comisai 1.0.41 → 1.0.44

package/node_modules/@comis/daemon/dist/wiring/setup-health.js

@@ -1,53 +1,28 @@
 // SPDX-License-Identifier: Apache-2.0
 /**
- * Health, process, and monitoring subsystem setup: process monitor, watchdog,
- * device identity loading, and heartbeat runner with configurable monitoring
- * sources.
+ * Health, process, and monitoring subsystem setup: process monitor and
+ * heartbeat runner with configurable monitoring sources.
  * Extracted from daemon.ts steps 5 through 6.7 to isolate process lifecycle
  * and monitoring concerns from the main startup sequence.
  * @module
  */
-import { loadOrCreateDeviceIdentity } from "../device/device-identity.js";
 import { createHeartbeatRunner, createDuplicateDetector, deliverHeartbeatNotification, } from "@comis/scheduler";
 import { createDiskSpaceSource, createSystemResourcesSource, createSystemdServiceSource, createSecurityUpdateSource, createGitWatcherSource, } from "../monitoring/index.js";
 // ---------------------------------------------------------------------------
 // Setup function
 // ---------------------------------------------------------------------------
 /**
- * Create and start the process monitor, start the systemd watchdog,
- * and load or create the device identity.
+ * Create and start the process monitor.
  * @param deps.container - Bootstrap output (config, event bus)
- * @param deps.logger - Root tracing logger (for identity load warnings)
  * @param deps._createProcessMonitor - Factory (overridable for tests)
- * @param deps._startWatchdog - Factory (overridable for tests)
  */
 export function setupHealth(deps) {
-    const { container, daemonLogger, _createProcessMonitor, _startWatchdog } = deps;
+    const { container, _createProcessMonitor } = deps;
     // 5. Create and start process monitor
     const processMonitor = _createProcessMonitor({ eventBus: container.eventBus });
     processMonitor.start();
-    // 6. Start watchdog (gracefully degrades to no-op on macOS)
-    const watchdogHandle = _startWatchdog({
-        logger: daemonLogger,
-        processMonitor,
-    });
-    // 6.4.5. Load or create device identity (optional -- warn but continue on failure)
-    let deviceIdentity;
-    const stateDir = container.config.dataDir || ".";
-    {
-        const identityResult = loadOrCreateDeviceIdentity(stateDir);
-        if (identityResult.ok) {
-            deviceIdentity = identityResult.value;
-            daemonLogger.info({ deviceId: deviceIdentity.deviceId }, "Device identity loaded");
-        }
-        else {
-            daemonLogger.warn({ err: identityResult.error.message, hint: "Check file permissions in data directory", errorKind: "internal" }, "Device identity not available (non-fatal)");
-        }
-    }
     return {
         processMonitor,
-        watchdogHandle,
-        deviceIdentity,
     };
 }
 // ---------------------------------------------------------------------------

package/node_modules/@comis/daemon/dist/wiring/setup-image-provider.d.ts

@@ -0,0 +1,86 @@
+/**
+ * Image-provider SELECTION (RES-02/RES-03/CRED-01).
+ *
+ * `createImageProviderSelector` returns a lazy getter (read-on-use at boot —
+ * mirrors `createImageGenProviderFactory` in setup-media.ts) that, per the
+ * resolved config + the agent's main provider, decides between:
+ *   - the Plan-03 pi-image-adapter (provider:"auto" / pi-ai-backed providers),
+ *     following the main provider via the Plan-01 `resolveImageProvider` and
+ *     resolving the key from the SAME `SecretManager` the main provider uses
+ *     (CRED-01 — no image-specific secret); or
+ *   - the relegated skills adapter (explicit `fal`/`openai`, additive legacy
+ *     path); or
+ *   - an honest-unavailable port (carrying the knob-naming hint) for an
+ *     image-incapable main (RES-03) — NEVER a misroute to a different paid
+ *     provider, NEVER silence.
+ *
+ * The selector NEVER reads the raw environment (creds via `SecretManager`
+ * only) and NEVER re-derives selection in the handler (RES-01 keystone: one
+ * source of truth — `resolveImageProvider`).
+ *
+ * Placement: `@comis/daemon` (pi-ai is a daemon dep, not a skills one). Kept in
+ * a dedicated file (not folded into setup-media.ts) so the skills-only
+ * setup-media module gains no pi-ai / core-media import edge.
+ *
+ * @module
+ */
+import { type ImageErrorKind, type ImageGenerationConfig, type ImageGenerationPort, type OAuthTokenManager, type SecretManager } from "@comis/core";
+import type { ComisLogger } from "@comis/infra";
+/**
+ * A port whose `execute()` always returns a classified `ImageGenError` Result
+ * err — the RES-03 honest-unavailable carrier. The agent gets a hint (naming
+ * the binding config knob), not silence. `isAvailable()` is `false` so callers
+ * that probe it know it cannot serve.
+ */
+export declare function makeUnavailableImagePort(errorKind: ImageErrorKind, hint: string, logger: ComisLogger): ImageGenerationPort;
+/**
+ * Build the lazy image-provider selector. Returns a getter that reads the
+ * config + `secretManager` on use; in practice the daemon invokes it ONCE at
+ * boot (`daemon.ts` `getImageGenProvider()`), and the handler then holds that
+ * boot-built adapter instance — so key rotation requires a daemon restart to
+ * take effect (NOT live per-request; IN-01 183-REVIEW). Returns `undefined`
+ * only when image generation is unconfigured (`imageGenConfig` absent) — an
+ * image-incapable main yields an unavailable PORT (RES-03), never `undefined`,
+ * so the handler is still constructed and surfaces the hint.
+ */
+export declare function createImageProviderSelector(deps: {
+    imageGenConfig: ImageGenerationConfig | undefined;
+    secretManager: SecretManager;
+    /** Resolved at boot for the DEFAULT agent (the common case for Phase 183). */
+    mainProviderId: string;
+    /** The existing skills fal/openai getter (createImageGenGetter). */
+    legacyGetter: () => ImageGenerationPort | undefined;
+    logger: ComisLogger;
+    /**
+     * The DEFAULT agent's OAuthTokenManager (184). The codex credential is OAuth,
+     * not a SecretManager env key — so codex availability + the per-call bearer
+     * resolve through this manager, NOT `resolveImageApiKey`. Surfaced from
+     * setupAgents → buildImageGenBundle (the composition-root threading gap).
+     * Absent (undefined) → codex is honest-unavailable (never a crash).
+     */
+    oauthManager?: OAuthTokenManager;
+    /** The DEFAULT agent's `Record<provider, profileId>` map (for getApiKey). */
+    oauthProfiles?: Record<string, string>;
+    /**
+     * STORE-AWARE Codex availability, resolved ONCE by the async caller
+     * (`buildImageGenBundle` via `oauthManager.hasStoredCredentials("openai-codex")`)
+     * and passed in as a sync snapshot — so the selector + the pure resolver stay
+     * synchronous. This is the AUTHORITATIVE Codex gate: it sees a logged-in
+     * profile in the PERSISTED store even when the in-memory cache is cold at boot
+     * (encrypted-store mode), which the sync `hasCredentials` could not — the bug
+     * that froze a Codex agent's image generation unavailable despite text working.
+     * When omitted (callers/tests that don't pre-resolve it) the gate falls back to
+     * the sync `oauthManager.hasCredentials` (the pre-fix behavior).
+     */
+    codexCredentialsAvailable?: boolean;
+    /**
+     * The agent's resolved CHAT model id (e.g. "gpt-5.5") for the follow-main
+     * Codex path. The Codex Responses endpoint rejects the image-API model id
+     * "gpt-image-1" with HTTP 400 ("returned a non-image response" — verified live)
+     * — it needs a valid CHAT model with `image_generation` as a TOOL. Threaded
+     * from buildImageGenBundle (the SAME resolveAgentModel the completion path
+     * uses) into the codex adapter's request model. Absent ⇒ the legacy
+     * CODEX_IMAGE_MODEL default (back-compat for callers/tests).
+     */
+    codexChatModelId?: string;
+}): () => ImageGenerationPort | undefined;

package/node_modules/@comis/daemon/dist/wiring/setup-image-provider.js

@@ -0,0 +1,206 @@
+// SPDX-License-Identifier: Apache-2.0
+/**
+ * Image-provider SELECTION (RES-02/RES-03/CRED-01).
+ *
+ * `createImageProviderSelector` returns a lazy getter (read-on-use at boot —
+ * mirrors `createImageGenProviderFactory` in setup-media.ts) that, per the
+ * resolved config + the agent's main provider, decides between:
+ *   - the Plan-03 pi-image-adapter (provider:"auto" / pi-ai-backed providers),
+ *     following the main provider via the Plan-01 `resolveImageProvider` and
+ *     resolving the key from the SAME `SecretManager` the main provider uses
+ *     (CRED-01 — no image-specific secret); or
+ *   - the relegated skills adapter (explicit `fal`/`openai`, additive legacy
+ *     path); or
+ *   - an honest-unavailable port (carrying the knob-naming hint) for an
+ *     image-incapable main (RES-03) — NEVER a misroute to a different paid
+ *     provider, NEVER silence.
+ *
+ * The selector NEVER reads the raw environment (creds via `SecretManager`
+ * only) and NEVER re-derives selection in the handler (RES-01 keystone: one
+ * source of truth — `resolveImageProvider`).
+ *
+ * Placement: `@comis/daemon` (pi-ai is a daemon dep, not a skills one). Kept in
+ * a dedicated file (not folded into setup-media.ts) so the skills-only
+ * setup-media module gains no pi-ai / core-media import edge.
+ *
+ * @module
+ */
+import { getImageModels } from "@earendil-works/pi-ai";
+import { resolveImageProvider, } from "@comis/core";
+import { err } from "@comis/shared";
+import { createPiImageAdapter, resolveImageApiKey, ImageGenError, } from "../api/pi-image-adapter.js";
+import { createCodexImageAdapter, CODEX_IMAGE_MODEL } from "../api/codex-image-adapter.js";
+import { OPENAI_IMAGE_MODEL } from "../api/openai-images-transport.js";
+import { GOOGLE_IMAGE_MODEL } from "../api/google-images-transport.js";
+/**
+ * A port whose `execute()` always returns a classified `ImageGenError` Result
+ * err — the RES-03 honest-unavailable carrier. The agent gets a hint (naming
+ * the binding config knob), not silence. `isAvailable()` is `false` so callers
+ * that probe it know it cannot serve.
+ */
+export function makeUnavailableImagePort(errorKind, hint, logger) {
+    return {
+        id: "unavailable",
+        isAvailable: () => false,
+        execute: () => {
+            logger.debug({ imageErrorKind: errorKind, hint, step: "image_unavailable" }, "Image generation unavailable for the resolved provider");
+            return Promise.resolve(err(new ImageGenError(hint, { imageErrorKind: errorKind, hint })));
+        },
+    };
+}
+/**
+ * Build the lazy image-provider selector. Returns a getter that reads the
+ * config + `secretManager` on use; in practice the daemon invokes it ONCE at
+ * boot (`daemon.ts` `getImageGenProvider()`), and the handler then holds that
+ * boot-built adapter instance — so key rotation requires a daemon restart to
+ * take effect (NOT live per-request; IN-01 183-REVIEW). Returns `undefined`
+ * only when image generation is unconfigured (`imageGenConfig` absent) — an
+ * image-incapable main yields an unavailable PORT (RES-03), never `undefined`,
+ * so the handler is still constructed and surfaces the hint.
+ */
+export function createImageProviderSelector(deps) {
+    return () => {
+        const cfg = deps.imageGenConfig;
+        if (!cfg)
+            return undefined;
+        // Explicit fal → the relegated skills adapter (additive legacy path,
+        // CFG-01 back-compat). 185 FOLD: `openai` is NO LONGER a legacy provider —
+        // it now resolves via the resolver path below (IMAGE_CAPABILITY["openai"] =
+        // "openai-images") → the Task-2 selector branch (the registered transport),
+        // eliminating the second parallel openai surface (design §5).
+        if (cfg.provider === "fal") {
+            return deps.legacyGetter();
+        }
+        // auto / openrouter / openai-codex / google → the pi-ai path via the
+        // Plan-01 resolver (one source of truth; creds via SecretManager closure).
+        const sel = resolveImageProvider(cfg, deps.mainProviderId, 
+        // CRED-01: codex availability is the OAuth credential (the bearer is
+        // OAuth, not a SecretManager env key) — so a Codex-only agent with NO
+        // FAL_KEY/OPENAI_API_KEY resolves available. The AUTHORITATIVE gate is the
+        // store-aware `codexCredentialsAvailable` flag, pre-resolved by the async
+        // caller (buildImageGenBundle) via `hasStoredCredentials("openai-codex")`
+        // — it sees a logged-in profile in the PERSISTED store even when the
+        // in-memory cache is cold at boot (encrypted-store mode), the bug the sync
+        // cache-only `hasCredentials` caused (a Codex agent's images froze
+        // unavailable for the daemon's life despite text working). Falls back to
+        // the sync `hasCredentials` ONLY when the flag was not pre-resolved
+        // (callers/tests). Absent manager + no flag → false (honest-unavailable,
+        // never a crash). Every other api stays the SecretManager env-key check.
+        (imagesApi) => imagesApi === "openai-codex-images"
+            ? (deps.codexCredentialsAvailable ??
+                deps.oauthManager?.hasCredentials("openai-codex") ??
+                false)
+            : resolveImageApiKey(imagesApi, deps.secretManager) !== undefined, 
+        // WR-04 (183-REVIEW): the once-per-resolution follow-main skip is the
+        // load-bearing "why did images go unavailable" evidence — promote it to
+        // INFO so it is visible at the default log level (§2.7). Per-fallback-
+        // entry skips stay DEBUG (they only matter when a chain is configured).
+        (reason) => reason.startsWith("follow-main skipped:")
+            ? deps.logger.info({ reason, step: "image_follow_main_skip" }, "Image follow-main resolution skipped")
+            : deps.logger.debug({ reason, step: "image_fallback_skip" }, "Image fallback entry skipped"));
+        if (!sel.ok) {
+            // RES-03 honest-unavailable: a port that surfaces the err (handler hint).
+            return makeUnavailableImagePort(sel.errorKind, sel.hint, deps.logger);
+        }
+        // 184: the Codex (ChatGPT-login) per-call-bearer adapter. Keyed EXACTLY on
+        // the codex images api — `openai-images`/`google-images` fall through to the
+        // not-yet-wired guard below (they land in 185, no scope creep).
+        if (sel.imagesApi === "openai-codex-images") {
+            // By construction `sel.imagesApi === "openai-codex-images"` is `ok` only
+            // when credsAvailable returned true, which requires a present manager
+            // (hasCredentials === true). The defensive guard makes that explicit (and
+            // keeps the adapter's required `oauthManager` honest) rather than a `!`.
+            if (!deps.oauthManager) {
+                return makeUnavailableImagePort("auth_required", `Codex image generation requires a logged-in "openai-codex" OAuth ` +
+                    `profile. Run "comis auth login --provider openai-codex", or set ` +
+                    `integrations.media.imageGeneration.provider.`, deps.logger);
+            }
+            return createCodexImageAdapter({
+                oauthManager: deps.oauthManager,
+                oauthProfiles: deps.oauthProfiles,
+                // Use the agent's CHAT model (e.g. "gpt-5.5") for the Codex Responses
+                // request — the endpoint 400s on the image-API model id "gpt-image-1"
+                // (verified live); image_generation is a TOOL, not the top-level model.
+                // Falls back to CODEX_IMAGE_MODEL when the chat model is not threaded.
+                model: deps.codexChatModelId
+                    ? { ...CODEX_IMAGE_MODEL, id: deps.codexChatModelId }
+                    : CODEX_IMAGE_MODEL,
+                timeoutMs: cfg.timeoutMs,
+                logger: deps.logger,
+                // Store-aware availability snapshot → the adapter's isAvailable() (so it
+                // doesn't fall back to the cold-cache-only hasCredentials).
+                credentialsAvailable: deps.codexCredentialsAvailable,
+            });
+        }
+        // 185 (PRV-01/02 — the WIRING KEYSTONE): the openai / google native
+        // transports (registered in registerComisImageProviders()). UNLIKE codex,
+        // their credential is a STATIC env key (OPENAI_API_KEY / GOOGLE_API_KEY via
+        // the FIXED resolveImageApiKey — CRED-01), resolved once at boot — so the
+        // generic createPiImageAdapter (which does the generateImages dispatch +
+        // mapping) is the right adapter, NOT a per-call-bearer one. The hand-built
+        // ImagesModel literal carries the api/provider/default-id; sel.model (the
+        // tool/config override) wins over the default when present (IN-02). Keyed
+        // EXACTLY on these two apis — every other api still falls through to the
+        // honest-unavailable guard below (no misroute).
+        if (sel.imagesApi === "openai-images" || sel.imagesApi === "google-images") {
+            const apiKey = resolveImageApiKey(sel.imagesApi, deps.secretManager);
+            const model = sel.imagesApi === "openai-images" ? OPENAI_IMAGE_MODEL : GOOGLE_IMAGE_MODEL;
+            return createPiImageAdapter({
+                model: sel.model ? { ...model, id: sel.model } : model,
+                apiKey,
+                timeoutMs: cfg.timeoutMs,
+                logger: deps.logger,
+            });
+        }
+        // Phase 183 wires the built-in openrouter catalog; 184/185 wired
+        // codex/openai/google above. Any REMAINING custom transport lands in a later
+        // phase — until then, surface an honest-unavailable naming the opt-in path
+        // (not a misroute).
+        if (sel.imagesApi !== "openrouter-images") {
+            return makeUnavailableImagePort("unsupported_provider", `Image provider "${sel.imagesApi}" is not yet wired (lands in a later phase). ` +
+                `Use provider:"openrouter" + OPENROUTER_API_KEY, or set ` +
+                `integrations.media.imageGeneration.provider.`, deps.logger);
+        }
+        const apiKey = resolveImageApiKey(sel.imagesApi, deps.secretManager);
+        const model = resolveOpenRouterModel(sel.model ?? sel.defaultModel, deps.logger);
+        return createPiImageAdapter({
+            model,
+            apiKey,
+            timeoutMs: cfg.timeoutMs,
+            // maxRetries omitted — the adapter's `maxRetries ?? 1` default is the
+            // single source of truth (IN-02 183-REVIEW: avoid a duplicated magic 1).
+            logger: deps.logger,
+        });
+    };
+}
+/**
+ * Resolve a runtime model-id string to a built-in openrouter `ImagesModel`.
+ *
+ * `getImageModel` is typed with a `keyof IMAGE_MODELS["openrouter"]` literal
+ * constraint, which a runtime `string` cannot satisfy — so look the id up in
+ * the catalog (`getImageModels`) and fall back to the first catalog model when
+ * the requested id is not present. The built-in openrouter catalog always has
+ * at least one model (Phase 183 default `black-forest-labs/flux.2-pro`).
+ *
+ * WR-02 (183-REVIEW): when the configured/tool model is NOT in the catalog the
+ * fallback would otherwise be a SILENT misroute — the operator's explicit
+ * choice discarded with no signal. Emit a WARN naming the unresolved id, the
+ * fallback, the binding knob, and an `errorKind` so the substitution is
+ * observable at the default log level (§2.7 anti-silent-misroute).
+ */
+function resolveOpenRouterModel(modelId, logger) {
+    const models = getImageModels("openrouter");
+    const match = models.find((m) => m.id === modelId);
+    if (!match) {
+        logger.warn({
+            requestedModel: modelId,
+            fallbackModel: models[0]?.id,
+            errorKind: "config",
+            hint: "Set integrations.media.imageGeneration.model to a model in the openrouter image catalog.",
+            step: "image_model_substituted",
+        }, "Configured image model not found in catalog; falling back to first catalog model");
+    }
+    // `as` narrows the union element to the concrete return type; both are an
+    // ImagesModel over the openrouter image apis — assignable at the call site.
+    return (match ?? models[0]);
+}

package/node_modules/@comis/daemon/dist/wiring/setup-interactive-callback.d.ts

@@ -0,0 +1,59 @@
+import type { SecretStorePort, ComisLogger, ApprovalGate, ClockPort, AppConfig } from "@comis/core";
+import type { SignCallbackData, MintApprovalLink } from "@comis/channels";
+import type { InteractiveCallbackRouter } from "@comis/orchestrator";
+import { type PendingApprovalToken } from "@comis/gateway";
+/**
+ * Resolve the interactive-callback signing secret at the daemon composition root.
+ *
+ * Synchronous: `SecretStorePort.set`/`getDecrypted` are synchronous (the
+ * eager-decrypt-at-boot pattern), so this returns the secret directly.
+ *
+ * @param secretStore - the encrypted store, or `undefined` when secrets are disabled
+ * @param logger - composition-root logger (the secret value is NEVER logged)
+ * @returns the 32-byte base64url signing secret
+ */
+export declare function resolveInteractiveCallbackSigningSecret(secretStore: SecretStorePort | undefined, logger: ComisLogger): string;
+/**
+ * Bind a resolved signing secret into the `SignCallbackData` closure the channel
+ * renderers consume. The secret is closure-captured here at the composition root
+ * and never passed into the channels package as a value.
+ */
+export declare function bindSignCallbackData(secret: string): SignCallbackData;
+/**
+ * The interactive-callback composition-root bundle. Threaded from the
+ * daemon into the channel renderers + the gateway route:
+ *   - `signCallbackData` → button-capable renderers (Telegram/Discord/Slack/LINE).
+ *   - `mintApprovalLink` → the Email DigestOnly renderer (single-use link).
+ *   - `tokens` + `resolveApproval` → the gateway approval-token route deps.
+ *   - `router` → the orchestrator's InteractiveCallbackRouter (button + plain-text
+ *     callbacks), wired to the same gate + secret the email link resolves against.
+ */
+export interface InteractiveCallbackWiring {
+    signCallbackData: SignCallbackData;
+    mintApprovalLink: MintApprovalLink;
+    router: InteractiveCallbackRouter;
+    tokens: Map<string, PendingApprovalToken>;
+    resolveApproval: (entry: PendingApprovalToken) => Promise<boolean>;
+}
+/**
+ * Build the full interactive-callback wiring at the daemon composition root.
+ * Resolves the signing secret (store or in-memory
+ * fallback), binds the renderer signer, constructs the InteractiveCallbackRouter
+ * over the SAME gate + secret + clock, and produces the Email single-use link
+ * minter + the gateway-route `resolveApproval` that consumes a minted token.
+ *
+ * The minted email link carries an OPAQUE `generateStrongToken()` (384-bit) — NOT
+ * the signed HMAC wire format (which would leak into a mail body). The token map
+ * entry records the shortId + choice; on the first GET the gateway route hands the
+ * consumed entry to `resolveApproval`, which re-renders the signed payload
+ * server-side and routes it through the router (lookup → session → expiry → verify
+ * → dispatch). Both the email-link path and the chat-button path resolve through
+ * the one router + one gate — no duplicate resolution authority.
+ */
+export declare function createInteractiveCallbackWiring(deps: {
+    secretStore: SecretStorePort | undefined;
+    approvalGate: ApprovalGate;
+    clock: ClockPort;
+    config: AppConfig;
+    logger: ComisLogger;
+}): InteractiveCallbackWiring;

package/node_modules/@comis/daemon/dist/wiring/setup-interactive-callback.js

@@ -0,0 +1,192 @@
+// SPDX-License-Identifier: Apache-2.0
+/**
+ * Signing-secret lifecycle + interactive-callback composition seam.
+ *
+ * The 32-byte `activity.interactiveCallbackSigningSecret` is the keystone of every
+ * signed channel callback: the renderers sign `callback_data` with it (via the
+ * injected `SignCallbackData`) and the orchestrator's `InteractiveCallbackRouter`
+ * verifies against it. This module owns its generate/read lifecycle at the daemon
+ * composition root:
+ *
+ *   - encrypted store ENABLED: generate once (`randomBytes(32).toString("base64url")`)
+ *     and persist via `SecretStorePort.set`; read it back via `getDecrypted` on
+ *     every subsequent start → STABLE across restart.
+ *   - store DISABLED (`undefined`, the default — schema-secrets `enabled:false`):
+ *     generate an in-memory secret per process. Documented fallback: in-flight
+ *     5-min approval buttons invalidate across restart (acceptable — approvals are
+ *     time-bounded). A corrupted/wrong-key store (getDecrypted error) also falls
+ *     back to a fresh in-memory secret rather than crashing boot.
+ *
+ * The secret value NEVER appears in a log line; only a boolean
+ * "generated vs read" + the source is logged. The secret name is on the
+ * `platformSecretNames` deny surface (see `INTERACTIVE_CALLBACK_SIGNING_SECRET_NAME`
+ * in `@comis/core`) so user-facing secret-ref tools can never resolve it.
+ *
+ * `bindSignCallbackData` turns the resolved secret into the `SignCallbackData`
+ * closure the channel renderers consume (delegating to `@comis/core`'s
+ * `signCallbackData`) — the secret is closure-captured and never crosses into the
+ * channels package as a value.
+ *
+ * @module
+ */
+import { randomBytes } from "node:crypto";
+import { signCallbackData, generateStrongToken, INTERACTIVE_CALLBACK_SIGNING_SECRET_NAME, } from "@comis/core";
+import { createInteractiveCallbackRouter } from "@comis/orchestrator";
+import { insertPendingApprovalToken, } from "@comis/gateway";
+/** Generate a fresh 32-byte base64url signing secret (mirrors token-generator). */
+function generateSigningSecret() {
+    return randomBytes(32).toString("base64url");
+}
+/**
+ * Resolve the interactive-callback signing secret at the daemon composition root.
+ *
+ * Synchronous: `SecretStorePort.set`/`getDecrypted` are synchronous (the
+ * eager-decrypt-at-boot pattern), so this returns the secret directly.
+ *
+ * @param secretStore - the encrypted store, or `undefined` when secrets are disabled
+ * @param logger - composition-root logger (the secret value is NEVER logged)
+ * @returns the 32-byte base64url signing secret
+ */
+export function resolveInteractiveCallbackSigningSecret(secretStore, logger) {
+    if (secretStore === undefined) {
+        // Disabled store: per-process in-memory secret (documented fallback).
+        logger.debug({
+            secretName: INTERACTIVE_CALLBACK_SIGNING_SECRET_NAME,
+            source: "in-memory",
+            submodule: "interactive-callback",
+        }, "Interactive-callback signing secret generated in memory (encrypted store disabled)");
+        return generateSigningSecret();
+    }
+    const existing = secretStore.getDecrypted(INTERACTIVE_CALLBACK_SIGNING_SECRET_NAME);
+    // Treat an EMPTY string the same as absent. HMAC accepts an empty key, so a
+    // degenerate/hand-edited store row decrypting to "" would not break verification —
+    // it would collapse the keyspace to a publicly-computable constant (empty key),
+    // making every callback forgeable. Reject it so the regenerate-and-persist path runs.
+    if (existing.ok && existing.value !== undefined && existing.value.length > 0) {
+        logger.debug({
+            secretName: INTERACTIVE_CALLBACK_SIGNING_SECRET_NAME,
+            source: "store",
+            generated: false,
+            submodule: "interactive-callback",
+        }, "Interactive-callback signing secret read from store");
+        return existing.value;
+    }
+    // Absent (first start) OR a decryption error (corrupted/wrong key): generate a
+    // fresh secret. On a clean store, persist it so it is stable across restart; on
+    // a decryption error, fall back to in-memory rather than crashing boot.
+    const secret = generateSigningSecret();
+    if (!existing.ok) {
+        logger.warn({
+            secretName: INTERACTIVE_CALLBACK_SIGNING_SECRET_NAME,
+            source: "in-memory",
+            errorKind: "internal",
+            hint: "The signing secret could not be decrypted; using a per-process secret. In-flight approval buttons will invalidate. Check the secrets master key.",
+            submodule: "interactive-callback",
+        }, "Interactive-callback signing secret decryption failed; using in-memory fallback");
+        return secret;
+    }
+    const written = secretStore.set(INTERACTIVE_CALLBACK_SIGNING_SECRET_NAME, secret);
+    if (!written.ok) {
+        logger.warn({
+            secretName: INTERACTIVE_CALLBACK_SIGNING_SECRET_NAME,
+            source: "in-memory",
+            errorKind: "internal",
+            hint: "The signing secret could not be persisted; using a per-process secret for this run. In-flight approval buttons will invalidate on restart.",
+            submodule: "interactive-callback",
+        }, "Interactive-callback signing secret persist failed; using in-memory fallback");
+        return secret;
+    }
+    logger.debug({
+        secretName: INTERACTIVE_CALLBACK_SIGNING_SECRET_NAME,
+        source: "store",
+        generated: true,
+        submodule: "interactive-callback",
+    }, "Interactive-callback signing secret generated and persisted");
+    return secret;
+}
+/**
+ * Bind a resolved signing secret into the `SignCallbackData` closure the channel
+ * renderers consume. The secret is closure-captured here at the composition root
+ * and never passed into the channels package as a value.
+ */
+export function bindSignCallbackData(secret) {
+    return (choice, shortId) => signCallbackData(secret, choice, shortId);
+}
+/** Derive the public base URL for approval links from gateway host/port/tls. */
+function gatewayBaseUrl(gateway) {
+    const scheme = gateway.tls !== undefined ? "https" : "http";
+    return `${scheme}://${gateway.host}:${gateway.port}`;
+}
+/**
+ * Build the full interactive-callback wiring at the daemon composition root.
+ * Resolves the signing secret (store or in-memory
+ * fallback), binds the renderer signer, constructs the InteractiveCallbackRouter
+ * over the SAME gate + secret + clock, and produces the Email single-use link
+ * minter + the gateway-route `resolveApproval` that consumes a minted token.
+ *
+ * The minted email link carries an OPAQUE `generateStrongToken()` (384-bit) — NOT
+ * the signed HMAC wire format (which would leak into a mail body). The token map
+ * entry records the shortId + choice; on the first GET the gateway route hands the
+ * consumed entry to `resolveApproval`, which re-renders the signed payload
+ * server-side and routes it through the router (lookup → session → expiry → verify
+ * → dispatch). Both the email-link path and the chat-button path resolve through
+ * the one router + one gate — no duplicate resolution authority.
+ */
+export function createInteractiveCallbackWiring(deps) {
+    const { secretStore, approvalGate, clock, config, logger } = deps;
+    const secret = resolveInteractiveCallbackSigningSecret(secretStore, logger);
+    const sign = bindSignCallbackData(secret);
+    const router = createInteractiveCallbackRouter({
+        gate: approvalGate,
+        getSecret: () => secret,
+        clock,
+    });
+    const tokens = new Map();
+    const baseUrl = gatewayBaseUrl(config.gateway);
+    const submodule = logger.child({ submodule: "interactive-callback" });
+    // Mint a single-use approval link for a kind:"approval" event. Email shows one
+    // affordance, so we mint the "approve" link (deny is reachable via the same
+    // route with a deny-token — but the primary failure-digest CTA is approve).
+    // The token is opaque; the shortId is the server-side correlation only.
+    const mintApprovalLink = (event) => {
+        const approval = event.approval;
+        if (approval === undefined)
+            return undefined;
+        const choice = "approve";
+        const token = generateStrongToken();
+        insertPendingApprovalToken(tokens, token, {
+            shortId: approval.shortId,
+            choice,
+            sessionKey: event.sessionKey,
+            channelType: "email",
+            channelKey: event.sessionKey,
+            agentId: event.agentId,
+        }, 
+        // ComisLogger is structurally assignable to the gateway's GatewayLogger
+        // (same trace/debug/info/warn/error shape).
+        submodule);
+        // safePath is for filesystem paths; the URL is assembled from trusted config
+        // host/port + an opaque token, so a plain template is correct here.
+        return `${baseUrl}/approve/${token}`;
+    };
+    // Resolve a consumed token by re-rendering its signed payload and routing it
+    // through the SAME router the chat buttons use. The token is already revoked by
+    // the gateway route before this is called (single-use), so a failure here never
+    // re-arms it. Returns true iff the router resolved the approval.
+    const resolveApproval = async (entry) => {
+        const rendered = router.render(entry.choice, entry.shortId);
+        if (!rendered.ok)
+            return false;
+        const result = await router.route({
+            channelType: entry.channelType,
+            channelKey: entry.channelKey,
+            agentId: entry.agentId,
+            sessionKey: entry.sessionKey,
+            rawData: rendered.value,
+            inboundUserId: `email:${entry.channelKey}`,
+        });
+        // route() is Result<_, never> — always ok; inspect the resolution kind.
+        return result.ok && result.value.kind === "resolved";
+    };
+    return { signCallbackData: sign, mintApprovalLink, router, tokens, resolveApproval };
+}

package/node_modules/@comis/daemon/dist/wiring/setup-learning-corroboration.d.ts

@@ -0,0 +1,43 @@
+/**
+ * FORGET-03 corroboration gate — the anti-induced-eviction SECURITY control shared
+ * by the learned-skill demote path and the memory failure-accrual path in
+ * `setup-learning.ts`. Extracted to its own leaf (zero imports from setup-learning.ts
+ * → no cycle) to keep `setup-learning.ts` under the 800-line cap. `setup-learning.ts`
+ * re-exports these for the existing importers (setup-learning.test.ts).
+ *
+ * @module
+ */
+/** Independent (distinct-session) failures required to corroborate a NON-deterministic failure. */
+export declare const CORROBORATION_MIN_INDEPENDENT = 2;
+/**
+ * WR-01 bound on the FORGET-03 corroboration tally — the max distinct memoryIds the
+ * `failureCorroborationTally` Map tracks before evicting the oldest. The tally is a
+ * daemon-lifetime in-process gauge (resets on restart); without a cap a busy fleet (or
+ * an adversary on rotating session keys) grows it unbounded. 50_000 mirrors the
+ * reaction/session trajectory maps' `maxEntries`. Past it the oldest-touched id is
+ * dropped — a soft forget of the stalest corroboration state, never a correctness loss.
+ */
+export declare const MAX_TRACKED_FAILURE_MEMORIES = 50000;
+/**
+ * FORGET-03 anti-induced-eviction corroboration gate (a SECURITY control). A
+ * `failure_count` accrual is permitted ONLY when corroborated:
+ *  - (a) the fused verdict has a DETERMINISTIC source (`tool`/`pipeline`) — one
+ *    suffices (it cannot be spoofed by an external sender), OR
+ *  - (b) the daemon has seen ≥2 INDEPENDENT failures (distinct sessions) for this
+ *    memory within the subscriber's lifetime.
+ * Below the gate → no accrual (Defer ≠ Retry — a single low-trust/`external` failure
+ * is benign). Daemon-side half of the two-layer control; the high-proof/system/pinned
+ * EVICTION exemption is store-side (Plan 05), so the daemon reads NO per-memory
+ * proof/trust/pinned here (`ResolvedOutcome` carries none — no hot-path DB read).
+ *
+ * Mutates `tally` (memoryId → distinct sessionIds seen failing it) so the across-call
+ * distinct-session count accumulates. Returns true when the accrual should fire.
+ *
+ * WR-01 BOUNDED (two caps, no daemon-lifetime growth): (1) the inner per-memory Set
+ * STOPS growing at `CORROBORATION_MIN_INDEPENDENT` (past the gate the exact count is
+ * irrelevant); (2) the outer Map is capped at `maxTracked` (default
+ * {@link MAX_TRACKED_FAILURE_MEMORIES}) and evicts the OLDEST-touched memoryId
+ * (insertion order = recency via delete-before-set). Both keep the gate decision
+ * byte-identical for any realistic workload — the caps only bite the adversarial case.
+ */
+export declare function failureCorroborated(memoryId: string, sessionId: string, sources: ReadonlyArray<string>, tally: Map<string, Set<string>>, maxTracked?: number): boolean;