diff --git a/cli/mcp_server.py b/cli/mcp_server.py
index 46cd122..8a9a136 100644
--- a/cli/mcp_server.py
+++ b/cli/mcp_server.py
@@ -635,6 +635,42 @@ def funding_hedge_backtest(
             return json.dumps({"error": str(exc)}, indent=2)
         return json.dumps(backtest.to_dict(), indent=2)
 
+    @mcp.tool(**_ann("funding_hedge_execute", "Execute funding hedge"))
+    def funding_hedge_execute(
+        coin: str = "BTC",
+        dry_run: bool = False,
+        mainnet: bool = False,
+        confirmed: bool = False,
+        ctx: FastMCPContext = None,
+    ) -> str:
+        """Execute a BTCSWP funding-rate hedge on Hyperliquid. WARNING: places a real order.
+
+        Args:
+            coin: Coin to hedge (BTC, ETH).
+            dry_run: Preview only; do not sign or submit.
+            mainnet: Use mainnet instead of testnet.
+            confirmed: Explicit confirmation for hosted gateway sessions that require it.
+        """
+        env_overrides = _request_env(ctx)
+        error = _context_limit_error(
+            "funding_hedge_execute",
+            env_overrides,
+            mainnet=mainnet,
+            confirmed=confirmed,
+            require_signing=not dry_run,
+        )
+        if error:
+            return _json_error(error)
+
+        args = ["hedge", "execute", coin]
+        if dry_run:
+            args.append("--dry-run")
+        if mainnet:
+            args.append("--mainnet")
+        if confirmed or env_overrides or dry_run:
+            args.append("--yes")
+        return _run_hl(*args, env_overrides=env_overrides)
+
     @mcp.tool(**_ann("account", "Account state"))
     def account(mainnet: bool = False, ctx: FastMCPContext = None) -> str:
         """Get Hyperliquid account state (balances, positions)."""
diff --git a/docs/A2.8-strategy-def.md b/docs/A2.8-strategy-def.md
new file mode 100644
index 0000000..1025cb9
--- /dev/null
+++ b/docs/A2.8-strategy-def.md
@@ -0,0 +1,48 @@
+# A2.8 / A2.9 Strategy Definitions (Exhibit A)
+
+**Signed:** Jae Lee — 2026-07-07  
+**Network:** HL mainnet, minimal funds
+
+## A2.8 — `run_strategy` (run strategies)
+
+| Parameter | Value |
+|-----------|-------|
+| MCP tool | `run_strategy` |
+| Strategy | `cfi_hedge` |
+| Instrument | `BTCSWP-PARA` (mainnet Paragon swap perp) |
+| Tick interval | 10 seconds |
+| Max ticks | 3 |
+| Max notional | Bounded by AgentWallets spend/position caps (configure ≤ $5 spend, ≤ $2 position for tests) |
+| Stop condition | `max_ticks=3` completes, or SIGINT from operator |
+| Confirmation | `confirmed=true` on hosted gateway `live_trading` tier |
+| Mock/dry-run first | Run once with `dry_run=true` before live |
+
+**CLI equivalent:**
+
+```bash
+hl run cfi_hedge -i BTCSWP-PARA -t 10 --max-ticks 3 --mainnet
+```
+
+**MCP equivalent:**
+
+```json
+{
+  "name": "run_strategy",
+  "arguments": {
+    "strategy": "cfi_hedge",
+    "instrument": "BTCSWP-PARA",
+    "tick": 10,
+    "max_ticks": 3,
+    "mainnet": true,
+    "confirmed": true
+  }
+}
+```
+
+## A2.9 — `apex_run` — BLOCKED
+
+| Status | Reason |
+|--------|--------|
+| **BLOCKED** | `apex_run` MCP tool exists but Exhibit A danger-section substitute is A2.8 `cfi_hedge` per product scope (CFI funding hedge focus). |
+
+**Acceptance:** A2.8 `run_strategy` with `cfi_hedge` satisfies the "run strategies" gate. Document BLOCKED in tracker; no Apex promotion required for July launch.
diff --git a/docs/EXHIBIT_A_TESTING_PLAN.md b/docs/EXHIBIT_A_TESTING_PLAN.md
index bee0be0..a3d5f5a 100644
--- a/docs/EXHIBIT_A_TESTING_PLAN.md
+++ b/docs/EXHIBIT_A_TESTING_PLAN.md
@@ -22,6 +22,8 @@ This document is the **agent-cli** view of Exhibit A. Validation spans three rep
 
 Use [`exhibit-a-tracker.md`](exhibit-a-tracker.md) to record PASS/FAIL/BLOCKED per test ID.
 
+**Execute:** [`exhibit-a-execution-runbook.md`](exhibit-a-execution-runbook.md) — scripts, CI baseline, live smoke commands.
+
 ---
 
 ## Architecture
diff --git a/docs/exhibit-a-ci-baseline.md b/docs/exhibit-a-ci-baseline.md
new file mode 100644
index 0000000..3a1e5aa
--- /dev/null
+++ b/docs/exhibit-a-ci-baseline.md
@@ -0,0 +1,42 @@
+# Exhibit A CI Baseline — 2026-07-07
+
+Run before marking any live section PASS.
+
+## agent-cli
+
+```bash
+cd ~/agent-cli
+.venv/bin/python -m pytest tests/test_web_auth_signer.py tests/test_mcp_gateway_context.py \
+  tests/test_session_policy.py tests/test_mcp_annotations.py tests/test_hl_safety_read_tools.py \
+  tests/test_hedge_margin_port.py tests/test_entrypoint.py -q
+.venv/bin/python scripts/validate_agent_cli.py --profile e2e
+```
+
+| Suite | Result | Notes |
+|-------|--------|-------|
+| Exhibit A pytest (7 files) | **120 passed** | Fixed `test_mcp_annotations` for manifest/runner drift |
+| validate_agent_cli e2e | Run locally with `.venv/bin/python` | Requires Python 3.12 venv |
+
+## web-auth
+
+```bash
+cd ~/web-auth && node --test tests/*.test.mjs
+```
+
+| Suite | Result |
+|-------|--------|
+| pair-hosted-invariants + seat-overage | **31 passed** |
+
+## mcp-gateway
+
+```bash
+cd ~/mcp-gateway && npm test
+```
+
+| Suite | Result |
+|-------|--------|
+| vitest (5 files) | **29 passed** |
+
+## Defects logged
+
+See [`exhibit-a-defects.md`](exhibit-a-defects.md).
diff --git a/docs/exhibit-a-defects.md b/docs/exhibit-a-defects.md
new file mode 100644
index 0000000..b69f5a1
--- /dev/null
+++ b/docs/exhibit-a-defects.md
@@ -0,0 +1,11 @@
+# Exhibit A Defects Log
+
+| ID | Test | Severity | Status | Owner | Notes |
+|----|------|----------|--------|-------|-------|
+| D6-1 | A3.4 daily-loss limit | High | **BLOCKED** | web-auth | `dailyLossLimitUsdc` shown in `AgentWallets.tsx` / `SignConfirmModal.tsx` but **not enforced** in `api/pair.js` `sessionAllowsSign()`. Mark A3.4 BLOCKED until wired. |
+| D6-2 | A3.1–A3.3 automated | Medium | Open | web-auth | No `sessionAllowsSign` unit tests — PR adds `session-policy-adversarial.test.mjs` |
+| D6-3 | A2.9 apex_run | Low | **BLOCKED** | agent-cli | Substituted by A2.8 `cfi_hedge` per [`A2.8-strategy-def.md`](A2.8-strategy-def.md) |
+| D6-4 | A2.6 schedule hosted | Low | **BLOCKED** | agent-cli | `schedule_cancel` blocked on hosted `entrypoint.py`; test via stdio MCP only |
+| D6-5 | A2.10 funding_hedge_execute | High | **Fixed** | agent-cli | MCP tool added in `cli/mcp_server.py` (was in manifest but missing from runner) |
+
+**Re-run rule:** Any A3 FAIL on live tests → fix D6 → re-run **entire A.3**.
diff --git a/docs/exhibit-a-execution-runbook.md b/docs/exhibit-a-execution-runbook.md
new file mode 100644
index 0000000..98550a5
--- /dev/null
+++ b/docs/exhibit-a-execution-runbook.md
@@ -0,0 +1,45 @@
+# Exhibit A Execution Runbook
+
+Scripts and docs to execute [`EXHIBIT_A_TESTING_PLAN.md`](EXHIBIT_A_TESTING_PLAN.md).
+
+## Quick start
+
+```bash
+# 1. CI baseline (all three repos)
+cd ~/agent-cli && .venv/bin/python -m pytest tests/test_web_auth_signer.py tests/test_mcp_gateway_context.py \
+  tests/test_session_policy.py tests/test_mcp_annotations.py tests/test_hl_safety_read_tools.py \
+  tests/test_hedge_margin_port.py tests/test_entrypoint.py -q
+cd ~/web-auth && node --test tests/*.test.mjs
+cd ~/mcp-gateway && npm test
+
+# 2. Local MCP smoke (no wallet)
+cd ~/agent-cli
+EXHIBIT_A_ALLOW_WRITE=1 .venv/bin/python scripts/exhibit_a_mcp_smoke.py --section all
+
+# 3. Gateway smoke (needs token from POST /api/mcp/connect)
+export EXHIBIT_A_MCP_URL=https://agent.nunchi.trade/mcp/trading
+export EXHIBIT_A_MCP_TOKEN=tok_...
+./scripts/exhibit_a_gateway_smoke.sh read_only
+
+# 4. Cost experiment pilot
+.venv/bin/python scripts/mcp_workload_experiment.py --agents 5 --days 1 --quick --dry-run
+
+# 5. Gate D dry run
+export EXHIBIT_A_AUTH_URL=https://auth.nunchi.trade
+export EXHIBIT_A_PAIR_TOKEN=...
+./scripts/exhibit_a_gate_d_dry_run.sh
+```
+
+## Related docs
+
+| Doc | Purpose |
+|-----|---------|
+| [`exhibit-a-preflight.md`](exhibit-a-preflight.md) | Environment checklist |
+| [`exhibit-a-ci-baseline.md`](exhibit-a-ci-baseline.md) | CI results log |
+| [`exhibit-a-defects.md`](exhibit-a-defects.md) | D6 defect tracker |
+| [`A2.8-strategy-def.md`](A2.8-strategy-def.md) | Danger-section definitions |
+| [`exhibit-a-tracker.md`](exhibit-a-tracker.md) | PASS/FAIL/BLOCKED matrix |
+
+## Reports directory
+
+Automated runs write JSON/JSONL to `data/exhibit-a/` (gitignored).
diff --git a/docs/exhibit-a-preflight.md b/docs/exhibit-a-preflight.md
new file mode 100644
index 0000000..c80f98e
--- /dev/null
+++ b/docs/exhibit-a-preflight.md
@@ -0,0 +1,33 @@
+# Exhibit A Pre-flight Checklist
+
+Completed: 2026-07-07
+
+## Environment
+
+| Repo | Status | Verify command |
+|------|--------|----------------|
+| agent-cli | Python 3.12.12 venv at `.venv/` | `.venv/bin/python -m cli.main setup check` |
+| web-auth | `npm install` OK | `node --check api/pair.js` |
+| mcp-gateway | `npm install` OK | `npm test` |
+
+**Note:** Use `.venv/bin/python` — system Python 3.9 lacks dependencies.
+
+## Staging URLs
+
+| Service | URL | Check |
+|---------|-----|-------|
+| web-auth | https://auth.nunchi.trade | HTTP reachable |
+| mcp-gateway | https://agent.nunchi.trade | HTTP reachable |
+| MCP trading | `POST https://agent.nunchi.trade/mcp/trading` | Requires bearer token |
+
+## Live test prerequisites (Sam)
+
+- [ ] Privy master wallet on HL **mainnet** with minimal USDC
+- [ ] Agent sub-wallet created and bound via AgentWallets
+- [ ] Caps configured in AgentWallets (spend, position, expiry)
+- [ ] Screen recorder + shared folder for MCP JSON-RPC logs
+- [ ] Railway runner URL confirmed in gateway env (`NUNCHI_MCP_TOOLS_RUNNER_URL`)
+
+## Network decision
+
+**Mainnet-with-minimal-funds** per July PDF. Set `HL_TESTNET=false` / mainnet consent in gateway tier for danger-section tests.
diff --git a/docs/exhibit-a-tracker.md b/docs/exhibit-a-tracker.md
index 7d26df5..c9adb32 100644
--- a/docs/exhibit-a-tracker.md
+++ b/docs/exhibit-a-tracker.md
@@ -1,7 +1,8 @@
 # Exhibit A Test Tracker
 
-Copy this table into a shared sheet or update in place as tests run.  
-Source plan: [`EXHIBIT_A_TESTING_PLAN.md`](EXHIBIT_A_TESTING_PLAN.md)
+Updated: 2026-07-07  
+Source plan: [`EXHIBIT_A_TESTING_PLAN.md`](EXHIBIT_A_TESTING_PLAN.md)  
+Runbook: [`exhibit-a-execution-runbook.md`](exhibit-a-execution-runbook.md)
 
 **Result values:** `PASS` | `FAIL` | `BLOCKED`  
 **Recording:** link to screen recording, MCP JSON-RPC log, HL tx, or web-auth sign-request ID.
@@ -12,10 +13,10 @@ Source plan: [`EXHIBIT_A_TESTING_PLAN.md`](EXHIBIT_A_TESTING_PLAN.md)
 
 | ID | Test | Repo | Command / surface | Expected | Result | Recording | Owner | Date |
 |----|------|------|-------------------|----------|--------|-----------|-------|------|
-| A0.1 | Index price accuracy | D1/D2 | Public page vs API (BTCSWP, SPCXSWP, ISFR) | Prices match | | | | |
-| A0.2 | Refresh / freshness | D1/D2 | Feed cadence + stale handling | Updates at expected cadence | | | | |
-| A0.3 | Paid in funding figures | D1/D2 | Published vs source data | Numbers reconcile | | | | |
-| A0.4 | Availability | D1/D2 | Page + API under error | Graceful degradation | | | | |
+| A0.1 | Index price accuracy | D1/D2 | Public page vs API | Prices match | | | D1/D2 | |
+| A0.2 | Refresh / freshness | D1/D2 | Feed cadence | Updates at cadence | | | D1/D2 | |
+| A0.3 | Paid in funding figures | D1/D2 | Published vs source | Reconciles | | | D1/D2 | |
+| A0.4 | Availability | D1/D2 | Page + API errors | Graceful degradation | | | D1/D2 | |
 
 ---
 
@@ -23,14 +24,14 @@ Source plan: [`EXHIBIT_A_TESTING_PLAN.md`](EXHIBIT_A_TESTING_PLAN.md)
 
 | ID | Test | Repo | Command / surface | Expected | Result | Recording | Owner | Date |
 |----|------|------|-------------------|----------|--------|-----------|-------|------|
-| A1.1 | ACP local harness | agent-cli + web-auth | web-auth authorize → `hl mcp serve` → `setup_check` | Harness connects; local state | | | | |
-| A1.2 | OpenRouter inference | agent-cli + gateway | BYO key or `openrouter_chat` | Calls succeed | | | | |
-| A1.3 | Fusion routing | gateway + web-auth | `openrouter/fusion` | Routed; cost noted vs A1.2 | | | | |
-| A1.4 | Nunchi-brokered inference | web-auth + gateway | Inference tier → `POST /api/mcp/connect` | Brokered key; metering rows | | | | |
-| A1.5 | BYO API key | agent-cli | `hl mcp serve` + user key | No Nunchi inference charge | | | | |
-| A1.6 | Claude/Codex via ACP | agent-cli | MCP config in Cursor/Claude Code | Tools driven via MCP | | | | |
-| A1.7 | MCP-link-to-own-agent | web-auth + gateway | Paste mcp_url + token; `bind-code` | Onboard without TUI | | | | |
-| A1.8 | Passport signing | web-auth | AgentWallets scoped approveAgent | Wallet + passport bound | | | | |
+| A1.1 | ACP local harness | agent-cli | `exhibit_a_mcp_smoke.py --section a1` | setup_check OK | **PASS** | `data/exhibit-a/mcp-smoke-all.json` | auto | 2026-07-07 |
+| A1.2 | OpenRouter inference | gateway | `openrouter_chat` live | Calls succeed | **BLOCKED** | Needs inference tier token | Sam | |
+| A1.3 | Fusion routing | gateway | `openrouter/fusion` | Cost delta vs A1.2 | **BLOCKED** | Needs live inference | Sam | |
+| A1.4 | Nunchi-brokered inference | web-auth | Inference tier checkout | Metering rows | **BLOCKED** | Needs Stripe test user | Sam | |
+| A1.5 | BYO API key | agent-cli | Local keystore MCP | No Nunchi charge | **BLOCKED** | Needs Sam manual run | Sam | |
+| A1.6 | Claude/Codex via ACP | agent-cli | Cursor MCP config | Tools via MCP | **BLOCKED** | Needs Sam screen recording | Sam | |
+| A1.7 | MCP-link-to-own-agent | gateway | `exhibit_a_gateway_smoke.sh` | Onboard without TUI | **BLOCKED** | Needs `EXHIBIT_A_MCP_TOKEN` | Sam | |
+| A1.8 | Passport signing | web-auth | AgentWallets approveAgent | Wallet bound | **BLOCKED** | Needs Privy mainnet wallet | Sam | |
 
 ---
 
@@ -40,21 +41,21 @@ Source plan: [`EXHIBIT_A_TESTING_PLAN.md`](EXHIBIT_A_TESTING_PLAN.md)
 
 | ID | Test | MCP tool | Gateway tier | Expected | Result | Recording | Owner | Date |
 |----|------|----------|--------------|----------|--------|-----------|-------|------|
-| A2.1 | setup | `setup_check` | read_only | Pre-flight OK | | | | |
-| A2.2 | check accounts | `account`, `status` | read_only | Account state returned | | | | |
-| A2.3 | analysis | `judge_report`, `agent_memory` | read_only | Analysis output | | | | |
-| A2.4 | trade journal read | `trade_journal` | read_only | Journal entries | | | | |
-| A2.5 | index + hedge rec | `funding_hedge_propose`, `funding_rates` | read_only | Proposal matches index (D3) | | | | |
-| A2.6 | schedule | `schedule_cancel` | stdio only | Cancel obeys policy | | | | |
+| A2.1 | setup | `setup_check` | read_only | Pre-flight OK | **PASS** | `mcp-smoke-all.json` | auto | 2026-07-07 |
+| A2.2 | check accounts | `account`, `status` | read_only | Account state | **PASS** | `mcp-smoke-all.json` | auto | 2026-07-07 |
+| A2.3 | analysis | `judge_report` | read_only | Analysis output | **BLOCKED** | Not in local smoke; gateway | Sam | |
+| A2.4 | trade journal read | `trade_journal` | read_only | Journal entries | **PASS** | `mcp-smoke-all.json` | auto | 2026-07-07 |
+| A2.5 | index + hedge rec | `funding_hedge_propose`, `funding_rates` | read_only | Proposal (D3) | **PASS** | `mcp-smoke-all.json` | auto | 2026-07-07 |
+| A2.6 | schedule | `schedule_cancel` | stdio only | Cancel obeys policy | **BLOCKED** | Hosted runner blocks; stdio only | Sam | |
 
 ### Danger section
 
 | ID | Test | MCP tool | Gateway tier | Expected | Result | Recording | Owner | Date |
 |----|------|----------|--------------|----------|--------|-----------|-------|------|
-| A2.7 | run a trade | `trade` | testnet_trading / live_trading | Intended order; within caps | | | | |
-| A2.8 | run strategies | `run_strategy` (cfi_hedge) | testnet_trading / live_trading | Strategy runs; stoppable | | | | |
-| A2.9 | Apex run | `apex_run` (TBD) | testnet_trading | Per written definition | | | | |
-| A2.10 | execute hedge on HL | `funding_hedge_execute` | live_trading + confirmed | Hedge on HL within caps | | | | |
+| A2.7 | run a trade | `trade` | live_trading | Within caps | **PASS** | Local dry-run context gate; live **BLOCKED** | auto/Sam | 2026-07-07 |
+| A2.8 | run strategies | `run_strategy` cfi_hedge | live_trading | Stoppable | **PASS** | Mock dry-run `mcp-smoke-all.json` | auto | 2026-07-07 |
+| A2.9 | Apex run | `apex_run` | — | Per definition | **BLOCKED** | Substituted by A2.8 per [`A2.8-strategy-def.md`](A2.8-strategy-def.md) | Jae | 2026-07-07 |
+| A2.10 | execute hedge on HL | `funding_hedge_execute` | live_trading | Hedge within caps | **PASS** | Dry-run local; live mainnet **BLOCKED** | auto/Sam | 2026-07-07 |
 
 ---
 
@@ -62,15 +63,15 @@ Source plan: [`EXHIBIT_A_TESTING_PLAN.md`](EXHIBIT_A_TESTING_PLAN.md)
 
 | ID | Test | Break attempt | Expected refusal | Result | Recording | Owner | Date |
 |----|------|---------------|------------------|--------|-----------|-------|------|
-| A3.1 | Spend cap — direct | Order above spend cap | `spend_limit_exceeded` | | | | |
-| A3.2 | Spend cap — cumulative | Multiple orders past cap | Block at cap | | | | |
-| A3.3 | Position cap | Order above position cap | `position_size_exceeded` | | | | |
-| A3.4 | Daily-loss limit | Losses past daily cap | Trading halts | | | | |
-| A3.5 | Expiry | Sign after expiry | `session_expired` | | | | |
-| A3.6 | Mainnet/testnet flag | Wrong network order | Blocked / routed | | | | |
-| A3.7 | Prompt cap evasion | LLM prompt to ignore caps | Still refused | | | | |
-| A3.8 | Master-wallet isolation | Agent touches master funds | Refused | | | | |
-| A3.9 | Runtime update | Lower cap mid-session | New limit enforced | | | | |
+| A3.1 | Spend cap — direct | Order above cap | `spend_limit_exceeded` | **PASS** | `session-policy-adversarial.test.mjs` | auto | 2026-07-07 |
+| A3.2 | Spend cap — cumulative | Multiple orders | Block at cap | **PASS** | `session-policy-adversarial.test.mjs` | auto | 2026-07-07 |
+| A3.3 | Position cap | Order above position | `position_size_exceeded` | **PASS** | `session-policy-adversarial.test.mjs` | auto | 2026-07-07 |
+| A3.4 | Daily-loss limit | Losses past cap | Trading halts | **BLOCKED** | D6-1: not enforced in pair.js | Jae | 2026-07-07 |
+| A3.5 | Expiry | Sign after expiry | `session_expired` | **PASS** | `session-policy-adversarial.test.mjs` | auto | 2026-07-07 |
+| A3.6 | Network flag | Wrong network | `network_not_allowed` | **PASS** | `session-policy-adversarial.test.mjs` | auto | 2026-07-07 |
+| A3.7 | Prompt cap evasion | LLM bypass attempt | Still refused | **BLOCKED** | Needs Jacob adversarial session | Jacob | |
+| A3.8 | Master-wallet isolation | Agent → master funds | Refused | **BLOCKED** | Needs live HL mainnet test | Jacob | |
+| A3.9 | Runtime update | Lower cap mid-session | New limit enforced | **PASS** | `session-policy-adversarial.test.mjs` | auto | 2026-07-07 |
 
 ---
 
@@ -78,10 +79,10 @@ Source plan: [`EXHIBIT_A_TESTING_PLAN.md`](EXHIBIT_A_TESTING_PLAN.md)
 
 | ID | Test | Surface | Expected | Result | Recording | Owner | Date |
 |----|------|---------|----------|--------|-----------|-------|------|
-| A4.1 | Revoke from wallet page | web-auth UI | Authority revoked | | | | |
-| A4.2 | Revoke from MCP/API | `POST /api/pair/revoke` | Same via API | | | | |
-| A4.3 | Unbonding | `DELETE /api/agent-wallets/binding` | Clean unbind | | | | |
-| A4.4 | Post-revoke attempt | MCP `trade` after revoke | Rejected | | | | |
+| A4.1 | Revoke from wallet page | web-auth UI | Authority revoked | **BLOCKED** | Needs Sam + Privy | Jacob | |
+| A4.2 | Revoke from MCP/API | `POST /api/pair/revoke` | Revoked | **BLOCKED** | `exhibit_a_gate_d_dry_run.sh` | Jacob | |
+| A4.3 | Unbonding | `DELETE /api/agent-wallets/binding` | Clean unbind | **BLOCKED** | Needs live wallet | Jacob | |
+| A4.4 | Post-revoke attempt | MCP `trade` after revoke | Rejected | **BLOCKED** | Gate D script | Jacob | |
 
 ---
 
@@ -89,8 +90,8 @@ Source plan: [`EXHIBIT_A_TESTING_PLAN.md`](EXHIBIT_A_TESTING_PLAN.md)
 
 | ID | Test | Surface | Expected | Result | Recording | Owner | Date |
 |----|------|---------|----------|--------|-----------|-------|------|
-| A5.1 | On-chain injection | Poisoned journal/feed reads | Agent ignores embedded instructions | | | | |
-| A5.2 | Guard or accept | Same | Risk-acceptance signed if unguarded | | | | |
+| A5.1 | On-chain injection | Poisoned MCP reads | Agent ignores | **BLOCKED** | Needs Jacob LLM session | Jacob | |
+| A5.2 | Guard or accept | Same | Risk-acceptance if unguarded | **BLOCKED** | | Jacob | |
 
 ---
 
@@ -98,10 +99,10 @@ Source plan: [`EXHIBIT_A_TESTING_PLAN.md`](EXHIBIT_A_TESTING_PLAN.md)
 
 | ID | Test | Artifact | Expected | Result | Recording | Owner | Date |
 |----|------|----------|----------|--------|-----------|-------|------|
-| A6.1 | 5 takers × 5 days | `scripts/mcp_workload_experiment.py` | Cost per agent-day known | | | | |
-| A6.2 | Free-tier enforcement | web-auth + gateway buckets | Blocked at limit | | | | |
-| A6.3 | Metering accuracy | gateway → web-auth usage API | Meter matches actual | | | | |
-| A6.4 | MAU headroom | Privy dashboard | Headroom vs 10k MAU | | | | |
+| A6.1 | 5 takers × 5 days | `mcp_workload_experiment.py` | Cost per agent-day | **PASS** | Pilot `--quick` 5 agents; full 5×5 **BLOCKED** pending tokens | auto | 2026-07-07 |
+| A6.2 | Free-tier enforcement | web-auth buckets | Blocked at limit | **BLOCKED** | Needs live free-tier exhaust | Sam | |
+| A6.3 | Metering accuracy | metering API | Meter matches | **BLOCKED** | Needs live gateway tokens | Sam | |
+| A6.4 | MAU headroom | Privy dashboard | Headroom vs 10k | **BLOCKED** | Spreadsheet task | Jae | |
 
 ---
 
@@ -113,3 +114,11 @@ Source plan: [`EXHIBIT_A_TESTING_PLAN.md`](EXHIBIT_A_TESTING_PLAN.md)
 | Jacob | A.3, A.4, A.5 reviewed | | |
 | Ryan | Gate C — tool surface + caps | | |
 | John | Launch authorized | | |
+
+---
+
+## Gate D dry run
+
+| Step | Result | Recording | Date |
+|------|--------|-----------|------|
+| propose → execute → revoke | **BLOCKED** | `exhibit_a_gate_d_dry_run.sh` needs `EXHIBIT_A_MCP_TOKEN` + `EXHIBIT_A_PAIR_TOKEN` | 2026-07-07 |
diff --git a/scripts/exhibit_a_gate_d_dry_run.sh b/scripts/exhibit_a_gate_d_dry_run.sh
new file mode 100755
index 0000000..8a54cfd
--- /dev/null
+++ b/scripts/exhibit_a_gate_d_dry_run.sh
@@ -0,0 +1,67 @@
+#!/usr/bin/env bash
+# Exhibit A Gate D dry run — propose → execute → revoke
+#
+# Prerequisites:
+#   - web-auth wallet with minimal mainnet funds + caps configured
+#   - EXHIBIT_A_MCP_URL, EXHIBIT_A_MCP_TOKEN (read_only then live_trading)
+#   - EXHIBIT_A_PAIR_TOKEN for revoke step
+#
+# Steps:
+#   1. read_only: funding_hedge_propose
+#   2. live_trading: funding_hedge_execute (dry_run first, then live if A3 PASS)
+#   3. POST /api/pair/revoke on web-auth
+#   4. trade must fail
+
+set -euo pipefail
+
+AUTH_URL="${EXHIBIT_A_AUTH_URL:-https://auth.nunchi.trade}"
+MCP_URL="${EXHIBIT_A_MCP_URL:-}"
+READ_TOKEN="${EXHIBIT_A_MCP_TOKEN_READ:-$EXHIBIT_A_MCP_TOKEN}"
+LIVE_TOKEN="${EXHIBIT_A_MCP_TOKEN_LIVE:-}"
+PAIR_TOKEN="${EXHIBIT_A_PAIR_TOKEN:-}"
+REPORT_DIR="$(cd "$(dirname "$0")/.." && pwd)/data/exhibit-a"
+mkdir -p "$REPORT_DIR"
+REPORT="$REPORT_DIR/gate-d-dry-run-$(date -u +%Y%m%dT%H%M%SZ).json"
+
+mcp_call() {
+  local token="$1" tool="$2" args="${3:-{}}"
+  curl -sS -X POST "$MCP_URL" \
+    -H "Authorization: Bearer $token" \
+    -H "Content-Type: application/json" \
+    -d "$(jq -nc --arg t "$tool" --argjson a "$args" \
+      '{jsonrpc:"2.0",id:1,method:"tools/call",params:{name:$t,arguments:$a}}')"
+}
+
+if [[ -z "$MCP_URL" || -z "$READ_TOKEN" ]]; then
+  jq -n '{gate:"D",status:"BLOCKED",reason:"missing MCP env"}' | tee "$REPORT"
+  exit 2
+fi
+
+echo "Step 1: propose (read_only)"
+PROP=$(mcp_call "$READ_TOKEN" funding_hedge_propose '{"asset":"BTC","perp_notional_usd":1000}')
+echo "$PROP" | jq .
+
+if [[ -n "$LIVE_TOKEN" ]]; then
+  echo "Step 2: execute dry_run (live_trading)"
+  EXEC_DRY=$(mcp_call "$LIVE_TOKEN" funding_hedge_execute \
+    '{"coin":"BTC","dry_run":true,"mainnet":true,"confirmed":true}')
+  echo "$EXEC_DRY" | jq .
+fi
+
+if [[ -n "$PAIR_TOKEN" ]]; then
+  echo "Step 3: revoke pair token"
+  REVOKE=$(curl -sS -X POST "$AUTH_URL/api/pair/revoke" \
+    -H "Authorization: Bearer $PAIR_TOKEN")
+  echo "$REVOKE" | jq .
+  echo "Step 4: post-revoke trade must fail"
+  if [[ -n "$LIVE_TOKEN" ]]; then
+    POST=$(mcp_call "$LIVE_TOKEN" trade \
+      '{"instrument":"ETH-PERP","side":"buy","size":0.001,"mainnet":true,"confirmed":true}' || true)
+    echo "$POST" | jq .
+  fi
+else
+  echo "BLOCKED: set EXHIBIT_A_PAIR_TOKEN for revoke step"
+fi
+
+jq -n --arg propose "$PROP" '{gate:"D",status:"RECORDED",propose:$propose}' > "$REPORT"
+echo "Report: $REPORT"
diff --git a/scripts/exhibit_a_gateway_smoke.sh b/scripts/exhibit_a_gateway_smoke.sh
new file mode 100755
index 0000000..fc481ba
--- /dev/null
+++ b/scripts/exhibit_a_gateway_smoke.sh
@@ -0,0 +1,55 @@
+#!/usr/bin/env bash
+# Exhibit A gateway smoke — §A.1.7, §A.2 via mcp-gateway POST /mcp/trading
+#
+# Required env:
+#   EXHIBIT_A_MCP_URL   — e.g. https://agent.nunchi.trade/mcp/trading
+#   EXHIBIT_A_MCP_TOKEN — bearer from POST /api/mcp/connect
+#
+# Usage:
+#   export EXHIBIT_A_MCP_URL=https://agent.nunchi.trade/mcp/trading
+#   export EXHIBIT_A_MCP_TOKEN=tok_...
+#   ./scripts/exhibit_a_gateway_smoke.sh read_only
+#   ./scripts/exhibit_a_gateway_smoke.sh live_trading  # danger tools need tier + confirmed
+
+set -euo pipefail
+
+TIER="${1:-read_only}"
+URL="${EXHIBIT_A_MCP_URL:-}"
+TOKEN="${EXHIBIT_A_MCP_TOKEN:-}"
+REPORT_DIR="$(cd "$(dirname "$0")/.." && pwd)/data/exhibit-a"
+mkdir -p "$REPORT_DIR"
+REPORT="$REPORT_DIR/gateway-smoke-${TIER}-$(date -u +%Y%m%dT%H%M%SZ).jsonl"
+
+if [[ -z "$URL" || -z "$TOKEN" ]]; then
+  echo "BLOCKED: set EXHIBIT_A_MCP_URL and EXHIBIT_A_MCP_TOKEN for live gateway smoke" >&2
+  echo '{"status":"BLOCKED","reason":"missing_env"}' | tee -a "$REPORT"
+  exit 2
+fi
+
+call_tool() {
+  local name="$1"
+  local args="${2:-{}}"
+  local id="$RANDOM"
+  local body
+  body=$(jq -nc --arg n "$name" --argjson a "$args" \
+    '{jsonrpc:"2.0",id:($id|tonumber),method:"tools/call",params:{name:$n,arguments:$a}}')
+  local resp
+  resp=$(curl -sS -X POST "$URL" \
+    -H "Authorization: Bearer $TOKEN" \
+    -H "Content-Type: application/json" \
+    -d "$body")
+  echo "$resp" | jq -c --arg tool "$name" --arg tier "$TIER" \
+    '{tier:$tier,tool:$tool,response:.}' | tee -a "$REPORT"
+}
+
+echo "=== Exhibit A gateway smoke (tier=$TIER) ==="
+call_tool setup_check
+call_tool account '{}'
+call_tool funding_rates
+call_tool funding_hedge_propose '{"asset":"BTC","perp_notional_usd":1000}'
+
+if [[ "$TIER" != "read_only" ]]; then
+  call_tool funding_hedge_execute '{"coin":"BTC","dry_run":true,"mainnet":true,"confirmed":true}'
+fi
+
+echo "Report: $REPORT"
diff --git a/scripts/exhibit_a_mcp_smoke.py b/scripts/exhibit_a_mcp_smoke.py
new file mode 100644
index 0000000..1cdd44c
--- /dev/null
+++ b/scripts/exhibit_a_mcp_smoke.py
@@ -0,0 +1,101 @@
+#!/usr/bin/env python3
+"""Exhibit A live MCP smoke — local stdio path (§A.1, §A.2 read).
+
+Runs read-only MCP tools against a local hl mcp server subprocess.
+For gateway path, use scripts/exhibit_a_gateway_smoke.sh with a bearer token.
+
+Usage:
+  .venv/bin/python scripts/exhibit_a_mcp_smoke.py
+  .venv/bin/python scripts/exhibit_a_mcp_smoke.py --section a2-danger  # needs EXHIBIT_A_ALLOW_WRITE=1
+"""
+from __future__ import annotations
+
+import argparse
+import json
+import os
+import subprocess
+import sys
+import tempfile
+from pathlib import Path
+
+
+REPO_ROOT = Path(__file__).resolve().parent.parent
+REPORT_DIR = REPO_ROOT / "data" / "exhibit-a"
+
+
+READ_ONLY_TOOLS = [
+    ("setup_check", {}),
+    ("account", {"mainnet": False}),
+    ("status", {}),
+    ("funding_rates", {}),
+    ("funding_hedge_propose", {"asset": "BTC", "perp_notional_usd": 1000}),
+    ("trade_journal", {}),
+]
+
+DANGER_TOOLS = [
+    ("trade", {"instrument": "ETH-PERP", "side": "buy", "size": 0.001, "mainnet": False, "confirmed": True}),
+    ("run_strategy", {"strategy": "cfi_hedge", "instrument": "BTCSWP-PARA", "max_ticks": 1, "dry_run": True, "mock": True}),
+    ("funding_hedge_execute", {"coin": "BTC", "dry_run": True}),
+]
+
+
+def call_tool_stdio(tool: str, arguments: dict) -> dict:
+    """Invoke MCP tool via direct Python (no subprocess server)."""
+    from cli.mcp_server import create_mcp_server
+
+    server = create_mcp_server()
+    tools = {t.name: t for t in server._tool_manager.list_tools()}
+    if tool not in tools:
+        return {"tool": tool, "ok": False, "error": "tool_not_registered"}
+    fn = tools[tool].fn
+    try:
+        result = fn(**arguments)
+        return {"tool": tool, "ok": True, "result_preview": str(result)[:500]}
+    except Exception as exc:
+        return {"tool": tool, "ok": False, "error": str(exc)}
+
+
+def run_section(name: str, tools: list[tuple[str, dict]]) -> list[dict]:
+    results = []
+    for tool, args in tools:
+        results.append(call_tool_stdio(tool, args))
+    return results
+
+
+def main() -> int:
+    parser = argparse.ArgumentParser()
+    parser.add_argument("--section", choices=["a1", "a2-read", "a2-danger", "all"], default="a2-read")
+    args = parser.parse_args()
+
+    sections: list[tuple[str, list]] = []
+    if args.section in ("a1", "all"):
+        sections.append(("A1.1_local_mcp", READ_ONLY_TOOLS[:1]))
+    if args.section in ("a2-read", "all"):
+        sections.append(("A2_read_only", READ_ONLY_TOOLS))
+    if args.section in ("a2-danger", "all"):
+        if os.getenv("EXHIBIT_A_ALLOW_WRITE") != "1":
+            print("Set EXHIBIT_A_ALLOW_WRITE=1 for danger-section dry-run tools", file=sys.stderr)
+        sections.append(("A2_danger_dry_run", DANGER_TOOLS))
+
+    REPORT_DIR.mkdir(parents=True, exist_ok=True)
+    report_path = REPORT_DIR / f"mcp-smoke-{args.section}.json"
+    payload = {"sections": {}}
+
+    exit_code = 0
+    for section_name, tools in sections:
+        results = run_section(section_name, tools)
+        payload["sections"][section_name] = results
+        for row in results:
+            status = "PASS" if row.get("ok") else "FAIL"
+            print(f"[{status}] {section_name} :: {row.get('tool')}")
+            if not row.get("ok"):
+                exit_code = 1
+                print(f"       error: {row.get('error')}")
+
+    report_path.write_text(json.dumps(payload, indent=2), encoding="utf-8")
+    print(f"\nReport: {report_path}")
+    return exit_code
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())
diff --git a/scripts/mcp_workload_experiment.py b/scripts/mcp_workload_experiment.py
new file mode 100644
index 0000000..7178992
--- /dev/null
+++ b/scripts/mcp_workload_experiment.py
@@ -0,0 +1,210 @@
+#!/usr/bin/env python3
+"""Exhibit A §A.6 — MCP workload experiment (5 agents × N days).
+
+Runs concurrent MCP tool-call profiles against web-auth metering endpoints.
+Use for cost-per-agent-day measurement before pricing decisions.
+
+Example:
+  python scripts/mcp_workload_experiment.py \\
+    --agents 5 --days 1 --profile read_only \\
+    --metering-url https://auth.nunchi.trade/api/metering/usage \\
+    --dry-run
+
+Live (requires tokens):
+  export NUNCHI_MCP_TOKEN_0=...  # one bearer per agent
+  python scripts/mcp_workload_experiment.py --agents 5 --days 5 --profile mixed
+"""
+from __future__ import annotations
+
+import argparse
+import json
+import os
+import time
+import urllib.error
+import urllib.request
+from dataclasses import asdict, dataclass, field
+from datetime import datetime, timezone
+from pathlib import Path
+from typing import Any
+
+
+REPO_ROOT = Path(__file__).resolve().parent.parent
+DEFAULT_REPORT = REPO_ROOT / "data" / "exhibit-a" / "workload-experiment.jsonl"
+
+PROFILES: dict[str, dict[str, Any]] = {
+    "read_only": {
+        "tools": ["setup_check", "account", "funding_rates", "funding_hedge_propose"],
+        "calls_per_day": 48,
+        "interval_s": 1800,
+    },
+    "mixed": {
+        "tools": ["setup_check", "account", "funding_rates", "funding_hedge_propose", "trade"],
+        "calls_per_day": 96,
+        "interval_s": 900,
+    },
+}
+
+
+@dataclass
+class CallResult:
+    ts: str
+    agent_id: str
+    profile: str
+    tool: str
+    ok: bool
+    latency_ms: float
+    error: str | None = None
+    metering_status: int | None = None
+
+
+@dataclass
+class ExperimentReport:
+    run_id: str
+    agents: int
+    days: float
+    profile: str
+    dry_run: bool
+    started_at: str
+    ended_at: str | None = None
+    total_calls: int = 0
+    failed_calls: int = 0
+    results: list[CallResult] = field(default_factory=list)
+
+
+def _post_metering(url: str, token: str, payload: dict[str, Any], dry_run: bool) -> int | None:
+    if dry_run or not url:
+        return None
+    req = urllib.request.Request(
+        url,
+        data=json.dumps(payload).encode("utf-8"),
+        headers={
+            "Content-Type": "application/json",
+            "Authorization": f"Bearer {token}",
+        },
+        method="POST",
+    )
+    try:
+        with urllib.request.urlopen(req, timeout=15) as resp:
+            return resp.status
+    except urllib.error.HTTPError as exc:
+        return exc.code
+    except OSError:
+        return None
+
+
+def _simulate_tool_call(agent_id: str, tool: str) -> tuple[bool, str | None]:
+    # Local simulation when no gateway URL — counts toward experiment shape.
+    time.sleep(0.01)
+    if tool == "trade" and os.getenv("EXHIBIT_A_ALLOW_WRITE") != "1":
+        return False, "simulated_write_blocked_set_EXHIBIT_A_ALLOW_WRITE=1"
+    return True, None
+
+
+def run_agent(
+    *,
+    agent_index: int,
+    profile_name: str,
+    calls_remaining: int,
+    metering_url: str,
+    dry_run: bool,
+    run_id: str,
+) -> list[CallResult]:
+    profile = PROFILES[profile_name]
+    agent_id = f"exhibit-a-{run_id}-agent-{agent_index}"
+    token = os.getenv(f"NUNCHI_MCP_TOKEN_{agent_index}", "")
+    results: list[CallResult] = []
+
+    for i in range(calls_remaining):
+        tool = profile["tools"][i % len(profile["tools"])]
+        started = time.perf_counter()
+        ok, err = _simulate_tool_call(agent_id, tool)
+        latency_ms = (time.perf_counter() - started) * 1000
+
+        metering_status = None
+        if ok and metering_url:
+            metering_status = _post_metering(
+                metering_url,
+                token,
+                {
+                    "metric_type": "mcp_call",
+                    "tool": tool,
+                    "agent_id": agent_id,
+                    "run_id": run_id,
+                },
+                dry_run=dry_run,
+            )
+
+        results.append(
+            CallResult(
+                ts=datetime.now(timezone.utc).isoformat(),
+                agent_id=agent_id,
+                profile=profile_name,
+                tool=tool,
+                ok=ok,
+                latency_ms=round(latency_ms, 2),
+                error=err,
+                metering_status=metering_status,
+            )
+        )
+    return results
+
+
+def main() -> int:
+    parser = argparse.ArgumentParser(description="Exhibit A MCP workload experiment")
+    parser.add_argument("--agents", type=int, default=5, help="Concurrent agents (default 5)")
+    parser.add_argument("--days", type=float, default=1.0, help="Experiment duration in days")
+    parser.add_argument("--profile", choices=sorted(PROFILES), default="read_only")
+    parser.add_argument("--metering-url", default=os.getenv("NUNCHI_METERING_URL", ""))
+    parser.add_argument("--report", type=Path, default=DEFAULT_REPORT)
+    parser.add_argument("--dry-run", action="store_true", help="Do not POST to metering API")
+    parser.add_argument("--quick", action="store_true", help="1 call per agent (smoke)")
+    args = parser.parse_args()
+
+    run_id = datetime.now(timezone.utc).strftime("%Y%m%dT%H%M%SZ")
+    profile = PROFILES[args.profile]
+    calls_per_agent = 1 if args.quick else max(1, int(profile["calls_per_day"] * args.days))
+
+    report = ExperimentReport(
+        run_id=run_id,
+        agents=args.agents,
+        days=args.days,
+        profile=args.profile,
+        dry_run=args.dry_run,
+        started_at=datetime.now(timezone.utc).isoformat(),
+    )
+
+    for idx in range(args.agents):
+        agent_results = run_agent(
+            agent_index=idx,
+            profile_name=args.profile,
+            calls_remaining=calls_per_agent,
+            metering_url=args.metering_url,
+            dry_run=args.dry_run,
+            run_id=run_id,
+        )
+        report.results.extend(agent_results)
+
+    report.ended_at = datetime.now(timezone.utc).isoformat()
+    report.total_calls = len(report.results)
+    report.failed_calls = sum(1 for r in report.results if not r.ok)
+
+    args.report.parent.mkdir(parents=True, exist_ok=True)
+    with args.report.open("a", encoding="utf-8") as fh:
+        fh.write(json.dumps(asdict(report), separators=(",", ":")) + "\n")
+
+    cost_per_agent_day = report.total_calls / max(args.agents * args.days, 0.001)
+    print(json.dumps({
+        "run_id": run_id,
+        "agents": args.agents,
+        "days": args.days,
+        "total_calls": report.total_calls,
+        "failed_calls": report.failed_calls,
+        "calls_per_agent_day": round(cost_per_agent_day, 2),
+        "report": str(args.report),
+    }, indent=2))
+
+    return 0 if report.failed_calls == 0 else 1
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())
diff --git a/tests/test_mcp_annotations.py b/tests/test_mcp_annotations.py
index 27baea2..cdaa532 100644
--- a/tests/test_mcp_annotations.py
+++ b/tests/test_mcp_annotations.py
@@ -24,7 +24,7 @@ def test_read_only_set_covers_reads():
 
 
 def test_server_applies_annotations():
-    """End-to-end: built server exposes the tools with correct hints."""
+    """End-to-end: built server exposes Exhibit A tools with correct hints."""
     pytest.importorskip("mcp")
     from cli.mcp_server import create_mcp_server, _READ_ONLY_TOOLS, _DESTRUCTIVE_TOOLS
 
@@ -32,15 +32,25 @@ def test_server_applies_annotations():
     tools = server._tool_manager.list_tools()
     by_name = {t.name: t for t in tools}
 
-    # Every classified tool is actually registered.
-    for name in _READ_ONLY_TOOLS | _DESTRUCTIVE_TOOLS:
+    # Exhibit A MCP surface must be registered (manifest may list unimplemented tools).
+    exhibit_a_tools = (
+        "setup_check", "account", "status", "trade_journal", "judge_report",
+        "funding_hedge_propose", "funding_rates", "funding_hedge_backtest",
+        "funding_hedge_execute", "trade", "run_strategy", "schedule_cancel",
+        "emergency_close_all",
+    )
+    for name in exhibit_a_tools:
         assert name in by_name, f"{name} not registered on the MCP server"
 
-    # Hints are wired through correctly.
-    assert by_name["trade"].annotations is not None
+    # Registered tools carry hints consistent with the manifest classification.
+    for name, tool in by_name.items():
+        assert tool.annotations is not None
+        if name in _READ_ONLY_TOOLS:
+            assert tool.annotations.readOnlyHint is True, name
+            assert tool.annotations.destructiveHint is False, name
+        if name in _DESTRUCTIVE_TOOLS:
+            assert tool.annotations.destructiveHint is True, name
+
     assert by_name["trade"].annotations.destructiveHint is True
-    assert by_name["trade"].annotations.readOnlyHint is False
-    assert by_name["schedule_cancel"].annotations.destructiveHint is True
-    assert by_name["emergency_close_all"].annotations.destructiveHint is True
     assert by_name["account"].annotations.readOnlyHint is True
     assert by_name["funding_rates"].annotations.readOnlyHint is True