comisai 1.0.42 → 1.0.44

package/node_modules/@comis/agent/dist/executor/pi-executor/safety-gate.js

@@ -15,6 +15,7 @@
 import { formatSessionKey } from "@comis/core";
 import { validateInput } from "../executor-input-guard.js";
 import { tryInjectSilentFailure } from "../fault-injector.js";
+import { buildAbortRedirectMessage } from "../../bridge/bridge-safety-controls.js";
 /**
  * Run all pre-lock safety gates in sequence and short-circuit on the first
  * gate that blocks. The factory MUST honor the returned `passed: false`
@@ -46,6 +47,7 @@ export function runSafetyGates(state, deps, ctx) {
     // Provider-level degradation pre-check (before per-agent circuit breaker)
     if (deps.providerHealth?.isDegraded(ctx.provider)) {
         state.result.finishReason = "provider_degraded";
+        state.result.response = buildAbortRedirectMessage(undefined, "provider_degraded", ctx.msg.text.slice(0, 200));
         deps.logger.warn({
             provider: ctx.provider,
             hint: "Provider is degraded across multiple agents; skipping execution",
@@ -56,6 +58,7 @@ export function runSafetyGates(state, deps, ctx) {
     // Circuit breaker pre-check
     if (deps.circuitBreaker.isOpen()) {
         state.result.finishReason = "circuit_open";
+        state.result.response = buildAbortRedirectMessage(undefined, "circuit_open", ctx.msg.text.slice(0, 200));
         deps.logger.warn({
             hint: "Circuit breaker is open, skipping execution",
             errorKind: "dependency",
@@ -64,7 +67,7 @@ export function runSafetyGates(state, deps, ctx) {
     }
     // Test-only silent-LLM-failure fault injection.
     // Gated by COMIS_TEST_SILENT_FAIL_FLAG env var. Lets operators validate
-    // the FINDING-2 retry/reuseSessionKey path end-to-end without waiting
+    // the retry/reuseSessionKey path end-to-end without waiting
     // for real Anthropic instability. Env var is absent in all shipped
     // configs; see packages/agent/src/executor/fault-injector.ts for the
     // safety analysis.

package/node_modules/@comis/agent/dist/executor/pi-executor/session-bootstrap.d.ts

@@ -13,9 +13,11 @@
  * @module
  */
 import type { CacheRetention } from "@earendil-works/pi-ai";
-import type { SessionKey } from "@comis/core";
+import type { SessionKey, ModelOperationType } from "@comis/core";
 import type { ExecutionResult, ExecutionOverrides } from "../types.js";
+import type { TimeoutSource } from "../../model/operation-model-resolver.js";
 import type { ExecutionPlan } from "../../planner/types.js";
+import type { ExecutionPlanHolder } from "./execution-plan-holder.js";
 import type { PiExecutorDeps } from "./pi-executor-types.js";
 import type { AdaptiveCacheRetention } from "../adaptive-cache-retention.js";
 import type { PerAgentConfig } from "@comis/core";
@@ -50,16 +52,34 @@ export interface SessionBootstrapResult {
         current: ExecutionPlan | undefined;
     };
 }
+/**
+ * The merged per-execution timeout (LAT-01): values + binding provenance.
+ * `source`/`operationType` feed knob-named hints (timeout-knob.ts) and the
+ * execution:prompt_timeout payload. This is THE one effectiveTimeout shape —
+ * RunSessionLockedContext and RunPromptParams alias it (three inline copies
+ * unified). 177-03 extends this with stallCeilingMultiplier (LAT-02 makespan
+ * threading).
+ */
+export interface EffectiveTimeout {
+    promptTimeoutMs: number;
+    retryPromptTimeoutMs: number;
+    /**
+     * LAT-02 (177-03): makespan = promptTimeoutMs × stallCeilingMultiplier —
+     * R-1 non-optional wherever stall semantics apply (177-01 DECISION). The
+     * ceiling is DERIVED at the race call site (model-retry), never a
+     * standalone ms knob.
+     */
+    stallCeilingMultiplier: number;
+    source: TimeoutSource;
+    operationType?: ModelOperationType;
+}
 /**
  * Per-execute override decode — separated from the bootstrap so the factory
  * can write the values into its own closure-scope `let`s via the provided
  * accessor refs.
  */
 export interface OverrideDecodeResult {
-    readonly effectiveTimeout: {
-        readonly promptTimeoutMs: number;
-        readonly retryPromptTimeoutMs: number;
-    };
+    readonly effectiveTimeout: EffectiveTimeout;
 }
 /**
  * Pre-resolve OAuth + initialize ExecutionResult + SEP execution-plan ref.
@@ -80,6 +100,13 @@ export declare function bootstrapSession(state: Readonly<SessionBootstrapState>,
     readonly config: PerAgentConfig;
     readonly sessionKey: SessionKey;
     readonly overrides: ExecutionOverrides | undefined;
+    /**
+     * Optional ExecutionPlanPort holder. When provided and SEP is
+     * enabled for this turn, the per-turn `executionPlanRef` is published into
+     * it so the gateway/ACP plan bridge reads the active plan via the port.
+     * Absent in non-ACP runtimes — existing callers are unaffected.
+     */
+    readonly executionPlanHolder?: ExecutionPlanHolder;
 }): Promise<SessionBootstrapResult>;
 /**
  * Per-execute override decode — derives the effective timeout from the

package/node_modules/@comis/agent/dist/executor/pi-executor/session-bootstrap.js

@@ -56,6 +56,20 @@ export async function bootstrapSession(state, deps, ctx) {
     // SEP: Initialize execution plan ref (shared with bridge via mutable ref)
     const sepEnabled = ctx.config.sep?.enabled !== false && !ctx.overrides?.skipSep;
     const executionPlanRef = { current: undefined };
+    // Keep the ExecutionPlanPort holder lifecycle SYMMETRIC so the
+    // gateway/ACP plan bridge never reads a stale plan. A SEP-on turn publishes
+    // the live per-turn ref (so a disabled turn does not point the port at a
+    // never-populated ref); a SEP-off turn DE-PUBLISHES any ref left by
+    // a prior SEP-on turn so getCurrentPlan() cannot project the previous turn's
+    // plan during this turn (stale-plan leak).
+    if (ctx.executionPlanHolder) {
+        if (sepEnabled) {
+            ctx.executionPlanHolder.publish(executionPlanRef);
+        }
+        else {
+            ctx.executionPlanHolder.clear();
+        }
+    }
     return { executionStartMs, result, sepEnabled, executionPlanRef };
 }
 /**
@@ -81,12 +95,29 @@ export function decodeExecutionOverrides(state, deps, ctx) {
     const operationDefaultTimeout = overrides?.operationType
         ? operationDefaults[overrides.operationType]
         : undefined;
+    // LAT-01 binding provenance (Critical Finding 1): a present override CARRIES
+    // the source its producer labeled — the cron producer materializes
+    // promptTimeout unconditionally, so re-deriving here would call every cron
+    // timeout "explicit". An unlabeled override (legacy producer shape) IS
+    // explicit by the caller; otherwise the level that binds labels itself.
+    const overrideMs = overrides?.promptTimeout?.promptTimeoutMs;
+    const source = overrideMs !== undefined
+        ? (overrides?.promptTimeout?.source ?? "operation_explicit")
+        : operationDefaultTimeout !== undefined
+            ? "operation_default"
+            : "agent_config";
     const effectiveTimeout = {
-        promptTimeoutMs: overrides?.promptTimeout?.promptTimeoutMs
+        promptTimeoutMs: overrideMs
             ?? operationDefaultTimeout
             ?? config.promptTimeout.promptTimeoutMs,
         retryPromptTimeoutMs: overrides?.promptTimeout?.retryPromptTimeoutMs
             ?? config.promptTimeout.retryPromptTimeoutMs,
+        // LAT-02: the schema's .default(10) guarantees presence post-parse; the
+        // `?? 10` covers hand-built configs (tests/legacy carriers) that bypass
+        // the zod parse.
+        stallCeilingMultiplier: config.promptTimeout.stallCeilingMultiplier ?? 10,
+        source,
+        operationType: overrides?.operationType,
     };
     // Create adaptive retention.
     // Parent agents start at configRetention directly (typically "long"/1h) so the

package/node_modules/@comis/agent/dist/executor/pi-executor/trajectory-confinement.d.ts

@@ -0,0 +1 @@
+export declare function resolveTrajectoryConfinedBase(trajectoryConfigDir: string | undefined, dataDir: string | undefined): string | undefined;

package/node_modules/@comis/agent/dist/executor/pi-executor/trajectory-confinement.js

@@ -0,0 +1,30 @@
+// SPDX-License-Identifier: Apache-2.0
+/**
+ * Resolve the confinement base for trajectory-file writes (the directory every
+ * resolved `<sessionFile>.trajectory.jsonl` path must stay inside, asserted at
+ * open() to reject ancestor-symlink escapes).
+ *
+ * Two cases:
+ *  - The operator explicitly set `diagnostics.trajectory.dir` (e.g.
+ *    `/var/log/comis/traj/`) → they own that path's legitimacy, so confinement
+ *    is skipped (returns `undefined`) — we must not reject their own write path.
+ *  - Default (no explicit dir) → confine to the operator's RESOLVED data root
+ *    (`config.dataDir` / `COMIS_DATA_DIR`, threaded as `dataDir`). This is NOT a
+ *    hardcoded `~/.comis`: a custom-`dataDir` install (`dataDir: ~/.comis-foo`)
+ *    keeps its session files — and their co-located trajectory files — under
+ *    that root, so a `~/.comis` base would reject every write while the pointer
+ *    sidecar still advertises the (never-created) file, blinding `obs.explain`.
+ *    Only when no dataDir is resolved at all do we fall back to `~/.comis`.
+ *
+ * Same bug class as the 260611 session-index-writer fix (which also fell back
+ * to the real `~/.comis` and silently diverged from custom installs).
+ *
+ * @module
+ */
+import * as os from "node:os";
+import { safePath } from "@comis/core";
+export function resolveTrajectoryConfinedBase(trajectoryConfigDir, dataDir) {
+    if (trajectoryConfigDir !== undefined)
+        return undefined;
+    return dataDir ?? safePath(os.homedir(), ".comis");
+}

package/node_modules/@comis/agent/dist/executor/post-batch-continuation.d.ts

@@ -76,7 +76,7 @@ export interface RunPostBatchContinuationDeps {
  *   4. Fire when (2) AND (≥1 tool call from step 3); else `no_match`.
  *
  * `session.followUp` errors are caught and propagated as
- * `Result<_, ContinuationError>` per AGENTS.md §2.1 + the
- * `executor-prompt-runner.ts:931` precedent.
+ * `Result<_, ContinuationError>` (the
+ * `executor-prompt-runner.ts:931` pattern).
  */
 export declare function runPostBatchContinuation(deps: RunPostBatchContinuationDeps): Promise<Result<ContinuationOutcome, ContinuationError>>;

package/node_modules/@comis/agent/dist/executor/post-batch-continuation.js

@@ -77,14 +77,14 @@ function buildDirective(priorToolCallCount, priorToolNames) {
  *   4. Fire when (2) AND (≥1 tool call from step 3); else `no_match`.
  *
  * `session.followUp` errors are caught and propagated as
- * `Result<_, ContinuationError>` per AGENTS.md §2.1 + the
- * `executor-prompt-runner.ts:931` precedent.
+ * `Result<_, ContinuationError>` (the
+ * `executor-prompt-runner.ts:931` pattern).
  */
 export async function runPostBatchContinuation(deps) {
     const { session, messages, config, logger, agentId, getVisibleAssistantText } = deps;
     // Step 1: disable check.
     if (!config.enabled || config.maxRetries === 0) {
-        logger.info({ submodule: SUBMODULE, agentId, decision: "skip", reason: "disabled" }, "Post-batch continuation skipped");
+        logger.info({ submodule: SUBMODULE, agentId, decision: "skip", continuationReason: "disabled" }, "Post-batch continuation skipped");
         return ok({
             recovered: false,
             attempts: 0,
@@ -97,7 +97,7 @@ export async function runPostBatchContinuation(deps) {
     /* eslint-disable @typescript-eslint/no-explicit-any */
     const msgs = messages;
     if (!Array.isArray(msgs) || msgs.length === 0) {
-        logger.info({ submodule: SUBMODULE, agentId, decision: "skip", reason: "non_empty_final" }, "Post-batch continuation skipped");
+        logger.info({ submodule: SUBMODULE, agentId, decision: "skip", continuationReason: "non_empty_final" }, "Post-batch continuation skipped");
         return ok({
             recovered: false,
             attempts: 0,
@@ -113,7 +113,7 @@ export async function runPostBatchContinuation(deps) {
         !hasThinkingBlock(last.content) &&
         !hasToolCallBlock(last.content);
     if (!lastIsEmpty) {
-        logger.info({ submodule: SUBMODULE, agentId, decision: "skip", reason: "non_empty_final" }, "Post-batch continuation skipped");
+        logger.info({ submodule: SUBMODULE, agentId, decision: "skip", continuationReason: "non_empty_final" }, "Post-batch continuation skipped");
         return ok({
             recovered: false,
             attempts: 0,
@@ -141,7 +141,7 @@ export async function runPostBatchContinuation(deps) {
     /* eslint-enable @typescript-eslint/no-explicit-any */
     const priorToolNames = [...priorToolNamesSet];
     if (priorToolCallCount === 0) {
-        logger.info({ submodule: SUBMODULE, agentId, decision: "skip", reason: "no_tool_calls" }, "Post-batch continuation skipped");
+        logger.info({ submodule: SUBMODULE, agentId, decision: "skip", continuationReason: "no_tool_calls" }, "Post-batch continuation skipped");
         return ok({
             recovered: false,
             attempts: 0,
@@ -155,7 +155,7 @@ export async function runPostBatchContinuation(deps) {
         submodule: SUBMODULE,
         agentId,
         decision: "fire",
-        reason: "empty_after_tool_batch",
+        continuationReason: "empty_after_tool_batch",
         priorToolCallCount,
         priorToolNames,
         maxAttempts: config.maxRetries,

package/node_modules/@comis/agent/dist/executor/prompt-assembly.d.ts

@@ -10,15 +10,108 @@
  */
 import type { SessionKey, NormalizedMessage, PerAgentConfig, MemoryPort, HookRunner, SecretManager, EnvelopeConfig, WrapExternalContentOptions, TypedEventBus, SenderTrustDisplayConfig, SpawnPacket, DeliveryMirrorPort, ModelOperationType, ToolCapabilityPort } from "@comis/core";
 import type { ComisLogger } from "@comis/core";
+import { createRecallTrace } from "@comis/observability";
 import type { ToolDefinition } from "@earendil-works/pi-coding-agent";
-import type { BootstrapContextFile } from "../bootstrap/types.js";
+import type { PromptMode, BootstrapContextFile } from "../bootstrap/types.js";
 import { type SystemPromptBlocks } from "../bootstrap/index.js";
+import { type TopicMatchScore } from "../memory/topic-key.js";
+import { type ModelProfile } from "./model-profile.js";
+/**
+ * Resolve the effective PromptMode for a given execution context.
+ *
+ * Priority (highest to lowest):
+ * 1. Compact-secure for small/nano capabilityClass (C2/S1) — wins even for
+ *    cron/heartbeat turns (WR-03: security holds independent of model + operation).
+ * 2. Cron/heartbeat auto-upgrade: "full" → "operational" (frontier/mid + no-profile).
+ * 3. baseMode (operator-explicit or "full" default).
+ *
+ * compact-secure fires ONLY when:
+ *   - compactPromptConfig.enabled is true (default)
+ *   - profile.capabilityClass is "small" or "nano"
+ *   - baseMode is "full" (respect explicit operator overrides)
+ *
+ * WR-03: the compact-secure check is evaluated BEFORE the cron/heartbeat →
+ * operational downgrade. The milestone's premise is "weaker class ⇒ stricter
+ * securityLevel", and compact-secure carries the S1 anti-injection sender-trust
+ * hardening. A cron/heartbeat turn on a small/nano model must NOT silently lose
+ * that hardening — it gets compact-secure, not operational. The operational
+ * downgrade is reserved for frontier/mid (and no-profile) cron/heartbeat turns,
+ * which never enter compact-secure anyway.
+ *
+ * Frontier/mid: never compact-secure. This is the behavior-neutral guarantee
+ * for large-tier models — their prompt stays byte-identical to pre-152 output.
+ *
+ * @internal exported for tests only
+ */
+export declare function resolvePromptModeForProfile(baseMode: PromptMode, operationType: ModelOperationType, profile: ModelProfile | undefined, compactPromptConfig: {
+    enabled?: boolean;
+    targetTokens?: number;
+} | undefined): PromptMode;
 /**
  * Extract the user's preferred language from USER.md bootstrap content.
  * Matches the "Preferred language:" field and returns the trimmed value,
  * or undefined if not found or empty/placeholder.
  */
 export declare function extractUserLanguage(files: BootstrapContextFile[]): string | undefined;
+/** Read the per-turn topic-matched learned-skill names for a session. The pi-event-bridge
+ *  calls this when assembling the turn's `usedSkillIds`. Undefined when nothing matched this turn. */
+export declare function getSessionPromptTopicMatchedSkills(snapshotKey: string): ReadonlyArray<string> | undefined;
+/** The per-turn topic-match reuse CENSUS (finding A): every surfaced skill that overlapped the
+ *  turn, with its coverage + credited flag. STORED here during assembly (overwritten per turn) and
+ *  emitted as `memory:skill_surfaced` by postExecution — NOT emitted inline, because the standing-block
+ *  assembly runs BEFORE the trajectory bridge subscribes (assembleTools precedes
+ *  attachTrajectoryToEventBus in pi-executor), so an inline emit fires to no listener (proven live,
+ *  package-delivery-20260628). Same store→read-at-postExecution pattern as the usedSkillIds carrier above. */
+export interface SkillSurfacedCensus {
+    surfacedCount: number;
+    creditedCount: number;
+    scores: TopicMatchScore[];
+}
+/** Read (for postExecution) the per-turn surfaced-skill census. Undefined when no skill overlapped. */
+export declare function getSessionPromptSkillSurfacedCensus(snapshotKey: string): SkillSurfacedCensus | undefined;
+/** Clear the stored census after postExecution emits it — so a later turn that assembles no
+ *  standing-block (e.g. skipRag) never re-emits a stale prior-turn census. */
+export declare function clearSessionPromptSkillSurfacedCensus(snapshotKey: string): void;
+/** The per-turn memory-injection (RAG) summary — content-free counts + closed trust-level tags.
+ *  STORED here during assembly, emitted as `memory:injected` by postExecution (the inline assembly
+ *  runs BEFORE the trajectory bridge subscribes — the same pre-bridge timing bug as the surfaced
+ *  census, so an inline emit was lost on EVERY turn). Overwritten per turn; set only when the
+ *  injector produced content. */
+export interface MemoryInjectedSummary {
+    hitCount: number;
+    charsInjected: number;
+    trustTags: string[];
+    pinnedCount: number;
+}
+/** Read (for postExecution) the per-turn memory-injection summary. Undefined when no injection. */
+export declare function getSessionPromptMemoryInjected(snapshotKey: string): MemoryInjectedSummary | undefined;
+/** Clear the stored injection summary after postExecution emits it (avoids a stale re-emit on a
+ *  later no-injection turn). */
+export declare function clearSessionPromptMemoryInjected(snapshotKey: string): void;
+/**
+ * Parse a frozen `<available_skills>` XML block (the exact shape emitted by
+ * `formatAvailableSkillsXml` in @comis/skills: a sequence of `<skill>` blocks
+ * each carrying `<name>`, `<description>`, `<location>`) into a
+ * `location → skillName` Map. The location is the raw absolute path the `read`
+ * tool reports, so XML entities are unescaped (the inverse of `escapeXml`) to
+ * make the keys/values match raw text. ATTR-01.
+ *
+ * Pure + total: never throws. `undefined`/empty/no-`<skill>` input yields an
+ * empty Map. A `<skill>` block missing either `<name>` or `<location>` is
+ * skipped (defensive — the producer always emits both).
+ *
+ * @param xml - The frozen prompt-skills XML snapshot, or undefined.
+ * @returns location→skillName Map (empty when nothing to index).
+ */
+export declare function parseSkillLocationIndex(xml: string | undefined): Map<string, string>;
+/**
+ * Read the frozen location→skillName index for a session. The pi-event-bridge
+ * calls this on a `read` tool execution to attribute skill use (ATTR-01).
+ * Returns undefined when no snapshot has been frozen for the session yet.
+ *
+ * @param snapshotKey - The formatted session key used at the freeze point.
+ */
+export declare function getSessionPromptSkillLocations(snapshotKey: string): ReadonlyMap<string, string> | undefined;
 /**
  * Compute a stable hash string from config fields that affect tool rendering.
  * Used as part of the rendered tool cache key so that mid-session
@@ -51,6 +144,12 @@ export declare function clearSessionBootstrapFileSnapshot(sessionKey: string): v
  * Call during session cleanup to prevent the Map from growing unbounded.
  */
 export declare function clearSessionPromptSkillsXmlSnapshot(sessionKey: string): void;
+/**
+ * Reset the per-agent WR-02 sender-trust WARN dedup. Test-only seam (mirrors
+ * the clearSession* snapshot resets) so suites don't leak the once-per-agent
+ * state across cases.
+ */
+export declare function clearWr02SenderTrustWarned(): void;
 /** Frozen prompt state captured after first-turn assembly for sub-agent cache prefix sharing.
  *  When propagated to sub-agents via SpawnPacket, allows prefix reuse instead of independent assembly. */
 export interface CacheSafeParams {
@@ -84,12 +183,76 @@ export declare function getCacheSafeParams(sessionKey: string): CacheSafeParams
  * Call during session cleanup to prevent the Map from growing unbounded.
  */
 export declare function clearCacheSafeParams(sessionKey: string): void;
+/**
+ * Construct the recall-trace recorder from `diagnostics.recallTrace` config, mirroring
+ * how `createCacheTrace` is wired in pi-executor: the `enabled` gate, the optional
+ * `filePath` override, and the `confinedBaseDir` (the daemon containment base —
+ * `~/.comis` — for ancestor-symlink rejection, applied only when no explicit path is set,
+ * exactly like cacheTrace). Returns `null` when config is absent or `enabled: false`
+ * (the recorder's null-when-disabled contract), so the default leaves recall unchanged.
+ * Extracted as a small helper to keep the recall block legible.
+ */
+export declare function buildRecallTrace(cfg: {
+    enabled?: boolean;
+    filePath?: string;
+    maxFileBytes?: number;
+} | undefined, agentId: string, sessionId: string, dataDir?: string, envelope?: {
+    readonly sessionKey?: string;
+    readonly tenantId?: string;
+}): ReturnType<typeof createRecallTrace>;
 /** Dependencies required by the prompt assembly helper. */
 export interface PromptAssemblyParams {
     config: PerAgentConfig;
     deps: {
         workspaceDir: string;
+        /** Daemon data dir (COMIS_DATA_DIR / config.dataDir). Forwarded so the
+         *  recall-trace recorder resolves its containment base from the SAME source
+         *  the memory.recall_trace reader uses. Absent ⇒ ~/.comis. */
+        dataDir?: string;
         memoryPort?: MemoryPort;
+        /** Optional cross-encoder reranker + timers for createMemoryRecall (default-OFF). */
+        reranker?: import("@comis/core").RerankerPort;
+        /** Optional entity-associative store for createMemoryRecall's entity lane
+         *  (default-OFF via config.rag.entityLane). TYPE-only (the agent↛memory build cut). */
+        entityStore?: import("@comis/core").MemoryEntityStore;
+        /** Optional temporal-spread store for createMemoryRecall's 4th lane
+         *  (default-OFF via config.rag.lanes.temporal). TYPE-only (the agent↛memory build cut). */
+        temporalStore?: import("@comis/core").MemoryTemporalStore;
+        /** Optional causal store for createMemoryRecall's 5th lane
+         *  (default-OFF via config.rag.lanes.causal). TYPE-only (the agent↛memory build cut). */
+        causalStore?: import("@comis/core").MemoryCausalStore;
+        /** Optional triple store for createMemoryRecall's 6th graph-spread lane
+         *  (default-OFF via config.rag.lanes.graphSpread). TYPE-only (the agent↛memory build cut). */
+        tripleStore?: import("@comis/core").TripleStorePort;
+        /** Optional embedding read store for createMemoryRecall's MMR diversity re-rank
+         *  (default-OFF via config.rag.mmr). TYPE-only (the agent↛memory build cut). */
+        embeddingStore?: import("@comis/core").MemoryEmbeddingStore;
+        /** Optional usefulness store for createMemoryRecall's usefulness read
+         *  (default-OFF via config.rag.feedback). TYPE-only (the agent↛memory build cut). */
+        usefulnessStore?: import("@comis/core").MemoryUsefulnessStore;
+        /** Optional pinned-memory store for createMemoryRecall's Step-0 pinned-first lane.
+         *  DEFAULT-OFF (config.rag.pinned.enabled=false): with the store absent or the flag off,
+         *  no query runs and the pipeline is byte-identical to pre-pinning. Passed from PiExecutorDeps
+         *  → PromptAssemblyParams.deps → createMemoryRecall. TYPE-only (the agent↛memory build cut). */
+        pinnedStore?: import("@comis/core").MemoryPinnedStore;
+        /** Optional LCD provenance read store for createMemoryRecall's post-fusion
+         *  provenance down-weighting pass (Phase 173, DIST-03 read side — the C1→C2
+         *  carry-in). DEFAULT-OFF BYTE-IDENTITY: absent OR no lcd_distilled result → no
+         *  read, recall order unchanged. Passed from PiExecutorDeps → PromptAssemblyParams.deps
+         *  → createMemoryRecall. TYPE-only (the agent↛memory build cut). */
+        provenanceStore?: import("@comis/core").LcdProvenanceReadStore;
+        /** Optional per-user profile store for the LLM-free standing-block injection
+         *  (default-OFF). Absent ⇒ no read, no push, byte-identical prompt
+        /** Optional mental-model store (the v2.31 Reflection doc store) for the LLM-free
+         *  `<user_profile>` standing-block injection (FOLD-01, Phase 225 — the kind:"profile"
+         *  read source; the standalone userRepresentationStore was deleted in Plan 05). Absent ⇒ no list, no push,
+         *  byte-identical prompt (the cost gate). The agent receives the segregated port
+         *  TYPE only — the agent↛memory build cut. The read is a deterministic
+         *  `list(scope,"profile")` + the pure `buildProfileBlock` formatter (the per-user
+         *  doc is selected by `topicKey === sessionKey.userId`); NO model call crosses onto
+         *  the recall hot path (the milestone's #1 constraint). */
+        mentalModelStore?: import("@comis/core").MentalModelStorePort;
+        timers?: import("@comis/core").TimerPort;
         hookRunner?: HookRunner;
         secretManager?: SecretManager;
         envelopeConfig?: EnvelopeConfig;
@@ -113,6 +276,19 @@ export interface PromptAssemblyParams {
         documentationConfig?: import("@comis/core").DocumentationConfig;
         /** Event bus for sender:trust_resolved audit events. */
         eventBus?: TypedEventBus;
+        /**
+         * Recall-trace writer configuration. Forwarded from
+         * AppConfig.diagnostics.recallTrace by daemon wiring (mirrors cacheTraceConfig).
+         * When omitted or `enabled: false`, the recall-trace recorder is null
+         * (createRecallTrace returns null), so createMemoryRecall captures nothing and
+         * behaves exactly as before — recall-trace is OPT-IN (default-off). The recorder
+         * has NO raw-content slot; every payload is full-sanitized before disk.
+         */
+        recallTraceConfig?: {
+            readonly enabled?: boolean;
+            readonly filePath?: string;
+            readonly maxFileBytes?: number;
+        };
         /** Spawn packet for sub-agent context injection.
          *  Threaded from ExecutionOverrides; used for system prompt template. */
         spawnPacket?: SpawnPacket;
@@ -140,6 +316,25 @@ export interface PromptAssemblyParams {
         toolCapabilityPort: ToolCapabilityPort;
         /** Wall-clock + monotonic time reads. */
         clock: import("@comis/core").ClockPort;
+        /** Optional ObservabilityStore sink for SystemPromptReport persistence.
+         *  Type-only narrow Pick (see
+         *  @comis/observability#ObservabilityStoreLike). When omitted, the
+         *  report is built but not persisted to SQLite. Forwarded by the
+         *  daemon composition root. */
+        observabilityStore?: import("@comis/observability").ObservabilityStoreLike;
+        /** Optional SessionStoreReportSink for per-session SystemPromptReport
+         *  persistence. When omitted, the report is built but not written to a
+         *  session ledger. */
+        sessionStore?: import("@comis/observability").SessionStoreReportSink;
+        /** Optional set of tool names registered in the prompt but filtered out
+         *  by policy (toolPolicy.deny / capability gate). The SystemPromptReport's
+         *  tools.entries[].callable reflects this. */
+        policyFilteredToolNames?: ReadonlySet<string>;
+        /** Optional run-scoped identifier (per pi-mono turn). Becomes the report's
+         *  `runId` field for cross-correlation with trajectory events. */
+        runId?: string;
+        /** Optional tenant ID for multi-tenant deployments. */
+        tenantId?: string;
     };
     msg: NormalizedMessage;
     sessionKey: SessionKey;
@@ -168,6 +363,30 @@ export interface PromptAssemblyParams {
      *  the promptMode from "full" to "operational" and dispatch operation-specific
      *  bootstrap filters. */
     operationType: ModelOperationType;
+    /** C2/S1: ModelProfile resolved per execution in pi-executor. Drives compact-secure
+     *  promptMode selection for small/nano capabilityClass when
+     *  contextEngine.compactPrompt.enabled is true. Also supplies securityLevel for
+     *  lockdown scaling inside the compact-secure assembler. When absent, no compact-secure
+     *  downgrade is applied (fail-open for the mode selection, fail-closed at the security
+     *  level via the assembler's default "standard" securityLevel). */
+    modelProfile?: ModelProfile;
+    /** Degenerate-window compact-prompt fallback budget (2026-06-22 root-cause
+     *  context-exhaustion fix, Part 2 extension). When provided AND the resolved-mode
+     *  system prompt cannot fit the effective window —
+     *  `systemPromptOnlyTokens + outputHeadroom + messageFloorTokens > effectiveWindow`,
+     *  i.e. even zero tools won't fit — the assembler re-assembles in the existing
+     *  `compact-secure` mode (security floor intact, ~700 tok) so the agent still
+     *  runs instead of context-exhausting on its fixed overhead. Absent ⇒ no
+     *  window-fit check (byte-identical to pre-fix; the assembler is window-agnostic).
+     *  Already-compact modes (`compact-secure`, `none`) are never re-assembled. */
+    windowFitBudget?: {
+        /** The effective context window in tokens (min(configured, served, capabilityCap)). */
+        effectiveWindow: number;
+        /** Output headroom tokens reserved for the reply (+thinking block). */
+        outputHeadroom: number;
+        /** Minimum tokens reserved for the user message + a little history. */
+        messageFloorTokens: number;
+    };
 }
 /**
  * Assemble the full system prompt for a PiExecutor execution cycle.
@@ -192,5 +411,17 @@ export interface ExecutionPromptResult {
     dynamicPreamble: string;
     /** Top-1 RAG memory for inline injection adjacent to user message. */
     inlineMemory?: string;
+    /** Recalled memories (id + content) for turn-end attribution. Content is
+     *  used IN-PROCESS by the overlap heuristic at postExecution and is NEVER
+     *  logged/emitted — only the resulting ids cross the bus. Rides the RESULT object
+     *  (like inlineMemory), NOT assemblerParams, so the cache-fence invariant holds. */
+    recalledMemories?: ReadonlyArray<{
+        id: string;
+        content: string;
+    }>;
+    /** USER.md preferred language (extractUserLanguage value, placeholder-filtered),
+     *  surfaced so the executor can thread it into PostExecutionParams.userMdLanguage
+     *  (DET-02 tier-2). Undefined on the parent-cache reuse path. */
+    userLanguage?: string;
 }
 export declare function assembleExecutionPrompt(params: PromptAssemblyParams): Promise<ExecutionPromptResult>;