Ed25519 signed receipts (AARM R5) with HMAC-SHA256 fallback. Hash-chained tamper-evident context (AARM R2). First-call-any-risk DEFER trigger. Deny-on-block whitelist escalation. Sibling deferral. Prompt scan carry-forward. Critical hardening blocks all tools. 847 tests passing. Optional crypto: pip install agentlock[crypto].