comisai 1.0.41 → 1.0.44

package/node_modules/@comis/agent/dist/spawn/announce-key.d.ts

@@ -0,0 +1,60 @@
+/**
+ * Shared announcement idempotency-key construction + a bounded delivery-dedup
+ * primitive, used by every sub-agent completion-delivery path.
+ *
+ * INFO-DRY: `buildAnnounceKey` is the single source of truth for the
+ * `${callerSessionKey}::${runId}` key. The success path (`deliverAnnouncement`)
+ * and the failure path (`deliverFailureNotification`) both build it; two
+ * hand-rolled literals would silently diverge on any delimiter/operand change
+ * and break the cross-path dedup (the DELIVERY-03 premise) with no test
+ * catching the drift. One helper converts that into a one-edit guarantee.
+ *
+ * WR-02 / WR-03: `createDeliveryDedup` owns the delivered-key set OUTSIDE the
+ * batcher so the no-batcher success branches can mark too (consistent dedup
+ * whether or not a batcher is wired), and it is BOUNDED (FIFO eviction) like
+ * every sibling structure in this subsystem (`runs` MAX_RUNS, the DLQ
+ * `maxEntries`) — a long-running daemon spawning thousands of sub-agents must
+ * not leak one Set entry per delivery for the whole process lifetime.
+ *
+ * @module
+ */
+/**
+ * Build the shared idempotency key `${callerSessionKey}::${runId}`.
+ *
+ * `::` delimits the formatted session key's own single colons
+ * (`callerSessionKey` is the formatted form, e.g. `default:user1:chan1`).
+ * Returns `undefined` for a top-level spawn (no `callerSessionKey`) or an
+ * empty-string key — those deliveries are never deduped.
+ */
+export declare function buildAnnounceKey(callerSessionKey: string | undefined, runId: string): string | undefined;
+/**
+ * Bounded delivered-key set for completion-delivery idempotency.
+ *
+ * The dedup window only needs to outlive the debounce + DLQ-retry horizon
+ * (minutes), not the daemon — an entry whose `runId` is long-terminal can never
+ * be legitimately re-delivered through the live path. The default cap is set
+ * well past any realistic concurrent in-flight + DLQ-retry window so eviction
+ * never drops a key that is still inside its delivery window (eviction is
+ * oldest-delivered FIFO; the oldest entry is, by construction, the furthest
+ * past its in-flight window).
+ */
+export interface DeliveryDedup {
+    /** Has this key already been delivered? */
+    has(key: string): boolean;
+    /** Record this key as delivered. Call ONLY after a confirmed successful send. */
+    mark(key: string): void;
+    /** Current number of retained keys (for tests / observability). */
+    readonly size: number;
+}
+/**
+ * Default delivered-key cap. 10_000 » any realistic concurrent in-flight +
+ * DLQ-retry window (the DLQ itself caps at `maxEntries=100` and bounds
+ * re-delivery by `attemptCount`/`maxAgeMs`), so a key is only ever evicted long
+ * after its run is terminal and can no longer be legitimately re-delivered.
+ */
+export declare const MAX_DELIVERED_KEYS = 10000;
+/**
+ * Create a bounded delivery-dedup. `Set` preserves insertion order, so the
+ * first-inserted (oldest-delivered) key is evicted first on overflow.
+ */
+export declare function createDeliveryDedup(cap?: number): DeliveryDedup;

package/node_modules/@comis/agent/dist/spawn/announce-key.js

@@ -0,0 +1,64 @@
+// SPDX-License-Identifier: Apache-2.0
+/**
+ * Shared announcement idempotency-key construction + a bounded delivery-dedup
+ * primitive, used by every sub-agent completion-delivery path.
+ *
+ * INFO-DRY: `buildAnnounceKey` is the single source of truth for the
+ * `${callerSessionKey}::${runId}` key. The success path (`deliverAnnouncement`)
+ * and the failure path (`deliverFailureNotification`) both build it; two
+ * hand-rolled literals would silently diverge on any delimiter/operand change
+ * and break the cross-path dedup (the DELIVERY-03 premise) with no test
+ * catching the drift. One helper converts that into a one-edit guarantee.
+ *
+ * WR-02 / WR-03: `createDeliveryDedup` owns the delivered-key set OUTSIDE the
+ * batcher so the no-batcher success branches can mark too (consistent dedup
+ * whether or not a batcher is wired), and it is BOUNDED (FIFO eviction) like
+ * every sibling structure in this subsystem (`runs` MAX_RUNS, the DLQ
+ * `maxEntries`) — a long-running daemon spawning thousands of sub-agents must
+ * not leak one Set entry per delivery for the whole process lifetime.
+ *
+ * @module
+ */
+/**
+ * Build the shared idempotency key `${callerSessionKey}::${runId}`.
+ *
+ * `::` delimits the formatted session key's own single colons
+ * (`callerSessionKey` is the formatted form, e.g. `default:user1:chan1`).
+ * Returns `undefined` for a top-level spawn (no `callerSessionKey`) or an
+ * empty-string key — those deliveries are never deduped.
+ */
+export function buildAnnounceKey(callerSessionKey, runId) {
+    return callerSessionKey ? `${callerSessionKey}::${runId}` : undefined;
+}
+/**
+ * Default delivered-key cap. 10_000 » any realistic concurrent in-flight +
+ * DLQ-retry window (the DLQ itself caps at `maxEntries=100` and bounds
+ * re-delivery by `attemptCount`/`maxAgeMs`), so a key is only ever evicted long
+ * after its run is terminal and can no longer be legitimately re-delivered.
+ */
+export const MAX_DELIVERED_KEYS = 10_000;
+/**
+ * Create a bounded delivery-dedup. `Set` preserves insertion order, so the
+ * first-inserted (oldest-delivered) key is evicted first on overflow.
+ */
+export function createDeliveryDedup(cap = MAX_DELIVERED_KEYS) {
+    const keys = new Set();
+    return {
+        has: (key) => keys.has(key),
+        mark(key) {
+            // Re-marking an existing key must not grow the set (Set.add is a no-op for
+            // a present member, and we only evict when adding a NEW key at capacity).
+            if (keys.has(key))
+                return;
+            if (keys.size >= cap) {
+                const oldest = keys.values().next().value;
+                if (oldest !== undefined)
+                    keys.delete(oldest);
+            }
+            keys.add(key);
+        },
+        get size() {
+            return keys.size;
+        },
+    };
+}

package/node_modules/@comis/agent/dist/spawn/announcement-ports.d.ts

@@ -36,6 +36,8 @@ export interface QueuedAnnouncementShape {
     callerAgentId: string;
     callerSessionKey: string;
     runId: string;
+    /** Idempotency key `${callerSessionKey}::${runId}` (DELIVERY-01). Mirrors QueuedAnnouncement.idempotencyKey — keep in lockstep (D-MIRRORS). */
+    idempotencyKey?: string;
 }
 /**
  * Batcher port: coalesces sub-agent announcements before forwarding to the
@@ -47,6 +49,10 @@ export interface AnnouncementBatcher {
     flush(): Promise<void>;
     shutdown(): Promise<void>;
     readonly pending: number;
+    /** DELIVERY-01: has this idempotency key already been delivered? Mirrors the orchestrator batcher — keep in lockstep (D-MIRRORS / D-SHAREDDEDUP). Plan 03's failure path reads it. */
+    hasDelivered(key: string): boolean;
+    /** DELIVERY-01: mark an idempotency key delivered (success only). Mirrors the orchestrator batcher (D-MIRRORS). */
+    markDelivered(key: string): void;
 }
 /**
  * Single dead-letter-queue entry shape. Mirrors `DeadLetterEntry` from
@@ -63,6 +69,8 @@ export interface DeadLetterEntryShape {
     lastAttemptAt: number;
     lastError?: string;
     threadId?: string;
+    /** Idempotency key `${callerSessionKey}::${runId}` (DELIVERY-01). Mirrors DeadLetterEntry.idempotencyKey — keep in lockstep (D-MIRRORS). */
+    idempotencyKey?: string;
 }
 /**
  * Dead-letter-queue port: persists failed announcements for retry. Concrete
@@ -73,6 +81,13 @@ export interface AnnouncementDeadLetterQueue {
     enqueue(entry: Omit<DeadLetterEntryShape, "id" | "lastAttemptAt">): void;
     drain(sendToChannel: (type: string, id: string, text: string, options?: {
         threadId?: string;
-    }) => Promise<boolean>): Promise<void>;
+    }) => Promise<boolean>, 
+    /**
+     * WR-01: invoked with the entry's `idempotencyKey` after a SUCCESSFUL
+     * re-delivery so the caller can mark the recovered key delivered (shared
+     * deliveredKeys set) — otherwise a later failure sweep double-notifies.
+     * Mirrors the orchestrator DLQ signature (D-MIRRORS).
+     */
+    onDelivered?: (idempotencyKey: string) => void): Promise<void>;
     size(): number;
 }

package/node_modules/@comis/agent/dist/spawn/child-prompt-economy.d.ts

@@ -0,0 +1,147 @@
+/**
+ * Child-prompt economy (STRIP-01 / STRIP-02): drop the heavy inherited context
+ * blocks from a READ-ONLY spawned child's assembled system prompt, on the SPAWN
+ * side, while preserving the constitutional anti-injection safety core.
+ *
+ * A read-only child still ingests untrusted web/MCP/file content, so it remains
+ * a prompt-injection target and MUST keep the safety floor (Pitfall 5 / STRIP-5).
+ * The drop narrows CONTEXT only — it never widens capability.
+ *
+ * ===========================================================================
+ * Task-0 spike findings (Q-STRIP-1) — the spawn → child-prompt path at HEAD
+ * (feature/v2.30). These pin the drop points + the chosen mechanism.
+ * ===========================================================================
+ *
+ * 1. The child's resolved PromptMode.
+ *    A spawned child boots through the SAME assembly entry point as any turn:
+ *    `assembleExecutionPrompt` (executor/prompt-assembly.ts:736). Its mode is
+ *    `resolvePromptModeForProfile(baseMode, operationType, modelProfile,
+ *    compactPrompt)` (prompt-assembly.ts:981) — typically "full" for a
+ *    frontier/mid child (or "compact-secure" for a small/nano child).
+ *    The RESEARCH assumption (A3/A4 — that the "minimal" mode already drops the
+ *    heavy STRIP-01 blocks) is CONFIRMED WRONG: in system-prompt-assembler.ts
+ *    the heavy sections use MODES_ALL (incl. "minimal"), and the `m==="minimal"`
+ *    flag only shortens each builder's TEXT — it does not OMIT the section.
+ *    ⇒ a real drop mechanism is required; we cannot just pick a mode.
+ *
+ * 2. WHERE the heavy blocks are emitted.
+ *    project-context / workspace / skills / reasoning(thinking) / memory-recall
+ *    are real SECTIONS in the assembled system-prompt string
+ *    (system-prompt-assembler.ts SECTIONS table, lines 278-356), each emitting a
+ *    stable `## <Heading>`, joined by SECTION_SEPARATOR ("\n\n---\n\n",
+ *    system-prompt-assembler.ts:58). The RESEARCH "CLAUDE.md-equivalent overlay"
+ *    maps to `## Project Context` (it injects AGENTS.md/ROLE.md — the project-
+ *    instruction overlay, context-sections.ts:181). The RESEARCH "usage trailer"
+ *    has NO Comis analogue in the prompt — token-budget is a DEBUG log line
+ *    (prompt-assembly.ts:1989), never prompt text — so there is nothing to strip
+ *    for it.
+ *
+ * 3. WHERE the safety core lives — same assembled string:
+ *      - `## Safety`                        (core-sections.ts:28; ALWAYS the
+ *                                            full 14-line buildSafetySection(false))
+ *      - `## Config & Secret File Integrity`(tooling-sections.ts:185)
+ *      - `## Authorized Senders`            (sender-trust, trust-sections.ts:129)
+ *      - `## Autonomy`                      (autonomy-doctrine.ts:42)
+ *
+ * 4. MECHANISM (chosen): a post-assembly, per-child string strip on the child's
+ *    OWN assembled `systemPrompt` — split on SECTION_SEPARATOR, drop the sections
+ *    whose heading is in READ_ONLY_CHILD_DROP_HEADINGS, keep everything else
+ *    (so the safety core survives by construction). Rationale:
+ *      (a) cap-safe — ALL logic lives here; the two capped files
+ *          (sub-agent-runner.ts 2643L, prompt-assembly.ts 2035L) take only a
+ *          single call-site hook (Task 2), no section-builder edits;
+ *      (b) testable in isolation — pure string → string;
+ *      (c) per-child — operates on the child's own assembled prompt, never the
+ *          shared SECTIONS state (T-221-STRIP-03), and works on BOTH assembly
+ *          paths (full assembly + the parent-cache reuse path, prompt-assembly.ts
+ *          806-974) because both yield a `systemPrompt` string.
+ *
+ * @module
+ */
+import type { SystemPromptBlocks } from "../bootstrap/index.js";
+/**
+ * The heavy inherited section headings dropped for a read-only child (STRIP-01).
+ * Each is a real `## <Heading>` emitted by the SECTIONS builders (see the
+ * Task-0 spike notes above for the file:line of each). `## Project Context` is
+ * the CLAUDE.md-equivalent overlay; `## Extended Thinking` / `## Reasoning
+ * Format` are the two thinking-guidance variants the reasoning builder emits.
+ */
+export declare const READ_ONLY_CHILD_DROP_HEADINGS: readonly string[];
+/**
+ * The constitutional anti-injection floor that MUST survive the drop
+ * (STRIP-5 / Pitfall 5). Used by the safety-core assertion; kept disjoint from
+ * the drop set by an arch-style test in child-prompt-economy.test.ts.
+ */
+export declare const READ_ONLY_CHILD_KEEP_HEADINGS: readonly string[];
+/**
+ * Whether a spawned child is read-only — i.e. its entire tool surface is
+ * read-only (every tool ⊆ the read-only set per `isReadOnlyTool`), OR it
+ * carries an explicit read-only role.
+ *
+ * Conservative by construction (T-221-STRIP-02): a child is read-only ONLY when
+ * we can PROVE it. Any tool that is not provably read-only — a mutating tool
+ * (`exec`/`edit`/`write`/...) OR an unknown/unregistered tool — makes the child
+ * NOT read-only, and a mutating tool overrides even an explicit read-only role
+ * (capability is never widened by the hint). An empty tool surface is NOT
+ * read-only on its own (no proof of intent), but the explicit read-only role
+ * still classifies a no-tool child as read-only.
+ *
+ * Delegates the per-tool decision to `isReadOnlyTool` (executor/tool-parallelism)
+ * → `getToolMetadata().isReadOnly` (@comis/core) so the classification reuses the
+ * single registry source of truth rather than a hand-rolled list.
+ *
+ * @param childToolNames - The child's resolved tool surface (tool names).
+ * @param role - Optional explicit role; "read-only" classifies as read-only
+ *   UNLESS a mutating tool is present.
+ */
+export declare function isReadOnlyChild(childToolNames: readonly string[], role?: string): boolean;
+/**
+ * Drop the heavy inherited blocks (READ_ONLY_CHILD_DROP_HEADINGS) from an
+ * assembled child system prompt, preserving every other section — including the
+ * full safety core (STRIP-01 + STRIP-5).
+ *
+ * Splits on SECTION_SEPARATOR (the exact joiner the assembler uses), removes the
+ * sections whose leading `## Heading` is in the drop set, and re-joins the
+ * survivors with the same separator. A no-op (returns the input unchanged) when
+ * no heavy section is present, so a NON-read-only path that never calls this, or
+ * an already-lean prompt, is byte-identical.
+ *
+ * Pure + total: never throws; operates only on the passed string.
+ *
+ * @param assembledPrompt - The child's assembled system-prompt string.
+ * @returns The prompt with the heavy sections removed.
+ */
+export declare function economiseChildPrompt(assembledPrompt: string): string;
+/** The economised child prompt — the input window the child boots with. */
+export interface EconomisedChildPrompt {
+    /** The (possibly stripped) full system-prompt string. */
+    systemPrompt: string;
+    /** The (possibly stripped) cache blocks; undefined passes through untouched. */
+    systemPromptBlocks?: SystemPromptBlocks;
+}
+/**
+ * Apply the read-only-child prompt economy on the SPAWN side (STRIP-02): if the
+ * child is read-only, drop the heavy inherited blocks from BOTH the assembled
+ * `systemPrompt` string AND the `systemPromptBlocks.semiStableBody`; otherwise
+ * pass everything through byte-identically (a mutating or unknown-tool child
+ * gets the full prompt — conservative, T-221-STRIP-02).
+ *
+ * Both representations must be stripped because the multi-block path
+ * (request-body/breakpoint-orchestration.ts) builds the system message from
+ * `staticPrefix`/`attribution`/`semiStableBody` when blocks are present, which
+ * OVERRIDES the flat string — stripping only the string would be a no-op at the
+ * wire. The heavy sections all live in `semiStableBody` (identity/persona →
+ * staticPrefix, safety/language → attribution, everything else → body per the
+ * assembler's block boundaries), and the safety-core sections that live in the
+ * body (config-secret/sender-trust/autonomy) are NOT in the drop set, so they
+ * survive. `staticPrefix`/`attribution` are passed through unchanged.
+ *
+ * Single chokepoint so the call site in the (capped) prompt-assembly.ts stays a
+ * one-liner per assembly path.
+ *
+ * @param systemPrompt - The child's assembled system-prompt string.
+ * @param systemPromptBlocks - The child's cache blocks (may be undefined).
+ * @param childToolNames - The child's resolved tool surface.
+ * @param role - Optional explicit role (e.g. "read-only").
+ */
+export declare function economiseForReadOnlyChild(systemPrompt: string, systemPromptBlocks: SystemPromptBlocks | undefined, childToolNames: readonly string[], role?: string): EconomisedChildPrompt;

package/node_modules/@comis/agent/dist/spawn/child-prompt-economy.js

@@ -0,0 +1,200 @@
+// SPDX-License-Identifier: Apache-2.0
+/**
+ * Child-prompt economy (STRIP-01 / STRIP-02): drop the heavy inherited context
+ * blocks from a READ-ONLY spawned child's assembled system prompt, on the SPAWN
+ * side, while preserving the constitutional anti-injection safety core.
+ *
+ * A read-only child still ingests untrusted web/MCP/file content, so it remains
+ * a prompt-injection target and MUST keep the safety floor (Pitfall 5 / STRIP-5).
+ * The drop narrows CONTEXT only — it never widens capability.
+ *
+ * ===========================================================================
+ * Task-0 spike findings (Q-STRIP-1) — the spawn → child-prompt path at HEAD
+ * (feature/v2.30). These pin the drop points + the chosen mechanism.
+ * ===========================================================================
+ *
+ * 1. The child's resolved PromptMode.
+ *    A spawned child boots through the SAME assembly entry point as any turn:
+ *    `assembleExecutionPrompt` (executor/prompt-assembly.ts:736). Its mode is
+ *    `resolvePromptModeForProfile(baseMode, operationType, modelProfile,
+ *    compactPrompt)` (prompt-assembly.ts:981) — typically "full" for a
+ *    frontier/mid child (or "compact-secure" for a small/nano child).
+ *    The RESEARCH assumption (A3/A4 — that the "minimal" mode already drops the
+ *    heavy STRIP-01 blocks) is CONFIRMED WRONG: in system-prompt-assembler.ts
+ *    the heavy sections use MODES_ALL (incl. "minimal"), and the `m==="minimal"`
+ *    flag only shortens each builder's TEXT — it does not OMIT the section.
+ *    ⇒ a real drop mechanism is required; we cannot just pick a mode.
+ *
+ * 2. WHERE the heavy blocks are emitted.
+ *    project-context / workspace / skills / reasoning(thinking) / memory-recall
+ *    are real SECTIONS in the assembled system-prompt string
+ *    (system-prompt-assembler.ts SECTIONS table, lines 278-356), each emitting a
+ *    stable `## <Heading>`, joined by SECTION_SEPARATOR ("\n\n---\n\n",
+ *    system-prompt-assembler.ts:58). The RESEARCH "CLAUDE.md-equivalent overlay"
+ *    maps to `## Project Context` (it injects AGENTS.md/ROLE.md — the project-
+ *    instruction overlay, context-sections.ts:181). The RESEARCH "usage trailer"
+ *    has NO Comis analogue in the prompt — token-budget is a DEBUG log line
+ *    (prompt-assembly.ts:1989), never prompt text — so there is nothing to strip
+ *    for it.
+ *
+ * 3. WHERE the safety core lives — same assembled string:
+ *      - `## Safety`                        (core-sections.ts:28; ALWAYS the
+ *                                            full 14-line buildSafetySection(false))
+ *      - `## Config & Secret File Integrity`(tooling-sections.ts:185)
+ *      - `## Authorized Senders`            (sender-trust, trust-sections.ts:129)
+ *      - `## Autonomy`                      (autonomy-doctrine.ts:42)
+ *
+ * 4. MECHANISM (chosen): a post-assembly, per-child string strip on the child's
+ *    OWN assembled `systemPrompt` — split on SECTION_SEPARATOR, drop the sections
+ *    whose heading is in READ_ONLY_CHILD_DROP_HEADINGS, keep everything else
+ *    (so the safety core survives by construction). Rationale:
+ *      (a) cap-safe — ALL logic lives here; the two capped files
+ *          (sub-agent-runner.ts 2643L, prompt-assembly.ts 2035L) take only a
+ *          single call-site hook (Task 2), no section-builder edits;
+ *      (b) testable in isolation — pure string → string;
+ *      (c) per-child — operates on the child's own assembled prompt, never the
+ *          shared SECTIONS state (T-221-STRIP-03), and works on BOTH assembly
+ *          paths (full assembly + the parent-cache reuse path, prompt-assembly.ts
+ *          806-974) because both yield a `systemPrompt` string.
+ *
+ * @module
+ */
+import { isReadOnlyTool } from "../executor/tool-parallelism.js";
+import { SECTION_SEPARATOR } from "../bootstrap/index.js";
+// ---------------------------------------------------------------------------
+// The drop / keep heading contract
+// ---------------------------------------------------------------------------
+/**
+ * The heavy inherited section headings dropped for a read-only child (STRIP-01).
+ * Each is a real `## <Heading>` emitted by the SECTIONS builders (see the
+ * Task-0 spike notes above for the file:line of each). `## Project Context` is
+ * the CLAUDE.md-equivalent overlay; `## Extended Thinking` / `## Reasoning
+ * Format` are the two thinking-guidance variants the reasoning builder emits.
+ */
+export const READ_ONLY_CHILD_DROP_HEADINGS = [
+    "## Project Context",
+    "## Workspace",
+    "## Skills",
+    "## Memory",
+    "## Extended Thinking",
+    "## Reasoning Format",
+];
+/**
+ * The constitutional anti-injection floor that MUST survive the drop
+ * (STRIP-5 / Pitfall 5). Used by the safety-core assertion; kept disjoint from
+ * the drop set by an arch-style test in child-prompt-economy.test.ts.
+ */
+export const READ_ONLY_CHILD_KEEP_HEADINGS = [
+    "## Safety",
+    "## Config & Secret File Integrity",
+    "## Authorized Senders",
+    "## Autonomy",
+];
+/** Drop-heading lookup; a section is dropped iff its heading is a member. */
+const DROP_SET = new Set(READ_ONLY_CHILD_DROP_HEADINGS);
+// ---------------------------------------------------------------------------
+// Read-only child detection
+// ---------------------------------------------------------------------------
+/**
+ * Whether a spawned child is read-only — i.e. its entire tool surface is
+ * read-only (every tool ⊆ the read-only set per `isReadOnlyTool`), OR it
+ * carries an explicit read-only role.
+ *
+ * Conservative by construction (T-221-STRIP-02): a child is read-only ONLY when
+ * we can PROVE it. Any tool that is not provably read-only — a mutating tool
+ * (`exec`/`edit`/`write`/...) OR an unknown/unregistered tool — makes the child
+ * NOT read-only, and a mutating tool overrides even an explicit read-only role
+ * (capability is never widened by the hint). An empty tool surface is NOT
+ * read-only on its own (no proof of intent), but the explicit read-only role
+ * still classifies a no-tool child as read-only.
+ *
+ * Delegates the per-tool decision to `isReadOnlyTool` (executor/tool-parallelism)
+ * → `getToolMetadata().isReadOnly` (@comis/core) so the classification reuses the
+ * single registry source of truth rather than a hand-rolled list.
+ *
+ * @param childToolNames - The child's resolved tool surface (tool names).
+ * @param role - Optional explicit role; "read-only" classifies as read-only
+ *   UNLESS a mutating tool is present.
+ */
+export function isReadOnlyChild(childToolNames, role) {
+    // A mutating/unknown tool always wins — never widen capability via the hint.
+    const everyToolReadOnly = childToolNames.every((name) => isReadOnlyTool(name));
+    if (role === "read-only") {
+        // Explicit read-only role: honor it unless a tool proves the child can mutate.
+        return everyToolReadOnly;
+    }
+    // No role hint: require BOTH a non-empty surface AND every tool read-only.
+    // An empty surface has no proof of read-only intent → not read-only.
+    return childToolNames.length > 0 && everyToolReadOnly;
+}
+// ---------------------------------------------------------------------------
+// The section-drop
+// ---------------------------------------------------------------------------
+/**
+ * Extract the first line of a section (its `## Heading`, when present).
+ * Sections are assembled as `lines.join("\n")`, so the heading is line 0.
+ */
+function sectionHeading(section) {
+    const newlineIdx = section.indexOf("\n");
+    return (newlineIdx === -1 ? section : section.slice(0, newlineIdx)).trim();
+}
+/**
+ * Drop the heavy inherited blocks (READ_ONLY_CHILD_DROP_HEADINGS) from an
+ * assembled child system prompt, preserving every other section — including the
+ * full safety core (STRIP-01 + STRIP-5).
+ *
+ * Splits on SECTION_SEPARATOR (the exact joiner the assembler uses), removes the
+ * sections whose leading `## Heading` is in the drop set, and re-joins the
+ * survivors with the same separator. A no-op (returns the input unchanged) when
+ * no heavy section is present, so a NON-read-only path that never calls this, or
+ * an already-lean prompt, is byte-identical.
+ *
+ * Pure + total: never throws; operates only on the passed string.
+ *
+ * @param assembledPrompt - The child's assembled system-prompt string.
+ * @returns The prompt with the heavy sections removed.
+ */
+export function economiseChildPrompt(assembledPrompt) {
+    const sections = assembledPrompt.split(SECTION_SEPARATOR);
+    const kept = sections.filter((section) => !DROP_SET.has(sectionHeading(section)));
+    // Preserve byte-identity when nothing was dropped (no spurious re-join diff).
+    if (kept.length === sections.length)
+        return assembledPrompt;
+    return kept.join(SECTION_SEPARATOR);
+}
+/**
+ * Apply the read-only-child prompt economy on the SPAWN side (STRIP-02): if the
+ * child is read-only, drop the heavy inherited blocks from BOTH the assembled
+ * `systemPrompt` string AND the `systemPromptBlocks.semiStableBody`; otherwise
+ * pass everything through byte-identically (a mutating or unknown-tool child
+ * gets the full prompt — conservative, T-221-STRIP-02).
+ *
+ * Both representations must be stripped because the multi-block path
+ * (request-body/breakpoint-orchestration.ts) builds the system message from
+ * `staticPrefix`/`attribution`/`semiStableBody` when blocks are present, which
+ * OVERRIDES the flat string — stripping only the string would be a no-op at the
+ * wire. The heavy sections all live in `semiStableBody` (identity/persona →
+ * staticPrefix, safety/language → attribution, everything else → body per the
+ * assembler's block boundaries), and the safety-core sections that live in the
+ * body (config-secret/sender-trust/autonomy) are NOT in the drop set, so they
+ * survive. `staticPrefix`/`attribution` are passed through unchanged.
+ *
+ * Single chokepoint so the call site in the (capped) prompt-assembly.ts stays a
+ * one-liner per assembly path.
+ *
+ * @param systemPrompt - The child's assembled system-prompt string.
+ * @param systemPromptBlocks - The child's cache blocks (may be undefined).
+ * @param childToolNames - The child's resolved tool surface.
+ * @param role - Optional explicit role (e.g. "read-only").
+ */
+export function economiseForReadOnlyChild(systemPrompt, systemPromptBlocks, childToolNames, role) {
+    if (!isReadOnlyChild(childToolNames, role)) {
+        return { systemPrompt, systemPromptBlocks };
+    }
+    return {
+        systemPrompt: economiseChildPrompt(systemPrompt),
+        systemPromptBlocks: systemPromptBlocks
+            ? { ...systemPromptBlocks, semiStableBody: economiseChildPrompt(systemPromptBlocks.semiStableBody) }
+            : undefined,
+    };
+}

package/node_modules/@comis/agent/dist/spawn/coordinator-progress-fork.d.ts

@@ -0,0 +1,95 @@
+/**
+ * COORD-03 — the ~30s read-only progress fork.
+ *
+ * A multi-day coordinator spawns children that may run for minutes. Without a
+ * progress signal a long child advances invisibly until it returns. This helper
+ * surfaces that advance every ~30s by emitting a CONTENT-FREE
+ * `session:sub_agent_progress` event — a 3-5 word status line + elapsed +
+ * steps — WITHOUT the child completing.
+ *
+ * It is deliberately NOT a re-execution (RESEARCH Pitfall 6 / T-218-13). "Fork"
+ * here means a cheap read-only *summary* of the in-flight child's current step
+ * state, NOT a second run. The helper has NO reference to `executeAgent`, a
+ * spawner, a tool dispatcher, or a model — its ONLY input is a pure
+ * `getStepState` read plus the injected clock/timers. A naive fork that re-ran
+ * the child or called a tool would burn the per-root budget and could itself
+ * spawn (fork-bomb); this one cannot, by construction.
+ *
+ * Discipline:
+ *   - §2.7 CONTENT-FREE (T-218-14): the event carries identifiers + a short
+ *     status `progressLine` + counts + a timestamp ONLY — never the child's
+ *     output, message body, or any tool result.
+ *   - No-globals (AGENTS §2.5; globals.test.ts): time is read from the injected
+ *     {@link ClockPort} and the interval is scheduled on the injected
+ *     {@link TimerPort} — never `setInterval`/`Date.now`. The handle is
+ *     `.unref()`'d so it never blocks event-loop exit, and `stop()` cancels it
+ *     via `handle.cancel()` (never raw `clearInterval`), so the fork never
+ *     outlives the child (T-218-15: no leaked timer).
+ *   - No model call: the `progressLine` is built deterministically from the step
+ *     count — it is a state summary, not an LLM summarization (cheap +
+ *     deterministic).
+ *
+ * INTERNAL to @comis/agent — consumed by sub-agent-runner.ts. NOT re-exported
+ * from packages/agent/src/index.ts (no public-export-consumers entry needed).
+ *
+ * @module
+ */
+import type { ClockPort, TimerPort, EventMap } from "@comis/core";
+/** Default progress cadence — the v8 §23.10 ~30s fork. */
+export declare const COORDINATOR_PROGRESS_INTERVAL_MS = 30000;
+/**
+ * The minimal event-bus surface the fork needs: it ONLY ever emits the
+ * content-free progress event. The production `TypedEventBus` (whose `emit` is
+ * the generic `emit<K>(event, payload)`) satisfies this narrower contract, so
+ * the runner passes its real bus unchanged. Deliberately narrow — the fork has
+ * no `.on`/`.off` and cannot subscribe to or trigger anything else.
+ */
+export interface ProgressForkEventBus {
+    emit(event: "session:sub_agent_progress", payload: EventMap["session:sub_agent_progress"]): unknown;
+}
+/**
+ * Dependencies for {@link createCoordinatorProgressFork}. Note what is ABSENT:
+ * there is no `executeAgent`, no spawner, no tool dispatcher, and no model — the
+ * fork is read-only by its type. `getStepState` is a PURE read of the in-flight
+ * run's current step counter (the runner passes a thin closure over its run
+ * handle); the fork never mutates run state.
+ */
+export interface CoordinatorProgressForkDeps {
+    /** Emit-only bus surface (the real TypedEventBus satisfies it). */
+    eventBus: ProgressForkEventBus;
+    /** Injected wall-clock — elapsedMs is `clock.now() - startMs` (no Date.now). */
+    clock: ClockPort;
+    /** Injected timer port — the ~30s tick (no setInterval global). */
+    timers: TimerPort;
+    /** The in-flight child run id (echoed on the event; never derived from content). */
+    runId: string;
+    /** The child agent id (echoed on the event). */
+    agentId: string;
+    /**
+     * Pure read of the in-flight child's current step state. The fork's ONLY
+     * input besides the clock/timers — there is no re-execution channel. When the
+     * runner cannot cheaply read a live step count it returns `{ stepsExecuted: 0 }`
+     * and the elapsed wall-clock is the advance signal (RESEARCH: a count-only
+     * advance is still NOT a re-execution).
+     */
+    getStepState: () => {
+        stepsExecuted: number;
+    };
+    /** Override the ~30s cadence (default {@link COORDINATOR_PROGRESS_INTERVAL_MS}). */
+    intervalMs?: number;
+}
+/** Opaque lifecycle handle — start the fork at spawn, stop it in the completion finally. */
+export interface CoordinatorProgressForkHandle {
+    /** Begin the ~30s read-only progress ticks. Idempotent — a second start is a no-op. */
+    start(): void;
+    /**
+     * Stop the fork: cancel the interval (via `handle.cancel()`) so it never
+     * outlives the child. Idempotent and safe to call before `start()` (no-op).
+     */
+    stop(): void;
+}
+/**
+ * Create the COORD-03 read-only progress fork. See the module doc for the full
+ * read-only / content-free / no-globals / no-leak contract.
+ */
+export declare function createCoordinatorProgressFork(deps: CoordinatorProgressForkDeps): CoordinatorProgressForkHandle;

package/node_modules/@comis/agent/dist/spawn/coordinator-progress-fork.js

@@ -0,0 +1,49 @@
+/** Default progress cadence — the v8 §23.10 ~30s fork. */
+export const COORDINATOR_PROGRESS_INTERVAL_MS = 30_000;
+/**
+ * Build a short, content-free progress status line from the step count. ≤ ~6
+ * words by construction (T-218-14, §2.7) — a status descriptor, NOT child
+ * content. NEVER incorporate the child's output here.
+ */
+function buildProgressLine(stepsExecuted) {
+    return `running, step ${stepsExecuted}`;
+}
+/**
+ * Create the COORD-03 read-only progress fork. See the module doc for the full
+ * read-only / content-free / no-globals / no-leak contract.
+ */
+export function createCoordinatorProgressFork(deps) {
+    const { eventBus, clock, timers, runId, agentId, getStepState } = deps;
+    const intervalMs = deps.intervalMs ?? COORDINATOR_PROGRESS_INTERVAL_MS;
+    let handle;
+    let startMs = 0;
+    function tick() {
+        // READ-ONLY: a pure step read + a clock read. No tool, no spawn, no model.
+        const { stepsExecuted } = getStepState();
+        const now = clock.now();
+        eventBus.emit("session:sub_agent_progress", {
+            runId,
+            agentId,
+            progressLine: buildProgressLine(stepsExecuted),
+            elapsedMs: now - startMs,
+            stepsExecuted,
+            timestamp: now,
+        });
+    }
+    return {
+        start() {
+            if (handle)
+                return; // idempotent — never schedule two intervals
+            startMs = clock.now();
+            handle = timers.setInterval(tick, intervalMs);
+            // Never block event-loop exit (mirrors the HB-01 keep-alive in the runner).
+            handle.unref();
+        },
+        stop() {
+            // Cancel via the opaque handle (never raw clearInterval). Idempotent +
+            // safe before start() — handle is undefined then, and cancel() is a no-op
+            // on an already-cancelled timer.
+            handle?.cancel();
+        },
+    };
+}