@commonlyai/cli 0.1.196 → 0.1.198

package/node_modules/@commonlyai/seats/README.md

@@ -15,12 +15,11 @@ It is private and is not published on its own. `@commonlyai/cli` depends on it a
 - Operator-pinned fleet seats select their CLI path in each seat's local `run.sh` launcher,
   outside this repo. Update that pin and restart the seat to load a release.
   Global CLI installs must be upgraded too; publishing does not update a running seat.
-- Check the running wrapper's CLI path and the live spawn argv to see what it runs
-  ([diagnosis guide](../../docs/runbooks/diagnosing-a-silent-seat.md#2-read-the-live-spawn--the-prompt-is-in-argv)).
+- Check the running wrapper's CLI path and the live spawn argv to see what it runs.
   The registry describes configuration; it does not prove what was loaded.
 
 **Rule:** nothing here imports Commonly code. An adapter that needs Commonly policy (the memory preamble, the legacy sandbox-trust names, the fleet seat-model switch) takes it as a host object through its factory, for example `createHermesAdapter(host)`. The CLI binds that host in `cli/src/lib/adapters/<name>.js`. `cli/__tests__/seats-package.test.mjs` enforces the import rule and checks that the tarball carries every source file.
 
-The extraction plan is D62, extract-in-place.
+The extraction plan is extract-in-place.
 
 **Run record.** The trace store writes each run as a versioned, hash-chained JSONL record. It covers who granted which agent what access for which task, who approved each call, what was attempted, and the result. A tool outside this package can read, verify and export it to OTLP. The format is specified in [`docs/record-v1.md`](docs/record-v1.md), and a generated sample is in [`docs/examples/`](docs/examples/).

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@commonlyai/cli",
-  "version": "0.1.196",
+  "version": "0.1.198",
   "license": "Apache-2.0",
   "description": "The Commonly CLI — connect agents, manage pods, iterate fast",
   "type": "module",

package/src/commands/agent.js

@@ -178,8 +178,7 @@ export const NO_AGENT_CLI_CODE = 'no_agent_cli';
  * workspace, and an environment that is absent or enforces nothing (a record
  * from before bootstrap applied the default, or one attached without an
  * environment file). Such a record is told how to pick the default up; it is
- * not rewritten here (Cofounder, 2026-10-16: none were found outside our own
- * tests).
+ * not rewritten here.
  */
 export const savedSeatLacksDefaultSandbox = (record) => Boolean(record)
   && ADAPTERS_WITH_DEFAULT_SANDBOX.has(record.adapter)
@@ -717,7 +716,7 @@ export const assertSandboxDeclaredForPublicPod = async ({
     );
   }
 
-  // Normalized FIRST (Vera 71715, Wren 71718): the predicate below reads a
+  // Normalized FIRST: the predicate below reads a
   // legacy `internal` record as the `public` it means, the same mapping the
   // attach gate and both adapters use. Reading it raw refused a record that
   // means public one call before the gate #1840 fixes — TASK-113 claims
@@ -904,7 +903,7 @@ export const updateAgentConfiguration = async ({
  * The sandbox an attach will actually run under — derived, then gated.
  *
  * The trust is normalized ONCE, before it is used for anything. A stored
- * `internal` means `public` (environment.js, Wren 69585), and resolving the mode
+ * `internal` means `public` (environment.js), and resolving the mode
  * off the raw value made this gate disagree with the adapters in BOTH
  * directions: `{ trust: 'internal' }` with no declared mode left the attach-time
  * mode at `'none'` and refused nothing here, and `internal` beside
@@ -917,8 +916,7 @@ export const updateAgentConfiguration = async ({
  * either way; what was wrong is that this gate's verdict contradicted theirs, and
  * its refusal for the `mode: 'none'` shape landed later, at adapter spawn, after
  * attach had already published and minted. Normalizing here makes the two agree
- * and puts the refusal where the user can see it (Kai, TASK-113; re-measured at
- * source after Vera 71664).
+ * and puts the refusal where the user can see it (TASK-113).
  *
  * Whether the resolved mode is AVAILABLE here — bwrap installed, macOS for
  * Seatbelt, the codex permission-profile version — is deliberately not this
@@ -932,7 +930,7 @@ export const updateAgentConfiguration = async ({
  * codex.js:546) and passed the normalized object on, which is why their suites
  * confined a legacy record all along; the grant-broker guard normalized for its
  * own trust check and then handed the resolver the raw object, so its symptom was
- * a false `sandbox_mode_unenforceable` refusal (Vera 71676). Both are settled on
+ * a false `sandbox_mode_unenforceable` refusal. Both are settled on
  * main now — the resolver reads the effective trust (mode.js:38) and the guard
  * imports the same reader from environment.js (grant-broker-guard.js:186) — so
  * this helper needs no coupling to them: it normalizes once, here, before its own
@@ -944,7 +942,7 @@ export const resolveAttachSandbox = ({
   // An adapter that enforces one confined shape of its own (dsh: Seatbelt with a
   // restricted network and NO trust) says so here, and its check is the one that
   // decides: the trust-keyed gates below cannot express that shape, so before
-  // this they refused the only environment dsh accepts (D106). The adapter's
+  // this they refused the only environment dsh accepts. The adapter's
   // check throws on every other shape, so this admits nothing it would refuse.
   if (typeof adapter?.confinesOwnSandbox === 'function' && adapter.confinesOwnSandbox(environment)) {
     return { mode: environment.sandbox.mode, trust: environment.sandbox.trust };
@@ -967,7 +965,7 @@ export const resolveAttachSandbox = ({
       `sandbox.trust=${trust} requires an enforced sandbox mode; refusing to attach unsandboxed`,
     );
   }
-  // Moved in from the call site (Vera 71675): this is the check the raw compare
+  // Moved in from the call site: this is the check the raw compare
   // used to fail closed on, refusing `internal` beside `mode: 'workspace'`. It is
   // pure — a mode and an adapter name — so it belongs with the derivation, and
   // its witnesses live beside it.
@@ -1490,7 +1488,7 @@ export const performRun = ({
   // (`daemon-supervisor.js`); this is the same predicate at the only other site
   // that can see the record — same code, so one refusal with two emitters.
   //
-  // IN MEMORY, RECORD UNTOUCHED (wren 71641): the withheld environment is what
+  // IN MEMORY, RECORD UNTOUCHED: the withheld environment is what
   // the adapter spawns with, and the stored record keeps its broker, so the
   // daemon stays the layer that judges a host it knows. Applied once for the
   // run rather than per turn: `agent run` reads its record once at boot.
@@ -1903,7 +1901,7 @@ export const performRun = ({
     const memoryWithheld = Boolean(placement.reason);
     const memoryLongTerm = memoryWithheld ? undefined : await readLongTerm(client, { onError });
 
-    // Sharpen TASK-129: focus is a turn-start read, not an enqueue-time
+    // TASK-129: focus is a turn-start read, not an enqueue-time
     // snapshot. Read through the authorized runtime context route immediately
     // before spawn so queued events observe the current revision. The helper
     // disables pod-skill synthesis and throws on failure; the surrounding
@@ -1997,8 +1995,8 @@ export const performRun = ({
     try {
       opened = await lease.open();
     } catch (err) {
-      // A VERDICT IS NOT A CRASH, AND IT IS NOT A NO-OP (wren 72153, vera
-      // 72157). Letting it escape as a bare throw left `turnResult` undefined,
+      // A VERDICT IS NOT A CRASH, AND IT IS NOT A NO-OP.
+      // Letting it escape as a bare throw left `turnResult` undefined,
       // so `claimReleaseFor` returned the legacy holder-only DELETE — right for
       // a transient failure, wrong for a refusal that recurs on every
       // redelivery: the wake loops forever with one local log line as its only
@@ -2409,7 +2407,7 @@ export const performRun = ({
     // its batch and chose silence; one that printed nothing may have crashed,
     // timed out or lost its route without saying so. The bare `no_action`
     // stays the sentinel's alone, because a digest counts as read only on
-    // that (sable, #2753). Release, hand-off and spawn counting treat
+    // that (#2753). Release, hand-off and spawn counting treat
     // `empty-output` exactly as they treat a bare decline.
     if (!delivered && !replyText) return { outcome: 'no_action', reason: EMPTY_OUTPUT };
     return { outcome: delivered ? 'posted' : 'no_action' };

package/src/lib/adapters/claude.js

@@ -105,8 +105,8 @@ const DEFAULT_TIMEOUT_MS = (() => {
 
 const buildPrompt = buildMemoryPreamble;
 
-// The working habits a private claude seat is taught on a fresh session (D48,
-// TASK-545). Parallel reads live here because only this CLI has a subagent
+// The working habits a private claude seat is taught on a fresh session
+// (TASK-545). Parallel reads live here because only this CLI has a subagent
 // tool; codex is passed row slicing alone. A public seat is passed neither: its
 // argv allows Read and the MCP under dontAsk, so it has no subagent to spawn,
 // and it answers strangers rather than working board rows.
@@ -841,7 +841,7 @@ const prepareArgv = async (innerArgv, ctx) => {
   // A public trust is ONE contract on both platforms: the jail bounds the
   // filesystem and the policy bounds the tools. The bwrap branch below used to
   // get the jail only — a derived Linux seat kept Bash/Write/WebFetch and ran on
-  // the operator's own Claude settings inside the namespace (Vera 69578).
+  // the operator's own Claude settings inside the namespace.
   const publicBwrapSandbox = sandboxTrust === 'public' && sandboxMode === 'bwrap';
   // A workspace seat on Linux: the same jail, with the workspace tier's policy
   // and a HOME of its own outside the project.
@@ -867,7 +867,7 @@ const prepareArgv = async (innerArgv, ctx) => {
   // above; anything else that lands here (the literal 'none', a typo, a
   // non-string) used to fall through to the bare `claude` spawn below — an
   // unconfined seat with a public record, which is how a record can claim
-  // confinement it never applies (Vera 69548).
+  // confinement it never applies.
   if (isConfinedTrust(sandboxTrust) && !publicNativeSandbox && sandboxMode !== 'bwrap') {
     throw new Error(
       `${sandboxTrust} Claude agents require an enforced sandbox mode `
@@ -929,7 +929,7 @@ const prepareArgv = async (innerArgv, ctx) => {
   if (publicBwrapSandbox || workspaceBwrapSandbox) {
     // The mode is chosen here, so the mechanism is verified here: a missing
     // bwrap must fail the seat's derivation with an actionable message, not
-    // every one of its spawns with a bare ENOENT (Wren 69586). On a non-Linux
+    // every one of its spawns with a bare ENOENT. On a non-Linux
     // host this reports the macOS-only message, same as the wrapper would.
     const bwrap = (ctx._detectBwrap || detectBwrap)();
     if (!bwrap.available) {
@@ -1043,7 +1043,7 @@ export default {
     const seatModel = requireSeatModel(rawCtx.environment, 'claude');
     // `sandbox.trust: 'internal'` is refused for new declarations and read as
     // `public` for a record that already carries it; such a seat is confined
-    // where it can be and refuses to derive where it cannot (Wren 69585).
+    // where it can be and refuses to derive where it cannot.
     // Resolved ONCE here and threaded to BOTH consumers — the public-state
     // preparation below and the argv builder — because two independent reads of
     // one declaration is exactly how this seat crashed with "public Claude
@@ -1091,9 +1091,9 @@ export default {
     // present in one but not the other means a retry silently runs a different
     // model than the turn it is replacing — the same drifting-copy shape that
     // has bitten this codebase repeatedly.
-    // `effort` rides in the same array for the same reason: Sam's 2026-09-01
-    // order ("flip all fable agents into fable 5.1 with high or above
-    // effort") needs both facts to reach every spawn, including the
+    // `effort` rides in the same array for the same reason: an order
+    // like "flip all fable agents into fable 5.1 with high or above
+    // effort" needs both facts to reach every spawn, including the
     // session-recovery retry, or a retry runs at a different effort than the
     // turn it replaces.
     const modelArgs = [
@@ -1133,7 +1133,7 @@ export default {
       // Trust is normalized at entry (legacy `internal` reads as public). The
       // MCP policy follows trust alone, whatever confines the seat: a public
       // bwrap seat needs a host-prepared build exactly as a Seatbelt one does
-      // (Rhea on #2247).
+      // (#2247).
       if (publicNativeSandbox) {
         publicClaudeState = await preparePublicClaudeState(ctx);
       } else if (workspaceBwrapSandbox) {
@@ -1210,7 +1210,7 @@ export default {
     } catch (err) {
       // A public seat's refusal is not a session-store failure, whatever its
       // message happens to contain: it must reach the run loop, never the
-      // fresh-session retry below (Rhea on #2247).
+      // fresh-session retry below (#2247).
       if (err?.code === PUBLIC_MCP_UNAVAILABLE_CODE) throw err;
       // Self-heal against a corrupted session store. If the persisted id is
       // already in use (or claude has forgotten about it), discard it and

package/src/lib/adapters/codex.js

@@ -115,7 +115,7 @@ const buildPrompt = buildMemoryPreamble;
 //     when they also carry a `command`. `auditDeclaredMcp` classifies by
 //     `transport` and never judges the command of an entry that declared an
 //     http one, so emitting it here executes a command the guard did not
-//     approve — the case Vera measured on 2026-09-18 (Connectors 69774).
+//     approve — a case measured on 2026-09-18.
 //   - Token-bearing values ride through `env_vars`, never a `-c ...env=...`
 //     argv override. Command lines are visible to other same-user processes
 //     unless the OS sandbox blocks process inspection; keeping bearer tokens
@@ -661,7 +661,7 @@ export default {
     // undefined and '' as absence itself; it does not need a guard, it needs
     // the value.
     //
-    // Codex has no subagent tool, so of D48's two habits (TASK-545) it is
+    // Codex has no subagent tool, so of the two habits (TASK-545) it is
     // taught row slicing alone; claude.js adds parallel reads. A public seat
     // answers strangers rather than working board rows, so it is taught neither.
     const fullPrompt = buildPrompt(prompt, ctx.memoryLongTerm, {

package/src/lib/adapters/dsh.js

@@ -59,7 +59,7 @@ export const assertPrivateDsh = (environment = {}) => { isConfinedDsh(environmen
  * The macOS developer tools a confined writer needs for git, granted read-only.
  * /usr/bin/git is an xcrun shim: inside the sandbox it cannot read the tools it
  * forwards to, so `git` fails with "No developer tools were found" and a writer
- * cannot commit (D106). Returns null when no tools are installed; the seat then
+ * cannot commit. Returns null when no tools are installed; the seat then
  * runs without git rather than failing.
  *
  * DEVELOPER_DIR and xcode-select are both settable by whoever starts the seat,
@@ -333,7 +333,7 @@ export default {
   requiresModel: true,
   name: 'dsh', runtimeType: 'dsh', supportsProvider: true,
 
-  // The attach gate defers to this for dsh's one confined shape (D106).
+  // The attach gate defers to this for dsh's one confined shape.
   confinesOwnSandbox: (environment) => isConfinedDsh(environment),
 
   async validateEnvironment(environment, workspacePath) {

package/src/lib/adapters/pi.js

@@ -100,7 +100,7 @@ const substitutePlaceholders = (value, ctx) => {
  * deliberately not friendlier than the guard's — a normalized `'HTTP'` or a
  * padded `' http '` is a shape the guard refuses as an unknown transport, and an
  * adapter that accepted one would be running something the guard never judged
- * (Vera, Connectors 69776). The schema admits `http`/`stdio`/`sse`
+ * The schema admits `http`/`stdio`/`sse`
  * (environment.js:236) and admits an ABSENT transport, which the guard reads as
  * stdio; that is what this reads too.
  */
@@ -129,8 +129,7 @@ const originOf = (value) => {
  * environment is not usable for this: the kernel keeps the copy the process was
  * started with, so a same-user child could read the token back with
  * `ps eww $PPID` / `/proc/$PPID/environ` even after the bridge deleted its own
- * copy — which is what the previous channel did, and the row this closes
- * (Vera, Connectors).
+ * copy — which is what the previous channel did, and the row this closes.
  *
  * WHICH shape an entry becomes is decided by `transport` — the same field, read
  * with the same default and the same exact comparison the daemon's
@@ -141,7 +140,7 @@ const originOf = (value) => {
  * `${COMMONLY_AGENT_TOKEN}` in the command is one of the known placeholders), and
  * a presence-classifier then ran that command as stdio with the real token
  * substituted. The guard's judgement and the adapter's disagreed, and the adapter
- * is what executes (Vera, Connectors 69774).
+ * is what executes.
  *
  * The http half also enforces the guard's own origin rule, so the HTTP half does
  * not depend on a guard that may not be on the machine: `auditDeclaredMcp`
@@ -153,7 +152,7 @@ const originOf = (value) => {
  *
  * The grant broker is refused outright, by PATH rather than by entry name: it is
  * the one http entry that carries authority rather than data, and pi confines on
- * no host. wren's ruling for TASK-063 (`isGrantBrokerUrl` in pi-mcp-client.mjs),
+ * no host. The ruling for TASK-063 (`isGrantBrokerUrl` in pi-mcp-client.mjs),
  * the daemon-side half of the same refusal the server makes at the projection —
  * this is the half that holds on deploy skew, when the row names no adapter for
  * the server to key on, and in any backend older than the refusal.
@@ -162,7 +161,7 @@ const originOf = (value) => {
  * a declared stdio command is executed with no allowlist check, here and in both
  * sibling adapters, so it depends entirely on the guard — `auditDeclaredMcp`
  * admits only the shipped commonly MCP server or a command already present in the
- * local record, and that rule exists nowhere else (Vera, 69778; TASK-069).
+ * local record, and that rule exists nowhere else (TASK-069).
  */
 export const resolveMcpServers = (mcpServers, ctx = {}) => {
   const carried = [];
@@ -295,7 +294,7 @@ export const sessionExists = async (sessionDir, sessionId) => {
  * one does not start.
  *
  * The trust is read THROUGH the legacy table (`effectiveSandboxTrust`), not
- * raw. A stored `internal` means `public` (Vera 69592, Wren 69585) and every
+ * raw. A stored `internal` means `public` and every
  * other gate in this package resolves it that way: the attach path
  * (`agent.js`), the mode resolver (`sandbox/mode.js`) and the grant-broker
  * guard. Reading it raw here made this gate the one site that failed OPEN — a

package/src/lib/daemon-supervisor.js

@@ -238,7 +238,7 @@ export const createDaemonSupervisor = ({
     // seat RUNS under, and `withholdGrantBroker` asks the same question the
     // server asks (`can this seat confine a granter's authority?`) for the cases
     // the server cannot see — a row naming no adapter, a backend older than the
-    // refusal, a record written by hand. Entry-level per wren 69829: the broker
+    // refusal, a record written by hand. Entry-level: the broker
     // entry is withheld and the seat still starts, because it was never promised
     // confinement. `record.instanceUrl` is what makes the injected url
     // identifiable at all — the record holds the UNRESOLVED

package/src/lib/enforcement.js

@@ -635,7 +635,7 @@ export const splitForChat = (text, { limit = 400 } = {}) => {
  *                                    text and post one message — the reply's
  *                                    own opening plus the file card.
  *
- * The thread rung is new (Sam 57691) and it replaces attachment as the answer
+ * The thread rung is new and it replaces attachment as the answer
  * for PROSE overflow. Before threads existed, a long analysis had nowhere to
  * go but a file, and that was the right workaround. It is now the wrong one:
  * an attachment is un-quotable, un-followable, and an all-or-nothing read,
@@ -678,7 +678,7 @@ export const deliverChatReply = async ({
   //
   // TASK-535 — the send-time freshness hold. The backend answers 409
   // `unseen_messages` when other members posted after this seat's last
-  // recorded tail read. A turn that ran ~43 minutes (rhea, 2026-10-25 10:01Z)
+  // recorded tail read. A turn that ran ~43 minutes
   // hit it on the thread headline, the attach card and the split fallback in
   // turn, so the reply was lost and its 10 events re-ran. A retry without an
   // override cannot succeed — every rung posts to the same guarded route.
@@ -771,7 +771,7 @@ export const deliverChatReply = async ({
   // its rendering. The tone contract's own rule covers it: over ~800 chars of
   // ONE indivisible thing is a document, not a message — attach it. Without
   // this check a 659-char fence rode the single/split branches straight past
-  // the gate (found by the fleet's implementation audit, Sharpen msg 53018).
+  // the gate (found by the fleet's implementation audit).
   const hasIndivisibleOversize = chunks.some((c) => c.length > attachThreshold);
   if (chunks.length <= 1 && !hasIndivisibleOversize) {
     const response = await postMessage({ content: chunks[0] ?? text });

package/src/lib/environment.js

@@ -75,9 +75,9 @@ const findInlineProviderCredentialField = (value, path) => {
 // daemon path it was silently inert — claude fell through to a bare unconfined
 // spawn and codex took `--dangerously-bypass-approvals-and-sandbox` — so a
 // declaration that reads as "confine me, not as a public agent" meant the
-// opposite of what it said (Vera 69592). It is refused for new declarations
+// opposite of what it said. It is refused for new declarations
 // above, and a record that already carries it is resolved TOWARD confinement,
-// never toward the bare spawn (Wren 69585): `internal` is read as `public`, so
+// never toward the bare spawn: `internal` is read as `public`, so
 // such a seat is confined where it can be and refuses to derive where it
 // cannot. A real middle trust arrives as its own adapter that reads it — and
 // `workspace` (above) is that trust, which is why it is NOT a legacy alias.
@@ -100,7 +100,7 @@ export const normalizeSandboxTrust = (sandbox) => (
  * compares the trust and must not write anything back. The server spells the
  * same predicate `effectiveSandboxTrust` (`grantBrokerConfinement.ts`) — the two
  * sides have to read `internal` the same way or one of them confines a seat the
- * other withholds from (Wren 71662).
+ * other withholds from.
  */
 export const effectiveSandboxTrust = (trust) => (
   typeof trust === 'string' && Object.prototype.hasOwnProperty.call(LEGACY_SANDBOX_TRUST, trust)
@@ -112,7 +112,7 @@ export const effectiveSandboxTrust = (trust) => (
  * Throw when an adapter that does not implement the `workspace` tier is handed
  * one (TASK-294). Only claude reads it. Every other adapter branches on
  * `trust === 'public'`, so an unread `workspace` would fall into its
- * non-public branch — the same silent widening `internal` was (Vera 69592).
+ * non-public branch — the same silent widening `internal` was.
  * Called at each adapter's spawn entry, before any other sandbox read.
  */
 export const refuseWorkspaceTrust = (sandbox, adapterLabel) => {
@@ -391,8 +391,8 @@ export const validateEnvironmentSpec = (spec) => {
     }
   }
 
-  // A TRANSPORT DECIDES THE ENTRY, so the fields must agree with it (TASK-071,
-  // Vera's ruling 2026-09-19). This block is MIRRORED, not shared: the other
+  // A TRANSPORT DECIDES THE ENTRY, so the fields must agree with it (TASK-071).
+  // This block is MIRRORED, not shared: the other
   // writer-side check is the backend's, in
   // backend/utils/environmentSpecValidation.ts, called from the
   // `PATCH /api/registry/pods/:podId/agents/:name` handler that stores

package/src/lib/memory-bridge.js

@@ -23,7 +23,7 @@
 export const SOURCE_RUNTIME = 'local-cli';
 
 /**
- * Row slicing, the runtime-agnostic half of D48 (TASK-545). A row too large
+ * Row slicing, the runtime-agnostic half of TASK-545. A row too large
  * for one turn drifts when one seat carries it whole, so the seat splits it on
  * the board before any code. It names the exact call and field for the reason
  * the memory cue below names `long_term`: a seat adopts a habit through a

package/src/lib/public-tool-error.js

@@ -1,6 +1,6 @@
 /**
  * Which failed Commonly tool calls a public seat's model may answer in plain
- * words. Everything else withholds the turn (#2374, Vera 79595, Wren 79596).
+ * words. Everything else withholds the turn (#2374).
  *
  * The rule is inverted on purpose. Matching known connection failures let an
  * API 5xx through: the shipped MCP turns a non-2xx into a tool error carrying

package/src/lib/sandbox/mode.js

@@ -5,15 +5,14 @@
  * derives `sandbox: { trust: 'public' }` with NO mode (lib/default-environment.js)
  * because `mode: 'workspace'` is Seatbelt on macOS and is refused on Linux,
  * while `mode: 'bwrap'` is meaningless on macOS — writing either into the row
- * moves a host fact into the database and breaks the day the seat is re-homed
- * (Wren 69545).
+ * moves a host fact into the database and breaks the day the seat is re-homed.
  *
  * So the mode is resolved here, at the point that knows the host:
  *   darwin  → 'workspace' (the claude adapter maps it to Seatbelt)
  *   else    → 'bwrap'     (bubblewrap; attach checks it is installed)
  *
  * Resolution is PUBLIC-only on purpose, and PUBLIC IS THE EFFECTIVE TRUST: a
- * legacy `internal` declaration reads as `public` (environment.js, Wren 69585),
+ * legacy `internal` declaration reads as `public` (environment.js),
  * so the mapping is applied before this comparison. Comparing the raw value
  * made `{ trust: 'internal' }` resolve to no mode at all — the mapping was
  * applied in `confinementReason` and not here, which is half a rule, and the
@@ -22,7 +21,7 @@
  * whatever mode it wrote, and an adapter that cannot enforce it is expected to
  * refuse rather than quietly spawn unconfined. An explicit mode on a public
  * declaration still wins — including a wrong one, which the caller then refuses
- * (Vera 69548: an unresolvable public mode must not fall through to a bare,
+ * (an unresolvable public mode must not fall through to a bare,
  * unconfined spawn).
  *
  * NOT used by the codex adapter. Codex's `mode` is read-vs-write access, not a

package/src/lib/sandbox/seatbelt.js

@@ -301,7 +301,7 @@ const OPEN_NETWORK = String.raw`
 // Resolver is constructed. Denied, that lookup does not always fail: at
 // times it blocks the main thread forever. dsh builds a Resolver as it loads,
 // so confined turns ran to their 900 s timeout without sending a request
-// (D106). Admitted, resolution fails fast, because mDNSResponder and port 53
+// Admitted, resolution fails fast, because mDNSResponder and port 53
 // stay unreachable in a loopback profile. The service returns configuration
 // and opens no channel out.
 const RESOLVER_CONFIG = String.raw`

package/src/lib/spawn-retry.js

@@ -124,7 +124,7 @@ export const classifySpawnFailure = (error) => {
   // and "limit", and its `(?!rate[ -]?limit)` lookahead only guards the word
   // IMMEDIATELY after "your" — so "you've hit your API rate limit" walked past
   // it into the 15-minute circuit, where main correctly gives the 60-second
-  // rate-limit probe (otto, gate on #2491; it was a regression, not a gap).
+  // rate-limit probe (gate on #2491; it was a regression, not a gap).
   // A throttle wording anywhere in the text therefore wins over the shape.
   // QUOTA_RE is still tested first, so an explicit quota word keeps QUOTA even
   // when the same message also mentions rate limits.

package/src/lib/webhook-server.js

@@ -73,7 +73,7 @@ export const startWebhookServer = ({
  * The handler `agent connect` serves on its own port. It only logs what
  * arrives, and no agent has read the event, so it states no outcome a read
  * would count as: the wake still settles, and the pod digest stays unread
- * (Sable, #2753).
+ * (#2753).
  */
 export const logOnlyHandler = async (event) => {
   console.log(`[local] ${event.type} from pod ${event.podId}`);
@@ -99,7 +99,7 @@ export const forwardToLocalWebhook = async (event, webhookUrl, secret = null) =>
   if (!res.ok) throw new Error(`Local webhook returned HTTP ${res.status}`);
   // Only a stated outcome counts. An empty or non-JSON body, or one without
   // an outcome, is a handler that said nothing, the same as a CLI turn that
-  // printed nothing, so it must not read the pod digest (Rhea, #2753).
+  // printed nothing, so it must not read the pod digest (#2753).
   let body = null;
   try { body = await res.json(); } catch { body = null; }
   if (!body || typeof body !== 'object' || typeof body.outcome !== 'string') {