comisai 1.0.42 → 1.0.45

package/node_modules/@comis/daemon/dist/wiring/setup-broker-activation.d.ts

@@ -0,0 +1,116 @@
+/**
+ * Broker activation seam types for tool assembly.
+ *
+ * Extracted from setup-tools.ts to keep setup-tools.ts under 800 lines.
+ * setup-tools.ts re-exports BrokerContextDeps so existing call sites that
+ * import from setup-tools.js continue to resolve the type.
+ *
+ * Follow-on: per-command token issuance will expand this module with
+ * the full broker-activation wiring (brokerSpawnEnv construction, issueToken
+ * lifecycle) currently inlined inside assembleToolsForAgent in setup-tools.ts.
+ * @module
+ */
+import type { SessionManager, IssuedSession, LeaseManager } from "@comis/infra";
+import { type AgentCapability, type OutputGuardPort } from "@comis/core";
+/**
+ * Broker context threaded from daemon bootFoundation into tool assembly.
+ * When present: exec tool is assembled with broker-only network isolation,
+ * secureCredentialHome, and brokerSpawnEnv (HTTPS_PROXY + placeholder key +
+ * single-use token).
+ * When absent (undefined): no change to the default open network path (no regression).
+ */
+export interface BrokerContextDeps {
+    /** TCP port the broker is listening on (for HTTPS_PROXY env var). */
+    tcpPort: number;
+    /** Unix socket path for broker-only egress (brokerSocketPath in SandboxOptions). */
+    socketPath: string;
+    /** Absolute path to the broker CA cert PEM (NODE_EXTRA_CA_CERTS env var). */
+    caPath: string;
+    /** Session manager for issuing a single-use token per assembleToolsForAgent call. */
+    sessionManager: SessionManager;
+    /**
+     * Placeholder env vars: mapping of env var name -> placeholder string.
+     * e.g. { ANTHROPIC_API_KEY: "comis-broker-placeholder" }
+     * NEVER contains the real secret value — resolved by the broker per-request.
+     */
+    placeholders: Record<string, string>;
+}
+export type { IssuedSession };
+/**
+ * Capability-lease mint deps (ENDPOINT-03; Phase 211 Plan 06). Threaded from
+ * daemon.ts for an AUTONOMY-BEARING agent so {@link buildBrokerSpawnEnv} mints
+ * an attenuated lease, registers the bearer in OutputGuard, and injects
+ * `COMIS_CAP_LEASE` + `COMIS_ORCH_SOCKET`. Absent for a non-autonomy agent (no
+ * lease minted). Independent of {@link BrokerContextDeps}: the cap socket is the
+ * loopback capability endpoint, NOT the HTTPS-proxy broker — so an autonomy
+ * agent gets the lease vars EVEN WHEN no broker is configured.
+ */
+export interface CapabilityMintDeps {
+    /** The daemon-wide LeaseManager (211-01) — mints the per-spawn lease. */
+    leaseManager: LeaseManager;
+    /** The OutputGuard the bearer is registered in at mint (Pitfall 1 — never logged). */
+    outputGuard: OutputGuardPort;
+    /** The cap socket path injected as COMIS_ORCH_SOCKET (the endpoint's 0600 socket). */
+    capSocketPath: string;
+    /** The agent's resolved autonomy caps (resolveAutonomy(...).capabilities). */
+    resolvedCaps: readonly AgentCapability[];
+    /** Budget ref recorded on the lease (Phase 213 budget enforcement reads it). */
+    budgetRef: string;
+    /** The session key the lease is minted for. */
+    sessionKey: string;
+    /** The root-run id the lease is scoped to. */
+    rootRunId: string;
+    /**
+     * The PARENT lease's caps, for a child spawn. When supplied (with
+     * {@link requestedCaps}), the minted caps are `attenuateCaps(parentCaps,
+     * requestedCaps)` — the child can never broaden beyond the parent (LEASE-04).
+     * Absent for a root spawn (the caps are then `resolvedCaps`).
+     */
+    parentCaps?: readonly AgentCapability[];
+    /** The caps the child requested — intersected with {@link parentCaps} at mint. */
+    requestedCaps?: readonly AgentCapability[];
+    /** The parent lease id, recorded for the Phase 213 revoke cascade. */
+    parentLeaseId?: string;
+    /**
+     * Phase 213: anchor the tree root in the bounded-autonomy service right after
+     * the mint. Called with the SAME tree-stable `rootRunId` the lease is minted
+     * with + the freshly-minted `leaseId` (+ parentLeaseId) so the per-root budget
+     * wall-clock deadline anchors and the rootRunId↔leaseId correlation builds (the
+     * audit/kill fan-out). Optional — absent ⇒ no anchor (older/non-autonomy wiring).
+     */
+    registerRoot?: (rootRunId: string, leaseId: string, parentLeaseId?: string) => void;
+}
+/** The env object {@link buildBrokerSpawnEnv} returns (broker fields optional). */
+export interface BrokerSpawnEnv {
+    HTTPS_PROXY?: string;
+    NODE_EXTRA_CA_CERTS?: string;
+    placeholders: Record<string, string>;
+}
+/**
+ * Build the spawn-env for an agent's exec tool. Two independent concerns merge
+ * into the `placeholders` slot (which `buildExecEnv` merges LAST, so these
+ * daemon-injected vars survive the existing exec/terminal scrub — Open Q3):
+ *
+ *   1. BROKER (when `brokerContext` present): issues a single-use proxy token
+ *      and adds HTTPS_PROXY + CA + `COMIS_BROKER_TOKEN` (placeholder values only;
+ *      real secrets are resolved by the broker per-request).
+ *   2. CAPABILITY LEASE (when `capMint` present — an autonomy-bearing agent):
+ *      mints an attenuated lease, registers the bearer in OutputGuard (so it is
+ *      never logged — Pitfall 1), and adds `COMIS_CAP_LEASE` (the bearer) +
+ *      `COMIS_ORCH_SOCKET` (the cap socket path). Independent of the broker — an
+ *      autonomy agent gets the lease vars EVEN WHEN no broker is configured.
+ *
+ * Returns `undefined` only when NEITHER concern applies (the default
+ * open-network, non-autonomy path; no regression).
+ *
+ * Open Q3 (subtle correctness): the JAIL-04 workspace-`.env` `COMIS_` block
+ * (211-04) applies ONLY to the untrusted workspace-loaded source — never to
+ * these daemon-injected `COMIS_CAP_LEASE`/`COMIS_ORCH_SOCKET` placeholders.
+ *
+ * FIXME: the broker token is issued once per assembleToolsForAgent call
+ * (per assembly, not per exec). The first exec consumes it; later calls in the
+ * same assembly receive 407 from the broker. Path to per-command issuance:
+ * thread sessionManager into ExecToolDeps and call issueToken() inside
+ * execute() — tracked as follow-on work.
+ */
+export declare function buildBrokerSpawnEnv(brokerContext: BrokerContextDeps | undefined, agentId: string, capMint?: CapabilityMintDeps): BrokerSpawnEnv | undefined;

package/node_modules/@comis/daemon/dist/wiring/setup-broker-activation.js

@@ -0,0 +1,84 @@
+// SPDX-License-Identifier: Apache-2.0
+/**
+ * Broker activation seam types for tool assembly.
+ *
+ * Extracted from setup-tools.ts to keep setup-tools.ts under 800 lines.
+ * setup-tools.ts re-exports BrokerContextDeps so existing call sites that
+ * import from setup-tools.js continue to resolve the type.
+ *
+ * Follow-on: per-command token issuance will expand this module with
+ * the full broker-activation wiring (brokerSpawnEnv construction, issueToken
+ * lifecycle) currently inlined inside assembleToolsForAgent in setup-tools.ts.
+ * @module
+ */
+import { attenuateCaps } from "@comis/core";
+/**
+ * Build the spawn-env for an agent's exec tool. Two independent concerns merge
+ * into the `placeholders` slot (which `buildExecEnv` merges LAST, so these
+ * daemon-injected vars survive the existing exec/terminal scrub — Open Q3):
+ *
+ *   1. BROKER (when `brokerContext` present): issues a single-use proxy token
+ *      and adds HTTPS_PROXY + CA + `COMIS_BROKER_TOKEN` (placeholder values only;
+ *      real secrets are resolved by the broker per-request).
+ *   2. CAPABILITY LEASE (when `capMint` present — an autonomy-bearing agent):
+ *      mints an attenuated lease, registers the bearer in OutputGuard (so it is
+ *      never logged — Pitfall 1), and adds `COMIS_CAP_LEASE` (the bearer) +
+ *      `COMIS_ORCH_SOCKET` (the cap socket path). Independent of the broker — an
+ *      autonomy agent gets the lease vars EVEN WHEN no broker is configured.
+ *
+ * Returns `undefined` only when NEITHER concern applies (the default
+ * open-network, non-autonomy path; no regression).
+ *
+ * Open Q3 (subtle correctness): the JAIL-04 workspace-`.env` `COMIS_` block
+ * (211-04) applies ONLY to the untrusted workspace-loaded source — never to
+ * these daemon-injected `COMIS_CAP_LEASE`/`COMIS_ORCH_SOCKET` placeholders.
+ *
+ * FIXME: the broker token is issued once per assembleToolsForAgent call
+ * (per assembly, not per exec). The first exec consumes it; later calls in the
+ * same assembly receive 407 from the broker. Path to per-command issuance:
+ * thread sessionManager into ExecToolDeps and call issueToken() inside
+ * execute() — tracked as follow-on work.
+ */
+export function buildBrokerSpawnEnv(brokerContext, agentId, capMint) {
+    // Neither broker nor capability lease → no spawn-env changes (no regression).
+    if (!brokerContext && !capMint)
+        return undefined;
+    // placeholders contain ONLY placeholder strings / daemon-injected tokens
+    // (never real secret values).
+    const placeholders = { ...(brokerContext?.placeholders ?? {}) };
+    const result = { placeholders };
+    if (brokerContext) {
+        const issued = brokerContext.sessionManager.issueToken(agentId);
+        result.HTTPS_PROXY = `http://127.0.0.1:${brokerContext.tcpPort}`;
+        result.NODE_EXTRA_CA_CERTS = brokerContext.caPath;
+        placeholders.COMIS_BROKER_TOKEN = issued.proxyToken; // single-use token
+    }
+    if (capMint) {
+        // Child caps = parent ∩ requested when a child spawn supplies both; else the
+        // agent's resolved caps (root spawn). attenuateCaps NEVER broadens (LEASE-04).
+        const caps = capMint.parentCaps !== undefined && capMint.requestedCaps !== undefined
+            ? attenuateCaps(capMint.parentCaps, capMint.requestedCaps)
+            : capMint.resolvedCaps;
+        const mintInput = {
+            agentId,
+            caps,
+            budgetRef: capMint.budgetRef,
+            sessionKey: capMint.sessionKey,
+            rootRunId: capMint.rootRunId,
+            ...(capMint.parentLeaseId !== undefined ? { parentLeaseId: capMint.parentLeaseId } : {}),
+        };
+        const issued = capMint.leaseManager.mintLease(mintInput);
+        const bearer = issued.bearer;
+        // Register the bearer BEFORE it leaves this function so any later log/model
+        // output that echoes it is redacted (Pitfall 1 — never logged).
+        capMint.outputGuard.registerSecret(bearer);
+        // Phase 213: anchor the tree root in the bounded-autonomy service with the
+        // SAME rootRunId the lease was minted with + the freshly-minted leaseId (so
+        // the per-root budget wall-clock anchors and the rootRunId↔leaseId index is
+        // built for the audit/kill fan-out).
+        capMint.registerRoot?.(capMint.rootRunId, issued.leaseId, capMint.parentLeaseId);
+        placeholders.COMIS_CAP_LEASE = bearer;
+        placeholders.COMIS_ORCH_SOCKET = capMint.capSocketPath;
+    }
+    return result;
+}

package/node_modules/@comis/daemon/dist/wiring/setup-broker.d.ts

@@ -0,0 +1,68 @@
+import "reflect-metadata";
+/**
+ * Credential broker wiring for daemon startup.
+ * Constructs NodeCaManager + SessionManager + MitmBroker and starts the
+ * broker (TCP + unix socket at `socketPath`). Mirrors setup-background-tasks.ts.
+ *
+ * Conditional construction: callers should only invoke this when
+ * `config.executor?.broker` is configured. A daemon with no broker config
+ * does NOT call this function — no socket or port is opened.
+ * @module
+ */
+import type { TypedEventBus, ClockPort, TimerPort, SecretManager, BrokerBinding } from "@comis/core";
+import type { ComisLogger, SessionManager, MitmBrokerPort } from "@comis/infra";
+/** Dependencies for the credential broker setup. */
+export interface SetupBrokerDeps {
+    /** Daemon data directory — CA cert/key persisted here. */
+    dataDir: string;
+    /** Typed event bus for broker:* event emission. */
+    eventBus: TypedEventBus;
+    /** Bound module logger. */
+    logger: ComisLogger;
+    /** Wall-clock adapter (no Date.now()). */
+    clock: ClockPort;
+    /** Timer scheduling adapter. */
+    timers: TimerPort;
+    /** Secret manager — resolves per-binding secret refs per request. */
+    secretManager: SecretManager;
+    /** Broker bindings (empty array = no injection rules; broker rejects all CONNECT). */
+    bindings: readonly BrokerBinding[];
+    /** TCP listen port. 0 = ephemeral (kernel-assigned). Default: 0. */
+    port?: number;
+    /** Unix socket path for sandbox-to-broker communication.
+     *  Defaults to safePath(dataDir, "broker.sock"). */
+    socketPath?: string;
+}
+/**
+ * Handle returned by setupBroker. Holds the live broker and its dependencies.
+ * `stop()` tears down TCP + unix socket and unlinks the socket file.
+ */
+export interface BrokerHandle {
+    /** The underlying SessionManager instance (for token issuance at spawn time). */
+    sessionManager: SessionManager;
+    /** The live MitmBrokerPort instance (TCP + optional unix socket). */
+    broker: MitmBrokerPort;
+    /** Resolved TCP port after broker.start(). Always > 0. */
+    tcpPort: number;
+    /** PEM path of the broker CA cert (for NODE_EXTRA_CA_CERTS in spawn envs). */
+    caPath: string;
+    /** Resolved unix socket path (broker.startUnixSocket was called on it). */
+    socketPath: string;
+    /** Tear down TCP + unix socket and unlink the socket file. Idempotent. */
+    stop: () => Promise<void>;
+}
+/**
+ * Wire the credential broker subsystem from daemon-level dependencies.
+ * Constructs NodeCaManager + SessionManager + MitmBroker, starts the broker
+ * on TCP (ephemeral port if `port === 0`) and a Unix socket (`socketPath`).
+ *
+ * The `caPath` in the returned handle is the PEM file path of the broker CA
+ * certificate on disk (`safePath(dataDir, "broker-ca.pem")`). The CA is
+ * initialised lazily on first TLS CONNECT by `createNodeCaManager`; the path
+ * exists after the first TLS handshake but callers should treat it as an
+ * opaque path string and pass it in `NODE_EXTRA_CA_CERTS`.
+ *
+ * @param deps - Daemon-level dependencies
+ * @returns BrokerHandle with live broker, port, socket path, and stop()
+ */
+export declare function setupBroker(deps: SetupBrokerDeps): Promise<BrokerHandle>;

package/node_modules/@comis/daemon/dist/wiring/setup-broker.js

@@ -0,0 +1,57 @@
+// SPDX-License-Identifier: Apache-2.0
+import "reflect-metadata"; // MUST be first import — createNodeCaManager uses @peculiar/x509 which needs tsyringe which needs Reflect.metadata
+import { safePath } from "@comis/core";
+import { createNodeCaManager, createSessionManager, createMitmBroker } from "@comis/infra";
+// ---------------------------------------------------------------------------
+// Factory
+// ---------------------------------------------------------------------------
+/**
+ * Wire the credential broker subsystem from daemon-level dependencies.
+ * Constructs NodeCaManager + SessionManager + MitmBroker, starts the broker
+ * on TCP (ephemeral port if `port === 0`) and a Unix socket (`socketPath`).
+ *
+ * The `caPath` in the returned handle is the PEM file path of the broker CA
+ * certificate on disk (`safePath(dataDir, "broker-ca.pem")`). The CA is
+ * initialised lazily on first TLS CONNECT by `createNodeCaManager`; the path
+ * exists after the first TLS handshake but callers should treat it as an
+ * opaque path string and pass it in `NODE_EXTRA_CA_CERTS`.
+ *
+ * @param deps - Daemon-level dependencies
+ * @returns BrokerHandle with live broker, port, socket path, and stop()
+ */
+export async function setupBroker(deps) {
+    const { dataDir, eventBus, logger, clock, timers, secretManager, bindings, port = 0, } = deps;
+    // Resolve the unix socket path (caller override or default in dataDir)
+    const socketPath = deps.socketPath ?? safePath(dataDir, "broker.sock");
+    // Construct CA manager — persists broker-ca.key (0o600) + broker-ca.pem to dataDir
+    const caManager = createNodeCaManager({ clock, dataDir });
+    // Construct session manager — single-use token lifecycle, TTL reaper
+    const sessionManager = createSessionManager({ clock });
+    // Construct the MITM broker with all deps
+    const broker = createMitmBroker({
+        sessionManager,
+        secretManager,
+        bindings,
+        eventBus,
+        logger,
+        clock,
+        timers,
+        caManager,
+    });
+    // Start TCP listener (resolves to bound port number)
+    const tcpPort = await broker.start(port);
+    // Start Unix socket listener (chmodSync(0o600) is called inside startUnixSocket)
+    await broker.startUnixSocket(socketPath);
+    // The CA cert PEM is at a fixed path relative to dataDir.
+    // createNodeCaManager initialises it lazily on first TLS CONNECT; the path
+    // is deterministic and safe to wire into spawn envs immediately.
+    const caPath = safePath(dataDir, "broker-ca.pem");
+    return {
+        sessionManager,
+        broker,
+        tcpPort,
+        caPath,
+        socketPath,
+        stop: () => broker.stop(),
+    };
+}

package/node_modules/@comis/daemon/dist/wiring/setup-capability-endpoint-boot.d.ts

@@ -0,0 +1,235 @@
+/**
+ * `constructCapabilityLayer` — the daemon-wide capability-lease construction +
+ * ACTIVATION (Phase 211 ENDPOINT-01/03 → Phase 212 Plan 05 dormancy activation),
+ * extracted from `daemon.ts`'s boot WITHOUT adding a net line to daemon.ts
+ * (line-cap ≤ 3000, arch invariant — the daemon-side wiring all lives here).
+ *
+ * Mirrors the credential broker's conditional construction (gated on
+ * `executor.broker`): construct ONE daemon-wide `LeaseManager` + the loopback
+ * capability endpoint when ANY agent resolves to an autonomy-bearing profile.
+ * The endpoint validates the lease + dispatches through the SAME `rpcCall` sink
+ * (so deny-by-origin + requireCapability + the unknown-method `!handler` throw
+ * all fire automatically).
+ *
+ * Phase 212 (the dormancy activation — Gap 3) flips the layer from constructed-
+ * but-DORMANT to ACTIVE, all inside this helper so daemon.ts only KEEPS the
+ * returned handle:
+ *   1. The daemon-side `tool.invoke` executor (`createToolInvokeExecutor`, Plan
+ *      02) is constructed HERE from the injected shipped cores (read/grep/find/
+ *      ls/jq + web_search) + the agent workspace resolver + the Plan-03 ResultRef
+ *      `materialize` writer, and injected into `createCapabilityEndpoint` via its
+ *      deps — MIRRORING how the `LeaseManager` is constructed-and-injected. NOT a
+ *      mutable setter on the handle: construction-time injection keeps the lease-
+ *      gated endpoint immutable once built (the executor IS the security-relevant
+ *      dispatch target).
+ *   2. `endpoint.startSocket(capSocketPath)` is called ONCE (the daemon-wide 0600
+ *      socket; the lease is per-spawn) — the boot log now reports `active: true`.
+ * The returned handle's `endpoint.stopSocket` is threaded into `setupShutdown`
+ * (mirrors the broker teardown). The bwrap per-jail bind is the orchestrate
+ * runner's (Plan 04) — this helper owns the daemon-wide socket lifecycle.
+ *
+ * @module
+ */
+import { type PerAgentConfig, type ClockPort, type TimerPort, type OutputGuardPort, type ComisLogger, type SessionKey, type DurableRunPort } from "@comis/core";
+import type { BoundedAutonomyBudgetHolder } from "@comis/agent";
+import { type LeaseManager } from "@comis/infra";
+import { type BoundedAutonomy } from "../autonomy/bounded-autonomy.js";
+import { type DenialBreaker } from "../autonomy/denial-breaker.js";
+import { type EvictRegistry } from "../autonomy/evict-registry.js";
+import type { NotifyFn } from "../autonomy/durable-resume-engine.js";
+import { type CapabilityEndpoint } from "./setup-capability-endpoint.js";
+import type { EmitCapabilityAuditDeps } from "../api/shared/emit-capability-audit.js";
+import type { RpcCall } from "@comis/skills/platform-tools";
+import type { LoggingResult } from "./setup-logging.js";
+/** The web-search API keys the daemon-side autonomous search reads (from the secret store). */
+export interface CapabilityWebSearchKeys {
+    get: (name: string) => string | undefined;
+}
+/**
+ * Build the `resolveRootRunId(sessionKey) → rootRunId` resolver (Phase 213-08,
+ * BUDGET-01/02) over a late-bound budget holder + a session→rootRunId index. The
+ * resolver is a STABLE closure created EARLY (before setupAgents/setupSchedulers,
+ * which hold it) and reads `holder.current` at call time — by the time a turn runs,
+ * the cap layer has populated it.
+ *
+ * Resolution: return the session's already-registered root if present; otherwise
+ * mint a SYNTHETIC per-session root `root-session-<formattedKey>` and `registerRoot`
+ * it on first use (via the holder). The synthetic fallback is what bounds a
+ * TOP-LEVEL (non-spawned) self-spawning loop — the budget's token/wall-clock limbs
+ * then key on a stable id for ANY run, not only orchestrate children (criterion #2).
+ * A synthetic root has no real lease, so a synthetic leaseId is recorded (the
+ * correlation index is content-free; the meter only needs the wall-clock anchor).
+ * Idempotent: the same session resolves to the SAME id on every call.
+ */
+export declare function createRootRunIdResolver(deps: {
+    holder: BoundedAutonomyBudgetHolder;
+    index: Map<string, string>;
+}): (sessionKey: SessionKey) => string;
+/** Deps for {@link constructCapabilityLayer} — the subset boot closes over. */
+export interface CapabilityLayerDeps {
+    /** The daemon's agents config map (only `autonomy` is read for the gate). */
+    agents: Record<string, PerAgentConfig>;
+    /** The deferred RPC dispatch sink the endpoint routes through. */
+    rpcCall: RpcCall;
+    /** Wall-clock for lease TTLs + the bounded-autonomy budget/rate windows. */
+    clock: ClockPort;
+    /**
+     * Timer port for the bounded-autonomy call-rate limiter's TTL-evict timers
+     * (Phase 213 RATE-01). The daemon's TimerPort (`handle.timers`).
+     */
+    timers: TimerPort;
+    /**
+     * The per-agent live cron-job count provider (Phase 213 RATE-02 count source).
+     * Bound by daemon.ts to `getAgentCronScheduler(agentId).getJobs().length`. The
+     * cap endpoint reads it THROUGH `boundedAutonomy.cronCount` for the `cronSelfMax`
+     * cap. Optional — absent ⇒ `cronCount` returns 0 (fail-open on that one limb).
+     */
+    cronJobCount?: (agentId: string) => number;
+    /** Absolute data dir — the cap socket path lives under it (cap.sock). */
+    dataDir: string;
+    /** The module-bound daemon logger for the construction INFO line. */
+    daemonLogger: LoggingResult["daemonLogger"];
+    /**
+     * The skills-scoped logger threaded into the shipped executor cores (file
+     * builtins + web_search). Optional so the 211 boot-gate unit tests can construct
+     * the layer without activating the executor.
+     */
+    skillsLogger?: ComisLogger;
+    /**
+     * Per-agent workspace dirs — the executor's `resolveWorkspace(agentId)` maps a
+     * lease's agentId to the jailed workspace its file builtins run under. Optional
+     * (the boot-gate tests omit it; the executor is then absent).
+     */
+    workspaceDirs?: Map<string, string>;
+    /** The default agent's workspace dir — the `resolveWorkspace` fallback. */
+    defaultWorkspaceDir?: string;
+    /**
+     * The secret store the daemon-side `web_search` reads provider keys from
+     * (SEARCH_API_KEY / PERPLEXITY_API_KEY / …), mirroring the in-process tool's
+     * config. Optional — absent → the keyless/default provider chain.
+     */
+    webSearchKeys?: CapabilityWebSearchKeys;
+    /**
+     * Phase 213-08 (BUDGET-01/02): the daemon-wide LATE-BOUND per-root budget holder,
+     * created EARLY in daemon.ts (before setupAgents/setupSchedulers, which hold it)
+     * and POPULATED here after `createBoundedAutonomy` with the narrow budget port.
+     * Optional — the 211 boot-gate unit tests omit it; the per-root reserve is then
+     * never wired (byte-identical).
+     */
+    boundedAutonomyHolder?: BoundedAutonomyBudgetHolder;
+    /**
+     * The session→rootRunId index the {@link createRootRunIdResolver} closure reads.
+     * Shared by reference with the resolver daemon.ts threads into setupAgents (built
+     * EARLY over the SAME holder). Optional — absent ⇒ a local index is used here.
+     */
+    rootRunIdIndex?: Map<string, string>;
+    /**
+     * Phase 213-08 (RATE-02): a daemon-supplied LeaseManager, built EARLY in daemon.ts
+     * (before setupSchedulers) so the cron-fire mint and this layer share the SAME
+     * instance. Optional — absent ⇒ this layer constructs its own (the 211 boot-gate
+     * path / older callers).
+     */
+    leaseManager?: LeaseManager;
+    /**
+     * AUDIT-01 (Phase 215): the structural deps the socket per-cap audit reads —
+     * `eventBus` (for the audit:event + capability:audited emits) + `config.tenantId`.
+     * daemon.ts passes the same `AppContainer` the dispatch sink holds (it is
+     * structurally assignable). Optional — the 211 boot-gate unit tests omit it, and
+     * the socket then emits NO per-cap audit (the endpoint still validates/dispatches;
+     * the in-process leg's audit at the dispatch closure is unaffected).
+     */
+    container?: EmitCapabilityAuditDeps["container"];
+    /**
+     * Phase 216 (HIGH-1): the durable-run store — forwarded to the cap endpoint so
+     * the jail leg allocates a monotonic `_outwardStepIndex` for an outward message
+     * method. Optional; absent ⇒ the endpoint injects no index (pass-through). The
+     * daemon builds the store EARLY (before this layer) and threads it here so the
+     * chokepoint shares the SAME store the resume engine + message handlers use.
+     */
+    durableRuns?: DurableRunPort;
+}
+/** The constructed capability layer handle (undefined when no autonomy agent). */
+export interface CapabilityLayerHandle {
+    leaseManager: LeaseManager;
+    endpoint: CapabilityEndpoint;
+    /**
+     * The daemon-wide bounded-autonomy service (Phase 213) — the single chokepoint
+     * the spawn ceiling (CEIL-01), cap-endpoint rate limit + cron self-ownership
+     * (RATE-01/02), outward quota (QUOTA-01/02), and per-root budget meter
+     * (BUDGET-03) consult. Constructed alongside the LeaseManager; `destroy()` tears
+     * down its rate-limiter timers (threaded into setupShutdown).
+     */
+    boundedAutonomy: BoundedAutonomy;
+    /** The cap socket path (under the data dir) — bound per jail by the orchestrate runner. */
+    capSocketPath: string;
+    /**
+     * The daemon-wide OutputGuard the lease mint registers each bearer in (Pitfall 1
+     * — ENDPOINT-03). `setup-tools.ts` reads it from the handle to build the
+     * `CapabilityMintDeps`, so the bearer is added to the redaction set at mint.
+     */
+    outputGuard: OutputGuardPort;
+    /**
+     * Phase 217-05 (BREAK-01/02): the daemon-wide per-rootRunId consecutive denial
+     * breaker. The dispatch chokepoint calls `recordDenial` ONLY on a
+     * CapabilityDeniedError floor-block and `recordAllow` on the allow branch; on
+     * the Nth consecutive floor-block it trips → execution:aborted + killByRootRun.
+     * `denialBreakerN` is sourced from the resolved autonomy-bearing config (LOW-1).
+     */
+    denialBreaker: DenialBreaker;
+    /**
+     * Phase 217-05 (EVICT-01/03): the daemon-wide evicted-rootRunId set. The
+     * `autonomy.evict` admin handler WRITES it (`mark`); the chokepoint READS it
+     * (`isEvicted`) at the NEXT gate decision to demote the run's mode to `default`
+     * mid-run. The SAME instance is threaded into createAutonomyHandlers via the
+     * `...deps` spread, activating the evict handler (Plan 04's cross-wave point).
+     */
+    evictRegistry: EvictRegistry;
+    /**
+     * Phase 217-05 (UNATT-03): the content-free escalate NotifyFn. The chokepoint
+     * fires it (NEVER awaited) on an unattended would-ask deny and on a breaker
+     * trip — out-of-band + auditable (a WARN with ids/enums/hint, never a body).
+     * Synchronous (void) so the deny re-throw is not blocked (the never-hang bar).
+     */
+    escalate: NotifyFn;
+}
+/** Result of {@link constructCapabilityLayer}: the cap handle + the boot preflight boolean. */
+export interface CapabilityLayerResult {
+    /** Undefined when NO agent resolves to an autonomy-bearing profile. */
+    capEndpointHandle: CapabilityLayerHandle | undefined;
+    /**
+     * Shutdown teardown thunk for the cap endpoint socket (stops + unlinks
+     * cap.sock), or `undefined` when no endpoint was constructed. Threaded into
+     * `setupShutdown` (mirrors the broker teardown).
+     */
+    capEndpointStop: (() => Promise<void>) | undefined;
+    /**
+     * JAIL-03 host namespace preflight result (the unprivileged-userns +
+     * `--unshare-net` probe, run once at boot). Fed to the SHIPPED degradeAutonomy
+     * via emitAutonomyBootLog — downshift to `assistant` + a doctor WARN when the
+     * host cannot build the jail (never a silent unjailed path). On non-Linux the
+     * probe honestly returns false. 211 only PRODUCES the boolean; the downshift
+     * stays in the shipped core fn.
+     */
+    namespacePreflightOk: boolean;
+    /**
+     * Phase 213-08 (BUDGET-01/02): the `resolveRootRunId(sessionKey)` resolver built
+     * over the populated holder + the session→rootRunId index. `undefined` when no
+     * autonomy agent (no cap layer). daemon.ts ALSO builds an equivalent resolver
+     * early (over the SAME holder + index) for setupAgents, which runs before this
+     * call — this returned one is the canonical resolver for any later consumer + the
+     * boot-test seam.
+     */
+    resolveRootRunId?: (sessionKey: SessionKey) => string;
+}
+/**
+ * Construct the daemon-wide capability layer (gated on an autonomy-bearing
+ * profile, mirroring how the broker is gated on `executor.broker`), ACTIVATE it
+ * (inject the executor + start the 0600 socket — Phase 212 Gap 3), AND run the
+ * JAIL-03 host namespace preflight once at boot. The cap handle is `undefined`
+ * when no agent is autonomy-bearing (so the lease layer + cap.sock are absent);
+ * the preflight runs unconditionally (it is a host capability check).
+ *
+ * Async because socket activation (`startSocket`) binds the unix socket before
+ * boot proceeds — daemon.ts `await`s this (net-zero: the call was already one line).
+ */
+export declare function constructCapabilityLayer(deps: CapabilityLayerDeps): Promise<CapabilityLayerResult>;