hmac_secret, ACS_HMAC_KEY_ID="test-key",
             ACS_HANDSHAKE_CACHE=str(d / "handshake"),
             ACS_SESSION_STATE_DIR=str(d / "state"),
             ACS_AUDIT_FILE=str(self.audit_path))
diff --git a/adapters/tests/common/test_security.py b/adapters/tests/common/test_security.py
index f0f49a11..91e9217b 100644
--- a/adapters/tests/common/test_security.py
+++ b/adapters/tests/common/test_security.py
@@ -33,7 +33,7 @@
 from acs.client import _handshake as client_handshake  # noqa: E402
 from acs.client import _store as client_store  # noqa: E402
 from acs.examples import destructive_bash  # noqa: E402
-from acs.testing.harness import launch_guardian  # noqa: E402
+from acs.testing.harness import launch_guardian, signing_env  # noqa: E402
 
 
 HERE = Path(__file__).resolve().parent
@@ -83,10 +83,11 @@ def setUp(self) -> None:
         self.secret_path = Path(self.tmpdir) / "hmac.key"
         self.secret_path.write_bytes(b"super-secret-key-material" * 4)
         self._old_env = {
-            "ACS_HMAC_SECRET_FILE": os.environ.get("ACS_HMAC_SECRET_FILE"),
-            "ACS_HMAC_SECRET": os.environ.get("ACS_HMAC_SECRET"),
+            "ACS_HMAC_SECRET_FILE": os.environ.get("ACS_HMAC_SECRET_FILE"), "ACS_HMAC_KEY_ID": "test-key",
+            "ACS_HMAC_SECRET": os.environ.get("ACS_HMAC_SECRET"), "ACS_HMAC_KEY_ID": "test-key",
         }
         os.environ["ACS_HMAC_SECRET_FILE"] = str(self.secret_path)
+        os.environ["ACS_HMAC_KEY_ID"] = "test-key"
         os.environ.pop("ACS_HMAC_SECRET", None)
 
     def tearDown(self) -> None:
@@ -133,8 +134,7 @@ class GuardianBodySizeCap(unittest.TestCase):
     @classmethod
     def setUpClass(cls) -> None:
         env = os.environ.copy()
-        env["ACS_DEV_MODE"] = "1"
-        env.pop("ACS_HMAC_SECRET", None)
+        env.update(signing_env())
         env.pop("ACS_HMAC_SECRET_FILE", None)
         cls.proc, cls.port = launch_guardian(env=env)
         cls.url = f"http://127.0.0.1:{cls.port}/acs"
@@ -410,6 +410,7 @@ def _make_envelope(self, sig_value):
     def test_malformed_signature_returns_false_not_crashes(self) -> None:
         import os
         os.environ["ACS_HMAC_SECRET"] = "verify-sig-robustness-test-secret"
+        os.environ["ACS_HMAC_KEY_ID"] = "test-key"
         try:
             for bad in self.BAD_VALUES:
                 with self.subTest(signature=bad[:30]):
@@ -523,27 +524,30 @@ def test_unwritable_audit_file_does_not_crash_hook_path(self) -> None:
 
 
 class Item19_SecretFileUnreadableRaises(unittest.TestCase):
-    """A configured-but-unreadable ACS_HMAC_SECRET_FILE must raise,
-    never silently downgrade to unsigned mode."""
+    """A configured-but-unreadable ACS_HMAC_SECRET_FILE must raise, not read as a missing secret."""
 
     def test_missing_secret_file_raises(self) -> None:
         os.environ["ACS_HMAC_SECRET_FILE"] = "/nonexistent-secret-file"
+        os.environ["ACS_HMAC_KEY_ID"] = "test-key"
         try:
             with self.assertRaises(client.SecretFileUnreadableError):
                 client.load_hmac_secret()
         finally:
             os.environ.pop("ACS_HMAC_SECRET_FILE", None)
 
-    def test_no_secret_at_all_is_still_devmode_empty(self) -> None:
-        """No configuration at all stays dev-mode (b\"\") — only a
-        CONFIGURED-and-broken path is an incident."""
+    def test_no_secret_at_all_reads_as_empty_and_is_refused(self) -> None:
+        """No configuration reads as an empty secret, which load_signing_material refuses (secret_missing)."""
         os.environ.pop("ACS_HMAC_SECRET_FILE", None)
         old = os.environ.pop("ACS_HMAC_SECRET", None)
         try:
             self.assertEqual(client.load_hmac_secret(), b"")
+            with self.assertRaises(client.SigningMaterialMissing) as refused:
+                client.load_signing_material()
+            self.assertEqual(refused.exception.cause, "secret_missing")
         finally:
             if old is not None:
                 os.environ["ACS_HMAC_SECRET"] = old
+                os.environ["ACS_HMAC_KEY_ID"] = "test-key"
 
 
 class Item20_DeadGuardianCostsOneTimeoutPerSession(unittest.TestCase):
@@ -552,7 +556,8 @@ class Item20_DeadGuardianCostsOneTimeoutPerSession(unittest.TestCase):
 
     def test_second_event_of_the_session_is_fast(self) -> None:
         import time as _time
-        with tempfile.TemporaryDirectory() as d, \
+        signing = {**{k: v for k, v in os.environ.items() if k != "ACS_HMAC_SECRET_FILE"}, **signing_env()}
+        with tempfile.TemporaryDirectory() as d, mock.patch.dict(os.environ, signing, clear=True), \
                 mock.patch.object(client_handshake, "_HANDSHAKE_CACHE_DIR", Path(d)):
             kw = dict(config=client.Config.from_env({"ACS_GUARDIAN_URL": "http://127.0.0.1:1/acs"}),
                       session_id="cache-test", agent_id="a", platform="test",
@@ -807,7 +812,7 @@ def _run_claude_adapter(self, *, guardian_url: str,
         env = os.environ.copy()
         env.update({
             "ACS_GUARDIAN_URL": guardian_url,
-            "ACS_HMAC_SECRET": secret,
+            "ACS_HMAC_SECRET": secret, "ACS_HMAC_KEY_ID": "test-key",
             "ACS_HANDSHAKE_CACHE": str(self.cache_dir),
             "ACS_HANDSHAKE_TIMEOUT_SECONDS": "2",
         })
@@ -866,15 +871,9 @@ def test_a_stored_decision_the_agent_edits_refuses_the_session(self) -> None:
 # ----- 23. ClientHello advertises only earned integrity capabilities -----
 
 class Item23_ClientHelloCapabilityHonesty(unittest.TestCase):
-    """An unsigned session must not advertise the signed ACS-Core floor.
+    """The captured ClientHello claims the signed ACS-Core floor and is signed; a hook with no secret sends none."""
 
-    Capture the actual serialized ClientHello at the network boundary.  The
-    fake transport deliberately refuses after capture because the behavior
-    under test is the adapter's outbound capability claim, not a cooperative
-    Guardian fixture repeating the same expectation.
-    """
-
-    def _capture_client_hello(self, secret: str | None) -> dict:
+    def _capture_client_hello(self, secret: str | None) -> tuple[client.Handshake, list[dict]]:
         saved = {name: os.environ.get(name) for name in
                  ("ACS_HMAC_SECRET", "ACS_HMAC_SECRET_FILE")}
         try:
@@ -882,6 +881,7 @@ def _capture_client_hello(self, secret: str | None) -> dict:
                 os.environ.pop("ACS_HMAC_SECRET", None)
             else:
                 os.environ["ACS_HMAC_SECRET"] = secret
+                os.environ["ACS_HMAC_KEY_ID"] = "test-key"
             os.environ.pop("ACS_HMAC_SECRET_FILE", None)
 
             captured: list[dict] = []
@@ -902,9 +902,7 @@ def refuse_after_capture(req, timeout):
                     platform="test",
                     methods_implemented=["steps/toolCallRequest"],
                 )
-            self.assertEqual(result, client.NoAnswer("transport_failure", {"error": "<urlopen error capture complete>"}))
-            self.assertEqual(len(captured), 1)
-            return captured[0]
+            return result, captured
         finally:
             for name, value in saved.items():
                 if value is None:
@@ -912,10 +910,11 @@ def refuse_after_capture(req, timeout):
                 else:
                     os.environ[name] = value
 
-    def test_signed_and_unsigned_client_hello_claims_match_the_wire(self) -> None:
-        signed = self._capture_client_hello("capability-secret")
-        unsigned = self._capture_client_hello(None)
-
+    def test_the_client_hello_claims_acs_core_and_is_signed(self) -> None:
+        result, captured = self._capture_client_hello("capability-secret-0123456789abcdef")
+        self.assertEqual(result, client.NoAnswer("transport_failure", {"error": "<urlopen error capture complete>"}))
+        self.assertEqual(len(captured), 1)
+        signed = captured[0]
         signed_payload = signed["params"]["payload"]
         self.assertEqual(signed_payload["profiles_supported"], ["acs-core"])
         self.assertEqual(signed_payload["signature_algorithms_supported"],
@@ -924,11 +923,10 @@ def test_signed_and_unsigned_client_hello_claims_match_the_wire(self) -> None:
             "a session advertising the Core integrity floor must actually "
             "sign its ClientHello")
 
-        unsigned_payload = unsigned["params"]["payload"]
-        self.assertEqual(unsigned_payload["profiles_supported"], [])
-        self.assertEqual(unsigned_payload["signature_algorithms_supported"], [])
-        self.assertNotIn("signature", unsigned["params"],
-            "unsigned development mode must be explicit on the wire")
+    def test_a_hook_with_no_secret_sends_no_client_hello(self) -> None:
+        result, captured = self._capture_client_hello(None)
+        self.assertEqual((result.cause, captured), ("secret_missing", []),
+                         "ACS-Core signs every request (§10), so nothing goes out unsigned")
 
 
 if __name__ == "__main__":
diff --git a/adapters/tests/common/test_serverhello_contract.py b/adapters/tests/common/test_serverhello_contract.py
index 6f49397a..76daa3dc 100644
--- a/adapters/tests/common/test_serverhello_contract.py
+++ b/adapters/tests/common/test_serverhello_contract.py
@@ -51,6 +51,7 @@ def setUp(self) -> None:
             if not key.startswith("ACS_")
         }
         clean_environment["ACS_HMAC_SECRET"] = self.SECRET
+        clean_environment["ACS_HMAC_KEY_ID"] = "test-key"
         self._stack.enter_context(mock.patch.dict(os.environ, clean_environment, clear=True))
         self._stack.enter_context(mock.patch.object(client_handshake, "_HANDSHAKE_CACHE_DIR", self.cache_directory))
         self.audit = self._stack.enter_context(mock.patch.object(client_handshake, "audit_event"))
@@ -75,7 +76,7 @@ def _run(self, url: str | None = None):
     def _sign(self, response: dict) -> dict:
         return client.sign_envelope(
             response, session_id=self.SESSION,
-            key=core.derive_session_key(self.SECRET.encode(), self.SESSION),
+            key=core.derive_session_key(self.SECRET.encode(), self.SESSION), key_id="test-key",
         )
 
     def _respond(self, request, timeout=None):
diff --git a/adapters/tests/common/test_session_gate.py b/adapters/tests/common/test_session_gate.py
index 68b8807b..c7b6b37a 100644
--- a/adapters/tests/common/test_session_gate.py
+++ b/adapters/tests/common/test_session_gate.py
@@ -13,10 +13,10 @@
 from concurrent.futures import ThreadPoolExecutor
 from pathlib import Path
 
-from acs.testing.harness import ProgrammableGuardian
+from acs.testing.harness import ProgrammableGuardian, validate_hook_payload
 
 BIN = Path(sys.executable).parent
-SECRET = "session-gate-hook-secret"
+SECRET = "session-gate-hook-secret-padded-to-32-bytes"
 
 
 def _audit_records(text: str) -> list[dict]:
@@ -32,7 +32,7 @@ def setUp(self) -> None:
 
     def _env(self, url: str, **extra: str) -> dict[str, str]:
         env = {k: v for k, v in os.environ.items() if not k.startswith("ACS_")}
-        env.update(ACS_GUARDIAN_URL=url, ACS_HMAC_SECRET=SECRET,
+        env.update(ACS_GUARDIAN_URL=url, ACS_HMAC_SECRET=SECRET, ACS_HMAC_KEY_ID="test-key",
                    ACS_HANDSHAKE_CACHE=str(self.root / "handshake"),
                    ACS_SESSION_STATE_DIR=str(self.root / "state"),
                    ACS_HANDSHAKE_TIMEOUT_SECONDS="2")
@@ -519,6 +519,66 @@ def test_a_hook_its_own_profile_requirement_refuses_leaves_the_start_to_the_next
                 self.assertFalse(denied, p.stdout)
                 self.assertEqual(guardian.methods_seen(), ["handshake/hello", "steps/sessionStart", "steps/toolCallRequest"])
 
+    def _end(self, host: str, url: str, session: str, **extra: str) -> subprocess.CompletedProcess:
+        if host == "claude-code":
+            argv, event = [str(BIN / "acs-claude-code-hook")], {"session_id": session, "cwd": "/tmp",
+                                                               "hook_event_name": "SessionEnd", "reason": "clear"}
+        else:
+            argv, event = [str(BIN / "acs-cursor-hook"), "sessionEnd"], {"conversation_id": session,
+                                                                        "workspace_roots": ["/tmp"], "reason": "completed"}
+        return subprocess.run(argv, input=json.dumps(event), capture_output=True, text=True,
+                              env=self._env(url, **extra), timeout=30)
+
+    def test_session_end_counts_the_sessions_decision_failures_once_each(self) -> None:
+        # The tool call, or sessionStart, gets no decision within the negotiated 300 ms (§6.4: timeout).
+        for host, run in (("claude-code", self._claude), ("cursor", self._cursor)):
+            for slow in ("steps/toolCallRequest", "steps/sessionStart"):
+                with self.subTest(host, slow=slow):
+                    guardian = ProgrammableGuardian(hmac_secret=SECRET, threaded=True)
+
+                    def hello(req, base=guardian._default_handshake):
+                        return {**base(req), "timeout_config": {"default_ms": 300}}
+
+                    def late(req, allow=guardian._default_allow):
+                        time.sleep(0.6)
+                        return allow(req)
+                    guardian.handlers.update({"handshake/hello": hello, slow: late})
+                    guardian.start()
+                    self.addCleanup(guardian.stop)
+                    session = str(uuid.uuid4())
+                    # A fail-closed hook re-settles a sessionStart failure through the gate; that is not a second failure.
+                    run(guardian.url(), session, ACS_DEFAULT_DENY="0" if slow == "steps/toolCallRequest" else "1")
+                    p = self._end(host, guardian.url(), session)
+                    self.assertEqual(p.returncode, 0, p.stderr[-300:])
+                    ends = guardian.envelopes_for("steps/sessionEnd")
+                    self.assertEqual(len(ends), 1, guardian.methods_seen())
+                    payload = ends[0]["params"]["payload"]
+                    self.assertEqual(payload["summary"]["decision_failures"], {"timeout": 1})
+                    self.assertEqual(validate_hook_payload(payload, "session-end.json"), [])
+
+    def test_a_fail_closed_session_end_still_reports_a_start_without_a_decision(self) -> None:
+        # sessionEnd is audit-only, so a fail-closed hook sends it with the start's timeout (§6.4).
+        for host, run in (("claude-code", self._claude), ("cursor", self._cursor)):
+            with self.subTest(host):
+                guardian = ProgrammableGuardian(hmac_secret=SECRET, threaded=True)
+
+                def hello(req, base=guardian._default_handshake):
+                    return {**base(req), "timeout_config": {"default_ms": 300}}
+
+                def late(req, allow=guardian._default_allow):
+                    time.sleep(0.6)
+                    return allow(req)
+                guardian.handlers.update({"handshake/hello": hello, "steps/sessionStart": late})
+                guardian.start()
+                self.addCleanup(guardian.stop)
+                session = str(uuid.uuid4())
+                run(guardian.url(), session, ACS_DEFAULT_DENY="1")
+                p = self._end(host, guardian.url(), session, ACS_DEFAULT_DENY="1")
+                self.assertEqual(p.returncode, 0, p.stderr[-300:])
+                [end] = guardian.envelopes_for("steps/sessionEnd")
+                self.assertEqual(end["params"]["payload"]["summary"]["decision_failures"], {"timeout": 1})
+                self.assertNotIn("steps/toolCallRequest", guardian.methods_seen(), "the fail-closed step was not sent")
+
     def test_parallel_startup_hooks_follow_one_refusal(self) -> None:
         guardian = self._slow_hello(0.5, lambda req: {"code": -32000, "message": "agent not permitted"})
         for host in self.STARTUP:
diff --git a/adapters/tests/common/test_wire_duplicates.py b/adapters/tests/common/test_wire_duplicates.py
index 92c4c056..cbaf6d72 100644
--- a/adapters/tests/common/test_wire_duplicates.py
+++ b/adapters/tests/common/test_wire_duplicates.py
@@ -15,6 +15,9 @@
 from acs.integrations.claude_code import wire as claude_wire
 from acs.integrations.cursor import wire as cursor_wire
 
+# The wire tools refuse to wire without a secret and its label (§10).
+SECRET_ARGS = ["--secret-env-inline=" + "0" * 64, "--key-id=test-key"]
+
 
 def _claude_hook(command: str) -> dict:
     return {"hooks": {"PreToolUse": [{"matcher": "*", "hooks": [{"type": "command", "command": command}]}]}}
@@ -55,7 +58,7 @@ def _wire(self, settings: Path, *extra: str, cwd: Path | None = None) -> tuple[i
                 contextlib.redirect_stdout(io.StringIO()), contextlib.redirect_stderr(err):
             try:
                 rc = self.MODULE.main(["--guardian-url=http://127.0.0.1:8787/acs", f"--settings={settings}",
-                                       f"--hook-command={self.hook}", "--write", *extra])
+                                       f"--hook-command={self.hook}", "--write", *SECRET_ARGS, *extra])
             except SystemExit as e:
                 rc = int(e.code or 0)
         return rc, err.getvalue()
diff --git a/adapters/tests/conformance/test_acs_core_conformance.py b/adapters/tests/conformance/test_acs_core_conformance.py
index a9561578..961ba0af 100644
--- a/adapters/tests/conformance/test_acs_core_conformance.py
+++ b/adapters/tests/conformance/test_acs_core_conformance.py
@@ -87,6 +87,7 @@
 # =============================================================================
 
 from acs.testing.harness import (  # noqa: E402
+    signing_env,
     launch_guardian,
     seed_negotiated_session,
     build_local_resolver as _build_local_resolver,
@@ -104,7 +105,7 @@ class CoreHarness(unittest.TestCase):
     cross-contaminate.
     """
 
-    HMAC_SECRET: str | None = TEST_HMAC_SECRET  # subclass can null to disable
+    HMAC_SECRET: str = TEST_HMAC_SECRET
 
     @classmethod
     def setUpClass(cls) -> None:
@@ -132,12 +133,8 @@ def setUpClass(cls) -> None:
         env = os.environ.copy()
         cls.statedir = tempfile.mkdtemp(prefix="acs-core-conformance-")
         env["ACS_GUARDIAN_STATE_DIR"] = cls.statedir
-        if cls.HMAC_SECRET:
-            env["ACS_HMAC_SECRET"] = cls.HMAC_SECRET
-            env.pop("ACS_DEV_MODE", None)
-        else:
-            env["ACS_DEV_MODE"] = "1"
-            env.pop("ACS_HMAC_SECRET", None)
+        env["ACS_HMAC_SECRET"] = cls.HMAC_SECRET
+        env["ACS_HMAC_KEY_ID"] = "test-key"
         env.pop("ACS_HMAC_SECRET_FILE", None)
         cls.guardian_proc, cls.port = launch_guardian(env=env)
         cls.url = f"http://127.0.0.1:{cls.port}/acs"
@@ -176,7 +173,7 @@ def _make_envelope(self, method: str, payload: dict | None = None, *,
         }
         if sign and self.HMAC_SECRET:
             key = core.derive_session_key(self.HMAC_SECRET.encode(), sid)
-            client.sign_envelope(env, key=key, session_id=sid)
+            client.sign_envelope(env, key=key, session_id=sid, key_id="test-key")
         return env
 
     def _post(self, envelope: dict) -> dict:
@@ -766,7 +763,7 @@ def _run_claude(self, guardian) -> dict:
         env = os.environ.copy()
         env.update({
             "ACS_GUARDIAN_URL": guardian.url(),
-            "ACS_HMAC_SECRET": self.SECRET,
+            "ACS_HMAC_SECRET": self.SECRET, "ACS_HMAC_KEY_ID": "test-key",
             "ACS_HANDSHAKE_CACHE": tempfile.mkdtemp(),
             # Hermetic per-call turn/session state.
             "ACS_SESSION_STATE_DIR": tempfile.mkdtemp(),
@@ -787,7 +784,7 @@ def _run_cursor(self, guardian) -> dict:
         env = os.environ.copy()
         env.update({
             "ACS_GUARDIAN_URL": guardian.url(),
-            "ACS_HMAC_SECRET": self.SECRET,
+            "ACS_HMAC_SECRET": self.SECRET, "ACS_HMAC_KEY_ID": "test-key",
             "ACS_HANDSHAKE_CACHE": tempfile.mkdtemp(),
             # Hermetic per-call turn/session state.
             "ACS_SESSION_STATE_DIR": tempfile.mkdtemp(),
@@ -949,7 +946,7 @@ def _guardian(self, method: str, result: dict):
 
     def _env(self, g):
         env = os.environ.copy()
-        env.update({"ACS_GUARDIAN_URL": g.url(), "ACS_HMAC_SECRET": self.SECRET,
+        env.update({"ACS_GUARDIAN_URL": g.url(), "ACS_HMAC_SECRET": self.SECRET, "ACS_HMAC_KEY_ID": "test-key",
                     "ACS_HANDSHAKE_CACHE": tempfile.mkdtemp(),
                     "ACS_SESSION_STATE_DIR": tempfile.mkdtemp()})
         env.pop("ACS_HMAC_SECRET_FILE", None)
@@ -1147,16 +1144,97 @@ def test_unapplied_redactions_cannot_be_half_applied_as_overrides(self) -> None:
             f"Cursor half-applied a combined MODIFY: {cursor!r}")
 
 
-# =============================================================================
-# CORE-05 — SessionContext + chain head (conformance.md, ACS-Core / SessionContext and Intent, §8)
-# =============================================================================
-#
-# "session_id, chain_hash (rolling SHA-256), append-only ContextEntry chain,
-#  with the Guardian publishing the chain head (chain_hash) on responses for
-#  content-bearing steps"
-# §8.2 — entry_hash = SHA-256(JCS(entry minus entry_hash/previous_hash) || prev_hash_bytes)
-# =============================================================================
+class Core04d_ModifyUnsupported(unittest.TestCase):
+    """§6.5: a MODIFY the client cannot apply is a DENY, recorded with reason_codes ["modify_unsupported"]."""
+
+    SECRET = Core04c_PromptGateAndMergeFailClosed.SECRET
+    _guardian = Core04c_PromptGateAndMergeFailClosed._guardian
+    _env = Core04c_PromptGateAndMergeFailClosed._env
+
+    REDACT = {"redactions": [{"path": "/command", "replacement": "[REDACTED]"}]}
+    CONTENT = {"modified_content": "echo safe"}
+    OVERRIDE = {"parameter_overrides": {"command": "echo safe"}}
+    CLAUDE = {"session_id": "mu-1", "cwd": "/tmp", "tool_name": "Bash", "tool_input": {"command": "unsafe"},
+              "tool_use_id": "mu1"}
+    CURSOR = {"conversation_id": "conv-mu-1", "workspace_roots": ["/tmp"], "tool_input": {"command": "unsafe"}}
+
+    def _modify(self, host: str, hook: str, event: dict, method: str, mods: dict) -> tuple[dict, list[dict]]:
+        result = {"decision": "modify", "reasoning": "rewrite", "modifications": mods}
+        argv = [sys.executable, str(INTEGRATIONS_DIR / host / "adapter.py")] + ([hook] if host == "cursor" else [])
+        with self._guardian(method, result) as g:
+            proc = subprocess.run(argv, input=json.dumps(event), capture_output=True, text=True,
+                                  env=self._env(g), timeout=15)
+            self.assertIn(method, g.methods_seen())
+        self.assertEqual(proc.returncode, 0, proc.stderr)
+        audits = [json.loads(line.removeprefix("ACS_AUDIT ")) for line in proc.stderr.splitlines()
+                  if line.startswith("ACS_AUDIT ")]
+        return (json.loads(proc.stdout) if proc.stdout.strip() else {},
+                [a for a in audits if a.get("acs_audit_event") == "modify_unsupported"])
+
+    def test_a_modify_the_host_cannot_apply_is_denied_and_recorded(self) -> None:
+        def claude_denied(o): return o.get("hookSpecificOutput", {}).get("permissionDecision") == "deny"
+        def claude_blocked(o): return o.get("decision") == "block"
+        def cursor_denied(o): return o.get("permission") == "deny"
+        def cursor_result_denied(o): return "updated_mcp_tool_output" not in o and \
+            o.get("additional_context", "").startswith("ACS Guardian denied this result")
+        def cursor_blocked(o): return o.get("continue") is False
+        claude_result = {**self.CLAUDE, "hook_event_name": "PostToolUse", "tool_response": {"stdout": "x"}}
+        cases = {
+            "Claude tool call with redactions": ("claude_code", "", {**self.CLAUDE, "hook_event_name": "PreToolUse"},
+                                                 "steps/toolCallRequest", self.REDACT, claude_denied),
+            "Claude tool call with replacement content": ("claude_code", "",
+                                                          {**self.CLAUDE, "hook_event_name": "PreToolUse"},
+                                                          "steps/toolCallRequest", self.CONTENT, claude_denied),
+            "Claude tool result with structured edits": ("claude_code", "", claude_result, "steps/toolCallResult",
+                                                         self.OVERRIDE, claude_blocked),
+            "Claude prompt": ("claude_code", "", {**self.CLAUDE, "hook_event_name": "UserPromptSubmit", "prompt": "hi"},
+                              "steps/userMessage", self.OVERRIDE, claude_blocked),
+            "Cursor tool call with redactions": ("cursor", "preToolUse", {**self.CURSOR, "tool_name": "Shell"},
+                                                 "steps/toolCallRequest", self.REDACT, cursor_denied),
+            "Cursor MCP tool call with overrides": ("cursor", "preToolUse", {**self.CURSOR, "tool_name": "MCP:run"},
+                                                    "steps/toolCallRequest", self.OVERRIDE, cursor_denied),
+            "Cursor shell execution with overrides": ("cursor", "beforeShellExecution",
+                                                      {**self.CURSOR, "command": "unsafe", "cwd": "/tmp"},
+                                                      "steps/toolCallRequest", self.OVERRIDE, cursor_denied),
+            "Cursor result of a built-in tool": ("cursor", "postToolUse",
+                                                 {**self.CURSOR, "tool_name": "Shell", "tool_output": "{\"stdout\": \"x\"}"},
+                                                 "steps/toolCallResult", self.CONTENT, cursor_result_denied),
+            "Cursor result of an HTTP MCP tool": ("cursor", "postToolUse",
+                                                  {**self.CURSOR, "tool_name": "MCP:run", "tool_output": "{\"redacted\": true}"},
+                                                  "steps/toolCallResult", self.CONTENT, cursor_result_denied),
+            "Cursor result with structured edits": ("cursor", "postToolUse",
+                                                    {**self.CURSOR, "tool_name": "MCP:run", "tool_output": "{\"x\": 1}"},
+                                                    "steps/toolCallResult", self.OVERRIDE, cursor_result_denied),
+            "Cursor shell execution result": ("cursor", "afterShellExecution",
+                                              {**self.CURSOR, "command": "unsafe", "output": "x", "cwd": "/tmp"},
+                                              "steps/toolCallResult", self.CONTENT, lambda o: o == {}),
+            "Cursor prompt": ("cursor", "beforeSubmitPrompt", {**self.CURSOR, "prompt": "hi"}, "steps/userMessage",
+                              self.OVERRIDE, cursor_blocked),
+        }
+        for name, (host, hook, event, method, mods, denied) in cases.items():
+            with self.subTest(name):
+                out, unsupported = self._modify(host, hook, event, method, mods)
+                self.assertTrue(denied(out), out)
+                self.assertEqual([a["reason_codes"] for a in unsupported], [["modify_unsupported"]])
+
+    def test_a_modify_the_host_applies_records_no_substitution(self) -> None:
+        cases = {
+            "Claude tool call with overrides": ("claude_code", "", {**self.CLAUDE, "hook_event_name": "PreToolUse"},
+                                                "steps/toolCallRequest", self.OVERRIDE,
+                                                lambda o: o["hookSpecificOutput"]["updatedInput"]["command"]),
+            "Cursor result of a local MCP tool": ("cursor", "postToolUse",
+                                                  {**self.CURSOR, "tool_name": "MCP:run", "tool_output": "{\"x\": 1}"},
+                                                  "steps/toolCallResult", self.CONTENT,
+                                                  lambda o: o["updated_mcp_tool_output"]),
+        }
+        for name, (host, hook, event, method, mods, applied) in cases.items():
+            with self.subTest(name):
+                out, unsupported = self._modify(host, hook, event, method, mods)
+                self.assertEqual(applied(out), "echo safe")
+                self.assertEqual(unsupported, [])
+
 
+# conformance.md ACS-Core: SessionContext and Intent, §8.
 class Core05_SessionContext(CoreHarness):
 
     def test_response_carries_chain_hash(self) -> None:
@@ -1388,7 +1466,7 @@ def test_response_is_signed_and_verifies(self) -> None:
         self.assertIsNotNone(sig,
             "Guardian response missing `signature` field per §10")
         key = core.derive_session_key(self.HMAC_SECRET.encode(), sid)
-        self.assertTrue(client.verify_signature(resp, key=key),
+        self.assertTrue(client.verify_signature(resp, key=key, key_id="test-key"),
             "Guardian's response signature must verify with the "
             "HKDF-derived per-session key")
 
@@ -1415,12 +1493,12 @@ def test_error_response_is_signed_and_verifies(self) -> None:
             "error response missing `signature` — errors are responses "
             "too; conformance.md, ACS-Core / Baseline integrity exempts only system/ping")
         key = core.derive_session_key(self.HMAC_SECRET.encode(), sid)
-        self.assertTrue(client.verify_signature(resp, key=key),
+        self.assertTrue(client.verify_signature(resp, key=key, key_id="test-key"),
             "error-response signature must verify with the per-session key")
         # And a tampered error must NOT verify (the check is real).
         tampered = json.loads(json.dumps(resp))
         tampered["error"]["message"] = "REPLAY_DETECTED but for a different action"
-        self.assertFalse(client.verify_signature(tampered, key=key),
+        self.assertFalse(client.verify_signature(tampered, key=key, key_id="test-key"),
             "tampered error envelope must fail verification")
 
     def test_per_session_key_derivation(self) -> None:
@@ -1470,7 +1548,8 @@ def _run_claude_adapter(self, *, guardian_url: str,
                              env_overrides: dict | None = None,
                              timeout: float = 10.0) -> subprocess.CompletedProcess:
         adapter = INTEGRATIONS_DIR / "claude_code" / "adapter.py"
-        env = os.environ.copy()
+        env = {k: v for k, v in os.environ.items() if k != "ACS_HMAC_SECRET_FILE"}
+        env.update(signing_env())
         env["ACS_GUARDIAN_URL"] = guardian_url
         env.pop("ACS_DEFAULT_DENY", None)
         if env_overrides:
@@ -1501,13 +1580,16 @@ def do_POST(self_h):  # noqa: N802
                 length = int(self_h.headers.get("Content-Length", "0"))
                 body = json.loads(self_h.rfile.read(length).decode())
                 time.sleep(delay_s)
-                reply = json.dumps({
+                reply = {
                     "jsonrpc": "2.0", "id": body.get("id"),
                     "result": {"type": "final", "acs_version": "0.1.0",
                                "request_id": body.get("params", {}).get("request_id", ""),
                                "decision": "deny",
                                "reasoning": "slow guardian denied"},
-                }).encode()
+                }
+                session = body["params"]["metadata"]["session_id"]
+                key = core.derive_session_key(signing_env()["ACS_HMAC_SECRET"].encode(), session)
+                reply = json.dumps(core.sign_with_key(reply, key, key_id=signing_env()["ACS_HMAC_KEY_ID"])).encode()
                 self_h.send_response(200)
                 self_h.send_header("Content-Length", str(len(reply)))
                 self_h.send_header("Content-Type", "application/json")
@@ -1537,24 +1619,18 @@ def log_message(self, *a, **kw): return
             srv.server_close()
 
     def test_guardian_error_response_carries_distinct_cause(self) -> None:
-        """A Guardian-returned JSON-RPC error must be distinguishable in
-        the audit log from 'Guardian unreachable' — same §6.4 fail
-        posture, but a signature error is a client bug while an
-        unreachable Guardian is an ops issue.
-
-        Setup: Guardian REQUIRES signing; the adapter runs WITHOUT a
-        secret, so the Guardian responds -32004 SIGNATURE_INVALID.
-        """
+        """A Guardian's JSON-RPC error is told apart from an unreachable Guardian in the audit."""
         adapter = INTEGRATIONS_DIR / "claude_code" / "adapter.py"
         env_g = os.environ.copy()
-        env_g["ACS_HMAC_SECRET"] = "regression-test-secret"
-        env_g.pop("ACS_DEV_MODE", None)
+        env_g["ACS_HMAC_SECRET"] = "regression-test-secret-padded-to-32-bytes"
+        env_g["ACS_HMAC_KEY_ID"] = "test-key"
         env_g["ACS_GUARDIAN_STATE_DIR"] = tempfile.mkdtemp()
         guardian, port = launch_guardian(env=env_g)
         try:
             env_a = os.environ.copy()
             env_a["ACS_GUARDIAN_URL"] = f"http://127.0.0.1:{port}/acs"
-            env_a.pop("ACS_HMAC_SECRET", None)
+            env_a["ACS_HMAC_SECRET"] = "a-secret-this-guardian-does-not-hold-0123456789"
+            env_a["ACS_HMAC_KEY_ID"] = "test-key"
             env_a.pop("ACS_HMAC_SECRET_FILE", None)
             env_a.pop("ACS_DEFAULT_DENY", None)  # default fail-open
             _negotiated(env_a, "00000000-0000-4000-8000-000000000001")
@@ -1598,19 +1674,18 @@ def test_guardian_error_response_carries_distinct_cause(self) -> None:
             except subprocess.TimeoutExpired: guardian.kill()
 
     def test_guardian_error_under_fail_closed_emits_deny(self) -> None:
-        """Same unsigned-adapter setup with ACS_DEFAULT_DENY=1: the
-        adapter MUST emit a deny AND audit the specific cause."""
         adapter = INTEGRATIONS_DIR / "claude_code" / "adapter.py"
         env_g = os.environ.copy()
-        env_g["ACS_HMAC_SECRET"] = "regression-test-secret-2"
-        env_g.pop("ACS_DEV_MODE", None)
+        env_g["ACS_HMAC_SECRET"] = "regression-test-secret-2-padded-to-32-bytes"
+        env_g["ACS_HMAC_KEY_ID"] = "test-key"
         env_g["ACS_GUARDIAN_STATE_DIR"] = tempfile.mkdtemp()
         guardian, port = launch_guardian(env=env_g)
         try:
             env_a = os.environ.copy()
             env_a["ACS_GUARDIAN_URL"] = f"http://127.0.0.1:{port}/acs"
             env_a["ACS_DEFAULT_DENY"] = "1"
-            env_a.pop("ACS_HMAC_SECRET", None)
+            env_a["ACS_HMAC_SECRET"] = "a-secret-this-guardian-does-not-hold-0123456789"
+            env_a["ACS_HMAC_KEY_ID"] = "test-key"
             env_a.pop("ACS_HMAC_SECRET_FILE", None)
             _negotiated(env_a, "00000000-0000-4000-8000-000000000002")
 
@@ -1658,8 +1733,7 @@ def test_malformed_envelope_under_fail_closed_emits_deny(self) -> None:
         deny AND log cause=malformed_envelope_response."""
         adapter = INTEGRATIONS_DIR / "claude_code" / "adapter.py"
         env_g = os.environ.copy()
-        env_g["ACS_DEV_MODE"] = "1"  # no signing for this test
-        env_g.pop("ACS_HMAC_SECRET", None)
+        env_g.update(signing_env())
         env_g.pop("ACS_HMAC_SECRET_FILE", None)
         env_g["ACS_GUARDIAN_STATE_DIR"] = tempfile.mkdtemp()
         guardian, port = launch_guardian(env=env_g)
@@ -1667,7 +1741,7 @@ def test_malformed_envelope_under_fail_closed_emits_deny(self) -> None:
             env_a = os.environ.copy()
             env_a["ACS_GUARDIAN_URL"] = f"http://127.0.0.1:{port}/acs"
             env_a["ACS_DEFAULT_DENY"] = "1"
-            env_a.pop("ACS_HMAC_SECRET", None)
+            env_a.update(signing_env())
             env_a.pop("ACS_HMAC_SECRET_FILE", None)
 
             _negotiated(env_a, "test-sess")
@@ -1732,7 +1806,7 @@ def _run_shell_adapter(self, platform: str, guardian,
         env = os.environ.copy()
         env.update({
             "ACS_GUARDIAN_URL": guardian.url(),
-            "ACS_HMAC_SECRET": guardian.hmac_secret,
+            "ACS_HMAC_SECRET": guardian.hmac_secret, "ACS_HMAC_KEY_ID": "test-key",
             "ACS_HANDSHAKE_CACHE": cache_dir,
         })
         env.pop("ACS_HMAC_SECRET_FILE", None)
diff --git a/adapters/tests/integrations/claude_code/e2e_check.py b/adapters/tests/integrations/claude_code/e2e_check.py
index 70223e18..ccb250a6 100644
--- a/adapters/tests/integrations/claude_code/e2e_check.py
+++ b/adapters/tests/integrations/claude_code/e2e_check.py
@@ -60,6 +60,7 @@
 
 
 HMAC_SECRET = "e2e-test-shared-secret-not-for-production"
+KEY_ID = "test-key"
 CLAUDE_MODEL = os.environ.get("CLAUDE_MODEL", "claude-haiku-4-5")
 PER_CALL_TIMEOUT_S = 120.0
 
@@ -90,6 +91,7 @@ def write_settings(workdir: Path, port: int) -> None:
     command = (
         f"ACS_GUARDIAN_URL=http://127.0.0.1:{port}/acs "
         f"ACS_HMAC_SECRET={HMAC_SECRET} "
+        f"ACS_HMAC_KEY_ID={KEY_ID} "
         f"ACS_GUARDIAN_HOST_ALLOWLIST= "
         f"python3 {ADAPTER}"
     )
@@ -458,10 +460,7 @@ def main() -> int:
         width=68,
     )
 
-    # Programmable Guardian — records every envelope, signs every response
-    # with the same HMAC secret the adapter uses, can be configured per
-    # scenario to return specific dispositions.
-    guardian = ProgrammableGuardian(hmac_secret=HMAC_SECRET)
+    guardian = ProgrammableGuardian(hmac_secret=HMAC_SECRET, key_id=KEY_ID)
     guardian.start()
 
     workdir = Path(tempfile.mkdtemp(prefix="acs-e2e-real-"))
diff --git a/adapters/tests/integrations/claude_code/test_adapter.py b/adapters/tests/integrations/claude_code/test_adapter.py
index 790b1047..46682314 100644
--- a/adapters/tests/integrations/claude_code/test_adapter.py
+++ b/adapters/tests/integrations/claude_code/test_adapter.py
@@ -24,6 +24,7 @@
 from acs.testing.harness import (  # noqa: E402
     ProgrammableGuardian,
     launch_guardian,
+    signing_env,
     seed_negotiated_session,
 )
 
@@ -46,7 +47,8 @@ def _claude_code_event(name: str, **extra) -> dict:
 class AdapterRoundTrip(unittest.TestCase):
     @classmethod
     def setUpClass(cls) -> None:
-        env = os.environ.copy(); env["ACS_DEV_MODE"] = "1"; env.pop("ACS_HMAC_SECRET", None); env.pop("ACS_HMAC_SECRET_FILE", None)
+        env = {k: v for k, v in os.environ.items() if k != "ACS_HMAC_SECRET_FILE"}
+        env.update(signing_env())
         cls.guardian_proc, cls.port = launch_guardian(env=env)
 
     @classmethod
@@ -66,7 +68,7 @@ def setUp(self) -> None:
     def _negotiated(self, url: str, session_id: str) -> dict[str, str]:
         """Env overrides in which the session already negotiated with url, so the test exercises a step-level failure."""
         seed_negotiated_session(self._handshake_dir, session_id=session_id, guardian_url=url,
-                                hmac_secret=os.environ.get("ACS_HMAC_SECRET"))
+                                hmac_secret=signing_env()["ACS_HMAC_SECRET"])
         return {"ACS_HANDSHAKE_CACHE": self._handshake_dir}
 
     def _run_adapter(
@@ -74,7 +76,8 @@ def _run_adapter(
         event: dict,
         env_overrides: dict[str, str] | None = None,
     ) -> tuple[int, str, str]:
-        env = os.environ.copy()
+        env = {k: v for k, v in os.environ.items() if k != "ACS_HMAC_SECRET_FILE"}
+        env.update(signing_env())
         env["ACS_GUARDIAN_URL"] = f"http://127.0.0.1:{self.port}/acs"
         env["ACS_HANDSHAKE_CACHE"] = self._handshake_dir
         # Turn state is per test unless the test passes its own ACS_SESSION_STATE_DIR.
@@ -259,7 +262,7 @@ def test_audit_only_hooks_never_emit_a_block(self) -> None:
                 # red. State is now isolated per test.)
                 with g, tempfile.TemporaryDirectory() as state:
                     env = {"ACS_GUARDIAN_URL": g.url(),
-                           "ACS_HMAC_SECRET": g.hmac_secret,
+                           "ACS_HMAC_SECRET": g.hmac_secret, "ACS_HMAC_KEY_ID": "test-key",
                            "ACS_SESSION_STATE_DIR": state}
                     if hook == "Stop":
                         # Open the turn: allow turnStart + userMessage
diff --git a/adapters/tests/integrations/claude_code/test_emission.py b/adapters/tests/integrations/claude_code/test_emission.py
index 689629f9..552e422c 100644
--- a/adapters/tests/integrations/claude_code/test_emission.py
+++ b/adapters/tests/integrations/claude_code/test_emission.py
@@ -48,12 +48,10 @@ def _emit(self, event: dict) -> CaptureGuardian:
             env = os.environ.copy()
             env.update({
                 "ACS_GUARDIAN_URL": g.url(),
-                "ACS_HMAC_SECRET": g.hmac_secret,
-                "ACS_HANDSHAKE": "1",           # capture the handshake too
-                "ACS_HANDSHAKE_CACHE": cache,   # fresh → handshake fires
-                # Fresh, isolated turn/session state per one-shot emit so a
-                # turn opened by one test can't leak into another (all
-                # cases reuse one SESSION id).
+                "ACS_HMAC_SECRET": g.hmac_secret, "ACS_HMAC_KEY_ID": "test-key",
+                "ACS_HANDSHAKE": "1",
+                "ACS_HANDSHAKE_CACHE": cache,
+                # Fresh state per emit, since every case reuses SESSION.
                 "ACS_SESSION_STATE_DIR": cache,
             })
             env.pop("ACS_HMAC_SECRET_FILE", None)
@@ -184,7 +182,7 @@ def setUpClass(cls):
             env = os.environ.copy()
             env.update({
                 "ACS_GUARDIAN_URL": cls.g.url(),
-                "ACS_HMAC_SECRET": cls.g.hmac_secret,
+                "ACS_HMAC_SECRET": cls.g.hmac_secret, "ACS_HMAC_KEY_ID": "test-key",
                 "ACS_HANDSHAKE": "1",
                 "ACS_HANDSHAKE_CACHE": cls._cache,  # SHARED → handshake once
                 "ACS_SESSION_STATE_DIR": cls._state,  # SHARED → turn_id persists
diff --git a/adapters/tests/integrations/claude_code/test_example_config.py b/adapters/tests/integrations/claude_code/test_example_config.py
index 36fc2688..cbac90e7 100644
--- a/adapters/tests/integrations/claude_code/test_example_config.py
+++ b/adapters/tests/integrations/claude_code/test_example_config.py
@@ -80,6 +80,7 @@ def test_example_equals_wire_py_output(self) -> None:
                 guardian_url="http://127.0.0.1:8787/acs",
                 secret_file="/path/to/.acs/hmac.key",
                 secret_env=None,
+                key_id="2026-11",
                 default_deny=(hook in wire.GATE_HOOKS),
                 host_allowlist=None,
                 audit_file="/path/to/.acs/audit.log",
diff --git a/adapters/tests/integrations/claude_code/test_live.py b/adapters/tests/integrations/claude_code/test_live.py
index 35578079..4d02b29d 100644
--- a/adapters/tests/integrations/claude_code/test_live.py
+++ b/adapters/tests/integrations/claude_code/test_live.py
@@ -3,6 +3,7 @@
 
 import json
 import os
+import shlex
 import shutil
 import subprocess
 import sys
@@ -20,7 +21,7 @@
 LIVE_SKIP_REASON = "live Claude Code test is opt-in: set ACS_LIVE_CLAUDE=1 to call the real claude CLI"
 
 
-from acs.testing.harness import launch_guardian  # noqa: E402
+from acs.testing.harness import launch_guardian, signing_env  # noqa: E402
 
 
 @unittest.skipUnless(LIVE, LIVE_SKIP_REASON)
@@ -34,8 +35,7 @@ def setUpClass(cls) -> None:
         # Launch first: settings.json below needs the OS-assigned port
         # launch_guardian returns.
         env = os.environ.copy()
-        env["ACS_DEV_MODE"] = "1"
-        env.pop("ACS_HMAC_SECRET", None)
+        env.update(signing_env())
         env.pop("ACS_HMAC_SECRET_FILE", None)
         cls.guardian_proc, cls.port = launch_guardian(env=env)
 
@@ -52,6 +52,7 @@ def setUpClass(cls) -> None:
                         "type": "command",
                         "command": (
                             f"ACS_GUARDIAN_URL=http://127.0.0.1:{cls.port}/acs "
+                            + " ".join(f"{k}={shlex.quote(v)}" for k, v in signing_env().items()) + " "
                             f"python3 {ADAPTER}"
                         ),
                     }],
diff --git a/adapters/tests/integrations/cursor/e2e_check.py b/adapters/tests/integrations/cursor/e2e_check.py
index fa11a381..6b60b783 100644
--- a/adapters/tests/integrations/cursor/e2e_check.py
+++ b/adapters/tests/integrations/cursor/e2e_check.py
@@ -76,6 +76,7 @@
 from acs.guardian.example_guardian import evaluate_step  # noqa: E402
 
 HMAC_SECRET = "e2e-test-shared-secret-not-for-production"
+KEY_ID = "test-key"
 
 
 # Shared pretty-printer + helpers; see src/acs/testing/e2e_report.py.
@@ -116,6 +117,7 @@ def cmd(event_name: str, *, fail_closed: bool) -> str:
         env_vars = (
             f"ACS_GUARDIAN_URL=http://127.0.0.1:{port}/acs "
             f"ACS_HMAC_SECRET={HMAC_SECRET} "
+            f"ACS_HMAC_KEY_ID={KEY_ID} "
             f"ACS_GUARDIAN_HOST_ALLOWLIST= "
             f"ACS_HANDSHAKE_CACHE={handshake_cache}"
         )
@@ -468,9 +470,7 @@ def main() -> int:
         return 1
 
     workdir = Path(tempfile.mkdtemp(prefix="acs-cursor-e2e-"))
-    guardian = ProgrammableGuardian(hmac_secret=HMAC_SECRET)
-    # Real example-Guardian policy as the default handler; scenarios
-    # never swap it out.
+    guardian = ProgrammableGuardian(hmac_secret=HMAC_SECRET, key_id=KEY_ID)
     guardian.handlers["__default__"] = real_policy_handler()
     guardian.start()
     write_project_hooks(workdir, guardian.port)
diff --git a/adapters/tests/integrations/cursor/test_adapter.py b/adapters/tests/integrations/cursor/test_adapter.py
index 4efe0b71..4369483e 100644
--- a/adapters/tests/integrations/cursor/test_adapter.py
+++ b/adapters/tests/integrations/cursor/test_adapter.py
@@ -24,13 +24,14 @@
 
 
 from acs.core import coerce_uuid  # noqa: E402
-from acs.testing.harness import launch_guardian, seed_negotiated_session  # noqa: E402
+from acs.testing.harness import launch_guardian, seed_negotiated_session, signing_env  # noqa: E402
 
 
 class CursorAdapter(unittest.TestCase):
     @classmethod
     def setUpClass(cls) -> None:
-        env = os.environ.copy(); env["ACS_DEV_MODE"] = "1"; env.pop("ACS_HMAC_SECRET", None); env.pop("ACS_HMAC_SECRET_FILE", None)
+        env = {k: v for k, v in os.environ.items() if k != "ACS_HMAC_SECRET_FILE"}
+        env.update(signing_env())
         cls.guardian_proc, cls.port = launch_guardian(env=env)
 
     @classmethod
@@ -50,11 +51,12 @@ def setUp(self) -> None:
     def _negotiated(self, url: str, session_id: str) -> dict[str, str]:
         """Env overrides in which the session already negotiated with url, so the test exercises a step-level failure."""
         seed_negotiated_session(self._handshake_dir, session_id=session_id, guardian_url=url,
-                                hmac_secret=os.environ.get("ACS_HMAC_SECRET"))
+                                hmac_secret=signing_env()["ACS_HMAC_SECRET"])
         return {"ACS_HANDSHAKE_CACHE": self._handshake_dir}
 
     def _run(self, event_name: str, event: dict, env_overrides: dict | None = None) -> tuple[int, str, str]:
-        env = os.environ.copy()
+        env = {k: v for k, v in os.environ.items() if k != "ACS_HMAC_SECRET_FILE"}
+        env.update(signing_env())
         env["ACS_GUARDIAN_URL"] = f"http://127.0.0.1:{self.port}/acs"
         env["ACS_HANDSHAKE_CACHE"] = self._handshake_dir
         # Turn state is per test, so earlier runs cannot leak into this one.
diff --git a/adapters/tests/integrations/cursor/test_emission.py b/adapters/tests/integrations/cursor/test_emission.py
index 1b01e79c..20879181 100644
--- a/adapters/tests/integrations/cursor/test_emission.py
+++ b/adapters/tests/integrations/cursor/test_emission.py
@@ -36,7 +36,7 @@ def _emit(self, event_name: str, event: dict) -> CaptureGuardian:
             env = os.environ.copy()
             env.update({
                 "ACS_GUARDIAN_URL": g.url(),
-                "ACS_HMAC_SECRET": g.hmac_secret,
+                "ACS_HMAC_SECRET": g.hmac_secret, "ACS_HMAC_KEY_ID": "test-key",
                 "ACS_HANDSHAKE": "1",
                 "ACS_HANDSHAKE_CACHE": cache,
                 # subagentStart needs a recorded prior step OR falls back
@@ -294,7 +294,7 @@ def setUpClass(cls):
             env = os.environ.copy()
             env.update({
                 "ACS_GUARDIAN_URL": cls.g.url(),
-                "ACS_HMAC_SECRET": cls.g.hmac_secret,
+                "ACS_HMAC_SECRET": cls.g.hmac_secret, "ACS_HMAC_KEY_ID": "test-key",
                 "ACS_HANDSHAKE": "1",
                 "ACS_HANDSHAKE_CACHE": cls._cache,      # SHARED → handshake once
                 "ACS_SESSION_STATE_DIR": cls._cache,    # SHARED → preCompact entries populate
diff --git a/adapters/tests/integrations/cursor/test_wire.py b/adapters/tests/integrations/cursor/test_wire.py
index ed3262ca..01f64ad7 100644
--- a/adapters/tests/integrations/cursor/test_wire.py
+++ b/adapters/tests/integrations/cursor/test_wire.py
@@ -30,7 +30,7 @@ def _run_default_wire() -> dict:
         proc = subprocess.run(
             [sys.executable, str(WIRE),
              "--guardian-url=http://127.0.0.1:8787/acs",
-             f"--secret-file={secret}",
+             f"--secret-file={secret}", "--key-id=test-key",
              f"--settings={settings}",
              "--write"],
             capture_output=True, text=True, timeout=30, cwd=d, env={**os.environ, "HOME": d},
diff --git a/adapters/tests/integrations/nat/e2e_check.py b/adapters/tests/integrations/nat/e2e_check.py
index 96d6f430..7b708c70 100644
--- a/adapters/tests/integrations/nat/e2e_check.py
+++ b/adapters/tests/integrations/nat/e2e_check.py
@@ -68,6 +68,7 @@ def _build_middleware(guardian_url: str, *, default_deny: bool = True,
     """Construct an ACSMiddleware with the same env the operator uses
     in production (HMAC secret on; signs every envelope)."""
     os.environ["ACS_HMAC_SECRET"] = HMAC_SECRET
+    os.environ["ACS_HMAC_KEY_ID"] = "test-key"
     from acs.integrations.nat.adapter import ACSMiddleware, ACSMiddlewareConfig  # noqa: E402
     return ACSMiddleware(ACSMiddlewareConfig(
         guardian_url=guardian_url,
diff --git a/adapters/tests/integrations/nat/test_adapter.py b/adapters/tests/integrations/nat/test_adapter.py
index 453fc13d..2822ecdf 100644
--- a/adapters/tests/integrations/nat/test_adapter.py
+++ b/adapters/tests/integrations/nat/test_adapter.py
@@ -48,6 +48,7 @@
 from acs.testing.harness import (  # noqa: E402
     ProgrammableGuardian,
     launch_guardian,
+    signing_env,
 )
 
 
@@ -73,7 +74,8 @@ def _make_context(tool_name: str, args: dict) -> "InvocationContext":
 class NATMiddlewareIntegration(unittest.TestCase):
     @classmethod
     def setUpClass(cls) -> None:
-        env = os.environ.copy(); env["ACS_DEV_MODE"] = "1"; env.pop("ACS_HMAC_SECRET", None); env.pop("ACS_HMAC_SECRET_FILE", None)
+        env = {k: v for k, v in os.environ.items() if k != "ACS_HMAC_SECRET_FILE"}
+        env.update(signing_env())
         cls.guardian_proc, cls.port = launch_guardian(env=env)
         cls.guardian_url = f"http://127.0.0.1:{cls.port}/acs"
 
@@ -89,9 +91,10 @@ def setUp(self) -> None:
         # Per-test handshake records, so no record left in the user's cache decides a session here.
         records = tempfile.TemporaryDirectory(prefix="acs-handshake-")
         self.addCleanup(records.cleanup)
-        patcher = mock.patch.object(client_handshake, "_HANDSHAKE_CACHE_DIR", Path(records.name))
-        patcher.start()
-        self.addCleanup(patcher.stop)
+        for patcher in (mock.patch.object(client_handshake, "_HANDSHAKE_CACHE_DIR", Path(records.name)),
+                        mock.patch.dict(os.environ, signing_env())):
+            patcher.start()
+            self.addCleanup(patcher.stop)
 
     def _make_middleware(self, default_deny: bool = True) -> ACSMiddleware:
         cfg = ACSMiddlewareConfig(
@@ -140,6 +143,7 @@ def delayed_deny(req: dict) -> dict:
         saved_secret_file = os.environ.get("ACS_HMAC_SECRET_FILE")
         try:
             os.environ["ACS_HMAC_SECRET"] = g.hmac_secret
+            os.environ["ACS_HMAC_KEY_ID"] = "test-key"
             os.environ.pop("ACS_HMAC_SECRET_FILE", None)
             with tempfile.TemporaryDirectory() as d, \
                     mock.patch.object(client_handshake, "_HANDSHAKE_CACHE_DIR",
@@ -153,16 +157,18 @@ def delayed_deny(req: dict) -> dict:
             self.assertIsNone(result,
                 "the late DENY arrived after the negotiated deadline; the "
                 "configured fail-open posture should control the timeout")
-            self.assertAlmostEqual(mw._posture.timeout_s, 0.1)
+            self.assertAlmostEqual(mw._step(None).posture.timeout_s, 0.1)
         finally:
             if saved_secret is None:
                 os.environ.pop("ACS_HMAC_SECRET", None)
             else:
                 os.environ["ACS_HMAC_SECRET"] = saved_secret
+                os.environ["ACS_HMAC_KEY_ID"] = "test-key"
             if saved_secret_file is None:
                 os.environ.pop("ACS_HMAC_SECRET_FILE", None)
             else:
                 os.environ["ACS_HMAC_SECRET_FILE"] = saved_secret_file
+                os.environ["ACS_HMAC_KEY_ID"] = "test-key"
 
     def test_unevaluated_tool_call_proceeds_unsent(self) -> None:
         """handshake.json: methods absent from methods_evaluated are
@@ -181,6 +187,7 @@ def hello(req: dict) -> dict:
         saved_secret_file = os.environ.get("ACS_HMAC_SECRET_FILE")
         try:
             os.environ["ACS_HMAC_SECRET"] = g.hmac_secret
+            os.environ["ACS_HMAC_KEY_ID"] = "test-key"
             os.environ.pop("ACS_HMAC_SECRET_FILE", None)
             with tempfile.TemporaryDirectory() as d, \
                     mock.patch.object(client_handshake, "_HANDSHAKE_CACHE_DIR",
@@ -203,10 +210,12 @@ def hello(req: dict) -> dict:
                 os.environ.pop("ACS_HMAC_SECRET", None)
             else:
                 os.environ["ACS_HMAC_SECRET"] = saved_secret
+                os.environ["ACS_HMAC_KEY_ID"] = "test-key"
             if saved_secret_file is None:
                 os.environ.pop("ACS_HMAC_SECRET_FILE", None)
             else:
                 os.environ["ACS_HMAC_SECRET_FILE"] = saved_secret_file
+                os.environ["ACS_HMAC_KEY_ID"] = "test-key"
 
     def test_acs_disabled_bypass_is_written_to_the_durable_sink(self) -> None:
         """Both NAT bypass boundaries must leave structured durable records."""
diff --git a/adapters/tests/integrations/nat/test_dispositions_live.py b/adapters/tests/integrations/nat/test_dispositions_live.py
index 6a62c6ab..2542f2f5 100644
--- a/adapters/tests/integrations/nat/test_dispositions_live.py
+++ b/adapters/tests/integrations/nat/test_dispositions_live.py
@@ -22,6 +22,9 @@
 from __future__ import annotations
 
 import asyncio
+import contextlib
+import io
+import json
 import sys
 import tempfile
 import unittest
@@ -47,7 +50,7 @@
 from acs.testing.harness import ProgrammableGuardian  # noqa: E402
 
 
-HMAC = "dispositions-live-shared-secret"
+HMAC = "dispositions-live-shared-secret-padded-to-32-bytes"
 
 
 def _make_ctx_with_pydantic_input(tool_name: str, model_cls, model_instance):
@@ -87,18 +90,16 @@ def tearDownClass(cls) -> None:
 
     def _mw(self, *, default_deny: bool = True) -> ACSMiddleware:
         import os
-        # Restore env after the test — adapter reads ACS_HMAC_SECRET at
-        # call time, and leaking this into adjacent tests (test_live's
-        # ACS_DEV_MODE=1 no-signing setup) makes the next test pass
-        # signed envelopes to an unsigned Guardian → response signature
-        # invalid. addCleanup runs even on test failure.
+        # The adapter reads ACS_HMAC_SECRET at call time, so it is restored for the next test; addCleanup runs even on failure.
         prior = os.environ.get("ACS_HMAC_SECRET")
         os.environ["ACS_HMAC_SECRET"] = HMAC
+        os.environ["ACS_HMAC_KEY_ID"] = "test-key"
         def _restore():
             if prior is None:
                 os.environ.pop("ACS_HMAC_SECRET", None)
             else:
                 os.environ["ACS_HMAC_SECRET"] = prior
+                os.environ["ACS_HMAC_KEY_ID"] = "test-key"
         self.addCleanup(_restore)
         return ACSMiddleware(ACSMiddlewareConfig(
             guardian_url=self.url, default_deny=default_deny,
@@ -203,10 +204,39 @@ class ShellInput(BaseModel):
         except ACSGuardianDenied:
             pass
 
-    # ────────────────────────────────────────────────────────────────
-    # ASK / DEFER substitution — per docs both substitute to DENY at
-    # the middleware boundary. Verify the function does NOT execute.
-    # ────────────────────────────────────────────────────────────────
+    def test_a_modify_nat_cannot_apply_is_denied_and_recorded(self) -> None:
+        """§6.5: a MODIFY the client cannot apply is a DENY, recorded with reason_codes ["modify_unsupported"]."""
+        class ShellInput(BaseModel):
+            command: str
+            secret: str
+
+        cases = {
+            "tool call with redactions": ("steps/toolCallRequest",
+                                          {"redactions": [{"path": "/secret", "replacement": "[REDACTED]"}]}),
+            "tool call with replacement content": ("steps/toolCallRequest", {"modified_content": "echo SAFE"}),
+            "tool result with structured edits": ("steps/toolCallResult", {"parameter_overrides": {"command": "x"}}),
+        }
+        for name, (method, mods) in cases.items():
+            with self.subTest(name):
+                ctx = _make_ctx_with_pydantic_input("Bash", ShellInput, ShellInput(command="unsafe", secret="s"))
+                ctx.output = "SECRET-OUTPUT"
+                self._set_response(method, {"decision": "modify", "reasoning": "rewrite", "modifications": mods})
+                mw = self._mw(default_deny=False)
+                err, raised = io.StringIO(), False
+                with contextlib.redirect_stderr(err):
+                    try:
+                        asyncio.run(mw.pre_invoke(ctx) if method == "steps/toolCallRequest" else mw.post_invoke(ctx))
+                    except ACSGuardianDenied:
+                        raised = True
+                if method == "steps/toolCallRequest":
+                    self.assertTrue(raised or getattr(ctx, "action", None) is not None,
+                                    "the call was neither raised nor skipped")
+                else:
+                    self.assertIsNone(ctx.output)
+                audits = [json.loads(line.removeprefix("ACS_AUDIT ")) for line in err.getvalue().splitlines()
+                          if line.startswith("ACS_AUDIT ")]
+                self.assertEqual([a["reason_codes"] for a in audits if a["acs_audit_event"] == "modify_unsupported"],
+                                 [["modify_unsupported"]])
 
     def test_ask_substituted_to_deny(self) -> None:
         class ShellInput(BaseModel):
diff --git a/adapters/tests/integrations/nat/test_emission.py b/adapters/tests/integrations/nat/test_emission.py
index 55c51b01..e48cbbe1 100644
--- a/adapters/tests/integrations/nat/test_emission.py
+++ b/adapters/tests/integrations/nat/test_emission.py
@@ -15,7 +15,6 @@
 import os
 import sys
 import tempfile
-import time
 import unittest
 from pathlib import Path
 from unittest import mock
@@ -43,7 +42,7 @@
     from acs.integrations.nat.adapter import ACSMiddlewareConfig  # noqa: E402
 from acs.testing.capture_guardian import CaptureGuardian  # noqa: E402
 
-HMAC = "nat-emission-shared-secret"
+HMAC = "nat-emission-shared-secret-padded-to-32-bytes"
 
 
 if _NAT_OK:
@@ -77,6 +76,7 @@ def setUp(self) -> None:
             patcher.start()
             self.addCleanup(patcher.stop)
         os.environ["ACS_HMAC_SECRET"] = HMAC
+        os.environ["ACS_HMAC_KEY_ID"] = "test-key"
         os.environ.pop("ACS_HANDSHAKE", None)
 
     def _mw(self) -> ACSMiddleware:
@@ -114,7 +114,8 @@ def test_lifecycle_observer_emits_session_hooks(self) -> None:
             mgr.push_intermediate_step(IntermediateStepPayload(
                 event_type=IntermediateStepType.WORKFLOW_END, name="wf",
                 data=StreamEventData(output="sunny"), UUID=wf_uuid))
-            time.sleep(0.3)
+            # close() returns once every queued lifecycle hook has gone out.
+            mw.close()
         finally:
             sub.unsubscribe()
         methods = self.guardian.methods()
@@ -150,7 +151,7 @@ def test_sequential_session_invariants(self) -> None:
             mgr.push_intermediate_step(IntermediateStepPayload(
                 event_type=IntermediateStepType.WORKFLOW_END, name="wf",
                 data=StreamEventData(output="a"), UUID=wf))
-            time.sleep(0.3)
+            mw.close()
         finally:
             sub.unsubscribe()
 
diff --git a/adapters/tests/integrations/nat/test_event_loop.py b/adapters/tests/integrations/nat/test_event_loop.py
index be5c5326..915a4d4c 100644
--- a/adapters/tests/integrations/nat/test_event_loop.py
+++ b/adapters/tests/integrations/nat/test_event_loop.py
@@ -29,7 +29,7 @@
 if _NAT_OK:
     from acs.integrations.nat.adapter import ACSMiddlewareConfig, build_acs_middleware
 
-SECRET = "nat-event-loop-secret"
+SECRET = "nat-event-loop-secret-padded-to-32-bytes"
 SLOW_S = 0.5
 
 
@@ -64,7 +64,7 @@ def setUp(self) -> None:
         env = {k: v for k, v in os.environ.items() if not k.startswith("ACS_")}
         for patcher in (mock.patch.object(_handshake, "_HANDSHAKE_CACHE_DIR", Path(records.name)),
                         mock.patch.object(_handshake, "_HANDSHAKE_TIMEOUT_S", 5.0),
-                        mock.patch.dict(os.environ, {**env, "ACS_HMAC_SECRET": SECRET}, clear=True)):
+                        mock.patch.dict(os.environ, {**env, "ACS_HMAC_SECRET": SECRET, "ACS_HMAC_KEY_ID": "test-key"}, clear=True)):
             patcher.start()
             self.addCleanup(patcher.stop)
         self.guardian = ProgrammableGuardian(hmac_secret=SECRET)
@@ -208,9 +208,10 @@ async def target(command: str) -> str:
                 await mw.function_middleware_invoke(command="echo hi", call_next=target, context=context)
                 return True
         self.assertTrue(asyncio.run(run()))
+        # The call opens the middleware's own session, so its sessionStart goes first; NAT's shutdown ends it.
         self.assertEqual(self.guardian.methods_seen(),
-                         ["handshake/hello", "steps/toolCallRequest", "steps/sessionStart", "steps/userMessage",
-                          "steps/toolCallResult"])
+                         ["handshake/hello", "steps/sessionStart", "steps/toolCallRequest", "steps/userMessage",
+                          "steps/toolCallResult", "steps/sessionEnd"])
 
     def test_a_hook_that_arrives_while_closing_waits_its_turn(self) -> None:
         """close() drains in order: a late hook neither blocks NAT nor overtakes the hooks queued before it."""
@@ -218,7 +219,7 @@ def test_a_hook_that_arrives_while_closing_waits_its_turn(self) -> None:
         started, release = threading.Event(), threading.Event()
         sent: list[tuple[str, str]] = []
 
-        def emit(method: str, payload: dict) -> None:
+        def emit(method: str, payload: dict, run: str | None = None) -> None:
             if method == "steps/sessionStart":
                 started.set()
                 release.wait(5)
@@ -262,7 +263,7 @@ def test_a_cancelled_wait_does_not_stop_the_hooks_behind_it(self) -> None:
         self.addCleanup(nat_adapter._OPEN_SENDERS.discard, mw._lifecycle)
         release, sent = threading.Event(), []
 
-        def emit(method: str, payload: dict) -> None:
+        def emit(method: str, payload: dict, run: str | None = None) -> None:
             if method == "first":
                 release.wait(5)
             sent.append(method)
diff --git a/adapters/tests/integrations/nat/test_failure_modes.py b/adapters/tests/integrations/nat/test_failure_modes.py
index 64be7585..a1b123fd 100644
--- a/adapters/tests/integrations/nat/test_failure_modes.py
+++ b/adapters/tests/integrations/nat/test_failure_modes.py
@@ -39,7 +39,8 @@
 GUARDIAN_SCRIPT = HERE.parents[2] / "src" / "acs" / "guardian" / "example_guardian.py"
 
 
-from acs.testing.harness import launch_guardian, seed_negotiated_session  # noqa: E402
+from acs.core import derive_session_key, sign_with_key  # noqa: E402
+from acs.testing.harness import launch_guardian, seed_negotiated_session, sign_for_test, signing_env  # noqa: E402
 
 
 class RecordingGuardian(BaseHTTPRequestHandler):
@@ -61,20 +62,22 @@ def do_POST(self) -> None:  # noqa: N802
             RecordingGuardian.recorded.append({"method": method, "session_id": sid, "request_id": rid})
             seen = RecordingGuardian.seen_per_session.setdefault(sid, set())
             if rid in seen and rid:
-                # Simulate the real Guardian's REPLAY_DETECTED behavior
-                reply = json.dumps({
+                reply = {
                     "jsonrpc": "2.0", "id": body.get("id"),
                     "error": {"code": -32005, "message": f"REPLAY_DETECTED: {rid}"},
-                }).encode("utf-8")
+                }
             else:
                 if rid:
                     seen.add(rid)
-                reply = json.dumps({
+                reply = {
                     "jsonrpc": "2.0", "id": body.get("id"),
                     "result": {"type": "final", "acs_version": "0.1.0",
                                "request_id": rid, "decision": "allow",
                                "chain_hash": "0" * 64},
-                }).encode("utf-8")
+                }
+        # Signed with the test secret under its label, as a Guardian signs every response (§10).
+        key = derive_session_key(signing_env()["ACS_HMAC_SECRET"].encode(), sid)
+        reply = json.dumps(sign_with_key(reply, key, key_id=signing_env()["ACS_HMAC_KEY_ID"])).encode("utf-8")
         self.send_response(200)
         self.send_header("Content-Type", "application/json")
         self.send_header("Content-Length", str(len(reply)))
@@ -113,7 +116,7 @@ def setUp(self) -> None:
         self.addCleanup(records.cleanup)
         self.records = Path(records.name)
         for patcher in (mock.patch.object(client_handshake, "_HANDSHAKE_CACHE_DIR", self.records),
-                        mock.patch.dict(os.environ)):
+                        mock.patch.dict(os.environ, signing_env())):
             patcher.start()
             self.addCleanup(patcher.stop)
 
@@ -140,7 +143,7 @@ def test_repeat_tool_call_does_not_get_replay_detected(self) -> None:
         )
         mw = ACSMiddleware(cfg)
         seed_negotiated_session(self.records, session_id=mw._session_id, guardian_url=self.url,
-                                hmac_secret=os.environ.get("ACS_HMAC_SECRET"))
+                                hmac_secret=signing_env()["ACS_HMAC_SECRET"])
 
         ctx1 = self._ctx("list_files", {})
         r1 = asyncio.run(mw.pre_invoke(ctx1))
@@ -183,8 +186,7 @@ def tearDownClass(cls) -> None:
     def _start_guardian(self):
         # Replay durability lives in the shared state dir, not the port.
         env = os.environ.copy()
-        env["ACS_DEV_MODE"] = "1"
-        env.pop("ACS_HMAC_SECRET", None)
+        env.update(signing_env())
         env.pop("ACS_HMAC_SECRET_FILE", None)
         env["ACS_GUARDIAN_STATE_DIR"] = str(self.tmpdir)
         proc, port = launch_guardian(env=env)
@@ -195,7 +197,7 @@ def _send_envelope(self, sid: str, rid: str):
         import urllib.request
         import uuid as _uuid
         from datetime import datetime, timezone
-        body = json.dumps({
+        body = json.dumps(sign_for_test({
             "jsonrpc": "2.0", "id": str(_uuid.uuid4()),
             "method": "steps/sessionStart",
             "params": {
@@ -205,7 +207,7 @@ def _send_envelope(self, sid: str, rid: str):
                 "metadata": {"agent_id": "test", "session_id": sid, "platform": "test"},
                 "payload": {},
             },
-        }).encode()
+        })).encode()
         req = urllib.request.Request(self.url, data=body,
             headers={"Content-Type": "application/json"}, method="POST")
         with urllib.request.urlopen(req, timeout=5.0) as resp:
diff --git a/adapters/tests/integrations/nat/test_live.py b/adapters/tests/integrations/nat/test_live.py
index 4cdd01f7..bfefa6cd 100644
--- a/adapters/tests/integrations/nat/test_live.py
+++ b/adapters/tests/integrations/nat/test_live.py
@@ -45,14 +45,15 @@
 HERE = Path(__file__).resolve().parent
 
 
-from acs.testing.harness import launch_guardian  # noqa: E402
+from acs.testing.harness import launch_guardian, signing_env  # noqa: E402
 
 
 @unittest.skipUnless(_NAT_OK, "nvidia-nat-core not installed")
 class LiveNATWorkflow(unittest.TestCase):
     @classmethod
     def setUpClass(cls) -> None:
-        env = os.environ.copy(); env["ACS_DEV_MODE"] = "1"; env.pop("ACS_HMAC_SECRET", None); env.pop("ACS_HMAC_SECRET_FILE", None)
+        env = {k: v for k, v in os.environ.items() if k != "ACS_HMAC_SECRET_FILE"}
+        env.update(signing_env())
         cls.guardian_proc, cls.port = launch_guardian(env=env)
         cls.guardian_url = f"http://127.0.0.1:{cls.port}/acs"
 
@@ -70,7 +71,7 @@ def setUp(self) -> None:
         self.addCleanup(records.cleanup)
         self.records = Path(records.name)
         for patcher in (mock.patch.object(client_handshake, "_HANDSHAKE_CACHE_DIR", self.records),
-                        mock.patch.dict(os.environ)):
+                        mock.patch.dict(os.environ, signing_env())):
             patcher.start()
             self.addCleanup(patcher.stop)
 
diff --git a/adapters/tests/integrations/nat/test_runner_lifecycle.py b/adapters/tests/integrations/nat/test_runner_lifecycle.py
index e04a6409..bf86fd47 100644
--- a/adapters/tests/integrations/nat/test_runner_lifecycle.py
+++ b/adapters/tests/integrations/nat/test_runner_lifecycle.py
@@ -1,12 +1,14 @@
-"""Every NAT run reports its whole lifecycle: the builder registers an exporter that NAT starts for each run before
-WORKFLOW_START, so a run's first events and a later run's events all reach the Guardian."""
+"""Each NAT run is its own ACS session, reported from before its WORKFLOW_START by the exporter its builder registers."""
 from __future__ import annotations
 
 import asyncio
 import contextlib
 import contextvars
+import json
 import os
 import tempfile
+import threading
+import time
 import unittest
 import uuid
 from pathlib import Path
@@ -25,15 +27,17 @@
 except ImportError:
     _NAT_OK = False
 
-from acs.client import _handshake
-from acs.testing.harness import ProgrammableGuardian
+from acs.client import _exchange, _handshake
+from acs.testing.harness import ProgrammableGuardian, validate_hook_payload
 
 if _NAT_OK:
-    from acs.integrations.nat.adapter import (ACSLifecycleExporterConfig, ACSMiddleware, ACSMiddlewareConfig,
-                                              build_acs_middleware)
+    from acs.integrations.nat.adapter import (ACSGuardianDenied, ACSLifecycleExporterConfig, ACSMiddleware,
+                                              ACSMiddlewareConfig, build_acs_middleware)
 
-SECRET = "nat-runner-lifecycle-secret"
-RUN = ["steps/sessionStart", "steps/userMessage", "steps/toolCallRequest", "steps/toolCallResult",
+SECRET = "nat-runner-lifecycle-secret-padded-to-32-bytes"
+# The middleware opens its own session when NAT builds it; each run is a session of its own after that.
+BUILD = ["handshake/hello"]
+RUN = ["handshake/hello", "steps/sessionStart", "steps/userMessage", "steps/toolCallRequest", "steps/toolCallResult",
        "steps/agentResponse", "steps/sessionEnd"]
 
 
@@ -67,6 +71,53 @@ async def ainvoke(self, message: str, to_type=None) -> str:
         raise _RunFailed(message)
 
 
+class _Hangs(_Entry):
+    """A workflow entry function that waits after its wrapped call until the run is cancelled."""
+
+    async def ainvoke(self, message: str, to_type=None) -> str:
+        await super().ainvoke(message, to_type)
+        # The call has returned, its result reported, before the run waits to be cancelled.
+        self.executed.append("returned")
+        await asyncio.Event().wait()
+        return message
+
+
+class _DeniedThenRetries(_Entry):
+    """The "long" run makes a call, waits until released, and calls again; other runs make one call."""
+
+    def __init__(self, middleware: ACSMiddleware, executed: list[str], started: asyncio.Event,
+                 release: asyncio.Event) -> None:
+        super().__init__(middleware, executed)
+        self.started, self.release = started, release
+
+    async def ainvoke(self, message: str, to_type=None) -> str:
+        if message != "long":
+            return await super().ainvoke(message, to_type)
+        with contextlib.suppress(ACSGuardianDenied):
+            await super().ainvoke("long-first", to_type)
+        self.started.set()
+        await self.release.wait()
+        with contextlib.suppress(ACSGuardianDenied):
+            await super().ainvoke("long-retry", to_type)
+        return message
+
+
+class _Waits(_Entry):
+    """A workflow entry function that waits, before any call, until the run is cancelled."""
+
+    async def ainvoke(self, message: str, to_type=None) -> str:
+        await asyncio.Event().wait()
+        return message
+
+
+class _TwoCalls(_Entry):
+    """A workflow entry function that makes two wrapped calls, message-1 then message-2."""
+
+    async def ainvoke(self, message: str, to_type=None) -> str:
+        await super().ainvoke(f"{message}-1", to_type)
+        return await super().ainvoke(f"{message}-2", to_type)
+
+
 @unittest.skipUnless(_NAT_OK, "nvidia-nat-core not installed")
 class EveryRunReportsItsLifecycle(unittest.TestCase):
     def setUp(self) -> None:
@@ -74,30 +125,41 @@ def setUp(self) -> None:
         self.addCleanup(records.cleanup)
         env = {k: v for k, v in os.environ.items() if not k.startswith("ACS_")}
         for patcher in (mock.patch.object(_handshake, "_HANDSHAKE_CACHE_DIR", Path(records.name)),
-                        mock.patch.dict(os.environ, {**env, "ACS_HMAC_SECRET": SECRET}, clear=True)):
+                        mock.patch.dict(os.environ, {**env, "ACS_HMAC_SECRET": SECRET, "ACS_HMAC_KEY_ID": "test-key"}, clear=True)):
             patcher.start()
             self.addCleanup(patcher.stop)
         self.guardian = ProgrammableGuardian(hmac_secret=SECRET)
         self.guardian.start()
         self.addCleanup(self.guardian.stop)
 
-    def _runs(self, *messages: str, with_builder: bool = True, entry: type[_Entry] = _Entry) -> list[str]:
+    def _sessions(self) -> list[list[str]]:
+        """The methods the Guardian received for each session_id, sessions in the order they began."""
+        sessions: dict[str, list[str]] = {}
+        for request in self.guardian.received:
+            session = ((request.get("params") or {}).get("metadata") or {}).get("session_id", "")
+            sessions.setdefault(session, []).append(request.get("method", ""))
+        return list(sessions.values())
+
+    def _runs(self, *messages: str, with_builder: bool = True, entry: type[_Entry] = _Entry,
+              default_deny: bool = False, prepare=None) -> list[str]:
         """Run each message through NAT's Runner with the exporters the middleware's builder registered."""
         executed: list[str] = []
         self.exporters: list[str] = []
 
         async def run() -> None:
-            config = ACSMiddlewareConfig(guardian_url=self.guardian.url(), default_deny=False,
+            config = ACSMiddlewareConfig(guardian_url=self.guardian.url(), default_deny=default_deny,
                                          session_id=str(uuid.uuid4()))
             async with WorkflowBuilder() as builder, \
                     build_acs_middleware(config, builder if with_builder else None) as middleware:
+                if prepare is not None:
+                    prepare(middleware)
                 # Workflow.run hands each Runner the exporters its builder collected.
                 exporters = {name: configured.instance for name, configured in builder._telemetry_exporters.items()}
                 self.exporters = [name.split("_")[0] + "_" + name.split("_")[1] for name in exporters]
                 manager = ExporterManager.from_exporters(exporters)
                 for message in messages:
                     async with Runner(message, entry(middleware, executed), ContextState.get(), manager) as runner:
-                        with contextlib.suppress(_RunFailed):
+                        with contextlib.suppress(_RunFailed, ACSGuardianDenied):
                             await runner.result()
                     await middleware._lifecycle_sent()
         asyncio.run(run())
@@ -106,18 +168,431 @@ async def run() -> None:
     def test_two_consecutive_runs_each_report_every_hook_in_order(self) -> None:
         self.assertEqual(self._runs("first", "second"), ["first", "second"])
         self.assertEqual(self.exporters, ["acs_lifecycle"])
-        self.assertEqual(self.guardian.methods_seen(), ["handshake/hello"] + RUN + RUN)
+        # hooks.md sessionStart: once per session, before any other steps/* hook; sessionEnd seals it.
+        self.assertEqual(self._sessions(), [BUILD, RUN, RUN])
+
+    def test_a_runs_session_start_carries_its_workflow_name_however_late_it_goes_out(self) -> None:
+        def slow_lifecycle(middleware) -> None:
+            send = middleware._lifecycle._send
+
+            def late(method, payload, run=None):
+                time.sleep(0.3)
+                send(method, payload, run)
+            middleware._lifecycle._send = late
+        self.assertEqual(self._runs("first", prepare=slow_lifecycle), ["first"])
+        [start] = self.guardian.envelopes_for("steps/sessionStart")
+        self.assertEqual(start["params"]["payload"]["platform_context"]["workflow_name"], "lifecycle-workflow")
+        self.assertEqual(self._sessions(), [BUILD, RUN])
 
-    def test_a_failed_run_reports_no_end(self) -> None:
-        """NAT pushes WORKFLOW_END only once the workflow returns, so a failed run sends no agentResponse or sessionEnd."""
+    def test_a_finished_runs_session_records_are_removed(self) -> None:
+        self.assertEqual(self._runs("first", "second"), ["first", "second"])
+        runs = [((r.get("params") or {}).get("metadata") or {}).get("session_id")
+                for r in self.guardian.envelopes_for("steps/sessionStart")]
+        self.assertEqual(len(set(runs)), 2)
+        for session in runs:
+            record = _handshake._handshake_cache_path(session, self.guardian.url())
+            self.assertEqual([path.name for path in (record, Path(f"{record}.started"), Path(f"{record}.lock"))
+                              if path.exists()], [])
+
+    def test_session_end_counts_the_runs_decision_failures(self) -> None:
+        # Threaded, so only the slow call times out and nothing queues behind it.
+        self.guardian = ProgrammableGuardian(hmac_secret=SECRET, threaded=True)
+        self.guardian.start()
+        self.addCleanup(self.guardian.stop)
+        hello = self.guardian._default_handshake
+        allow = self.guardian._default_allow
+        self.guardian.handlers["handshake/hello"] = lambda req: {**hello(req), "timeout_config": {"default_ms": 300}}
+        calls = iter([0.6, 0.0])
+        self.guardian.handlers["steps/toolCallRequest"] = lambda req: (time.sleep(next(calls)), allow(req))[1]
+        self.assertEqual(self._runs("first", "second"), ["first", "second"],
+                         "under proceed the call runs after its decision times out")
+        first, second = (end["params"]["payload"] for end in self.guardian.envelopes_for("steps/sessionEnd"))
+        self.assertEqual(first["summary"]["decision_failures"], {"timeout": 1})
+        self.assertEqual(second["summary"]["decision_failures"], {}, "each run's sessionEnd reports its own run's failures")
+        self.assertEqual(validate_hook_payload(first, "session-end.json"), [])
+
+    def test_overlapping_runs_each_report_their_own_failures(self) -> None:
+        self.guardian = ProgrammableGuardian(hmac_secret=SECRET, threaded=True)
+        self.guardian.start()
+        self.addCleanup(self.guardian.stop)
+        hello, allow = self.guardian._default_handshake, self.guardian._default_allow
+        # slow-1 outlives the negotiated 400 ms; slow-2 answers inside it and keeps the slow run going past the fast one.
+        delays = {"slow-1": 0.8, "slow-2": 0.3}
+
+        def call(req):
+            command = req["params"]["payload"]["arguments"]["command"]["value"]
+            time.sleep(delays.get(command, 0.0))
+            return allow(req)
+        self.guardian.handlers.update({"handshake/hello": lambda req: {**hello(req), "timeout_config": {"default_ms": 400}},
+                                       "steps/toolCallRequest": call})
+        executed: list[str] = []
+
+        async def run() -> None:
+            config = ACSMiddlewareConfig(guardian_url=self.guardian.url(), default_deny=False, session_id=str(uuid.uuid4()))
+            async with WorkflowBuilder() as builder, build_acs_middleware(config, builder) as middleware:
+                exporters = {name: configured.instance for name, configured in builder._telemetry_exporters.items()}
+
+                async def one(message: str, delay: float) -> None:
+                    await asyncio.sleep(delay)
+                    manager = ExporterManager.from_exporters(exporters)
+                    async with Runner(message, _TwoCalls(middleware, executed), ContextState.get(), manager) as runner:
+                        await runner.result()
+                await asyncio.gather(one("slow", 0.0), one("fast", 0.5))
+                await middleware._lifecycle_sent()
+        asyncio.run(run())
+        fast, slow = (end["params"]["payload"]["summary"]["decision_failures"]
+                      for end in self.guardian.envelopes_for("steps/sessionEnd"))
+        self.assertEqual((fast, slow), ({}, {"timeout": 1}), "the fast run ends first, after the slow run's failure")
+
+    def test_a_failed_run_still_reports_its_end(self) -> None:
+        """NAT pushes WORKFLOW_END only once the workflow returns; a failed run's sessionEnd goes out when NAT stops its exporter."""
         self.assertEqual(self._runs("first", "second", entry=_Failing), ["first", "second"])
-        self.assertEqual(self.guardian.methods_seen(), ["handshake/hello"] + RUN[:4] + RUN[:4])
+        ended = RUN[:5] + ["steps/sessionEnd"]
+        self.assertEqual(self._sessions(), [BUILD, ended, ended])
+        for end in self.guardian.envelopes_for("steps/sessionEnd"):
+            payload = end["params"]["payload"]
+            self.assertEqual((payload["reason"], payload["summary"]), ("error", {"decision_failures": {}}))
+            self.assertEqual(validate_hook_payload(payload, "session-end.json"), [])
+
+    def test_a_cancelled_run_reports_its_end_as_cancelled(self) -> None:
+        executed: list[str] = []
+
+        async def run() -> None:
+            config = ACSMiddlewareConfig(guardian_url=self.guardian.url(), session_id=str(uuid.uuid4()))
+            async with WorkflowBuilder() as builder, build_acs_middleware(config, builder) as middleware:
+                exporters = {name: configured.instance for name, configured in builder._telemetry_exporters.items()}
+
+                async def one() -> None:
+                    manager = ExporterManager.from_exporters(exporters)
+                    async with Runner("first", _Hangs(middleware, executed), ContextState.get(), manager) as runner:
+                        await runner.result()
+                task = asyncio.create_task(one())
+                while "returned" not in executed:
+                    await asyncio.sleep(0.01)
+                task.cancel()
+                with contextlib.suppress(asyncio.CancelledError):
+                    await task
+                await middleware._lifecycle_sent()
+        asyncio.run(run())
+        self.assertEqual(self._sessions(), [BUILD, RUN[:5] + ["steps/sessionEnd"]])
+        [end] = self.guardian.envelopes_for("steps/sessionEnd")
+        self.assertEqual(end["params"]["payload"]["reason"], "cancelled")
+
+    def test_a_run_cancelled_before_its_first_call_ends_as_cancelled(self) -> None:
+        """The run's task is known from its WORKFLOW_START, so a run cancelled before any call is not reported as an error."""
+        async def run() -> None:
+            config = ACSMiddlewareConfig(guardian_url=self.guardian.url(), session_id=str(uuid.uuid4()))
+            async with WorkflowBuilder() as builder, build_acs_middleware(config, builder) as middleware:
+                exporters = {name: configured.instance for name, configured in builder._telemetry_exporters.items()}
+
+                async def one() -> None:
+                    manager = ExporterManager.from_exporters(exporters)
+                    async with Runner("first", _Waits(middleware, []), ContextState.get(), manager) as runner:
+                        await runner.result()
+                task = asyncio.create_task(one())
+                while "steps/userMessage" not in self.guardian.methods_seen():
+                    await asyncio.sleep(0.01)
+                task.cancel()
+                with contextlib.suppress(asyncio.CancelledError):
+                    await task
+                await middleware._lifecycle_sent()
+        asyncio.run(run())
+        self.assertEqual(self._sessions(), [BUILD, RUN[:3] + ["steps/sessionEnd"]])
+        [end] = self.guardian.envelopes_for("steps/sessionEnd")
+        self.assertEqual(end["params"]["payload"]["reason"], "cancelled")
+
+    def test_a_run_cancelled_during_an_exchange_ends_after_it(self) -> None:
+        """A cancelled call leaves its round trip running in a worker thread; the run's sessionEnd goes out after it."""
+        for held in ("steps/toolCallRequest", "steps/toolCallResult"):
+            with self.subTest(held):
+                self.guardian.reset()
+                entered, release = threading.Event(), threading.Event()
+                send = _exchange._open
+
+                def hold(request, timeout, held=held):
+                    if json.loads(request.data).get("method") == held:
+                        entered.set()
+                        release.wait(5)
+                    return send(request, timeout=timeout)
+
+                async def run() -> int:
+                    config = ACSMiddlewareConfig(guardian_url=self.guardian.url(), session_id=str(uuid.uuid4()))
+                    async with WorkflowBuilder() as builder, build_acs_middleware(config, builder) as middleware:
+                        exporters = {name: c.instance for name, c in builder._telemetry_exporters.items()}
+
+                        async def one() -> None:
+                            manager = ExporterManager.from_exporters(exporters)
+                            async with Runner("first", _Entry(middleware, []), ContextState.get(), manager) as runner:
+                                await runner.result()
+                        with mock.patch.object(_exchange, "_open", hold):
+                            task = asyncio.create_task(one())
+                            for _ in range(500):
+                                if entered.is_set() or task.done():
+                                    break
+                                await asyncio.sleep(0.01)
+                            self.assertTrue(entered.is_set(), self.guardian.methods_seen())
+                            task.cancel()
+                            with contextlib.suppress(asyncio.CancelledError):
+                                await task
+                            # Held past the cancel, so a sessionEnd that did not wait would reach the Guardian first.
+                            threading.Timer(0.3, release.set).start()
+                            await asyncio.wait_for(middleware._lifecycle_sent(), 10)
+                        return len(middleware._runs)
+                self.assertEqual(asyncio.run(run()), 0)
+                [session] = self._sessions()[1:]
+                self.assertEqual(session[-1], "steps/sessionEnd", session)
+                self.assertIn(held, session)
+
+    def _outside_a_run(self, *commands: str, end_first: bool = False) -> tuple[list[str], list[bool]]:
+        """Calls made straight through the middleware, outside any NAT run; whether each was blocked."""
+        executed: list[str] = []
+        blocked: list[bool] = []
+
+        async def run() -> None:
+            config = ACSMiddlewareConfig(guardian_url=self.guardian.url(), session_id=str(uuid.uuid4()))
+            async with build_acs_middleware(config, None) as middleware:
+                context = FunctionMiddlewareContext(name="Read", config=None, description=None, input_schema=None,
+                                                    single_output_schema=str, stream_output_schema=str)
+
+                async def target(command: str) -> str:
+                    executed.append(command)
+                    return f"ran {command}"
+                for n, command in enumerate(commands):
+                    if end_first and n == len(commands) - 1:
+                        middleware._on_intermediate_step(SimpleNamespace(payload=IntermediateStepPayload(
+                            event_type=IntermediateStepType.WORKFLOW_END, name="wf", data=StreamEventData(output="a"))))
+                        await middleware._lifecycle_sent()
+                    try:
+                        await middleware.function_middleware_invoke(command=command, call_next=target, context=context)
+                        blocked.append(False)
+                    except ACSGuardianDenied:
+                        blocked.append(True)
+        asyncio.run(run())
+        return executed, blocked
+
+    def test_a_call_outside_any_run_opens_and_ends_the_middlewares_own_session(self) -> None:
+        self.assertEqual(self._outside_a_run("first", "second"), (["first", "second"], [False, False]))
+        own = ["handshake/hello", "steps/sessionStart"] + ["steps/toolCallRequest", "steps/toolCallResult"] * 2
+        self.assertEqual(self._sessions(), [own + ["steps/sessionEnd"]], "sessionStart first, sessionEnd at shutdown")
+        session = self.guardian.envelopes_for("steps/sessionEnd")[0]["params"]["metadata"]["session_id"]
+        record = _handshake._handshake_cache_path(session, self.guardian.url())
+        self.assertFalse(record.exists(), "the ended session's record is removed")
+
+    def test_a_middleware_with_no_call_outside_a_run_sends_only_its_handshake(self) -> None:
+        self.assertEqual(self._outside_a_run(), ([], []))
+        self.assertEqual(self._sessions(), [BUILD])
+
+    def test_a_call_after_the_middlewares_own_session_ended_is_refused(self) -> None:
+        self.assertEqual(self._outside_a_run("first", "late", end_first=True), (["first"], [False, True]))
+        [session] = self._sessions()
+        self.assertEqual(session[-1], "steps/sessionEnd", "nothing goes out after the session's end")
+        self.assertEqual(session.count("handshake/hello"), 1, "the ended session's id is not opened again")
+
+    def test_a_worker_that_starts_after_the_runs_end_sends_nothing(self) -> None:
+        """A cancelled call's worker may start only after the run's sessionEnd; it finds the run ended and sends nothing."""
+        for held in ("steps/toolCallRequest", "steps/toolCallResult"):
+            with self.subTest(held):
+                self.guardian.reset()
+                entered, release, done = threading.Event(), threading.Event(), threading.Event()
+
+                async def run() -> None:
+                    config = ACSMiddlewareConfig(guardian_url=self.guardian.url(), session_id=str(uuid.uuid4()))
+                    async with WorkflowBuilder() as builder, build_acs_middleware(config, builder) as middleware:
+                        exporters = {name: c.instance for name, c in builder._telemetry_exporters.items()}
+                        exchange = middleware._exchange
+
+                        def late(request, step, run, *rest, held=held):
+                            try:
+                                if request.get("method") == held:
+                                    entered.set()
+                                    release.wait(5)
+                                return exchange(request, step, run, *rest)
+                            finally:
+                                done.set()
+                        middleware._exchange = late
+
+                        async def one() -> None:
+                            manager = ExporterManager.from_exporters(exporters)
+                            async with Runner("first", _Entry(middleware, []), ContextState.get(), manager) as runner:
+                                await runner.result()
+                        task = asyncio.create_task(one())
+                        for _ in range(500):
+                            if entered.is_set() or task.done():
+                                break
+                            await asyncio.sleep(0.01)
+                        self.assertTrue(entered.is_set(), self.guardian.methods_seen())
+                        task.cancel()
+                        with contextlib.suppress(asyncio.CancelledError):
+                            await task
+                        await asyncio.wait_for(middleware._lifecycle_sent(), 10)
+                        release.set()
+                        for _ in range(500):
+                            if done.is_set():
+                                break
+                            await asyncio.sleep(0.01)
+                        await asyncio.wait_for(middleware._lifecycle_sent(), 10)
+                asyncio.run(run())
+                [session] = self._sessions()[1:]
+                self.assertEqual(session[-1], "steps/sessionEnd", session)
+                self.assertNotIn(held, session, "the late worker sent its step")
+
+    def test_a_late_step_of_an_ended_run_does_not_open_it_again(self) -> None:
+        from acs.client import SessionRefused
+        middleware = ACSMiddleware(ACSMiddlewareConfig(guardian_url=self.guardian.url(), session_id=str(uuid.uuid4())))
+        self.addCleanup(middleware.close)
+        middleware._run_state("ended")
+        middleware._forget_run("ended")
+        self.assertIsInstance(middleware._step("ended").decision, SessionRefused)
+        self.assertNotIn("ended", middleware._runs)
+        self.assertEqual(self.guardian.methods_seen(), [], "nothing was opened for the ended run")
+
+    def test_shutdown_waits_for_the_middlewares_own_session_still_opening(self) -> None:
+        entered, release = threading.Event(), threading.Event()
+        send = _exchange._open
+
+        def hold(request, timeout):
+            if json.loads(request.data).get("method") == "steps/sessionStart":
+                entered.set()
+                release.wait(5)
+            return send(request, timeout=timeout)
+        session = str(uuid.uuid4())
+
+        async def run() -> None:
+            context = FunctionMiddlewareContext(name="Read", config=None, description=None, input_schema=None,
+                                                single_output_schema=str, stream_output_schema=str)
+
+            async def target(command: str) -> str:
+                return command
+            with mock.patch.object(_exchange, "_open", hold):
+                async with build_acs_middleware(ACSMiddlewareConfig(guardian_url=self.guardian.url(), session_id=session),
+                                                None) as middleware:
+                    task = asyncio.create_task(middleware.function_middleware_invoke(
+                        command="hello", call_next=target, context=context))
+                    for _ in range(500):
+                        if entered.is_set() or task.done():
+                            break
+                        await asyncio.sleep(0.01)
+                    self.assertTrue(entered.is_set(), self.guardian.methods_seen())
+                    task.cancel()
+                    with contextlib.suppress(asyncio.CancelledError):
+                        await task
+                    # Released while NAT shuts the middleware down, which waits for the session to open.
+                    threading.Timer(0.3, release.set).start()
+        asyncio.run(run())
+        self.assertEqual(self._sessions(), [["handshake/hello", "steps/sessionStart", "steps/sessionEnd"]])
+        record = _handshake._handshake_cache_path(session, self.guardian.url())
+        self.assertEqual([path.name for path in (record, Path(f"{record}.started"), Path(f"{record}.lock"))
+                          if path.exists()], [], "the ended session leaves no records")
+
+    def test_a_denied_session_start_refuses_that_run(self) -> None:
+        """hooks.md sessionStart: ALLOW / DENY. A denied run's calls are blocked and nothing more of it is sent."""
+        allow = self.guardian._default_allow
+        answers = iter(["deny", "allow"])
+        # Answered late, so a call that did not wait for its run's sessionStart would reach the Guardian first.
+        self.guardian.handlers["steps/sessionStart"] = lambda req: (time.sleep(0.3), {**allow(req), "decision": next(answers)})[1]
+        self.assertEqual(self._runs("first", "second"), ["second"], "the denied run's call did not run")
+        self.assertEqual(self._sessions(), [BUILD, RUN[:2], RUN], "a refused run's session sends nothing more")
+
+    def test_a_refused_run_withholds_a_result_and_sends_nothing(self) -> None:
+        from acs.client import SessionRefused
+        from acs.integrations.nat.adapter import _Run
+        middleware = ACSMiddleware(ACSMiddlewareConfig(guardian_url=self.guardian.url(), session_id=str(uuid.uuid4())))
+        self.addCleanup(middleware.close)
+        middleware._runs["refused-run"] = _Run(session_id=str(uuid.uuid4()),
+                                               decision=SessionRefused("session_start_denied", {"decision": "deny"}))
+        context = SimpleNamespace(function_context=SimpleNamespace(name="Read"), output="SECRET-OUTPUT",
+                                  modified_args=("x",), modified_kwargs={})
+
+        async def post() -> None:
+            ContextState.get().workflow_run_id.set("refused-run")
+            await middleware.post_invoke(context)
+        asyncio.run(post())
+        self.assertIsNone(context.output)
+        self.assertNotIn("steps/toolCallResult", self.guardian.methods_seen())
+
+    def test_a_refused_run_stays_refused_while_other_runs_come_and_go(self) -> None:
+        """A run's decision lasts until its sessionEnd, however many runs start and end meanwhile."""
+        allow = self.guardian._default_allow
+        answers = iter(["deny"] + ["allow"] * 10)
+        self.guardian.handlers["steps/sessionStart"] = lambda req: {**allow(req), "decision": next(answers)}
+        executed: list[str] = []
+        tracked: list[int] = []
+
+        async def run() -> None:
+            config = ACSMiddlewareConfig(guardian_url=self.guardian.url(), session_id=str(uuid.uuid4()))
+            async with WorkflowBuilder() as builder, build_acs_middleware(config, builder) as middleware:
+                exporters = {name: configured.instance for name, configured in builder._telemetry_exporters.items()}
+                started, release = asyncio.Event(), asyncio.Event()
+
+                async def one(message: str) -> None:
+                    entry = _DeniedThenRetries(middleware, executed, started, release)
+                    async with Runner(message, entry, ContextState.get(), ExporterManager.from_exporters(exporters)) as runner:
+                        await runner.result()
+                long = asyncio.create_task(one("long"))
+                await asyncio.wait_for(started.wait(), timeout=10)
+                for i in range(3):
+                    await one(f"short-{i}")
+                await middleware._lifecycle_sent()
+                tracked.append(len(middleware._runs))
+                release.set()
+                await asyncio.wait_for(long, timeout=10)
+                await middleware._lifecycle_sent()
+                tracked.append(len(middleware._runs))
+        with mock.patch("acs.integrations.nat.adapter._MAX_COUNTED_RUNS", 2):
+            asyncio.run(run())
+        self.assertEqual(executed, ["short-0", "short-1", "short-2"], "neither call of the refused run ran")
+        self.assertEqual(tracked, [1, 0], "a run is forgotten once its sessionEnd is handled")
+
+    def test_a_running_runs_failure_counts_never_age_out(self) -> None:
+        from acs.client import Resolution
+        from acs.integrations.nat.adapter import _Run
+        middleware = ACSMiddleware(ACSMiddlewareConfig(guardian_url=self.guardian.url(), session_id=str(uuid.uuid4())))
+        self.addCleanup(middleware.close)
+        middleware._runs["running"] = _Run(session_id=str(uuid.uuid4()))
+        timeout = Resolution(True, "fail_open_bypass", "decision_timeout", {"failure_class": "timeout"},
+                             decision_failure=True)
+        with mock.patch("acs.integrations.nat.adapter._MAX_COUNTED_RUNS", 2):
+            for run in ("running", "a", "b", "c"):
+                middleware._count_failure(timeout, run)
+        self.assertEqual(list(middleware._decision_failures), ["running", "b", "c"],
+                         "only runs no sessionEnd will report age out")
+        middleware._forget_run("running")
+        self.assertEqual(list(middleware._decision_failures), ["b", "c"], "a forgotten run's counts go with it")
+        middleware.close()
+        middleware._runs["late"] = _Run(session_id=str(uuid.uuid4()))
+        middleware._queue_lifecycle_hook("steps/sessionEnd", {"reason": "error"}, "late")
+        self.assertEqual(middleware._runs, {}, "a sessionEnd the closed middleware cannot send is still handled")
+
+    def test_a_session_start_without_a_decision_follows_the_posture(self) -> None:
+        # The run's sessionEnd reports the start's timeout under either posture (§6.4): it is audit-only.
+        for default_deny, executed, sent in ((False, ["first"], RUN), (True, [], RUN[:2] + ["steps/sessionEnd"])):
+            with self.subTest(default_deny=default_deny):
+                self.guardian = ProgrammableGuardian(hmac_secret=SECRET, threaded=True)
+                self.guardian.start()
+                self.addCleanup(self.guardian.stop)
+                hello, allow = self.guardian._default_handshake, self.guardian._default_allow
+                self.guardian.handlers.update({
+                    "handshake/hello": lambda req: {**hello(req), "timeout_config": {"default_ms": 300}},
+                    "steps/sessionStart": lambda req: (time.sleep(0.6), allow(req))[1]})
+                self.assertEqual(self._runs("first", default_deny=default_deny), executed)
+                self.assertEqual(self._sessions(), [BUILD, sent])
+                [end] = self.guardian.envelopes_for("steps/sessionEnd")
+                self.assertEqual(end["params"]["payload"]["summary"]["decision_failures"], {"timeout": 1})
 
     def test_without_the_builder_each_run_reports_from_its_first_call(self) -> None:
         self.assertEqual(self._runs("first", "second", with_builder=False), ["first", "second"])
-        self.assertEqual(self.guardian.methods_seen(), ["handshake/hello"] + RUN[2:] + RUN[2:],
+        # The first call opens the run's session, so its sessionStart still comes first.
+        from_first_call = RUN[:2] + RUN[3:]
+        self.assertEqual(self._sessions(), [BUILD, from_first_call, from_first_call],
                          "the late subscription follows each run's new stream")
 
+    def test_without_the_builder_a_failed_run_still_ends(self) -> None:
+        """NAT completes a run's stream whether or not the run returns, so the late subscription ends a failed run."""
+        self.assertEqual(self._runs("first", with_builder=False, entry=_Failing), ["first"])
+        self.assertEqual(self._sessions(), [BUILD, RUN[:2] + RUN[3:5] + ["steps/sessionEnd"]])
+        [end] = self.guardian.envelopes_for("steps/sessionEnd")
+        self.assertEqual(end["params"]["payload"]["reason"], "error")
+
     def test_without_the_builder_overlapping_runs_are_each_subscribed_once(self) -> None:
         for order in ("AA", "ABA", "ABAB"):
             with self.subTest(order):
diff --git a/adapters/tests/integrations/nat/test_session_gate.py b/adapters/tests/integrations/nat/test_session_gate.py
index 52baed30..d0876a1a 100644
--- a/adapters/tests/integrations/nat/test_session_gate.py
+++ b/adapters/tests/integrations/nat/test_session_gate.py
@@ -22,7 +22,7 @@
 if _NAT_OK:
     from acs.integrations.nat.adapter import ACSMiddlewareConfig
 
-SECRET = "nat-session-gate-secret"
+SECRET = "nat-session-gate-secret-padded-to-32-bytes"
 
 
 @unittest.skipUnless(_NAT_OK, "nvidia-nat-core not installed")
@@ -34,7 +34,7 @@ def setUp(self) -> None:
         env = {k: v for k, v in os.environ.items() if not k.startswith("ACS_")}
         for patcher in (mock.patch.object(_handshake, "_HANDSHAKE_CACHE_DIR", self.records),
                         mock.patch.object(_handshake, "_HANDSHAKE_TIMEOUT_S", 2.0),
-                        mock.patch.dict(os.environ, {**env, "ACS_HMAC_SECRET": SECRET}, clear=True)):
+                        mock.patch.dict(os.environ, {**env, "ACS_HMAC_SECRET": SECRET, "ACS_HMAC_KEY_ID": "test-key"}, clear=True)):
             patcher.start()
             self.addCleanup(patcher.stop)
 
@@ -75,7 +75,7 @@ def test_an_unguarded_session_never_contacts_a_restored_guardian(self) -> None:
 
         self.assertEqual(self._run(guardian.url(), str(uuid.uuid4())), (1, False))
         self.assertEqual(guardian.methods_seen(),
-                         ["handshake/hello", "steps/toolCallRequest", "steps/toolCallResult",
+                         ["handshake/hello", "steps/sessionStart", "steps/toolCallRequest", "steps/toolCallResult",
                           "steps/sessionEnd"])
 
     def test_a_refused_session_never_runs_the_function(self) -> None:
diff --git a/adapters/tests/integrations/nat/test_untrusted_answers.py b/adapters/tests/integrations/nat/test_untrusted_answers.py
index 0a769939..2bb05930 100644
--- a/adapters/tests/integrations/nat/test_untrusted_answers.py
+++ b/adapters/tests/integrations/nat/test_untrusted_answers.py
@@ -27,7 +27,7 @@
 if _NAT_OK:
     from acs.integrations.nat.adapter import ACSMiddlewareConfig
 
-SECRET = "nat-untrusted-answers"
+SECRET = "nat-untrusted-answers-padded-to-32-bytes"
 FORGED = {"algorithm": "HMAC-SHA256", "value": "AAAA"}
 
 
@@ -46,7 +46,7 @@ def read(self) -> bytes:
 
 
 @unittest.skipUnless(_NAT_OK, "nvidia-nat-core not installed")
-@mock.patch.dict(os.environ, {"ACS_HMAC_SECRET": SECRET, "ACS_HMAC_SECRET_FILE": "",
+@mock.patch.dict(os.environ, {"ACS_HMAC_SECRET": SECRET, "ACS_HMAC_KEY_ID": "test-key", "ACS_HMAC_SECRET_FILE": "", "ACS_HMAC_KEY_ID": "test-key",
                               "ACS_DISABLED": "", "ACS_STARTUP_POSTURE": ""})
 class UntrustedAnswersNeverRunTheFunction(unittest.TestCase):
     def setUp(self) -> None:
@@ -75,7 +75,7 @@ async def target(command: str) -> str:
         def urlopen(req: Any, timeout: float) -> _Body:
             status, body = answer(json.loads(req.data))
             if body.get("sign"):
-                body = sign_with_key(body["envelope"], key)
+                body = sign_with_key(body["envelope"], key, key_id="test-key")
             raw = json.dumps(body).encode()
             if status == 200:
                 return _Body(raw)