comisai 1.0.42 → 1.0.45

package/node_modules/@comis/daemon/dist/wiring/setup-cross-session/setup-cross-session-runtime.js

@@ -12,13 +12,35 @@
  *
  * @module
  */
-import { tryGetContext, safePath, systemNowMs } from "@comis/core";
-import { createResultCondenser, createNarrativeCaster, createLifecycleHooks, resolveOperationModel, resolveProviderFamily, createSubAgentRunner } from "@comis/agent";
+import { tryGetContext, safePath, systemNowMs, resolveWorkspaceDir } from "@comis/core";
+import { createResultRefStore } from "@comis/skills/tools";
+import { createResultCondenser, createNarrativeCaster, createLifecycleHooks, resolveOperationModel, resolveProviderFamily, createSubAgentRunner, classifyErrorContext, createDeliveryDedup, resolvePostureFromSkills } from "@comis/agent";
 import { createCrossSessionSender, createAnnouncementBatcher, createAnnouncementDeadLetterQueue, } from "@comis/orchestrator";
 import { randomUUID } from "node:crypto";
+import { computeRetryBackoff } from "../../graph/graph-node-lifecycle.js";
 import { buildExecuteSubAgent } from "./setup-cross-session-graph.js";
 import { registerProxyTypingListeners } from "./setup-cross-session-events.js";
 // ---------------------------------------------------------------------------
+// No-op logger fallback
+// ---------------------------------------------------------------------------
+/**
+ * A silent {@link ComisLogger} used only when the optional `deps.logger` is
+ * absent (test wiring). `createResultRefStore` requires a full ComisLogger; the
+ * production composition root always supplies one, so this never logs in
+ * production — it exists so the materialize feature is wired regardless.
+ */
+const NOOP_LOGGER = {
+    level: "silent",
+    trace: () => { },
+    debug: () => { },
+    info: () => { },
+    warn: () => { },
+    error: () => { },
+    fatal: () => { },
+    audit: () => { },
+    child: () => NOOP_LOGGER,
+};
+// ---------------------------------------------------------------------------
 // Setup function
 // ---------------------------------------------------------------------------
 /**
@@ -85,6 +107,11 @@ export function setupCrossSession(deps) {
         getExecutor,
         fileLock: deps.fileLock,
         logger: deps.logger,
+        // WT-01: thread the git-worktree seam + registry so a `worktree:true` child
+        // runs in an isolated worktree (auto-clean-if-unchanged). Both absent ⇒ the
+        // request is honestly skipped (no git seam) — byte-identical default.
+        ...(deps.worktreeGitExec ? { worktreeGitExec: deps.worktreeGitExec } : {}),
+        ...(deps.worktreeRegistry ? { worktreeRegistry: deps.worktreeRegistry } : {}),
     });
     // Cross-session sender — fire-and-forget, wait, or ping-pong messaging
     const crossSessionSender = createCrossSessionSender({
@@ -96,6 +123,13 @@ export function setupCrossSession(deps) {
         sendToChannel,
         eventBus: container.eventBus,
         config: container.config.security.agentToAgent,
+        // Phase 216 HIGH-2 (ONCE-01/02): the announce() send is routed through the
+        // SAME three-state exactly-once ledger as message.send when the durable
+        // store + a resolvable rootRunId are wired — a restart-driven re-announce of
+        // an already-committed announcement is then a no-op. Absent ⇒ pass-through.
+        ...(deps.outwardLedger ? { outwardLedger: deps.outwardLedger } : {}),
+        ...(deps.durableRuns ? { durableRuns: deps.durableRuns } : {}),
+        ...(deps.resolveRootRunId ? { resolveRootRunId: deps.resolveRootRunId } : {}),
     });
     // Announce to parent session by injecting [System Message] and executing parent agent.
     const announceToParent = async (callerAgentId, callerSessionKey, text, channelType, channelId) => {
@@ -159,13 +193,37 @@ export function setupCrossSession(deps) {
         maxEntries: 100,
         eventBus: container.eventBus,
         logger: deps.logger?.child({ submodule: "dead-letter-queue" }),
+        // Phase 216 HIGH-2 (ONCE-03/04): the SAME ledger instance — drain consults it
+        // BEFORE re-delivering, so a committed announcement is SKIPPED across a restart
+        // (the in-memory deliveredKeys set rebuilds empty on boot; the durable ledger
+        // is the authoritative no-double-notify signal). Absent ⇒ legacy at-least-once.
+        ...(deps.outwardLedger ? { outwardLedger: deps.outwardLedger } : {}),
     });
+    // WR-02/WR-03: ONE bounded delivered-key store shared across every
+    // completion-delivery surface — the batcher success path, the no-batcher
+    // success branches in deliverAnnouncement, the failure path
+    // (deliverFailureNotification), and DLQ recovery (WR-01). A single instance is
+    // what makes cross-path dedup hold whether or not the batcher is on the path;
+    // it is bounded (FIFO) so it never leaks for the daemon lifetime.
+    const deliveryDedup = createDeliveryDedup();
     // Announcement batcher coalesces near-simultaneous sub-agent completions.
     const announcementBatcher = createAnnouncementBatcher({
         announceToParent,
         sendToChannel,
         logger: deps.logger?.child({ submodule: "announcement-batcher" }),
         deadLetterQueue,
+        deliveryDedup,
+        // DELIVERY-02: inject the transient/permanent classifier + backoff so the
+        // batcher self-heals transient fallback failures (retry-with-backoff) and
+        // fast-paths permanent ones to the DLQ. computeRetryBackoff is an
+        // intra-package import (daemon owns it); classifyErrorContext comes from
+        // @comis/agent — both injected here so the orchestrator never imports either
+        // (no dependency inversion). The batcher only ever classifies transport
+        // errors, so endReason is bound to "failed".
+        classifyErrorContext: (msg) => classifyErrorContext(msg, "failed"),
+        computeRetryBackoff,
+        maxRetries: container.config.security.agentToAgent.delivery.maxRetries,
+        eventBus: container.eventBus,
     });
     // Resolve condensation model via 5-level priority chain
     const subagentCtxConfigForCondenser = container.config.security?.agentToAgent?.subagentContext;
@@ -197,6 +255,30 @@ export function setupCrossSession(deps) {
         enabled: subagentCtxConfigForCondenser?.narrativeCasting ?? true,
         tagPrefix: subagentCtxConfigForCondenser?.resultTagPrefix ?? "Subagent Result",
     });
+    // Phase 218 (SUMREF-02): the full-output ResultRef store. The runner stays
+    // @comis/skills-free (DI) — the daemon owns the store + the child-workspace
+    // target selection. The callback resolves the CHILD's OWN jailed workspace
+    // from ctx.agentId (mirroring setup-cross-session-graph.ts:358-361), NEVER the
+    // lead's (T-218-08); createResultRefStore is additionally safePath-confined to
+    // that root, so a traversal returns a MaterializeError the runner degrades on.
+    // The store's 3-way union (ResultRef | MaterializeError | undefined) is returned
+    // UNCHANGED — the runner's dep contract IS that union, so no mapping is forced.
+    const resultRefStore = createResultRefStore({
+        logger: deps.logger
+            ? deps.logger.child({ submodule: "sub-agent-result-ref" })
+            : NOOP_LOGGER,
+    });
+    const materializeFullOutput = (content, ctx) => {
+        const childAgentConfig = container.config.agents[ctx.agentId]
+            ?? container.config.agents["default"]
+            ?? {};
+        const childWorkspaceDir = resolveWorkspaceDir(childAgentConfig, ctx.agentId, container.config.dataDir || undefined);
+        return resultRefStore.materialize(content, "sessions_spawn", {
+            workspacePath: childWorkspaceDir,
+            runId: ctx.runId,
+            nowMs: ctx.nowMs,
+        });
+    };
     // Create lifecycle hooks for spawn preparation and completion
     const lifecycleHooks = createLifecycleHooks({
         logger: deps.logger
@@ -215,6 +297,21 @@ export function setupCrossSession(deps) {
         announceToParent,
         eventBus: container.eventBus,
         config: container.config.security.agentToAgent,
+        // Sandbox no-downgrade posture resolver (SANDBOX-02). The runner is a
+        // @comis/agent leaf with no full-config import, so it CANNOT reach
+        // container.config.agents — we inject a closure that resolves each agent's
+        // posture from its per-agent skills config. The two-arg form mirrors the
+        // effectiveAgentId inherit-caller fallback in setup-cross-session-graph.ts
+        // (:197-199): a child with no dedicated config inherits the caller's config,
+        // so its resolved posture matches what it will actually run under (equal to
+        // the caller ⇒ not a phantom downgrade). resolvePostureFromSkills folds an
+        // absent slice to the most-confined default (fail-closed).
+        resolvePosture: (agentId, callerAgentId) => {
+            const effectiveAgentId = (agentId in container.config.agents)
+                ? agentId
+                : (callerAgentId && callerAgentId in container.config.agents ? callerAgentId : agentId);
+            return resolvePostureFromSkills(container.config.agents[effectiveAgentId]?.skills);
+        },
         tenantId: container.config.tenantId,
         dataDir: container.config.dataDir || ".",
         logger: deps.logger?.child({ submodule: "sub-agent-runner" }),
@@ -226,16 +323,35 @@ export function setupCrossSession(deps) {
         condenserModel: condenserApiKey ? { id: condensationResolution.modelId, provider: condensationResolution.provider } : undefined,
         condenserApiKey: condenserApiKey || undefined,
         narrativeCaster,
+        // SUMREF-02: the full-output ResultRef materialize, targeting the CHILD's
+        // own jailed workspace (resolved from ctx.agentId), returning the store's
+        // 3-way union unchanged. Absent of a wired store IS the no-op (no BC shim).
+        materializeFullOutput,
         lifecycleHooks,
         deadLetterQueue,
+        deliveryDedup,
         clock: deps.clock,
         timers: deps.timers,
+        // Phase 213 CEIL-01: the tree-wide spawn ceiling (bound to
+        // boundedAutonomy.tryAcquireSpawn by the daemon). Inert when absent.
+        ...(deps.checkSpawnCeiling ? { checkSpawnCeiling: deps.checkSpawnCeiling } : {}),
+        // Phase 213 CR-02: the symmetric release (boundedAutonomy.releaseSpawn).
+        ...(deps.releaseSpawnCeiling ? { releaseSpawnCeiling: deps.releaseSpawnCeiling } : {}),
+        // Phase 216 DUR-01/HB-01: the durable checkpoint store + thresholds + facts
+        // resolver (the runner writes a per-root checkpoint + heartbeat). Inert when
+        // absent (the byte-identical default; the daemon wires these only when on).
+        ...(deps.durableRuns ? { durableRuns: deps.durableRuns } : {}),
+        ...(deps.durability ? { durability: deps.durability } : {}),
+        ...(deps.durableRunFacts ? { durableRunFacts: deps.durableRunFacts } : {}),
     });
-    // Register proxy typing event listeners (typing:proxy_start/stop + TTL sweep + shutdown)
-    registerProxyTypingListeners({
+    // Register proxy typing event listeners (typing:proxy_start/stop + TTL
+    // sweep). Returns a cleanup function the composition root threads into
+    // ShutdownDeps.proxyTypingCleanup (replaces the eventBus.on(
+    // "system:shutdown", ...) indirection that silently no-op'd in production).
+    const proxyTypingCleanup = registerProxyTypingListeners({
         container,
         adaptersByType: adaptersByType,
         logger: deps.logger,
     });
-    return { crossSessionSender, subAgentRunner, sendToChannel, announceToParent, deadLetterQueue, announcementBatcher };
+    return { crossSessionSender, subAgentRunner, sendToChannel, announceToParent, deadLetterQueue, announcementBatcher, proxyTypingCleanup };
 }

package/node_modules/@comis/daemon/dist/wiring/setup-cross-session/worktree-spawn-run.d.ts

@@ -0,0 +1,72 @@
+import type { ComisLogger } from "@comis/infra";
+import { type GitExec, type CleanIfUnchangedResult } from "@comis/skills/tools";
+import type { WorktreeRegistry } from "../setup-worktree-sweep.js";
+/**
+ * Resolve the worktree dir for a run, CONFINED under the child's jailed workspace
+ * (`<workspaceDir>/.worktrees/wt-<runId>`). The runId is validated (no separators /
+ * `..` / null) AND `safePath` rejects any resolved path that escapes the workspace
+ * — a worktree can never escape the jail (T-219-11). Throws on either guard (fail
+ * LOUD, never a silent escape).
+ */
+export declare function resolveWorktreeDir(workspaceDir: string, runId: string): string;
+/** Deps for {@link prepareWorktree}. */
+export interface PrepareWorktreeDeps {
+    /** The lifecycle GitExec (the daemon binds the real execFile wrapper; tests inject a fake). */
+    gitExec: GitExec;
+    /** The shared registry the boot/periodic sweep reads (WT-02). */
+    registry: WorktreeRegistry;
+    /** The child's jailed workspace dir — the worktree is confined under it. */
+    workspaceDir: string;
+    /** The ref the worktree branches from (its branch point for the ahead-check). */
+    baseRef: string;
+    /** The child's runId — names the worktree dir + the fresh branch, correlates the registry entry. */
+    runId: string;
+    /** Optional structured logger; the lifecycle's own content-free WARNs ride it. */
+    logger?: ComisLogger;
+}
+/** Handle returned by {@link prepareWorktree}: the dir to run in + the terminal cleanup. */
+export interface WorktreeRunHandle {
+    /** The worktree's working-tree dir — the child's cwd/workspace for this run. */
+    dir: string;
+    /**
+     * Clean up on the child's terminal settle: the lifecycle's PRECISE
+     * cleanIfUnchanged. A pristine worktree is removed + dropped from the registry;
+     * a dirty/ahead one is PRESERVED (entry marked completed + LEFT so the boot
+     * sweep retries). Never throws on the preserve path — the agent's work survives.
+     */
+    cleanup(): Promise<CleanIfUnchangedResult>;
+}
+/**
+ * Create an isolated worktree for a `spawn --worktree` child and return the dir to
+ * run in + the terminal cleanup. The fresh branch is `wt-<runId>` off `baseRef`.
+ * The entry is registered (completed:false) so a crash mid-child leaves a record
+ * the boot sweep can reclaim. `createWorktree` throws (WorktreeGitError) on a git
+ * failure / git-absent host — the caller (executeSubAgent) catches it and fails
+ * the spawn LOUD rather than silently degrading to a non-worktree run.
+ */
+export declare function prepareWorktree(deps: PrepareWorktreeDeps): Promise<WorktreeRunHandle>;
+/** The seam executeSubAgent passes to {@link maybePrepareWorktreeForSpawn}. */
+export interface SpawnWorktreeSeam {
+    /** The lifecycle GitExec (composition root binds the real execFile wrapper). */
+    worktreeGitExec?: GitExec;
+    /** The shared registry the boot/periodic orphan sweep reads. */
+    worktreeRegistry?: WorktreeRegistry;
+    logger?: ComisLogger;
+}
+/**
+ * The executeSubAgent decision: when the child session metadata requests a worktree
+ * AND the git seam + registry are wired AND a runId is known, create an isolated
+ * worktree under `baseWorkspaceDir` (off the workspace's current HEAD) and return
+ * its run handle; otherwise return undefined. A request that cannot be honored
+ * (seam unwired / no runId) is NOT silently dropped — it WARNs (config errorKind)
+ * so the skip is visible, and the child falls back to its shared workspace.
+ * `createWorktree` throws on a git failure / git-absent host (the caller fails the
+ * spawn LOUD). Extracted from executeSubAgent to hold the graph file's size cap.
+ */
+export declare function maybePrepareWorktreeForSpawn(opts: {
+    wantsWorktree: boolean;
+    runId: string | undefined;
+    baseWorkspaceDir: string;
+    agentId: string;
+    seam: SpawnWorktreeSeam;
+}): Promise<WorktreeRunHandle | undefined>;

package/node_modules/@comis/daemon/dist/wiring/setup-cross-session/worktree-spawn-run.js

@@ -0,0 +1,125 @@
+// SPDX-License-Identifier: Apache-2.0
+// @allow-throw: the runId path-traversal guard (assertSafeRunId) throws a
+// PathTraversalError so a worktree dir can NEVER escape the agent's jailed
+// workspace (T-219-11) — a security assertion that MUST fail LOUD, not degrade.
+// createWorktree (the lifecycle, @comis/skills/tools) also throws WorktreeGitError
+// on a git failure; both surface at the executeSubAgent boundary which fails the
+// spawn rather than silently running a non-worktree / escaped-path child.
+/**
+ * `worktree-spawn-run` — the WT-01 create/run/clean seam for executeSubAgent.
+ *
+ * When a `spawn --worktree` child runs (its session metadata carries
+ * `worktree:true`), executeSubAgent runs it in an ISOLATED git worktree instead
+ * of the agent's shared jailed workspace. This module owns the two pieces that
+ * keeps executeSubAgent itself small (the 800-line file-size cap):
+ *
+ *   1. {@link resolveWorktreeDir} — the worktree dir, CONFINED under the child's
+ *      jailed workspace via `safePath` (T-219-11 — a worktree NEVER escapes the
+ *      jail; the child stays attenuated + jailed, just on its own working tree).
+ *   2. {@link prepareWorktree}    — create the worktree (the lifecycle's
+ *      createWorktree over the injected GitExec), register it (WT-02 orphan
+ *      tracking), and return `{ dir, cleanup }`. `cleanup()` runs the lifecycle's
+ *      PRECISE cleanIfUnchanged: a pristine worktree is removed + dropped from the
+ *      registry; a dirty/ahead one is PRESERVED (the entry is marked completed and
+ *      LEFT so the boot sweep retries once the child's work is committed).
+ *
+ * The happy path is fully self-contained inside ONE executeSubAgent call
+ * (create → run → clean). The registry + the boot/periodic {@link setupWorktreeSweep}
+ * exist ONLY to reclaim worktrees orphaned by a CRASH mid-child.
+ *
+ * @module
+ */
+import { safePath, PathTraversalError } from "@comis/core";
+import { createWorktree, cleanIfUnchanged, } from "@comis/skills/tools";
+/** The subdirectory (under the child's jailed workspace) that holds per-run worktrees. */
+const WORKTREES_SUBDIR = ".worktrees";
+/**
+ * A runId is daemon-minted (`root-…` / a randomUUID-derived `sub-agent-<id>`), so
+ * it is never attacker-controlled in production — but a path separator / traversal
+ * token in it would let the worktree dir drift, so we reject it explicitly
+ * (defense in depth, T-219-11). The `wt-<runId>` prefix already anchors the first
+ * path component (so `safePath`'s prefix check stays inside the workspace), but a
+ * separator inside the runId could still split it into a deeper dir — fail LOUD.
+ */
+function assertSafeRunId(runId) {
+    if (runId.length === 0 || /[/\\]/.test(runId) || runId.includes("..") || runId.includes("\0")) {
+        throw new PathTraversalError("worktree runId", runId);
+    }
+}
+/**
+ * Resolve the worktree dir for a run, CONFINED under the child's jailed workspace
+ * (`<workspaceDir>/.worktrees/wt-<runId>`). The runId is validated (no separators /
+ * `..` / null) AND `safePath` rejects any resolved path that escapes the workspace
+ * — a worktree can never escape the jail (T-219-11). Throws on either guard (fail
+ * LOUD, never a silent escape).
+ */
+export function resolveWorktreeDir(workspaceDir, runId) {
+    assertSafeRunId(runId);
+    return safePath(workspaceDir, WORKTREES_SUBDIR, `wt-${runId}`);
+}
+/**
+ * Create an isolated worktree for a `spawn --worktree` child and return the dir to
+ * run in + the terminal cleanup. The fresh branch is `wt-<runId>` off `baseRef`.
+ * The entry is registered (completed:false) so a crash mid-child leaves a record
+ * the boot sweep can reclaim. `createWorktree` throws (WorktreeGitError) on a git
+ * failure / git-absent host — the caller (executeSubAgent) catches it and fails
+ * the spawn LOUD rather than silently degrading to a non-worktree run.
+ */
+export async function prepareWorktree(deps) {
+    const { gitExec, registry, workspaceDir, baseRef, runId, logger } = deps;
+    const dir = resolveWorktreeDir(workspaceDir, runId);
+    const branch = `wt-${runId}`;
+    const entry = await createWorktree(gitExec, { dir, baseRef, branch, runId });
+    registry.register({ dir: entry.dir, baseRef: entry.baseRef, branch: entry.branch, runId });
+    logger?.info({ runId, step: "worktree-create" }, "Worktree created for spawn --worktree child");
+    const cleanup = async () => {
+        // Mark completed FIRST so that even if the in-line clean is preempted (a crash
+        // between here and the remove), the boot sweep sees a completed entry it may
+        // reclaim once pristine — never an in-progress one it must preserve.
+        registry.markCompleted(dir);
+        const result = await cleanIfUnchanged(gitExec, entry, logger);
+        if (result.removed) {
+            // Pristine → reclaimed in-line; drop the registry entry (stays bounded).
+            registry.remove(dir);
+        }
+        // Preserved (dirty/ahead/remove-failed) → LEAVE the entry so the boot sweep
+        // retries once the work is committed/cleaned (cleanIfUnchanged already
+        // content-free WARN-logged the preserve reason).
+        return result;
+    };
+    return { dir, cleanup };
+}
+/**
+ * The executeSubAgent decision: when the child session metadata requests a worktree
+ * AND the git seam + registry are wired AND a runId is known, create an isolated
+ * worktree under `baseWorkspaceDir` (off the workspace's current HEAD) and return
+ * its run handle; otherwise return undefined. A request that cannot be honored
+ * (seam unwired / no runId) is NOT silently dropped — it WARNs (config errorKind)
+ * so the skip is visible, and the child falls back to its shared workspace.
+ * `createWorktree` throws on a git failure / git-absent host (the caller fails the
+ * spawn LOUD). Extracted from executeSubAgent to hold the graph file's size cap.
+ */
+export async function maybePrepareWorktreeForSpawn(opts) {
+    const { wantsWorktree, runId, baseWorkspaceDir, agentId, seam } = opts;
+    if (!wantsWorktree)
+        return undefined;
+    if (seam.worktreeGitExec && seam.worktreeRegistry && runId) {
+        return prepareWorktree({
+            gitExec: seam.worktreeGitExec,
+            registry: seam.worktreeRegistry,
+            workspaceDir: baseWorkspaceDir,
+            baseRef: "HEAD",
+            runId,
+            ...(seam.logger ? { logger: seam.logger.child({ submodule: "worktree-spawn" }) } : {}),
+        });
+    }
+    seam.logger?.warn({
+        agentId,
+        hasGitExec: !!seam.worktreeGitExec,
+        hasRegistry: !!seam.worktreeRegistry,
+        hasRunId: !!runId,
+        hint: "spawn --worktree requested but the git-worktree seam is not wired (or no runId); the child runs in its shared workspace — wire worktreeGitExec + worktreeRegistry at the composition root",
+        errorKind: "config",
+    }, "Worktree requested but seam unavailable; running child in shared workspace");
+    return undefined;
+}

package/node_modules/@comis/daemon/dist/wiring/setup-delivery.d.ts

@@ -30,6 +30,18 @@ export declare function setupDeliveryQueue(deps: {
     eventBus: TypedEventBus;
     logger: ComisLogger;
     channelAdapters: Map<string, DeliveryAdapter>;
+    /**
+     * REACT-02 (Verified Learning, Phase 199): OPTIONAL outbound-message → trajectory
+     * capture, threaded into every drain pass. `undefined` when learning-outcome is
+     * disabled for all agents → the drain does ZERO extra work (byte-identity).
+     */
+    recordOutboundMessage?: (messageId: string, scope: {
+        traceId: string;
+        tenantId: string;
+        agentId: string;
+        sessionId: string;
+        participantId?: string;
+    }) => void;
 }): Promise<DeliveryQueueResult>;
 export declare function drainDeliveryQueue(deps: {
     deliveryQueue: DeliveryQueuePort;
@@ -38,7 +50,23 @@ export declare function drainDeliveryQueue(deps: {
     logger: ComisLogger;
     drainBudgetMs: number;
     defaultMaxAttempts: number;
-}): Promise<void>;
+    /**
+     * REACT-02 (Verified Learning, Phase 199): capture (platform messageId →
+     * trajectory scope) for an agent-authored OUTBOUND message so an inbound
+     * reaction can resolve its trajectory. OPTIONAL — `undefined` when learning-
+     * outcome is disabled for every agent (the byte-identity default → the drain
+     * does ZERO extra work). Called ONLY on a successful ack with a non-null traceId.
+     */
+    recordOutboundMessage?: (messageId: string, scope: {
+        traceId: string;
+        tenantId: string;
+        agentId: string;
+        sessionId: string;
+        participantId?: string;
+    }) => void;
+}): Promise<{
+    hadEntries: boolean;
+}>;
 export interface DeliveryMirrorResult {
     /** The delivery mirror adapter (real or no-op), available immediately. */
     deliveryMirror: DeliveryMirrorPort;

package/node_modules/@comis/daemon/dist/wiring/setup-delivery.js

@@ -21,7 +21,7 @@ import { createHash } from "node:crypto";
 // Setup function
 // ---------------------------------------------------------------------------
 export async function setupDeliveryQueue(deps) {
-    const { db, config, eventBus, logger, channelAdapters } = deps;
+    const { db, config, eventBus, logger, channelAdapters, recordOutboundMessage } = deps;
     const queueConfig = config.deliveryQueue;
     // 1. Adapter creation: no-op when disabled
     if (!queueConfig.enabled) {
@@ -39,16 +39,31 @@ export async function setupDeliveryQueue(deps) {
     let drainInterval;
     // Single-tick gate: in-flight Promise prevents overlapping ticks.
     let draining = null;
+    // Transition-gate state for the empty-drain log.
+    // Previously, every recurring tick on an empty queue emitted
+    // "Delivery queue drain: no pending entries" — dominated debug logs at
+    // one line per drainIntervalMs (5–10s). The gate logs ONCE when the
+    // queue transitions to empty; subsequent empty ticks are silent. Start
+    // `true` so the first empty-after-startup tick still produces a line.
+    let lastDrainHadPending = true;
     // Inner helper: one drain pass. Reused by startup drain AND each recurring tick.
     const runOneDrainPass = async () => {
-        await drainDeliveryQueue({
+        const passResult = await drainDeliveryQueue({
             deliveryQueue,
             channelAdapters,
             eventBus,
             logger,
             drainBudgetMs: queueConfig.drainBudgetMs,
             defaultMaxAttempts: queueConfig.defaultMaxAttempts,
+            recordOutboundMessage,
         });
+        if (passResult.hadEntries) {
+            lastDrainHadPending = true;
+        }
+        else if (lastDrainHadPending) {
+            logger.debug("Delivery queue drain: transitioned to empty");
+            lastDrainHadPending = false;
+        }
     };
     // 2. Startup drain + recurring drain timer + prune timer (deferred until channelAdapters populated)
     const drainAndStart = async () => {
@@ -114,18 +129,22 @@ export async function setupDeliveryQueue(deps) {
 // Drain implementation
 // ---------------------------------------------------------------------------
 export async function drainDeliveryQueue(deps) {
-    const { deliveryQueue, channelAdapters, eventBus, logger, drainBudgetMs, defaultMaxAttempts } = deps;
+    const { deliveryQueue, channelAdapters, eventBus, logger, drainBudgetMs, defaultMaxAttempts, recordOutboundMessage } = deps;
     const drainStart = systemNowMs();
     const deadline = drainStart + drainBudgetMs;
     const pendingResult = await deliveryQueue.pendingEntries();
     if (!pendingResult.ok) {
         logger.warn({ err: pendingResult.error, hint: "Could not fetch pending entries for drain cycle", errorKind: "internal" }, "Delivery queue drain: failed to fetch pending entries");
-        return;
+        // Treat as "no entries observed" — runOneDrainPass uses this to gate
+        // the transition log; a fetch failure does NOT count as "had pending".
+        return { hadEntries: false };
     }
     const entries = pendingResult.value;
     if (entries.length === 0) {
-        logger.debug("Delivery queue drain: no pending entries");
-        return;
+        // Fix B (log-review): the noisy "no pending entries" log moved up to
+        // runOneDrainPass as a transition-gated emit. Direct callers (the
+        // row-selection-invariant unit test) just observe the return value.
+        return { hadEntries: false };
     }
     let attempted = 0;
     let delivered = 0;
@@ -154,6 +173,34 @@ export async function drainDeliveryQueue(deps) {
         if (sendResult.ok) {
             await deliveryQueue.ack(entry.id, sendResult.value);
             delivered++;
+            // REACT-02 (CR-01): capture (platform messageId → trajectory scope) for
+            // inbound-reaction resolution. Agent-authored OUTBOUND only (the delivery
+            // queue is outbound); entry.traceId === trajectoryId AND options.agentId are
+            // both set from the request ALS at enqueue (delivery-service.ts). The
+            // agentId is the load-bearing (tenant, agent) isolation partition the
+            // reaction observe()s under — it must be the REAL agent, NEVER the tenantId.
+            // A null traceId (no trajectory) OR an absent agentId (a pre-executor /
+            // non-agent send) is a FAIL-CLOSED skip: mis-attributing a reaction to the
+            // tenantId would corrupt cross-agent isolation (T-198-16), so we record
+            // nothing rather than fall back. The callback is undefined when
+            // learning-outcome is disabled for all agents → zero extra work (byte-identity).
+            const recordAgentId = typeof options.agentId === "string" ? options.agentId : undefined;
+            if (entry.traceId !== null && recordAgentId !== undefined && recordOutboundMessage !== undefined) {
+                // FLAG-2: carry the conversation participant (the inbound sender) persisted
+                // into optionsJson at enqueue (delivery-service.ts) so a reaction resolved
+                // via this drain path is participant-aware — an unmapped group bystander
+                // resolves to "external" (inert) and cannot spoof reaction-learning. Absent
+                // on legacy/pre-threading rows → undefined → the trust resolution fails safe
+                // to the prior defaultTrustLevel-for-unmapped behavior.
+                const recordParticipantId = typeof options.participantId === "string" ? options.participantId : undefined;
+                recordOutboundMessage(sendResult.value, {
+                    traceId: entry.traceId,
+                    tenantId: entry.tenantId,
+                    agentId: recordAgentId,
+                    sessionId: entry.traceId, // session identity falls back to the trajectory id (scope-consistent)
+                    participantId: recordParticipantId,
+                });
+            }
             // Emit notification:delivered for notification-origin entries
             if (options.origin === "notification") {
                 eventBus.emit("notification:delivered", {
@@ -188,6 +235,7 @@ export async function drainDeliveryQueue(deps) {
         timestamp: systemNowMs(),
     });
     logger.info({ entriesAttempted: attempted, entriesDelivered: delivered, entriesFailed: failed, durationMs }, "Delivery queue drained");
+    return { hadEntries: true };
 }
 // ---------------------------------------------------------------------------
 // Idempotency key computation