comisai 1.0.42 → 1.0.44

package/node_modules/@comis/daemon/dist/graph/template-interpolation.js

@@ -9,6 +9,7 @@
  * testable.
  * @module
  */
+import { adjustSliceBoundary } from "@comis/core";
 // ---------------------------------------------------------------------------
 // Constants
 // ---------------------------------------------------------------------------
@@ -78,7 +79,9 @@ export function interpolateTaskText(taskText, dependsOn, nodeOutputs, maxResultL
             const suffix = sharedDir
                 ? `... [truncated -- full output: ${sharedDir}/${nodeId}-output.md]`
                 : "... [truncated]";
-            replacement = rawOutput.slice(0, maxResultLength) + suffix;
+            // SAFE-01: snap the content-length cut off a split surrogate pair / orphaned
+            // combining run so the injected upstream output is mojibake-free.
+            replacement = rawOutput.slice(0, adjustSliceBoundary(rawOutput, maxResultLength)) + suffix;
         }
         else {
             replacement = rawOutput;
@@ -96,6 +99,9 @@ export function interpolateTaskText(taskText, dependsOn, nodeOutputs, maxResultL
     matches.sort((a, b) => b.start - a.start);
     let result = taskText;
     for (const m of matches) {
+        // SAFE-01 EXCLUDED: this splices on regex MATCH indices of the ASCII
+        // `{{nodeId.result}}` template pattern — not a content-length cut. Snapping
+        // these boundaries would corrupt the splice (m.start/m.end are pattern edges).
         result = result.slice(0, m.start) + m.replacement + result.slice(m.end);
     }
     return result;
@@ -125,7 +131,7 @@ export function interpolateTaskText(taskText, dependsOn, nodeOutputs, maxResultL
  * @param params.maxResultLength - Truncation limit for upstream outputs (default 12000)
  */
 export function buildContextEnvelope(params) {
-    const { graphLabel, nodeId, task, originalTask, dependsOn, nodeOutputs, totalNodeCount, maxResultLength = DEFAULT_MAX_RESULT_LENGTH, sharedDir, contextMode = "full", failedUpstream = [], skippedUpstream = [], } = params;
+    const { graphLabel, nodeId, task, originalTask, dependsOn, nodeOutputs, totalNodeCount, maxResultLength = DEFAULT_MAX_RESULT_LENGTH, sharedDir, contextMode = "full", failedUpstream = [], skippedUpstream = [], language, } = params;
     // Sort dependsOn alphabetically for deterministic envelope prefix.
     // Sibling nodes with identical upstream sets produce byte-identical context sections.
     const sortedDeps = [...dependsOn].sort();
@@ -165,7 +171,9 @@ export function buildContextEnvelope(params) {
                 const suffix = sharedDir
                     ? `... [truncated -- full output: ${sharedDir}/${depId}-output.md]`
                     : "... [truncated]";
-                lines.push(output.slice(0, effectiveMaxLen) + suffix);
+                // SAFE-01: snap the content-length cut off a split surrogate pair / orphaned
+                // combining run so the upstream-output section is mojibake-free.
+                lines.push(output.slice(0, adjustSliceBoundary(output, effectiveMaxLen)) + suffix);
             }
             else {
                 lines.push(output);
@@ -193,6 +201,14 @@ export function buildContextEnvelope(params) {
         lines.push(`All nodes in this pipeline share this folder.`);
         lines.push(`NOTE: Upstream nodes may have written detailed reports here that contain more information than the condensed outputs above. Check this folder for additional context.`);
     }
+    // Language section (GEN-03): emit a verbatim-preserving directive when the conversation
+    // language is non-en. SAME sentence text as the 181-04 sub-agent role section (I7 single
+    // source). en/absent pushes nothing → byte-identical envelope (I1).
+    if (language && language !== "en") {
+        lines.push("");
+        lines.push("## Language");
+        lines.push(`Produce all user-facing output in ${language} (the conversation language). Code, identifiers, and file paths stay verbatim.`);
+    }
     // Task section
     lines.push("");
     lines.push(`## Your Task`);

package/node_modules/@comis/daemon/dist/index.d.ts

@@ -2,9 +2,32 @@ export { main } from "./daemon.js";
 export type { DaemonInstance, DaemonOverrides } from "./daemon-types.js";
 export { createAnnouncementDeadLetterQueue } from "@comis/orchestrator";
 export type { AnnouncementDeadLetterQueue, DeadLetterEntry } from "@comis/orchestrator";
-export { createContextHandlers } from "./api/context-handlers.js";
-export type { ContextHandlerDeps } from "./api/context-handlers.js";
+export { createAuthHandlers } from "./api/auth-handlers.js";
+export type { AuthHandlerDeps } from "./api/auth-handlers.js";
+export { createMemoryHandlers } from "./api/memory-handlers.js";
+export type { MemoryHandlerDeps } from "./api/memory-handlers.js";
 export { createAgentHandlers } from "./api/agent-handlers.js";
 export type { AgentHandlerDeps } from "./api/agent-handlers.js";
+export { createMcpHandlers } from "./api/mcp-handlers.js";
+export type { McpHandlerDeps } from "./api/mcp-handlers.js";
+export { createMcpOauthHandlers } from "./api/mcp-oauth-handlers.js";
+export type { McpOauthHandlerDeps } from "./api/mcp-oauth-handlers.js";
+export { persistMcpServers, type PersistMcpResult } from "./api/shared/persist-mcp-servers.js";
+export { _resetSigusr1Timer, _resetMutationFence, } from "./api/shared/persist-to-config.js";
+export { _resetConfigMutatedCoalescer } from "./api/mcp-config-mutated-coalescer.js";
+export { __setOutwardSendCrashHookForTest, OUTWARD_SEND_CRASH_SENTINEL, type OutwardSendCrashHookMode, } from "./api/outward-ledger-wrap.js";
+export { applyBundleInstall } from "./skills/bundle-install-helper.js";
+export type { ApplyBundleInstallArgs, ApplyBundleInstallResult, } from "./skills/bundle-install-helper.js";
+export { setupSkillBundles, buildSkillRegistriesForBundles } from "./wiring/setup-skill-bundles.js";
+export type { SetupSkillBundlesDeps } from "./wiring/setup-skill-bundles.js";
+export { applySkillOutcomeTransitions } from "./wiring/setup-learning-skill-transitions.js";
+export { createSkillTrendTracker } from "./wiring/setup-learning-skill-trend.js";
 export { createTracingLogger } from "./observability/trace-logger.js";
 export type { TracingLoggerOptions } from "./observability/trace-logger.js";
+export { emitStartupInvariants } from "./wiring/setup-startup-invariants.js";
+export type { StartupInvariantsDeps, StartupInvariants } from "./wiring/setup-startup-invariants.js";
+export { assembleIncidentReportFromSources } from "./api/obs-handlers/obs-explain.js";
+export { makeRealReader } from "./api/obs-handlers/obs-explain-readers.js";
+export type { IncidentSourceReader } from "./api/obs-handlers/obs-explain-readers.js";
+export { assembleFleetHealthReport } from "./api/obs-handlers/fleet-health.js";
+export { DENYLISTED_RPC_METHODS } from "./wiring/setup-capability-endpoint.js";

package/node_modules/@comis/daemon/dist/index.js

@@ -1,24 +1,108 @@
 // SPDX-License-Identifier: Apache-2.0
 // @comis/daemon - production daemon entry point
+//
+// Test-only root re-exports policy:
+// The four `createXxx`/`createYyy`/etc. re-exports below all have real
+// in-repo test consumers — each line carries a per-consumer breadcrumb.
+// They survive the BC-shim sweep because:
+//   1. Tests live under test/**, which the public-export-consumers AST
+//      walker explicitly excludes — so the entries appear as "orphans"
+//      to the walker but ARE consumed (Path B preserve-with-docs).
+//   2. The test/support/public-api-policy.ts entry for `@comis/daemon`
+//      tracks these four symbols + their consumer file paths.
+// Do NOT delete these re-exports without retargeting the consumers
+// listed in test/support/public-api-policy.ts.
 // Daemon entry point and types for integration test harness
 export { main } from "./daemon.js";
 // Announcement dead-letter queue (canonical surface lives in
 // packages/orchestrator/src/cross-session/; re-exported here so the
-// daemon's public API contract documented in test/support/public-api-policy.ts
-// stays stable for the resilience-e2e-dead-letter integration test).
+// daemon's public API contract stays stable for the
+// resilience-e2e-dead-letter integration test).
+// Consumer: test/integration/resilience-e2e-dead-letter.test.ts:22
 export { createAnnouncementDeadLetterQueue } from "@comis/orchestrator";
-// Context handlers: DAG context engine RPC handlers
-export { createContextHandlers } from "./api/context-handlers.js";
+// Auth handlers: encrypted OAuth-profile management (auth.set / auth.list /
+// auth.logout) — re-exported so the auth-set-encrypted integration test can
+// drive the real admin-gated auth.set handler against a mock
+// OAuthCredentialStorePort, proving the round-trip + residency invariant
+// (no plaintext token bytes in responses/logs/audit) without spinning up a
+// full daemon or opening a real secrets.db.
+// Consumer: test/integration/auth-set-encrypted.test.ts
+export { createAuthHandlers } from "./api/auth-handlers.js";
+// Memory handlers: memory + memory-diagnostic RPC handlers —
+// re-exported so the recall-diagnostics isolation integration test can drive
+// the actual admin-gated memory.observations / memory.entities /
+// memory.recall_stats / memory.recall_trace handlers against the REAL wired
+// scoped stores, proving the cross-scope-leak negative + the EoP admin-reject
+// through the RPC layer (not just the adapter).
+// Consumer: test/integration/security/recall-diagnostics-isolation.test.ts
+export { createMemoryHandlers } from "./api/memory-handlers.js";
 // Agent management RPC handlers — re-exported so the multi-account
 // integration test can drive the actual `agents.update` RPC handler against a
 // shared `agents` map, mirroring the daemon-runtime container.config.agents
 // pattern at daemon.ts:594/634.
+// Consumer: test/integration/oauth-multi-account.test.ts:80,580
 export { createAgentHandlers } from "./api/agent-handlers.js";
+// MCP management RPC handlers — re-exported so the MCP
+// install persistence integration test
+// (test/integration/mcp-persistence.test.ts) can drive the actual
+// `mcp.connect` / `mcp.disconnect` RPC handlers against a real
+// persistToConfig + appendConfigAuditWithOutcome pipeline pointed at a
+// tmpdir config path. Mirrors the createAgentHandlers re-export above.
+//
+// Module-level reset helpers from persist-to-config.ts are also surfaced
+// here because the persistToConfig writer holds two PROCESS-WIDE
+// singletons (sigusr1Timer + pendingConfigMutations fence) that MUST be
+// reset in beforeEach so a prior test's armed SIGUSR2 timer / pending
+// fence does not leak into the next test (per the module-level state
+// docs at packages/daemon/src/api/shared/persist-to-config.ts:12-43).
+export { createMcpHandlers } from "./api/mcp-handlers.js";
+// mcp.oauth_login / mcp.oauth_logout RPC handlers.
+export { createMcpOauthHandlers } from "./api/mcp-oauth-handlers.js";
+// Extracted single-writer for integrations.mcp.servers.
+// Consumers: the bundle-install helper and boot-path orchestrator both reach
+// the helper through this barrel re-export so neither needs a direct
+// daemon-internal import.
+export { persistMcpServers } from "./api/shared/persist-mcp-servers.js";
+export { _resetSigusr1Timer, _resetMutationFence, } from "./api/shared/persist-to-config.js";
+// Test seam: 500ms trailing-edge coalescer holds
+// closure-captured state across all persistMcpServers calls in a daemon
+// process. Integration tests call this in `beforeEach` to clear pending
+// added/removed maps and cancel any armed timer, mirroring the
+// _resetSigusr1Timer / _resetMutationFence pattern at persist-to-config.ts.
+// Consumer: test/integration/mcp-config-refresh.test.ts.
+export { _resetConfigMutatedCoalescer } from "./api/mcp-config-mutated-coalescer.js";
+// Phase 216 Plan 08 (MED-6) test seam: the exactly-once chaos test
+// (test/integration/durable-resume-e2e.test.ts) arms a crash-injection hook in
+// the REAL wrapOutwardSend so a live autonomy-originated send crashes in the
+// invariant-#12 window (between markUnknown and commit), leaving a genuine
+// unknown_after_send row for the post-restart recovery to reconcile. INERT in
+// production (never armed); mirrors the _resetSigusr1Timer test-seam pattern.
+export { __setOutwardSendCrashHookForTest, OUTWARD_SEND_CRASH_SENTINEL, } from "./api/outward-ledger-wrap.js";
+// Bundle-install helper + boot orchestrator surfaced through the daemon barrel
+// so the skill-bundle-install integration test
+// (test/integration/skill-bundle-install.test.ts) can drive the
+// atomic-install reject path + the boot re-merge idempotence path
+// against the REAL persistToConfig + audit JSONL pipeline pointed at a
+// tmpdir config path. Mirrors the createMcpHandlers / persistMcpServers
+// re-export pattern above.
+export { applyBundleInstall } from "./skills/bundle-install-helper.js";
+export { setupSkillBundles, buildSkillRegistriesForBundles } from "./wiring/setup-skill-bundles.js";
+// Resolve-seam learned-skill promote/demote loop body + the in-process
+// decay-aware trend tracker, surfaced through the daemon barrel so the Phase-222
+// MODEL-04 source-agnostic characterization
+// (test/integration/mental-model-readonly-lifecycle.test.ts) can drive the REAL
+// transition path — a hand-authored (no-synthesis) mental_models doc promotes via
+// promoteByName EXACTLY as a synthesized skill — instead of a store-only fallback.
+// Both are name-keyed and (tenant, agent)-scoped via the LearningScope/skillGaugeKey
+// they consume (no new data path / secret / cross-tenant widening). Mirrors the
+// skill-bundle-install test-driven re-export precedent above.
+export { applySkillOutcomeTransitions } from "./wiring/setup-learning-skill-transitions.js";
+export { createSkillTrendTracker } from "./wiring/setup-learning-skill-trend.js";
 // Re-export createTracingLogger so the test daemon harness can thread the
 // `LoggerOptions.disableRedaction` opt-in through to the SAME logger
 // instance the daemon uses for production code paths. Consumer is
 // test/support/daemon-harness.ts via
-// startTestDaemon({ disableRedaction: ...trueValue... }) for the residency
+// startTestDaemon({ disableRedaction: ...trueValue... }) for the
 // integration test.
 //
 // Note on phrasing: the literal token sequence `disableRedaction[:][space][true]`
@@ -26,4 +110,45 @@ export { createAgentHandlers } from "./api/agent-handlers.js";
 // walker at test/architecture/source-rules.test.ts does not trip its own
 // invariant (the walker source-greps `packages/*\/src/**` for that exact
 // byte sequence).
+// Consumer: test/support/daemon-harness.ts:434-442 (DYNAMIC require)
 export { createTracingLogger } from "./observability/trace-logger.js";
+// Startup invariant collector — re-exported so the
+// acceptance gate integration test can call emitStartupInvariants against
+// a mock logger without spinning up the full daemon.
+// Consumer: test/integration/incident-replay-2026-05-24.test.ts
+export { emitStartupInvariants } from "./wiring/setup-startup-invariants.js";
+// Obs-explain assembler + reader DI seam — re-exported so the RE-PROVE
+// scenario (test/live) can call the FROZEN Phase-153 assembler over a fixture
+// reader without a deep daemon-internal dist path. Read-only; the admin gate
+// stays on bindObsExplainHandlers (obs-explain.ts:188) — this exports ONLY the
+// gate-free assembler the X3 tests + the obs_explain MCP tool already call with
+// no _trustLevel, NEVER the admin-gated handler.
+// Consumer: test/live/scenarios/prove/diagnosis-reprove.test.ts
+export { assembleIncidentReportFromSources } from "./api/obs-handlers/obs-explain.js";
+export { makeRealReader } from "./api/obs-handlers/obs-explain-readers.js";
+// Fleet-health assembler RE-PROVE seam (v2.15 — mirrors the v2.14 obs-explain
+// precedent above). Re-exported from the TOP-LEVEL barrel so the keyless fleet
+// RE-PROVE scenario (test/live) can `import { assembleFleetHealthReport } from
+// "@comis/daemon"` — the live config aliases ONLY the top-level @comis/daemon ->
+// daemon/dist/index.js (no obs-handlers subpath alias). The gate-free assembler
+// only; the H1 admin gate stays on bindFleetHealthHandlers (fleet-health.ts).
+// Consumer: test/live/scenarios/prove/fleet-reprove.test.ts
+export { assembleFleetHealthReport } from "./api/obs-handlers/fleet-health.js";
+// pi-ai image shim (Phase 183, I1 keystone): `createPiImageAdapter` +
+// `registerComisImageProviders` + `resolveImageApiKey` + the typed cross-plan
+// `ImageGenError` live in `./api/pi-image-adapter.js`. They are daemon-internal
+// — consumed via relative imports (`wiring/setup-image-provider`,
+// `wiring/main-helpers`) — and intentionally NOT on the public barrel until a
+// cross-package consumer exists (public-export-consumers gate). A future-phase
+// transport that genuinely needs one cross-package re-exports it here then.
+// DENYLISTED_RPC_METHODS (Phase 219, CLI-02/03 RE-PROVE seam) — the cap-socket's
+// method-precise closed-door set (the `skills_manage`/admin-management methods the
+// endpoint's pre-check throws on BEFORE `validate()`). Re-exported from the
+// top-level barrel so the `comis-agent-same-gate` / `comis-agent-no-admin`
+// arch-tests DERIVE the denylisted-method set from the SAME source the endpoint
+// uses (no hand-maintained literal that drifts). Pure additive `export` — the
+// const + its `SUB_AGENT_TOOL_DENYLIST` soundness loop are unchanged; the daemon
+// runtime behavior is byte-identical. @comis/core cannot import this (it would be
+// a package cycle), so the cross-check lives in the architecture-suite arch-test.
+// Consumer: test/architecture/comis-agent-same-gate.test.ts + comis-agent-no-admin.test.ts
+export { DENYLISTED_RPC_METHODS } from "./wiring/setup-capability-endpoint.js";

package/node_modules/@comis/daemon/dist/monitoring/disk-space-source.js

@@ -5,7 +5,7 @@
  * fs.statfs(). Alerts when any path exceeds the configured threshold.
  * Disk space monitoring.
  */
-import { HEARTBEAT_OK_TOKEN } from "@comis/scheduler";
+import { HEARTBEAT_OK_TOKEN } from "@comis/shared";
 import { statfs } from "node:fs/promises";
 import { systemNowMs } from "@comis/core";
 const SOURCE_ID = "monitor:disk-space";

package/node_modules/@comis/daemon/dist/monitoring/git-watcher-source.js

@@ -6,7 +6,7 @@
  * all repositories.
  * Git repository monitoring.
  */
-import { HEARTBEAT_OK_TOKEN } from "@comis/scheduler";
+import { HEARTBEAT_OK_TOKEN } from "@comis/shared";
 import { execFile as execFileCb } from "node:child_process";
 import { promisify } from "node:util";
 import { envWithoutSystemdNotify } from "./exec-helpers.js";

package/node_modules/@comis/daemon/dist/monitoring/security-update-source.js

@@ -6,7 +6,7 @@
  * manager (apt-get, dnf, or yum). Gracefully degrades when no
  * supported package manager is found.
  */
-import { HEARTBEAT_OK_TOKEN } from "@comis/scheduler";
+import { HEARTBEAT_OK_TOKEN } from "@comis/shared";
 import { execFile as execFileCb } from "node:child_process";
 import { promisify } from "node:util";
 import { envWithoutSystemdNotify } from "./exec-helpers.js";

package/node_modules/@comis/daemon/dist/monitoring/system-resources-source.js

@@ -8,7 +8,7 @@
  * - Linux: reads /proc/meminfo MemAvailable (accounts for reclaimable buffers/cache)
  * - Fallback: os.freemem() for unsupported platforms
  */
-import { HEARTBEAT_OK_TOKEN } from "@comis/scheduler";
+import { HEARTBEAT_OK_TOKEN } from "@comis/shared";
 import { cpus, freemem, totalmem } from "node:os";
 import { execFile as execFileCb } from "node:child_process";
 import { readFile } from "node:fs/promises";

package/node_modules/@comis/daemon/dist/monitoring/systemd-service-source.js

@@ -6,7 +6,7 @@
  * using systemctl. Gracefully degrades when systemd is not available
  * (e.g., macOS, container environments).
  */
-import { HEARTBEAT_OK_TOKEN } from "@comis/scheduler";
+import { HEARTBEAT_OK_TOKEN } from "@comis/shared";
 import { execFile as execFileCb } from "node:child_process";
 import { access, constants } from "node:fs/promises";
 import { promisify } from "node:util";

package/node_modules/@comis/daemon/dist/notification/notification-service.js

@@ -34,7 +34,12 @@ function computeQuietHoursEndMs(config, nowMs) {
 export function createNotificationService(deps) {
     const getNow = deps.nowMs ?? Date.now;
     const rateLimiter = createRateLimiter({
-        maxPerHour: deps.defaultConfig.maxPerHour,
+        // Resolve the ceiling PER-AGENT from the agent's own notification config
+        // (schema-notification `maxPerHour`), falling back to the default. The
+        // limiter is keyed per-agent (tryAcquire(agentId)) but previously baked in
+        // ONLY defaultConfig.maxPerHour, so a configured per-agent ceiling was
+        // silently ignored (built-but-not-wired).
+        maxPerHour: (agentId) => (deps.notificationConfigs.get(agentId) ?? deps.defaultConfig).maxPerHour,
         nowMs: deps.nowMs,
     });
     const dedupDetector = createDuplicateDetector({
@@ -67,7 +72,10 @@ export function createNotificationService(deps) {
                     timestamp: now,
                 });
                 deps.logger.warn({ agentId: opts.agentId, attempted: channelResult.error.attempted }, "Notification suppressed: no channel resolved");
-                return err(new Error("No channel resolved for notification delivery"));
+                return err(new Error(`No channel resolved for notification delivery (tried: ${channelResult.error.attempted.join(" -> ")}). ` +
+                    "Pass channel_type + channel_id explicitly, set agents." +
+                    `${opts.agentId}.notification.primaryChannel in config, ` +
+                    "or notify after the agent has a recent channel session."));
             }
             const { channelType, channelId } = channelResult.value;
             // Step 4: Check quiet hours
@@ -130,8 +138,6 @@ export function createNotificationService(deps) {
                 channelId,
                 tenantId: deps.tenantId,
                 origin,
-                formatApplied: false,
-                chunkingApplied: false,
                 maxAttempts: 3,
                 createdAt: now,
                 scheduledAt,

package/node_modules/@comis/daemon/dist/notification/rate-limiter.d.ts

@@ -10,6 +10,12 @@ export interface RateLimiter {
     reset(agentId: string): void;
 }
 export declare function createRateLimiter(opts: {
-    maxPerHour: number;
+    /**
+     * The hourly ceiling. A function resolves it PER-AGENT (called on each
+     * tryAcquire) so an agent's own `notification.maxPerHour` config takes effect
+     * rather than a single global default — previously the limiter baked in one
+     * number and silently ignored the schema-supported per-agent ceiling.
+     */
+    maxPerHour: number | ((agentId: string) => number);
     nowMs?: () => number;
 }): RateLimiter;

package/node_modules/@comis/daemon/dist/notification/rate-limiter.js

@@ -8,6 +8,7 @@ export function createRateLimiter(opts) {
     const getNow = opts.nowMs ?? Date.now;
     const HOUR_MS = 3_600_000;
     const counters = new Map();
+    const limitFor = (agentId) => typeof opts.maxPerHour === "function" ? opts.maxPerHour(agentId) : opts.maxPerHour;
     return {
         tryAcquire(agentId) {
             const now = getNow();
@@ -16,7 +17,7 @@ export function createRateLimiter(opts) {
                 counters.set(agentId, { count: 1, windowStartMs: now });
                 return true;
             }
-            if (entry.count >= opts.maxPerHour)
+            if (entry.count >= limitFor(agentId))
                 return false;
             entry.count++;
             return true;

package/node_modules/@comis/daemon/dist/observability/build-config-posture-record.d.ts

@@ -0,0 +1,143 @@
+/**
+ * I3 — record a config-posture SNAPSHOT at boot.
+ *
+ * Captures the three log-file-only security-posture FINDINGS as a single
+ * point-in-time `obs_diagnostics` row at startup, so the fleet lens (Phase 161)
+ * can query a daemon's posture without grepping `daemon.log`:
+ *   - `tlsOff`               — the gateway is running without TLS (recomputed
+ *                              from `gateway.{tls, allowInsecureHttp}` at the
+ *                              boot site — the gateway WARN is NOT intercepted).
+ *   - `allowInsecureHttp`    — the operator explicitly opted into plaintext HTTP.
+ *   - `stranded`             — stranded-secret COUNTS per credential family
+ *                              ({stranded: <closed label>, entryCount: <count>})
+ *                              from the refactored `checkStorageModeConsistency`
+ *                              probe — COUNTS only, NEVER a secret value.
+ *   - `canaryFallbackActive`  — daemon-global boolean: `true` when `CANARY_SECRET`
+ *                              is absent, so EVERY agent falls back to a
+ *                              deterministic per-agent canary derivation
+ *                              (setup-agents-runtime.ts) instead of the
+ *                              operator-set secret. An HONEST presence proxy, not
+ *                              a per-agent tally: `CANARY_SECRET` is folded into
+ *                              the boot `mergedEnv` store-wins (buildMergedEnv),
+ *                              so the env read at the boot site already honors an
+ *                              encrypted/file secret-store entry — the same
+ *                              source the per-agent path resolves. Deep per-agent
+ *                              plumbing is avoided per KISS.
+ *
+ * This is a boot-time SNAPSHOT — a direct `insertDiagnostic`, NOT an event. An
+ * event would imply recurrence/streaming and go stale; a once-per-boot record
+ * is the correct point-in-time model (RESEARCH Pitfall 4). Because the snapshot
+ * is recorded once per boot regardless of WARN frequency, the recurrence gate
+ * does not gate I3 away.
+ *
+ * `details` carries ONLY booleans + counts + closed stranded labels — no secret
+ * values, no cert paths, no canary secrets, no free text. The stranded findings
+ * are the SAME count-only objects the probe already WARNs with (bounded-payload
+ * discipline, §2.7).
+ *
+ * @module
+ */
+import type { ClockPort } from "@comis/core";
+import type { ObservabilityStore } from "@comis/memory";
+import type { StrandedFinding } from "../wiring/setup-storage-mismatch-warn.js";
+/**
+ * RESOLVE-01: count configured agents whose NATIVE provider family disagrees with
+ * their model id's family (the `ffe11736` chimera). Conservative — gateway/custom
+ * providers + an unknown model family never flag (see `isProviderModelChimera`).
+ * Lives here (not inline in daemon.ts) to keep daemon.ts under its 3000-line cap.
+ * Count only — the caller persists the COUNT, never agent ids/model names (I3).
+ */
+export declare function countChimericModels(agents: Readonly<Record<string, {
+    provider?: string;
+    model?: string;
+}>>): number;
+/**
+ * OBS-7 (openclaw-usecases 2026-06-25): is the gateway bound to a LOOPBACK address?
+ *
+ * A loopback-bound gateway has no off-host network exposure, so running it WITHOUT
+ * TLS is benign — it matches the `gateway-exposure` security check, which flags only
+ * a `0.0.0.0`-without-TLS bind as critical, never a loopback one. Used to suppress the
+ * `tlsOff` config-posture finding on a loopback bind so it does not become the fleet
+ * `likelyRootCause` headline on a dev / loopback box (where it is noise). A non-loopback
+ * bind (`0.0.0.0` or a routable IP) WITHOUT TLS still flags — correct for production.
+ *
+ * `gateway.host` defaults to `127.0.0.1`, so a default daemon is loopback (benign by
+ * default); only an operator-set non-loopback host opts into the TLS-off finding. An
+ * absent/unknown host is treated as NON-loopback (conservative — never suppress on doubt).
+ */
+export declare function isLoopbackHost(host: string | undefined): boolean;
+/**
+ * SPEND-05: count configured agents burning tokens on remote-unknown-priced models
+ * — those whose configured `provider`+`model` resolves to the `"unknown"` pricing
+ * state (a NATIVE single-family provider with NO catalog rate — the `ffe11736`
+ * fail-open where `resolveModelPricing` silently returns $0, masking a phantom cost
+ * as free). A `"free"` local/gateway provider (honest $0) and a `"priced"` agent are
+ * NOT counted — so a local-first deployment is never false-flagged. Consumes the
+ * shipped 3-state {@link resolvePricingState} directly, NEVER a catalog-presence
+ * boolean. Lives here (not inline in daemon.ts) to keep daemon.ts under its 3000-line
+ * cap. Count only — the caller persists the COUNT, never agent ids/model names (I3).
+ */
+export declare function countPricingGaps(agents: Readonly<Record<string, {
+    provider?: string;
+    model?: string;
+}>>): number;
+/** The boot-time config-posture inputs (counts/booleans/closed labels only). */
+export interface ConfigPostureInputs {
+    /** The gateway is running without TLS (and not explicitly allowing insecure HTTP). */
+    tlsOff: boolean;
+    /** The operator opted into plaintext HTTP (`gateway.allowInsecureHttp`). */
+    allowInsecureHttp: boolean;
+    /** Stranded-secret COUNTS per family — never a secret value. */
+    strandedFindings: StrandedFinding[];
+    /**
+     * Daemon-global boolean: `true` when `CANARY_SECRET` is absent (every agent
+     * uses the deterministic per-agent canary fallback), `false` when it is set.
+     * An honest presence proxy keyed on `CANARY_SECRET` in env-or-secret-store
+     * (the boot `mergedEnv` is store-wins) — NOT a per-agent count.
+     */
+    canaryFallbackActive: boolean;
+    /**
+     * KNOB-03 (Phase 176): providers whose Ollama-served window < configured at
+     * this boot — a COUNT, never provider names (the no-free-text contract).
+     * Derived in daemon.ts from the SAME comparison results the KNOB-01 boot
+     * WARN used (one comparison, two surfaces — no drift).
+     */
+    servedBelowConfiguredCount: number;
+    /**
+     * RESOLVE-01 (observability-excellence): number of configured agents whose
+     * NATIVE provider family disagrees with their model id's family (the `ffe11736`
+     * chimera — e.g. `provider: anthropic` + a qwen model → phantom profile). A
+     * COUNT, never agent ids or model names (the no-free-text contract). Computed in
+     * daemon.ts via `isProviderModelChimera` over the configured agents at boot.
+     * Optional (defaults to 0 in the record) so existing callers/tests need no change.
+     */
+    chimericModelCount?: number;
+    /**
+     * SPEND-05 (observability-excellence): number of configured agents burning tokens
+     * on remote-unknown-priced models (`resolvePricingState == "unknown"` — a NATIVE
+     * provider with no catalog rate, the `ffe11736` fail-open where spend is silently
+     * under-counted as $0). A COUNT, never agent ids or model names (the no-free-text
+     * contract). Computed in daemon.ts via `countPricingGaps` over the configured
+     * agents at boot. Optional (defaults to 0 in the record).
+     */
+    pricingGapCount?: number;
+    /**
+     * RELAX-SURFACE (30uc-20260624, Track-M): `true` when the operator set
+     * `security.agentToAgent.sandboxNoDowngrade: false` — a RELAXED security default
+     * (a spawned child may run with a weaker sandbox posture than its parent). The
+     * Track-M relaxation-surfacing rule wants a relaxed default surfaced at boot, not
+     * silent. A boolean, never config bodies. Optional (defaults to `false`).
+     */
+    sandboxNoDowngradeDisabled?: boolean;
+}
+/**
+ * Write a one-shot `config_posture` row to `obs_diagnostics` at boot.
+ *
+ * No-ops when `obsStore` is `undefined` (observability persistence disabled) —
+ * the `?.` is mandatory so a disabled-persistence boot cannot crash shutdown
+ * (Pitfall 5). Severity is `"warning"` when ANY posture issue is present
+ * (`tlsOff` OR a stranded finding OR `canaryFallbackActive` OR
+ * `servedBelowConfiguredCount > 0`), else `"info"`. The timestamp comes from
+ * the injected `ClockPort` — never `Date.now()` (globals gate).
+ */
+export declare function buildConfigPostureRecord(obsStore: ObservabilityStore | undefined, inputs: ConfigPostureInputs, clock: ClockPort): void;

package/node_modules/@comis/daemon/dist/observability/build-config-posture-record.js

@@ -0,0 +1,91 @@
+import { isProviderModelChimera, resolvePricingState } from "@comis/core";
+/**
+ * RESOLVE-01: count configured agents whose NATIVE provider family disagrees with
+ * their model id's family (the `ffe11736` chimera). Conservative — gateway/custom
+ * providers + an unknown model family never flag (see `isProviderModelChimera`).
+ * Lives here (not inline in daemon.ts) to keep daemon.ts under its 3000-line cap.
+ * Count only — the caller persists the COUNT, never agent ids/model names (I3).
+ */
+export function countChimericModels(agents) {
+    return Object.values(agents).filter((a) => typeof a.provider === "string" && typeof a.model === "string" && isProviderModelChimera(a.provider, a.model)).length;
+}
+/**
+ * OBS-7 (openclaw-usecases 2026-06-25): is the gateway bound to a LOOPBACK address?
+ *
+ * A loopback-bound gateway has no off-host network exposure, so running it WITHOUT
+ * TLS is benign — it matches the `gateway-exposure` security check, which flags only
+ * a `0.0.0.0`-without-TLS bind as critical, never a loopback one. Used to suppress the
+ * `tlsOff` config-posture finding on a loopback bind so it does not become the fleet
+ * `likelyRootCause` headline on a dev / loopback box (where it is noise). A non-loopback
+ * bind (`0.0.0.0` or a routable IP) WITHOUT TLS still flags — correct for production.
+ *
+ * `gateway.host` defaults to `127.0.0.1`, so a default daemon is loopback (benign by
+ * default); only an operator-set non-loopback host opts into the TLS-off finding. An
+ * absent/unknown host is treated as NON-loopback (conservative — never suppress on doubt).
+ */
+export function isLoopbackHost(host) {
+    if (typeof host !== "string")
+        return false;
+    const h = host.trim().toLowerCase();
+    return h === "127.0.0.1" || h === "::1" || h === "localhost" || h.startsWith("127.");
+}
+/**
+ * SPEND-05: count configured agents burning tokens on remote-unknown-priced models
+ * — those whose configured `provider`+`model` resolves to the `"unknown"` pricing
+ * state (a NATIVE single-family provider with NO catalog rate — the `ffe11736`
+ * fail-open where `resolveModelPricing` silently returns $0, masking a phantom cost
+ * as free). A `"free"` local/gateway provider (honest $0) and a `"priced"` agent are
+ * NOT counted — so a local-first deployment is never false-flagged. Consumes the
+ * shipped 3-state {@link resolvePricingState} directly, NEVER a catalog-presence
+ * boolean. Lives here (not inline in daemon.ts) to keep daemon.ts under its 3000-line
+ * cap. Count only — the caller persists the COUNT, never agent ids/model names (I3).
+ */
+export function countPricingGaps(agents) {
+    return Object.values(agents).filter((a) => typeof a.provider === "string" &&
+        typeof a.model === "string" &&
+        resolvePricingState(a.provider, a.model) === "unknown").length;
+}
+/**
+ * Write a one-shot `config_posture` row to `obs_diagnostics` at boot.
+ *
+ * No-ops when `obsStore` is `undefined` (observability persistence disabled) —
+ * the `?.` is mandatory so a disabled-persistence boot cannot crash shutdown
+ * (Pitfall 5). Severity is `"warning"` when ANY posture issue is present
+ * (`tlsOff` OR a stranded finding OR `canaryFallbackActive` OR
+ * `servedBelowConfiguredCount > 0`), else `"info"`. The timestamp comes from
+ * the injected `ClockPort` — never `Date.now()` (globals gate).
+ */
+export function buildConfigPostureRecord(obsStore, inputs, clock) {
+    const chimericModelCount = inputs.chimericModelCount ?? 0;
+    const pricingGapCount = inputs.pricingGapCount ?? 0;
+    const sandboxNoDowngradeDisabled = inputs.sandboxNoDowngradeDisabled ?? false;
+    const hasIssue = inputs.tlsOff ||
+        inputs.strandedFindings.length > 0 ||
+        inputs.canaryFallbackActive ||
+        inputs.servedBelowConfiguredCount > 0 ||
+        chimericModelCount > 0 ||
+        pricingGapCount > 0 ||
+        sandboxNoDowngradeDisabled;
+    obsStore?.insertDiagnostic({
+        timestamp: clock.now(),
+        category: "config_posture",
+        severity: hasIssue ? "warning" : "info",
+        message: "config_posture",
+        details: JSON.stringify({
+            tlsOff: inputs.tlsOff,
+            allowInsecureHttp: inputs.allowInsecureHttp,
+            stranded: inputs.strandedFindings,
+            canaryFallbackActive: inputs.canaryFallbackActive,
+            servedBelowConfiguredCount: inputs.servedBelowConfiguredCount,
+            // RESOLVE-01: agents booted with a NATIVE provider + a foreign model family
+            // (the ffe11736 chimera). A COUNT, never agent ids/model names (no free text).
+            chimericModelCount,
+            // SPEND-05: agents burning tokens on remote-unknown-priced models
+            // (resolvePricingState == "unknown"). A COUNT, never agent ids/model names.
+            pricingGapCount,
+            // RELAX-SURFACE: the no-downgrade sandbox invariant is DISABLED (relaxed
+            // default surfaced at boot, not silent). A boolean, never config bodies.
+            sandboxNoDowngradeDisabled,
+        }),
+    });
+}

package/node_modules/@comis/daemon/dist/observability/delivery-queue-logger.d.ts

@@ -1,15 +1,19 @@
 /**
  * Delivery queue observability: structured logging subscriber for queue
  * lifecycle events.
- * Subscribes to all 7 delivery queue events (delivery:enqueued, delivery:acked,
- * delivery:nacked, delivery:failed, delivery:queue_drained, delivery:hook_cancelled,
- * delivery:aborted) and logs with
+ * Subscribes to the 8 delivery queue / reply-binding events (delivery:enqueued,
+ * delivery:acked, delivery:nacked, delivery:failed, delivery:queue_drained,
+ * delivery:hook_cancelled, delivery:aborted, delivery:reply_bound) and logs with
  * canonical fields per the project logging rules.
  * Logging levels follow the boundary-event convention:
  * - INFO for boundary events: enqueue (message enters queue), ack (delivery
  *   confirmed), queue_drained (startup drain complete).
  * - WARN for degraded states: nack (transient failure, will retry) and fail
  *   (permanent failure). WARN events include hint and errorKind as required.
+ * - DEBUG for the reply->trajectory binding breadcrumb (delivery:reply_bound,
+ *   WR-01): a high-frequency per-reply positive signal, kept at DEBUG so it does
+ *   not flood INFO, but present so a reaction map-miss is one-call diagnosable
+ *   (the bind fired vs never fired) from the log trail alongside the bus event.
  * @module
  */
 import type { TypedEventBus } from "@comis/core";