@cello-protocol/daemon 0.0.52 → 0.0.54

package/dist/types.d.ts

@@ -59,16 +59,15 @@ export interface AgentInfo {
     pubkey?: string;
     error?: string;
     /**
-     * M8B F14: whether THIS agent currently has an armed standing receiver. Populated on the
+     * Whether THIS agent currently has an armed standing receiver. Populated on the
      * cello_status surface (getStatus) so a deaf agent — online but unable to accept inbound
      * sessions — is visible per-agent, not hidden behind the daemon-level ANY-agent aggregate.
      */
     standing_receiver_ready?: boolean;
     /**
-     * M8C-AUTOSTART-1 (F5): whether THIS agent is the current (selected) agent for the requesting
-     * connection. Split out from `state` so a selected agent reads `state: "online"` + `selected: true`
-     * — `state` no longer overloads the value "current", so two healthy agents don't read as
-     * different readiness levels.
+     * Whether THIS agent is the current (selected) agent for the requesting connection. Kept SEPARATE
+     * from `state` — `state` must not overload the value "current", or two equally healthy agents read
+     * as different readiness levels. A selected agent reads `state: "online"` + `selected: true`.
      */
     selected?: boolean;
 }
@@ -85,33 +84,35 @@ export interface DaemonStatusResponse {
     /**
      * True when the standing receiver node is listening and ready to accept the
      * next inbound session. Set to true by SessionNodeManager.initialize() during
-     * daemon startup (before the IPC socket opens). DAEMON-002 AC-002.
+     * daemon startup, before the IPC socket opens.
      */
     standing_receiver_ready: boolean;
     /**
      * Total count of retry_queue entries across all sessions.
-     * Always present as integer >= 0. DAEMON-003 AC-009.
+     * Always present as integer >= 0.
      */
     retryQueueDepth: number;
     /**
-     * M7-SESSION-001 AC-007: interrupted sessions from SQLite.
+     * Interrupted sessions from SQLite.
      * Always present (empty array if none). Never undefined or omitted.
      */
     interrupted_sessions: InterruptedSessionInfo[];
     /**
-     * M8B F16: ACTIVE sessions with their direct-path counterparty liveness, so a
+     * ACTIVE sessions with their direct-path counterparty liveness, so a
      * counterparty-gone session is visible to the operator instead of looking identical
      * to a quiet-but-healthy one. Always present (empty array if none).
      */
     active_sessions: ActiveSessionInfo[];
 }
-/** M8B F16: one active session's status row (see DaemonStatusResponse.active_sessions). */
+/** One active session's status row (see DaemonStatusResponse.active_sessions). */
 export interface ActiveSessionInfo {
     sessionId: string;
     agentName: string;
     counterpartyPubkey: string;
     /** Direct-path counterparty liveness; 'unknown' before any session-node observation. */
     liveness: "alive" | "gone" | "unknown";
+    /** DOD-SESSION-NAME-1: this agent's own label for the session; null when unnamed. */
+    sessionName: string | null;
 }
 export interface DaemonConfig {
     celloDir: string;
@@ -121,9 +122,9 @@ export interface DaemonConfig {
     version: string;
     logger: Logger;
     /**
-     * M7-MANIFEST-002: manifest loading and verification.
+     * Manifest loading and verification.
      * When provided, startDaemon() calls manifestProvider.loadAndVerify() at startup.
-     * When absent, manifest loading is skipped (backward compat for DAEMON-001 tests).
+     * When absent, manifest loading is skipped.
      *
      * Production: requires manifestRootKeys (non-empty array) and manifestThreshold (>= 1).
      * The bundled consortium-manifest.json is NOT shipped in the npm package — operators
@@ -131,39 +132,38 @@ export interface DaemonConfig {
      */
     manifestProvider?: IManifestProvider;
     /**
-     * M7-MANIFEST-002: officer root keys for manifest signature verification.
+     * Officer root keys for manifest signature verification.
      * Required when manifestProvider is provided.
      */
     manifestRootKeys?: readonly string[];
     /**
-     * M7-MANIFEST-002: officer threshold for manifest signature verification.
+     * Officer threshold for manifest signature verification.
      * Required when manifestProvider is provided.
      */
     manifestThreshold?: number;
     /**
-     * M7-MANIFEST-002: version store for monotonicity enforcement.
+     * Version store for monotonicity enforcement.
      * When absent, monotonicity check is skipped.
      */
     manifestVersionStore?: IManifestVersionStore;
     /**
-     * M7-MANIFEST-002: poll scheduler for background manifest refresh.
+     * Poll scheduler for background manifest refresh.
      * When absent, polling is disabled.
      */
     manifestPollScheduler?: IManifestPollScheduler;
     /**
-     * CELLO-M7-CONN-001 (DOD-CONN-3): base URL for the daemon-level HTTP manifest poll
-     * (`${directoryHttpUrl}/manifest`). The poll moved off the keystone signaling stream
-     * to unauthenticated HTTP and runs even with zero agents. Defaults to
-     * resolveDirectoryUrl(process.env). Tests inject an in-process server URL.
+     * Base URL for the daemon-level HTTP manifest poll (`${directoryHttpUrl}/manifest`). The poll runs
+     * over unauthenticated HTTP, NOT the keystone signaling stream, so it keeps running with zero
+     * agents. Defaults to resolveDirectoryUrl(process.env). Tests inject an in-process server URL.
      */
     directoryHttpUrl?: string;
     /**
-     * M7-MANIFEST-002: challenge verifier for directory step-5 identity proof.
+     * Challenge verifier for directory step-5 identity proof.
      * When absent, directory challenge verification is skipped.
      */
     challengeVerifier?: IDirectoryChallengeVerifier;
     /**
-     * M7-SIGNAL-001: injectable connect function for directory signaling stream.
+     * Injectable connect function for the directory signaling stream.
      * When absent, a stub that always rejects (directory_signaling_not_configured) is used.
      * Production: performs the full 7-step directory handshake.
      *
@@ -173,92 +173,83 @@ export interface DaemonConfig {
      */
     signalingConnect?: () => Promise<ConnectResult>;
     /**
-     * M7 Keystone (Part 1): resolves the directory endpoint to dial (GET /bootstrap).
+     * Resolves the directory endpoint to dial (GET /bootstrap).
      * When signalingConnect is absent and this is present, startDaemon builds the
      * production signalingConnect from this resolver + the daemon's primary agent
      * identity. Ignored when signalingConnect is provided directly.
      */
     directoryEndpointResolver?: () => Promise<DirectoryEndpoint | null>;
     /**
-     * CELLO-M7-DAEMON-004: injectable session-node factory for the composition root.
+     * Injectable session-node factory for the composition root.
      * When absent, the production factory (real libp2p via createNode) is used.
      * Tests inject a controllable factory to exercise the send/receive/tree path
-     * without the real transport stack — the same adapter-injection pattern
-     * DAEMON-002 established for ISessionNodeFactory.
+     * without the real transport stack.
      */
     sessionNodeFactory?: import("./session-node-manager.js").ISessionNodeFactory;
     /**
-     * CELLO-M7-MSG-001 (AC-004/AC-005): park target for the startup flush of un-acked
-     * content. On startup — BEFORE the IPC socket opens — the daemon drains retry_queue
-     * entries still awaiting a `persisted` delivery ACK and re-parks each to the relay
-     * store-and-forward queue via this function (the crash backstop, D-d). The function
-     * performs the encrypted relay deposit and is the natural emitter of
-     * content.park.deposited (it holds the recipient context).
+     * Park target for the startup flush of un-acked content. On startup — BEFORE the IPC
+     * socket opens — the daemon drains retry_queue entries still awaiting a `persisted`
+     * delivery ACK and re-parks each to the relay store-and-forward queue via this function
+     * (the crash backstop). The function performs the encrypted relay deposit and is the
+     * natural emitter of content.park.deposited (it holds the recipient context).
      *
-     * Re-home (Option A): this is supplied by the daemon's OWN send path — the daemon
-     * owns the session core, so it constructs the relay-deposit function natively (NOT a
-     * hosted CelloClient / RelayStreamManager). When absent (a daemon started without the
-     * content send path, or unit tests), the startup flush is a documented no-op
-     * (content.park.flush.deferred at WARN) and the durable awaiting entries remain queued
-     * for the next startup that has a park target.
+     * It is supplied by the daemon's OWN send path — the daemon owns the session core, so it
+     * constructs the relay-deposit function natively (never a hosted CelloClient /
+     * RelayStreamManager). When absent (a daemon started without the content send path, or
+     * unit tests), the startup flush is a no-op (content.park.flush.deferred at WARN) and the
+     * durable awaiting entries remain queued for the next startup that has a park target.
      */
     contentParkFn?: import("./retry-queue.js").ParkFn;
     /**
-     * CELLO-M7-MSG-001 (AC-001/AC-003): the TTF (time-to-flush) window, in ms, the
-     * sender waits for a `persisted` delivery ACK before handing un-acked content to the
-     * park backstop. Default 20_000 (Part-4 proposed 10–30s band). Tests inject a small
-     * value to drive TTF expiry deterministically.
+     * The TTF (time-to-flush) window, in ms, the sender waits for a `persisted` delivery ACK
+     * before handing un-acked content to the park backstop. Default 20_000. Tests inject a
+     * small value to drive TTF expiry deterministically.
      */
     contentTtfMs?: number;
     /**
-     * CELLO-M7-TRANSPORT-001: low-level dialer backing the transport selector in
+     * Low-level dialer backing the transport selector in
      * production environments (dev/staging/production). Wraps a CelloNode (direct +
      * relay circuit dial) and the daemon relay registry. Required for production
      * CELLO_ENV; for 'local'/'test' the composition root uses an in-process stub.
      */
     transportDialer?: TransportDialer;
     /**
-     * CELLO-M7-TRANSPORT-001: AutoNAT service adapter backing dialability detection
+     * AutoNAT service adapter backing dialability detection
      * in production environments. Wraps the standing-receiver node's libp2p AutoNAT
      * observable. For 'local'/'test' the composition root uses a stub (dialable=false).
      */
     autoNatService?: IAutoNatService;
     /**
-     * CELLO-M7-TRANSPORT-001: directory session negotiation adapter (WIRE-001/
-     * SIGNAL-001). cello_initiate_session calls negotiate() to obtain the
-     * FROST-signed SessionAssignment, then drives the transport selector to dial the
-     * counterparty (AC-005/AC-006/AC-008/AC-010c). When absent, cello_initiate_session
-     * reports directory_signaling_not_configured — it does NOT crash, proving the
-     * transport adapters are wired.
+     * Directory session negotiation adapter. cello_initiate_session calls negotiate() to
+     * obtain the FROST-signed SessionAssignment, then drives the transport selector to dial
+     * the counterparty. When absent, cello_initiate_session reports
+     * directory_signaling_not_configured — it does NOT crash.
      */
     sessionNegotiator?: SessionNegotiator;
     /**
-     * CELLO-M7-TRANSPORT-001: returns this daemon's relay circuit address (from the
-     * relay registry populated at directory connection) for the SessionAssignment
-     * advertised address when the standing receiver is NOT dialable (AC-004). When
-     * absent, an empty advertised relay address is used (the negotiator supplies the
-     * real one in production).
+     * Returns this daemon's relay circuit address (from the relay registry populated at
+     * directory connection) for the SessionAssignment advertised address when the standing
+     * receiver is NOT dialable. When absent, an empty advertised relay address is used (the
+     * negotiator supplies the real one in production).
      */
     getRelayCircuitAddress?: () => string;
     /**
-     * M8C-TGDOOR-1: injectable Telegram Bot API client (test override — production uses
-     * HttpTelegramBotClient, constructed from telegram_settings once configured via
-     * setTelegramSettings). Absent = TGDOOR is inert (no poller starts) until settings exist.
+     * Injectable Telegram Bot API client (test override — production uses HttpTelegramBotClient,
+     * constructed from telegram_settings once configured via setTelegramSettings). Absent = the
+     * Telegram doorbell is inert (no poller starts) until settings exist.
      */
     telegramBotClient?: TelegramBotClient;
     /**
-     * M9-CORE-001: the security gateway client. Every outbound message is screened in
-     * cello_send before sessionNodeManager.sendContent; every inbound message is screened
-     * in the inbound funnel before it enters the receive buffer. The daemon holds ONLY this
-     * narrow interface — all detection lives in the separate gateway program. When absent,
-     * the composition root falls back to a PassthroughGatewayClient (always-allow), so the
-     * seam still returns a verdict (SI-001) and pre-M9 daemons behave unchanged.
+     * The security gateway client. Every outbound message is screened in cello_send before
+     * sessionNodeManager.sendContent; every inbound message is screened in the inbound funnel
+     * before it enters the receive buffer. The daemon holds ONLY this narrow interface — all
+     * detection lives in the separate gateway program. When absent, the composition root falls
+     * back to a PassthroughGatewayClient (always-allow), so the seam still returns a verdict.
      */
     securityGateway?: SecurityGatewayClient;
 }
 /**
  * Maximum number of concurrent session nodes per daemon.
- * Outline.md §Resource Caps, DAEMON-002 AC-006.
  */
 export declare const MAX_SESSION_NODES = 32;
 /**
@@ -270,8 +261,8 @@ export declare const MAX_SESSION_NODES = 32;
  * - seal_interrupted_pending: both parties have produced and exchanged signed
  *   SEAL-INTERRUPTED leaves (a verified bilateral commitment), but the FROST
  *   threshold notarization has NOT been performed. This is a non-terminal state
- *   — it is explicitly NOT 'sealed'. See daemon.ts handleSealInterruptedFlow and
- *   the H-1 audit note for what blocks the threshold seal.
+ *   — it is explicitly NOT 'sealed'. See daemon.ts handleSealInterruptedFlow for what
+ *   blocks the threshold seal.
  * - sealed: a real FROST threshold notarization completed. Only the normal
  *   (non-interrupted) close path produces this today.
  */
@@ -279,8 +270,8 @@ export type SessionStatus = "active" | "sealed" | "interrupted" | "seal_interrup
 export interface SessionRecord {
     session_id: string;
     /**
-     * DOD-AGENT-ID-JOINKEY-1: the STABLE key this row is scoped by. Every `sessions` query joins on
-     * this, never on `agent_name`.
+     * The STABLE key this row is scoped by. Every `sessions` query joins on this, never on
+     * `agent_name`.
      */
     agent_id: string;
     /**
@@ -294,31 +285,39 @@ export interface SessionRecord {
     status: SessionStatus;
     created_at: number;
     updated_at: number;
-    /** M7-SESSION-001: leaf count at interruption. 0 if not yet set. */
+    /** Leaf count at interruption. 0 if not yet set. */
     message_count: number;
-    /** M7-SESSION-001: ISO 8601 timestamp of interruption. Null if not yet set. */
+    /** ISO 8601 timestamp of interruption. Null if not yet set. */
     interrupted_at: string | null;
     /**
-     * M7 legibility-TBS-binding: the counterparty's FROST primary (group) pubkey hex, from the
+     * The counterparty's FROST primary (group) pubkey hex, from the
      * SessionAssignment's signer_pubkey. The responder verifies the bilateral seal signature against
      * it. Null when this party initiated (it verifies against its own primary).
      */
     counterparty_primary_pubkey?: string | null;
+    /**
+     * DOD-SESSION-NAME-1: this agent's own human-readable label for the session. Null when unnamed,
+     * and unnamed MEANS something (see the column comment in session-node-manager). Local and
+     * cosmetic — it reaches no wire structure.
+     */
+    session_name?: string | null;
 }
-/** M7-SESSION-001: An interrupted session entry in the cello status response. */
+/** An interrupted session entry in the cello status response. */
 export interface InterruptedSessionInfo {
     sessionId: string;
     agentName: string;
     counterpartyPubkey: string;
     messageCount: number;
     interruptedAt: string;
+    /** DOD-SESSION-NAME-1: this agent's own label for the session; null when unnamed. */
+    sessionName: string | null;
 }
 /**
- * cello_list_sessions: one session in the discovery list for the current agent.
+ * cello_sessions: one session in the discovery list for the current agent.
  * Covers every status (active, sealed, interrupted, seal_interrupted_pending) so
- * the by-id reads (cello_get_transcript / cello_get_sealed_receipt) have a source
- * for their session ids. Timestamps are ISO 8601; interruptedAt is null unless the
- * session is/was interrupted.
+ * the by-id reads (cello_transcript / cello_sealed_receipt) have a source for their
+ * session ids. Timestamps are ISO 8601; interruptedAt is null unless the session
+ * is/was interrupted.
  */
 export interface SessionListEntry {
     sessionId: string;
@@ -331,12 +330,20 @@ export interface SessionListEntry {
     createdAt: string;
     updatedAt: string;
     interruptedAt: string | null;
-    /** MONIKER-5 AC1: the resolved display label (pet name ?? offered ?? fingerprint). */
+    /** The resolved display label (pet name ?? offered ?? fingerprint). */
     who: string;
     whoKnown: boolean;
+    /**
+     * DOD-SESSION-NAME-1: this agent's own label for the session, or null when unnamed.
+     *
+     * Returned ALONGSIDE sessionId, never instead of it — the id is what you paste into the next
+     * command. Null is a value with meaning: a session that closed cleanly through an agent usually
+     * has a name, so an unnamed closed one is a hint it did not.
+     */
+    sessionName: string | null;
 }
 /**
- * Result of a session listing (cello_list_sessions / the daemon-wide `list_sessions`). `sessions`
+ * Result of a session listing (cello_sessions / the daemon-wide `list_sessions`). `sessions`
  * is already filtered + capped at `limit`; `totalMatched` is how many matched the filter before the
  * cap, so the caller can tell the operator "showing 50 of 312".
  */

package/dist/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EACV,iBAAiB,EACjB,qBAAqB,EACrB,sBAAsB,EACtB,2BAA2B,EAC3B,aAAa,EACb,eAAe,EAChB,MAAM,2BAA2B,CAAC;AACnC,OAAO,KAAK,EAAE,eAAe,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAClF,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,yBAAyB,CAAC;AAGrE,YAAY,EAAE,qBAAqB,EAAE,CAAC;AAGtC,YAAY,EACV,iBAAiB,EACjB,qBAAqB,EACrB,sBAAsB,EACtB,2BAA2B,GAC5B,CAAC;AAGF,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAChE,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAIlE,MAAM,WAAW,MAAM;IACrB,KAAK,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IAC7D,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IAC5D,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IAC5D,KAAK,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;CAC9D;AAID,MAAM,WAAW,eAAe;IAC9B,GAAG,EAAE,MAAM,CAAC;IACZ,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;CACjB;AAID,MAAM,WAAW,UAAU;IACzB,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAClC;AAED,MAAM,WAAW,aAAa;IAC5B,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE,OAAO,CAAC;CACjB;AAED,MAAM,WAAW,gBAAgB;IAC/B,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE;QACL,IAAI,EAAE,MAAM,CAAC;QACb,OAAO,EAAE,MAAM,CAAC;QAChB,QAAQ,EAAE,MAAM,CAAC;KAClB,CAAC;CACH;AAED,MAAM,MAAM,WAAW,GAAG,aAAa,GAAG,gBAAgB,CAAC;AAI3D,MAAM,WAAW,eAAe;IAC9B,YAAY,EAAE,MAAM,CAAC;IACrB,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAChC;AAED,MAAM,MAAM,QAAQ,GAAG,WAAW,GAAG,eAAe,CAAC;AAIrD;;;;GAIG;AACH,eAAO,MAAM,4BAA4B,EAAG,uBAAgC,CAAC;AAI7E,MAAM,MAAM,UAAU,GAAG,YAAY,GAAG,QAAQ,GAAG,SAAS,GAAG,aAAa,CAAC;AAE7E,MAAM,WAAW,SAAS;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,UAAU,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;;;OAIG;IACH,uBAAuB,CAAC,EAAE,OAAO,CAAC;IAClC;;;;;OAKG;IACH,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAID,MAAM,MAAM,gBAAgB,GAAG,UAAU,GAAG,OAAO,GAAG,MAAM,GAAG,YAAY,CAAC;AAE5E,MAAM,WAAW,cAAc;IAC7B,kBAAkB,EAAE,MAAM,CAAC;IAC3B,MAAM,EAAE,gBAAgB,CAAC;CAC1B;AAID,MAAM,MAAM,uBAAuB,GAAG,WAAW,GAAG,cAAc,GAAG,MAAM,CAAC;AAE5E,MAAM,WAAW,oBAAoB;IACnC,MAAM,EAAE,SAAS,CAAC;IAClB,mBAAmB,EAAE,uBAAuB,CAAC;IAC7C,MAAM,EAAE,SAAS,EAAE,CAAC;IAKpB;;;;OAIG;IACH,uBAAuB,EAAE,OAAO,CAAC;IACjC;;;OAGG;IACH,eAAe,EAAE,MAAM,CAAC;IACxB;;;OAGG;IACH,oBAAoB,EAAE,sBAAsB,EAAE,CAAC;IAC/C;;;;OAIG;IACH,eAAe,EAAE,iBAAiB,EAAE,CAAC;CACtC;AAED,2FAA2F;AAC3F,MAAM,WAAW,iBAAiB;IAChC,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,kBAAkB,EAAE,MAAM,CAAC;IAC3B,wFAAwF;IACxF,QAAQ,EAAE,OAAO,GAAG,MAAM,GAAG,SAAS,CAAC;CACxC;AAID,MAAM,WAAW,YAAY;IAC3B,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,YAAY,EAAE,MAAM,CAAC;IACrB,cAAc,EAAE,MAAM,CAAC;IACvB,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf;;;;;;;;OAQG;IACH,gBAAgB,CAAC,EAAE,iBAAiB,CAAC;IACrC;;;OAGG;IACH,gBAAgB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACrC;;;OAGG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B;;;OAGG;IACH,oBAAoB,CAAC,EAAE,qBAAqB,CAAC;IAC7C;;;OAGG;IACH,qBAAqB,CAAC,EAAE,sBAAsB,CAAC;IAC/C;;;;;OAKG;IACH,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B;;;OAGG;IACH,iBAAiB,CAAC,EAAE,2BAA2B,CAAC;IAChD;;;;;;;;OAQG;IACH,gBAAgB,CAAC,EAAE,MAAM,OAAO,CAAC,aAAa,CAAC,CAAC;IAChD;;;;;OAKG;IACH,yBAAyB,CAAC,EAAE,MAAM,OAAO,CAAC,iBAAiB,GAAG,IAAI,CAAC,CAAC;IACpE;;;;;;OAMG;IACH,kBAAkB,CAAC,EAAE,OAAO,2BAA2B,EAAE,mBAAmB,CAAC;IAC7E;;;;;;;;;;;;;;OAcG;IACH,aAAa,CAAC,EAAE,OAAO,kBAAkB,EAAE,MAAM,CAAC;IAClD;;;;;OAKG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;;;;;OAKG;IACH,eAAe,CAAC,EAAE,eAAe,CAAC;IAClC;;;;OAIG;IACH,cAAc,CAAC,EAAE,eAAe,CAAC;IACjC;;;;;;;OAOG;IACH,iBAAiB,CAAC,EAAE,iBAAiB,CAAC;IACtC;;;;;;OAMG;IACH,sBAAsB,CAAC,EAAE,MAAM,MAAM,CAAC;IACtC;;;;OAIG;IACH,iBAAiB,CAAC,EAAE,iBAAiB,CAAC;IACtC;;;;;;;OAOG;IACH,eAAe,CAAC,EAAE,qBAAqB,CAAC;CACzC;AAID;;;GAGG;AACH,eAAO,MAAM,iBAAiB,KAAK,CAAC;AAEpC;;;;;;;;;;;;;GAaG;AACH,MAAM,MAAM,aAAa,GACrB,QAAQ,GACR,QAAQ,GACR,aAAa,GACb,0BAA0B,GAI1B,WAAW,CAAC;AAEhB,MAAM,WAAW,aAAa;IAC5B,UAAU,EAAE,MAAM,CAAC;IACnB;;;OAGG;IACH,QAAQ,EAAE,MAAM,CAAC;IACjB;;;;;OAKG;IACH,UAAU,EAAE,MAAM,CAAC;IACnB,mBAAmB,EAAE,MAAM,CAAC;IAC5B,MAAM,EAAE,aAAa,CAAC;IACtB,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,oEAAoE;IACpE,aAAa,EAAE,MAAM,CAAC;IACtB,+EAA+E;IAC/E,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B;;;;OAIG;IACH,2BAA2B,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC7C;AAED,iFAAiF;AACjF,MAAM,WAAW,sBAAsB;IACrC,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,kBAAkB,EAAE,MAAM,CAAC;IAC3B,YAAY,EAAE,MAAM,CAAC;IACrB,aAAa,EAAE,MAAM,CAAC;CACvB;AAED;;;;;;GAMG;AACH,MAAM,WAAW,gBAAgB;IAC/B,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,kBAAkB,EAAE,MAAM,CAAC;IAC3B,MAAM,EAAE,aAAa,CAAC;IACtB,yFAAyF;IACzF,QAAQ,EAAE,MAAM,GAAG,QAAQ,GAAG,QAAQ,CAAC;IACvC,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,sFAAsF;IACtF,GAAG,EAAE,MAAM,CAAC;IACZ,QAAQ,EAAE,OAAO,CAAC;CACnB;AAED;;;;GAIG;AACH,MAAM,WAAW,mBAAmB;IAClC,EAAE,EAAE,IAAI,CAAC;IACT,MAAM,EAAE,MAAM,GAAG,QAAQ,GAAG,QAAQ,GAAG,KAAK,CAAC;IAC7C,KAAK,EAAE,MAAM,CAAC;IACd,YAAY,EAAE,MAAM,CAAC;IACrB,QAAQ,EAAE,gBAAgB,EAAE,CAAC;CAC9B;AAID,eAAO,MAAM,UAAU;;;;;;;;;;CAUb,CAAC"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EACV,iBAAiB,EACjB,qBAAqB,EACrB,sBAAsB,EACtB,2BAA2B,EAC3B,aAAa,EACb,eAAe,EAChB,MAAM,2BAA2B,CAAC;AACnC,OAAO,KAAK,EAAE,eAAe,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAClF,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,yBAAyB,CAAC;AAGrE,YAAY,EAAE,qBAAqB,EAAE,CAAC;AAGtC,YAAY,EACV,iBAAiB,EACjB,qBAAqB,EACrB,sBAAsB,EACtB,2BAA2B,GAC5B,CAAC;AAGF,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAChE,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAIlE,MAAM,WAAW,MAAM;IACrB,KAAK,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IAC7D,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IAC5D,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IAC5D,KAAK,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;CAC9D;AAID,MAAM,WAAW,eAAe;IAC9B,GAAG,EAAE,MAAM,CAAC;IACZ,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;CACjB;AAID,MAAM,WAAW,UAAU;IACzB,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAClC;AAED,MAAM,WAAW,aAAa;IAC5B,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE,OAAO,CAAC;CACjB;AAED,MAAM,WAAW,gBAAgB;IAC/B,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE;QACL,IAAI,EAAE,MAAM,CAAC;QACb,OAAO,EAAE,MAAM,CAAC;QAChB,QAAQ,EAAE,MAAM,CAAC;KAClB,CAAC;CACH;AAED,MAAM,MAAM,WAAW,GAAG,aAAa,GAAG,gBAAgB,CAAC;AAI3D,MAAM,WAAW,eAAe;IAC9B,YAAY,EAAE,MAAM,CAAC;IACrB,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAChC;AAED,MAAM,MAAM,QAAQ,GAAG,WAAW,GAAG,eAAe,CAAC;AAIrD;;;;GAIG;AACH,eAAO,MAAM,4BAA4B,EAAG,uBAAgC,CAAC;AAI7E,MAAM,MAAM,UAAU,GAAG,YAAY,GAAG,QAAQ,GAAG,SAAS,GAAG,aAAa,CAAC;AAE7E,MAAM,WAAW,SAAS;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,UAAU,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;;;OAIG;IACH,uBAAuB,CAAC,EAAE,OAAO,CAAC;IAClC;;;;OAIG;IACH,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAID,MAAM,MAAM,gBAAgB,GAAG,UAAU,GAAG,OAAO,GAAG,MAAM,GAAG,YAAY,CAAC;AAE5E,MAAM,WAAW,cAAc;IAC7B,kBAAkB,EAAE,MAAM,CAAC;IAC3B,MAAM,EAAE,gBAAgB,CAAC;CAC1B;AAID,MAAM,MAAM,uBAAuB,GAAG,WAAW,GAAG,cAAc,GAAG,MAAM,CAAC;AAE5E,MAAM,WAAW,oBAAoB;IACnC,MAAM,EAAE,SAAS,CAAC;IAClB,mBAAmB,EAAE,uBAAuB,CAAC;IAC7C,MAAM,EAAE,SAAS,EAAE,CAAC;IAIpB;;;;OAIG;IACH,uBAAuB,EAAE,OAAO,CAAC;IACjC;;;OAGG;IACH,eAAe,EAAE,MAAM,CAAC;IACxB;;;OAGG;IACH,oBAAoB,EAAE,sBAAsB,EAAE,CAAC;IAC/C;;;;OAIG;IACH,eAAe,EAAE,iBAAiB,EAAE,CAAC;CACtC;AAED,kFAAkF;AAClF,MAAM,WAAW,iBAAiB;IAChC,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,kBAAkB,EAAE,MAAM,CAAC;IAC3B,wFAAwF;IACxF,QAAQ,EAAE,OAAO,GAAG,MAAM,GAAG,SAAS,CAAC;IACvC,qFAAqF;IACrF,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;CAC5B;AAID,MAAM,WAAW,YAAY;IAC3B,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,YAAY,EAAE,MAAM,CAAC;IACrB,cAAc,EAAE,MAAM,CAAC;IACvB,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf;;;;;;;;OAQG;IACH,gBAAgB,CAAC,EAAE,iBAAiB,CAAC;IACrC;;;OAGG;IACH,gBAAgB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACrC;;;OAGG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B;;;OAGG;IACH,oBAAoB,CAAC,EAAE,qBAAqB,CAAC;IAC7C;;;OAGG;IACH,qBAAqB,CAAC,EAAE,sBAAsB,CAAC;IAC/C;;;;OAIG;IACH,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B;;;OAGG;IACH,iBAAiB,CAAC,EAAE,2BAA2B,CAAC;IAChD;;;;;;;;OAQG;IACH,gBAAgB,CAAC,EAAE,MAAM,OAAO,CAAC,aAAa,CAAC,CAAC;IAChD;;;;;OAKG;IACH,yBAAyB,CAAC,EAAE,MAAM,OAAO,CAAC,iBAAiB,GAAG,IAAI,CAAC,CAAC;IACpE;;;;;OAKG;IACH,kBAAkB,CAAC,EAAE,OAAO,2BAA2B,EAAE,mBAAmB,CAAC;IAC7E;;;;;;;;;;;;OAYG;IACH,aAAa,CAAC,EAAE,OAAO,kBAAkB,EAAE,MAAM,CAAC;IAClD;;;;OAIG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;;;;;OAKG;IACH,eAAe,CAAC,EAAE,eAAe,CAAC;IAClC;;;;OAIG;IACH,cAAc,CAAC,EAAE,eAAe,CAAC;IACjC;;;;;OAKG;IACH,iBAAiB,CAAC,EAAE,iBAAiB,CAAC;IACtC;;;;;OAKG;IACH,sBAAsB,CAAC,EAAE,MAAM,MAAM,CAAC;IACtC;;;;OAIG;IACH,iBAAiB,CAAC,EAAE,iBAAiB,CAAC;IACtC;;;;;;OAMG;IACH,eAAe,CAAC,EAAE,qBAAqB,CAAC;CACzC;AAID;;GAEG;AACH,eAAO,MAAM,iBAAiB,KAAK,CAAC;AAEpC;;;;;;;;;;;;;GAaG;AACH,MAAM,MAAM,aAAa,GACrB,QAAQ,GACR,QAAQ,GACR,aAAa,GACb,0BAA0B,GAI1B,WAAW,CAAC;AAEhB,MAAM,WAAW,aAAa;IAC5B,UAAU,EAAE,MAAM,CAAC;IACnB;;;OAGG;IACH,QAAQ,EAAE,MAAM,CAAC;IACjB;;;;;OAKG;IACH,UAAU,EAAE,MAAM,CAAC;IACnB,mBAAmB,EAAE,MAAM,CAAC;IAC5B,MAAM,EAAE,aAAa,CAAC;IACtB,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,oDAAoD;IACpD,aAAa,EAAE,MAAM,CAAC;IACtB,+DAA+D;IAC/D,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B;;;;OAIG;IACH,2BAA2B,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5C;;;;OAIG;IACH,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC9B;AAED,iEAAiE;AACjE,MAAM,WAAW,sBAAsB;IACrC,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,kBAAkB,EAAE,MAAM,CAAC;IAC3B,YAAY,EAAE,MAAM,CAAC;IACrB,aAAa,EAAE,MAAM,CAAC;IACtB,qFAAqF;IACrF,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;CAC5B;AAED;;;;;;GAMG;AACH,MAAM,WAAW,gBAAgB;IAC/B,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,kBAAkB,EAAE,MAAM,CAAC;IAC3B,MAAM,EAAE,aAAa,CAAC;IACtB,yFAAyF;IACzF,QAAQ,EAAE,MAAM,GAAG,QAAQ,GAAG,QAAQ,CAAC;IACvC,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,uEAAuE;IACvE,GAAG,EAAE,MAAM,CAAC;IACZ,QAAQ,EAAE,OAAO,CAAC;IAClB;;;;;;OAMG;IACH,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;CAC5B;AAED;;;;GAIG;AACH,MAAM,WAAW,mBAAmB;IAClC,EAAE,EAAE,IAAI,CAAC;IACT,MAAM,EAAE,MAAM,GAAG,QAAQ,GAAG,QAAQ,GAAG,KAAK,CAAC;IAC7C,KAAK,EAAE,MAAM,CAAC;IACd,YAAY,EAAE,MAAM,CAAC;IACrB,QAAQ,EAAE,gBAAgB,EAAE,CAAC;CAC9B;AAID,eAAO,MAAM,UAAU;;;;;;;;;;CAUb,CAAC"}

package/dist/types.js

@@ -15,7 +15,6 @@ export const STANDING_RECEIVER_AGENT_NAME = "__standing_receiver__";
 // --- Session node types ---
 /**
  * Maximum number of concurrent session nodes per daemon.
- * Outline.md §Resource Caps, DAEMON-002 AC-006.
  */
 export const MAX_SESSION_NODES = 32;
 // --- Error codes ---

package/dist/types.js.map

@@ -1 +1 @@
-{"version":3,"file":"types.js","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AA8EH,gCAAgC;AAEhC;;;;GAIG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAG,uBAAgC,CAAC;AAkO7E,6BAA6B;AAE7B;;;GAGG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,EAAE,CAAC;AAqGpC,sBAAsB;AAEtB,MAAM,CAAC,MAAM,UAAU,GAAG;IACxB,yBAAyB,EAAE,2BAA2B;IACtD,yBAAyB,EAAE,2BAA2B;IACtD,iBAAiB,EAAE,mBAAmB;IACtC,oBAAoB,EAAE,sBAAsB;IAC5C,6BAA6B,EAAE,+BAA+B;IAC9D,8BAA8B,EAAE,gCAAgC;IAChE,oBAAoB,EAAE,sBAAsB;IAC5C,4BAA4B,EAAE,8BAA8B;IAC5D,6BAA6B,EAAE,+BAA+B;CACtD,CAAC"}
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AA8EH,gCAAgC;AAEhC;;;;GAIG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAG,uBAAgC,CAAC;AAyN7E,6BAA6B;AAE7B;;GAEG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,EAAE,CAAC;AAqHpC,sBAAsB;AAEtB,MAAM,CAAC,MAAM,UAAU,GAAG;IACxB,yBAAyB,EAAE,2BAA2B;IACtD,yBAAyB,EAAE,2BAA2B;IACtD,iBAAiB,EAAE,mBAAmB;IACtC,oBAAoB,EAAE,sBAAsB;IAC5C,6BAA6B,EAAE,+BAA+B;IAC9D,8BAA8B,EAAE,gCAAgC;IAChE,oBAAoB,EAAE,sBAAsB;IAC5C,4BAA4B,EAAE,8BAA8B;IAC5D,6BAA6B,EAAE,+BAA+B;CACtD,CAAC"}

package/dist/vocabulary.d.ts

@@ -1,12 +1,12 @@
 /**
- * DOD-ONBOARD-HELP-1 §2b — the ONE vocabulary.
+ * The ONE vocabulary.
  *
  * A capability has exactly one name, and that name renders differently on each surface:
  *
  *     capability "agents"  →  MCP tool `cello_agents`  ·  CLI command `cello agents`
  *
- * The rule (Andre, 2026-07-11): **an MCP tool's name is `cello_` + the CLI command name**,
- * snake_cased, keeping any sub-verb. Humans and agents learn a capability ONCE.
+ * The rule: **an MCP tool's name is `cello_` + the CLI command name**, snake_cased, keeping any
+ * sub-verb. Humans and agents learn a capability ONCE.
  *
  * Why this table exists rather than three lists of string literals:
  *
@@ -42,9 +42,9 @@ export interface DualSurfaceVerb {
  */
 export declare const DUAL_SURFACE_VERBS: readonly DualSurfaceVerb[];
 /**
- * Tools that exist ONLY on the MCP surface. They are the DOD-CUSTODY-DAEMON-1 stubs — the daemon
- * handlers return `not_implemented`, so there is deliberately no CLI command to build a second
- * broken path to. Listed so the audit test can tell "known MCP-only" from "stale name".
+ * Tools that exist ONLY on the MCP surface. Their daemon handlers return `not_implemented`, so
+ * there is deliberately no CLI command to build a second broken path to. Listed so the audit test
+ * can tell "known MCP-only" from "stale name".
  */
 export declare const MCP_ONLY_TOOLS: readonly string[];
 /**
@@ -59,27 +59,22 @@ export declare const NON_TOOL_IDENTIFIERS: readonly string[];
 /** Every `cello_*` token the daemon is ALLOWED to name in guidance. Anything else is a bug. */
 export declare function knownToolNames(): ReadonlySet<string>;
 /**
- * CLI verbs that NO LONGER EXIST (DOD-ONBOARD-HELP-1 §2, clean renames — no aliases).
+ * CLI verbs that DO NOT EXIST. No string anywhere may hand one of these to an operator.
  *
- * Why this list exists as well as the tool audit: the tool audit matches `cello_*` tokens, so it is
- * structurally BLIND to a dead *CLI* verb — `cello register` is just prose to it. That blindness is
- * exactly how three dead-command instructions survived a green build in the first cut of this story
- * (the missing-token onboarding error, an unregistered-agent warning, and relay-receipts' own usage
- * line all still said `cello register` / `cello receipts`). A user handed a command that does not
- * dispatch is worse off than one handed nothing.
+ * This list is needed IN ADDITION to the tool audit: that audit matches `cello_*` tokens, so it is
+ * structurally BLIND to a dead *CLI* verb — `cello register` is just prose to it. A user handed a
+ * command that does not dispatch is worse off than one handed nothing.
  *
- * Anchoring is by NEGATIVE LOOKAHEAD, not a trailing space — see deadCliVerbPattern() for why the
- * space failed.
+ * Anchoring is by NEGATIVE LOOKAHEAD, not a trailing space — see deadCliVerbPattern().
  */
 export declare const DEAD_CLI_VERBS: readonly string[];
 /**
  * Match any dead CLI verb, wherever it is SPOKEN — the one regex both audits share.
  *
- * The negative lookahead `(?![-\w])` is what makes this work, and the first cut got it wrong: it
- * anchored on a trailing SPACE (`"cello register "`), which review broke immediately — a verb
- * followed by a quote, period, backtick, paren or comma slipped straight through, and a live string
- * (`'cello register'`, in the Hermes plugin scaffolded onto the operator's disk) was sailing past a
- * green audit. An audit defeated by a full stop is not an audit.
+ * The negative lookahead `(?![-\w])` is load-bearing; do NOT weaken it to a trailing SPACE. A verb
+ * followed by a quote, period, backtick, paren or comma would slip straight through, and dead verbs
+ * appear inside quotes and at end of sentence in real guidance strings. An audit defeated by a full
+ * stop is not an audit.
  *
  * The lookahead still lets the LIVE commands through, because each dead verb is a strict prefix of
  * its replacement: `cello register-agent`, `cello close-session`, `cello initiate-session` all have
@@ -87,7 +82,7 @@ export declare const DEAD_CLI_VERBS: readonly string[];
  */
 export declare function deadCliVerbPattern(): RegExp;
 /**
- * MCP tool names this story RENAMED AWAY. Nothing may hand one of these to an agent again.
+ * MCP tool names that DO NOT EXIST. Nothing may hand one of these to an agent.
  *
  * Distinct from `knownToolNames()` (an allowlist: "every cello_* token must be in the table"). That
  * allowlist works inside the daemon, where every `cello_*` token IS a tool name — but it cannot be
@@ -96,12 +91,18 @@ export declare function deadCliVerbPattern(): RegExp;
  * assets, plain config identifiers (`cello_socket_path`, `cello_dir`). An allowlist there would
  * either drown in false positives or be so riddled with exceptions it stopped meaning anything.
  *
- * So outside the daemon we assert the DENYLIST instead: whatever else a string says, it must not
- * name a tool we deleted. That is precisely the regression that shipped — the Hermes `platform_hint`
- * told the operator's agent to call `cello_check_notifications` and `cello_list_sessions` after both
- * had ceased to exist.
+ * So outside the daemon assert the DENYLIST instead: whatever else a string says, it must not name a
+ * deleted tool. The exposure is real — non-code assets ship to the operator's disk and instruct
+ * their agent (the Hermes `platform_hint` is a live example).
  */
 export declare const RENAMED_AWAY_TOOLS: readonly string[];
+/**
+ * Rewrite MCP tool names in a guidance string into the CLI verbs an operator would type.
+ *
+ * Only `cello_*` tokens in DUAL_SURFACE_VERBS are rewritten. An MCP-only tool has no CLI verb to
+ * offer, so it is left alone — inventing one would send the operator to a command that does not
+ * exist, which is the exact failure this whole mechanism prevents.
+ */
 export declare function toCliGuidance(text: string): string;
 /** The client surfaces the daemon renders guidance for. Recorded per connection at `ipc.connect`. */
 export type ClientSurface = "cli" | "mcp";
@@ -112,11 +113,10 @@ export type ClientSurface = "cli" | "mcp";
  * cannot forget it and a new guidance string cannot drift. MCP callers get the response verbatim —
  * the source strings already hold the canonical MCP names.
  *
- * RECURSES into nested objects and arrays. The first cut only rewrote a TOP-LEVEL `guidance`, which
- * left real instructions per-surface-wrong: `cello inbox`'s rename notices live at
- * `agents[i].rename_notices[j].notice` and told a CLI operator to call `cello_contact_set_moniker`
- * with JSON arguments — a thing they cannot type. A choke point that only covers the easy shape is
- * not a choke point; it just moves the leak somewhere less visible.
+ * MUST RECURSE into nested objects and arrays; rewriting only a TOP-LEVEL `guidance` is not enough.
+ * Real instructions live deep — `cello inbox`'s rename notices sit at
+ * `agents[i].rename_notices[j].notice`. A choke point that only covers the easy shape is not a choke
+ * point; it just moves the leak somewhere less visible.
  */
 export declare function renderForSurface(result: unknown, surface: ClientSurface): unknown;
 //# sourceMappingURL=vocabulary.d.ts.map

package/dist/vocabulary.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"vocabulary.d.ts","sourceRoot":"","sources":["../src/vocabulary.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAEH,oGAAoG;AACpG,MAAM,WAAW,eAAe;IAC9B,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;CACb;AAED;;;;;;GAMG;AACH,eAAO,MAAM,kBAAkB,EAAE,SAAS,eAAe,EA6BxD,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,cAAc,EAAE,SAAS,MAAM,EAI3C,CAAC;AAEF;;;;;;;GAOG;AACH,eAAO,MAAM,oBAAoB,EAAE,SAAS,MAAM,EAAsB,CAAC;AAEzE,+FAA+F;AAC/F,wBAAgB,cAAc,IAAI,WAAW,CAAC,MAAM,CAAC,CAMpD;AAED;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,cAAc,EAAE,SAAS,MAAM,EAU3C,CAAC;AASF;;;;;;;;;;;;GAYG;AACH,wBAAgB,kBAAkB,IAAI,MAAM,CAI3C;AAED;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,kBAAkB,EAAE,SAAS,MAAM,EAY/C,CAAC;AAqCF,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAUlD;AAED,qGAAqG;AACrG,MAAM,MAAM,aAAa,GAAG,KAAK,GAAG,KAAK,CAAC;AAU1C;;;;;;;;;;;;GAYG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,aAAa,GAAG,OAAO,CAGjF"}
+{"version":3,"file":"vocabulary.d.ts","sourceRoot":"","sources":["../src/vocabulary.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAEH,oGAAoG;AACpG,MAAM,WAAW,eAAe;IAC9B,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;CACb;AAED;;;;;;GAMG;AACH,eAAO,MAAM,kBAAkB,EAAE,SAAS,eAAe,EA8BxD,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,cAAc,EAAE,SAAS,MAAM,EAI3C,CAAC;AAEF;;;;;;;GAOG;AACH,eAAO,MAAM,oBAAoB,EAAE,SAAS,MAAM,EAAsB,CAAC;AAEzE,+FAA+F;AAC/F,wBAAgB,cAAc,IAAI,WAAW,CAAC,MAAM,CAAC,CAMpD;AAED;;;;;;;;GAQG;AACH,eAAO,MAAM,cAAc,EAAE,SAAS,MAAM,EAS3C,CAAC;AASF;;;;;;;;;;;GAWG;AACH,wBAAgB,kBAAkB,IAAI,MAAM,CAI3C;AAED;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,kBAAkB,EAAE,SAAS,MAAM,EAW/C,CAAC;AA8BF;;;;;;GAMG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAUlD;AAED,qGAAqG;AACrG,MAAM,MAAM,aAAa,GAAG,KAAK,GAAG,KAAK,CAAC;AAU1C;;;;;;;;;;;GAWG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,aAAa,GAAG,OAAO,CAGjF"}