comisai 1.0.44 → 1.0.45

package/node_modules/@comis/agent/dist/spawn/sandbox-posture.d.ts

@@ -112,3 +112,26 @@ export interface SkillsPostureSlice {
  * Pure: no I/O, no config import beyond the structural {@link SkillsPostureSlice}.
  */
 export declare function resolvePostureFromSkills(skills: SkillsPostureSlice | undefined): SandboxPosture;
+/**
+ * Thrown by the sub-agent spawn path (P0-C no-downgrade gate) when a child's
+ * sandbox posture is strictly LESS confined than its spawner's on ≥1 dimension.
+ *
+ * A TYPED refusal (mirrors {@link RequiredToolsUnreachableError} in `@comis/core`):
+ * the daemon's `classifyRpcError` matches it to `precondition`/**warn**, so this
+ * fail-closed SECURITY refusal does NOT read as an `internal`/**error** handler
+ * fault in an operator's ERROR-level health sweep (OBS-RPC-REFUSAL-CLASS,
+ * orchestration-excellence-20260701). The refuse decision, the
+ * `security:sandbox_downgrade_refused` event, and the message are all unchanged —
+ * this only carries the type so the dispatch layer can classify it correctly.
+ *
+ * `violatedDimensions` are enum LABELS only (never posture values/paths/hosts, §2.7).
+ *
+ * @allow-throw: spawn() is consumed exclusively by daemon RPC handlers
+ * (@allow-throw boundary in sub-agent-runner.ts); rpc-dispatch converts this to a
+ * JSON-RPC error response.
+ */
+export declare class SandboxDowngradeError extends Error {
+    readonly kind: "sandbox_downgrade";
+    readonly violatedDimensions: readonly PostureDimension[];
+    constructor(message: string, violatedDimensions: readonly PostureDimension[]);
+}

package/node_modules/@comis/agent/dist/spawn/sandbox-posture.js

@@ -165,3 +165,30 @@ export function resolvePostureFromSkills(skills) {
         // filesystem / network / uid intentionally unset (present-but-inert, A1).
     };
 }
+/**
+ * Thrown by the sub-agent spawn path (P0-C no-downgrade gate) when a child's
+ * sandbox posture is strictly LESS confined than its spawner's on ≥1 dimension.
+ *
+ * A TYPED refusal (mirrors {@link RequiredToolsUnreachableError} in `@comis/core`):
+ * the daemon's `classifyRpcError` matches it to `precondition`/**warn**, so this
+ * fail-closed SECURITY refusal does NOT read as an `internal`/**error** handler
+ * fault in an operator's ERROR-level health sweep (OBS-RPC-REFUSAL-CLASS,
+ * orchestration-excellence-20260701). The refuse decision, the
+ * `security:sandbox_downgrade_refused` event, and the message are all unchanged —
+ * this only carries the type so the dispatch layer can classify it correctly.
+ *
+ * `violatedDimensions` are enum LABELS only (never posture values/paths/hosts, §2.7).
+ *
+ * @allow-throw: spawn() is consumed exclusively by daemon RPC handlers
+ * (@allow-throw boundary in sub-agent-runner.ts); rpc-dispatch converts this to a
+ * JSON-RPC error response.
+ */
+export class SandboxDowngradeError extends Error {
+    kind = "sandbox_downgrade";
+    violatedDimensions;
+    constructor(message, violatedDimensions) {
+        super(message);
+        this.name = "SandboxDowngradeError";
+        this.violatedDimensions = violatedDimensions;
+    }
+}

package/node_modules/@comis/agent/dist/spawn/sub-agent-runner.js

@@ -16,7 +16,7 @@ import { createCoordinatorProgressFork, } from "./coordinator-progress-fork.js";
 import { sanitizeAssistantResponse } from "../provider/response/sanitize-pipeline.js";
 import { randomUUID } from "node:crypto";
 import { classifyAbortReason, buildAnnouncementMessage, deliverAnnouncement, deliverFailureNotification, validateOutputs, sweepResultFiles, persistFailureRecord, } from "./sub-agent-result-processor.js";
-import { comparePosture } from "./sandbox-posture.js";
+import { comparePosture, SandboxDowngradeError } from "./sandbox-posture.js";
 import { steerRun as steerRunHelper } from "./steer-run.js";
 // ---------------------------------------------------------------------------
 // Constants
@@ -703,7 +703,10 @@ export function createSubAgentRunner(deps) {
                     childPosture,
                 });
                 // @allow-throw: spawn() consumed exclusively by daemon RPC handlers; @allow-throw boundary.
-                throw new Error(`Spawn refused: child "${params.agentId}" sandbox posture is less confined than parent "${params.callerAgentId}" on: ${violated}.`);
+                // Typed (OBS-RPC-REFUSAL-CLASS): classifyRpcError maps SandboxDowngradeError to
+                // precondition/warn — this fail-closed SECURITY refusal must NOT read as an
+                // internal/error handler fault in an operator's ERROR-level health sweep.
+                throw new SandboxDowngradeError(`Spawn refused: child "${params.agentId}" sandbox posture is less confined than parent "${params.callerAgentId}" on: ${violated}.`, cmp.violatedDimensions);
             }
         }
         // Children check (bypassed for graph spawns)

package/node_modules/@comis/agent/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@comis/agent",
   "private": true,
-  "version": "1.0.44",
+  "version": "1.0.45",
   "author": "Moshe Anconina",
   "license": "Apache-2.0",
   "description": "AI agent executor, budget control, and session management for Comis",

package/node_modules/@comis/channels/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@comis/channels",
   "private": true,
-  "version": "1.0.44",
+  "version": "1.0.45",
   "author": "Moshe Anconina",
   "license": "Apache-2.0",
   "description": "Chat platform adapters — Discord, Telegram, Slack, WhatsApp, Signal, iMessage, IRC, LINE",

package/node_modules/@comis/cli/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@comis/cli",
   "private": true,
-  "version": "1.0.44",
+  "version": "1.0.45",
   "author": "Moshe Anconina",
   "license": "Apache-2.0",
   "description": "Command-line interface for the Comis AI agent platform",

package/node_modules/@comis/core/dist/domain/index.d.ts

@@ -35,3 +35,5 @@ export { ProviderFamilySchema, TranscriptToolCallIdModeSchema, ProviderCapabilit
 export type { ProviderFamily, TranscriptToolCallIdMode, ProviderCapabilities, } from "./provider-capabilities.js";
 export { SUB_AGENT_TOOL_DENYLIST, SUB_AGENT_TOOL_PROFILES, SUB_AGENT_TOOL_GROUPS, RequiredToolsUnreachableError, toolReachableGroups, computeReachableToolNames, } from "./sub-agent-tool-denylist.js";
 export type { UnreachableToolEntry } from "./sub-agent-tool-denylist.js";
+export { classifyTypedRpcError } from "./rpc-error-classification.js";
+export type { TypedRpcErrorKind, TypedRpcErrorClassification } from "./rpc-error-classification.js";

package/node_modules/@comis/core/dist/domain/index.js

@@ -24,3 +24,8 @@ export { ToolSchemaProfileSchema, ToolCallArgumentsEncodingSchema, ModelCompatCo
 export { ProviderFamilySchema, TranscriptToolCallIdModeSchema, ProviderCapabilitiesSchema, } from "./provider-capabilities.js";
 // Sub-agent tool governance
 export { SUB_AGENT_TOOL_DENYLIST, SUB_AGENT_TOOL_PROFILES, SUB_AGENT_TOOL_GROUPS, RequiredToolsUnreachableError, toolReachableGroups, computeReachableToolNames, } from "./sub-agent-tool-denylist.js";
+// RPC typed-refusal classification — the single source of truth the daemon
+// rpc-dispatch classifier AND the @comis/gateway method-router classifier both
+// delegate to, so intentional policy/security refusals classify consistently
+// (warn, never internal/ERROR) at every log layer (OBS-RPC-REFUSAL-CLASS).
+export { classifyTypedRpcError } from "./rpc-error-classification.js";

package/node_modules/@comis/core/dist/domain/rpc-error-classification.d.ts

@@ -0,0 +1,49 @@
+/**
+ * Single source of truth for classifying a TYPED RPC refusal (OBS-RPC-REFUSAL-CLASS).
+ *
+ * ## Why this lives in `@comis/core`
+ * An RPC error is classified + logged at **two** layers: the daemon's
+ * `classifyRpcError` (`packages/daemon/src/api/rpc-dispatch.ts`) AND the
+ * `@comis/gateway` method-router trace wrapper (`classifyRpcMethodError`). The
+ * gateway is a lower-level library and **cannot `instanceof`** the daemon
+ * (`PreconditionError`/`ValidationError`/`AuthorizationError`), `@comis/agent`
+ * (`SandboxDowngradeError`), or local (`RequiredToolsUnreachableError`) error classes —
+ * the dependency direction forbids it.
+ *
+ * Before this module each layer hard-coded its own typed→kind mapping and they
+ * **drifted**: the gateway layer kept logging intentional policy/security refusals as
+ * `internal`/ERROR(50) long after the dispatch layer was fixed to `precondition`/warn,
+ * so a `logscan --level 50,60` operator health sweep STILL flagged a fail-closed
+ * refusal as an ERROR (found live, orchestration-excellence-20260701). Both layers now
+ * delegate here, keyed off the stable {@link Error.name} — the lowest-common-denominator
+ * signal available WITHOUT a cross-package import. **Add a new typed refusal in ONE
+ * place: {@link TYPED_RPC_ERROR_BY_NAME}.**
+ *
+ * ## Scope
+ * This recognizes the TYPED refusals only. Each caller keeps its OWN fallback for an
+ * UNRECOGNIZED error (the daemon defaults to `internal`/`error`; the gateway applies its
+ * message-substring heuristics then `internal`/`error`) — those fallbacks legitimately
+ * differ per layer and are deliberately NOT unified here.
+ *
+ * A typed refusal is an EXPECTED caller-side / policy / security outcome, never an
+ * internal handler fault, so its `level` is always `"warn"` and its `errorKind` is
+ * never `"internal"`.
+ *
+ * @module
+ */
+/** The non-internal error kinds a typed RPC refusal classifies as. */
+export type TypedRpcErrorKind = "precondition" | "validation" | "auth";
+/** Classification of a recognized typed RPC refusal. `level` is always `"warn"`. */
+export interface TypedRpcErrorClassification {
+    readonly errorKind: TypedRpcErrorKind;
+    readonly hint: string;
+    readonly level: "warn";
+}
+/**
+ * Classify a TYPED RPC refusal by its {@link Error.name}, or return `null` when the
+ * error is NOT a recognized typed refusal (the caller then applies its own fallback).
+ *
+ * Pure + dependency-free: no I/O, no error-class imports (keyed off the `.name` string),
+ * deterministic for a given input.
+ */
+export declare function classifyTypedRpcError(err: unknown): TypedRpcErrorClassification | null;

package/node_modules/@comis/core/dist/domain/rpc-error-classification.js

@@ -0,0 +1,62 @@
+// SPDX-License-Identifier: Apache-2.0
+/**
+ * Single source of truth for classifying a TYPED RPC refusal (OBS-RPC-REFUSAL-CLASS).
+ *
+ * ## Why this lives in `@comis/core`
+ * An RPC error is classified + logged at **two** layers: the daemon's
+ * `classifyRpcError` (`packages/daemon/src/api/rpc-dispatch.ts`) AND the
+ * `@comis/gateway` method-router trace wrapper (`classifyRpcMethodError`). The
+ * gateway is a lower-level library and **cannot `instanceof`** the daemon
+ * (`PreconditionError`/`ValidationError`/`AuthorizationError`), `@comis/agent`
+ * (`SandboxDowngradeError`), or local (`RequiredToolsUnreachableError`) error classes —
+ * the dependency direction forbids it.
+ *
+ * Before this module each layer hard-coded its own typed→kind mapping and they
+ * **drifted**: the gateway layer kept logging intentional policy/security refusals as
+ * `internal`/ERROR(50) long after the dispatch layer was fixed to `precondition`/warn,
+ * so a `logscan --level 50,60` operator health sweep STILL flagged a fail-closed
+ * refusal as an ERROR (found live, orchestration-excellence-20260701). Both layers now
+ * delegate here, keyed off the stable {@link Error.name} — the lowest-common-denominator
+ * signal available WITHOUT a cross-package import. **Add a new typed refusal in ONE
+ * place: {@link TYPED_RPC_ERROR_BY_NAME}.**
+ *
+ * ## Scope
+ * This recognizes the TYPED refusals only. Each caller keeps its OWN fallback for an
+ * UNRECOGNIZED error (the daemon defaults to `internal`/`error`; the gateway applies its
+ * message-substring heuristics then `internal`/`error`) — those fallbacks legitimately
+ * differ per layer and are deliberately NOT unified here.
+ *
+ * A typed refusal is an EXPECTED caller-side / policy / security outcome, never an
+ * internal handler fault, so its `level` is always `"warn"` and its `errorKind` is
+ * never `"internal"`.
+ *
+ * @module
+ */
+// Keyed by `Error.name` (a `Map` — not object indexing — to keep the key set closed and
+// avoid the `detect-object-injection` sink on the `.get(name)` lookup). The name strings
+// are the CONTRACT with the error classes (each sets `this.name`); keep this map in sync
+// when a class is renamed or a new typed refusal is introduced. The hints match the
+// daemon's historical per-class hints so behavior is byte-identical after the two layers
+// delegate here (and the gateway layer now inherits the knob-naming hints too).
+const TYPED_RPC_ERROR_BY_NAME = new Map([
+    // Caller precondition failures (incl. gated-off policy refusals).
+    ["PreconditionError", { errorKind: "precondition", hint: "Caller precondition not met; check resource state before retry", level: "warn" }],
+    // Fail-closed SECURITY refusal (P0-C sub-agent sandbox no-downgrade gate).
+    ["SandboxDowngradeError", { errorKind: "precondition", hint: "Child sandbox posture is less confined than its spawner; align the child's skills sandbox config or set security.agentToAgent.sandboxNoDowngrade:false to allow", level: "warn" }],
+    // Caller-side validation failures.
+    ["ValidationError", { errorKind: "validation", hint: "Check parameter types and values against the schema", level: "warn" }],
+    ["RequiredToolsUnreachableError", { errorKind: "validation", hint: "Adjust required_tools and/or tool_groups per the per-tool hints in the error message", level: "warn" }],
+    // Expected authorization refusal (wrong-trust control-plane call).
+    ["AuthorizationError", { errorKind: "auth", hint: "Caller lacks admin trust for this control-plane method; use an admin-scoped token or the documented operator route (e.g. `comis explain` assembles obs reports offline)", level: "warn" }],
+]);
+/**
+ * Classify a TYPED RPC refusal by its {@link Error.name}, or return `null` when the
+ * error is NOT a recognized typed refusal (the caller then applies its own fallback).
+ *
+ * Pure + dependency-free: no I/O, no error-class imports (keyed off the `.name` string),
+ * deterministic for a given input.
+ */
+export function classifyTypedRpcError(err) {
+    const name = err instanceof Error ? err.name : "";
+    return TYPED_RPC_ERROR_BY_NAME.get(name) ?? null;
+}

package/node_modules/@comis/core/dist/exports/domain.d.ts

@@ -1,4 +1,4 @@
-export { AttachmentSchema, NormalizedMessageSchema, parseMessage, getMessageTraceId, NormalizedReactionSchema, parseReaction, TrustLevelSchema, MemorySourceSchema, MemoryEntrySchema, ExtractedEntitySchema, StructuredMemorySchema, MemoryExtractionResultSchema, MemoryEntitySchema, ToolCallSchema, TokenUsageSchema, AgentResponseSchema, SessionKeySchema, parseSessionKey, formatSessionKey, parseFormattedSessionKey, PollInputSchema, PollOptionResultSchema, NormalizedPollResultSchema, normalizePollDurationHours, RichButtonSchema, RichCardFieldSchema, RichCardSchema, RichEffectSchema, ApprovalRequestSchema, ApprovalResolutionSchema, SerializedApprovalRequestSchema, SerializedApprovalCacheEntrySchema, InjectionTypeSchema, CredentialMappingSchema, SecretRefSchema, isSecretRef, SecretRefOrStringSchema, DeliveryOriginSchema, createDeliveryOrigin, NodeStatusSchema, GraphStatusSchema, GraphNodeSchema, NodeExecutionStateSchema, ExecutionGraphSchema, GraphValidationError, parseExecutionGraph, topologicalSort, validateAndSortGraph, SubagentResultSchema, SubagentEndReasonSchema, parseSubagentResult, SubagentContextConfigSchema, NodeTypeIdSchema, ToolSchemaProfileSchema, ToolCallArgumentsEncodingSchema, ModelCompatConfigSchema, ProviderFamilySchema, TranscriptToolCallIdModeSchema, ProviderCapabilitiesSchema, SUB_AGENT_TOOL_DENYLIST, SUB_AGENT_TOOL_PROFILES, SUB_AGENT_TOOL_GROUPS, RequiredToolsUnreachableError, toolReachableGroups, computeReachableToolNames, MemoryExportEnvelopeSchema, MemoryExportEntrySchema, parseMemoryExportEnvelope, } from "../domain/index.js";
+export { AttachmentSchema, NormalizedMessageSchema, parseMessage, getMessageTraceId, NormalizedReactionSchema, parseReaction, TrustLevelSchema, MemorySourceSchema, MemoryEntrySchema, ExtractedEntitySchema, StructuredMemorySchema, MemoryExtractionResultSchema, MemoryEntitySchema, ToolCallSchema, TokenUsageSchema, AgentResponseSchema, SessionKeySchema, parseSessionKey, formatSessionKey, parseFormattedSessionKey, PollInputSchema, PollOptionResultSchema, NormalizedPollResultSchema, normalizePollDurationHours, RichButtonSchema, RichCardFieldSchema, RichCardSchema, RichEffectSchema, ApprovalRequestSchema, ApprovalResolutionSchema, SerializedApprovalRequestSchema, SerializedApprovalCacheEntrySchema, InjectionTypeSchema, CredentialMappingSchema, SecretRefSchema, isSecretRef, SecretRefOrStringSchema, DeliveryOriginSchema, createDeliveryOrigin, NodeStatusSchema, GraphStatusSchema, GraphNodeSchema, NodeExecutionStateSchema, ExecutionGraphSchema, GraphValidationError, parseExecutionGraph, topologicalSort, validateAndSortGraph, SubagentResultSchema, SubagentEndReasonSchema, parseSubagentResult, SubagentContextConfigSchema, NodeTypeIdSchema, ToolSchemaProfileSchema, ToolCallArgumentsEncodingSchema, ModelCompatConfigSchema, ProviderFamilySchema, TranscriptToolCallIdModeSchema, ProviderCapabilitiesSchema, SUB_AGENT_TOOL_DENYLIST, SUB_AGENT_TOOL_PROFILES, SUB_AGENT_TOOL_GROUPS, RequiredToolsUnreachableError, toolReachableGroups, computeReachableToolNames, classifyTypedRpcError, MemoryExportEnvelopeSchema, MemoryExportEntrySchema, parseMemoryExportEnvelope, } from "../domain/index.js";
 export { BackgroundTaskOriginSchema } from "../domain/background-task-origin.js";
 export type { BackgroundTaskOrigin } from "../domain/background-task-origin.js";
 export { KEYLESS_PROVIDER_TYPES, KEYLESS_API_KEY_SENTINEL } from "../provider/keyless-providers.js";

package/node_modules/@comis/core/dist/exports/domain.js

@@ -37,6 +37,8 @@ ToolSchemaProfileSchema, ToolCallArgumentsEncodingSchema, ModelCompatConfigSchem
 ProviderFamilySchema, TranscriptToolCallIdModeSchema, ProviderCapabilitiesSchema, 
 // Sub-agent tool governance
 SUB_AGENT_TOOL_DENYLIST, SUB_AGENT_TOOL_PROFILES, SUB_AGENT_TOOL_GROUPS, RequiredToolsUnreachableError, toolReachableGroups, computeReachableToolNames, 
+// RPC typed-refusal classification (single source of truth — OBS-RPC-REFUSAL-CLASS)
+classifyTypedRpcError, 
 // MemoryExportEnvelope
 MemoryExportEnvelopeSchema, MemoryExportEntrySchema, parseMemoryExportEnvelope, } from "../domain/index.js";
 export { BackgroundTaskOriginSchema } from "../domain/background-task-origin.js";

package/node_modules/@comis/core/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@comis/core",
   "private": true,
-  "version": "1.0.44",
+  "version": "1.0.45",
   "author": "Moshe Anconina",
   "license": "Apache-2.0",
   "description": "Core domain types, ports, event bus, security, and config for Comis",

package/node_modules/@comis/daemon/dist/api/graph-handlers/graph-mutate.js

@@ -17,6 +17,7 @@ import { randomUUID } from "node:crypto";
 import { existsSync, rmSync } from "node:fs";
 import { safePath, GraphDefineContract, GraphExecuteContract, GraphCancelContract, GraphSaveContract, GraphDeleteContract, GraphDeleteRunContract, stripInternalFields, requireCapability, } from "@comis/core";
 import { extractUserVariables, substituteUserVariables } from "../../graph/user-variables.js";
+import { PreconditionError } from "../errors.js";
 import { IS_DEV, buildGraphInput, validateGraphWarnings, validateTypeConfigs, } from "./graph-helpers.js";
 // Authoring telemetry/audit helpers extracted to keep this file under the
 // graph-handlers/ 500-line cap (file-size cap; behavior byte-identical).
@@ -119,7 +120,10 @@ export function bindGraphMutateHandlers(deps) {
             // graph runs. A non-from_intent execute (no marker) is wholly unaffected —
             // byte-identical to pre-174.
             if (synthPattern && !deps.authoringConfig?.intentAction) {
-                throw new Error("from_intent authoring is disabled by policy (orchestration.authoring.intentAction).");
+                // Typed (OBS-RPC-REFUSAL-CLASS): a gated-off policy refusal is a caller
+                // precondition failure, not an internal handler fault — classifyRpcError maps
+                // PreconditionError to precondition/warn so it doesn't read as a fleet ERROR.
+                throw new PreconditionError("from_intent authoring is disabled by policy (orchestration.authoring.intentAction).");
             }
             const userParams = stripInternalFields(rawParams);
             // M-1 (T-174-MARKER-LEAK): _synthesizedFromIntent is NOT in

package/node_modules/@comis/daemon/dist/api/rpc-dispatch.d.ts

@@ -16,23 +16,22 @@ export type { ApiDispatchDeps };
 /**
  * Classify an RPC error for structured logging.
  *
- * Accepts the raw error object (not just its message) so `instanceof`
- * checks against `PreconditionError` / `ValidationError` resolve. Returns
- * an ErrorKind, an actionable hint, AND a `level` (`"warn" | "error"`)
- * that the dispatcher uses to pick `logger.warn` vs `logger.error`. The
- * goal is to keep operator alerts meaningful: caller mistakes
- * (preconditions, validation) are warn-level via typed-class throws;
- * unmatched cases fall through to `error/internal`.
+ * Returns an ErrorKind, an actionable hint, AND a `level` (`"warn" | "error"`) that the
+ * dispatcher uses to pick `logger.warn` vs `logger.error`. The goal is to keep operator
+ * alerts meaningful: caller mistakes / policy / security refusals (`PreconditionError`,
+ * `ValidationError`, `AuthorizationError`, `RequiredToolsUnreachableError`,
+ * `SandboxDowngradeError`) are warn-level; unmatched cases fall through to `error/internal`.
  *
- * The legacy message-pattern (substring-match) fallbacks were deleted.
- * OBS-10 (reflect-obs-20260627): the admin-trust denials — every `throw new Error(
- * "Admin access required …")` across the ~26 control-plane handlers — were migrated to
- * `throw new AuthorizationError(...)`, so an operator's wrong-trust call classifies as
- * `auth`/`warn` instead of `internal`/`error` (it was reading as a fleet ERROR + tripping
- * operator alerts though the gate fired correctly). The remaining bare-Error handlers
- * ("immutable" preconditions, etc.) still classify as `internal`/`error` until migrated
- * to `PreconditionError`/`ValidationError` — that migration is incremental hardening. The
- * substring-fallback deletion is intentional; typed errors are the sanctioned path.
+ * The typed-refusal → kind/hint/level mapping lives in `@comis/core`
+ * ({@link classifyTypedRpcError}) as the SINGLE source of truth, because the SAME error is
+ * ALSO classified by the `@comis/gateway` method-router trace wrapper — which cannot
+ * `instanceof` these classes (dependency direction) and so keys off `Error.name`. Before
+ * that shared classifier the two layers drifted and the gateway kept logging intentional
+ * refusals as internal/ERROR after this layer was fixed (OBS-RPC-REFUSAL-CLASS,
+ * orchestration-excellence-20260701). **Add a new typed refusal in `@comis/core`, not
+ * here.** The legacy substring-match fallbacks remain deleted; typed errors are the
+ * sanctioned path (OBS-10: admin-trust denials throw `AuthorizationError`; bare-Error
+ * handlers still classify internal/error until migrated to a typed class).
  */
 export declare function classifyRpcError(err: unknown): {
     errorKind: ErrorKind;

package/node_modules/@comis/daemon/dist/api/rpc-dispatch.js

@@ -11,8 +11,7 @@
  * the field set inline.
  * @module
  */
-import { PreconditionError, ValidationError, AuthorizationError } from "./errors.js";
-import { RequiredToolsUnreachableError, API_CONTRACTS_ORDERED, HANDLER_CAPABILITY_MAP, CapabilityDeniedError, parseFormattedSessionKey, 
+import { classifyTypedRpcError, API_CONTRACTS_ORDERED, HANDLER_CAPABILITY_MAP, CapabilityDeniedError, parseFormattedSessionKey, 
 // Phase 217-05 (the keystone): the never-hang mode-aware deny decision.
 // resolveEffectiveMode = the EVICT-02 fail-closed primitive (Plan 01);
 // resolveAutonomy = the jail-leg server-side mode resolve (Plan 03); systemNowMs
@@ -122,39 +121,27 @@ const BINARY_PARAM_KEYS = ["source", "image", "video", "audio", "file"];
 /**
  * Classify an RPC error for structured logging.
  *
- * Accepts the raw error object (not just its message) so `instanceof`
- * checks against `PreconditionError` / `ValidationError` resolve. Returns
- * an ErrorKind, an actionable hint, AND a `level` (`"warn" | "error"`)
- * that the dispatcher uses to pick `logger.warn` vs `logger.error`. The
- * goal is to keep operator alerts meaningful: caller mistakes
- * (preconditions, validation) are warn-level via typed-class throws;
- * unmatched cases fall through to `error/internal`.
+ * Returns an ErrorKind, an actionable hint, AND a `level` (`"warn" | "error"`) that the
+ * dispatcher uses to pick `logger.warn` vs `logger.error`. The goal is to keep operator
+ * alerts meaningful: caller mistakes / policy / security refusals (`PreconditionError`,
+ * `ValidationError`, `AuthorizationError`, `RequiredToolsUnreachableError`,
+ * `SandboxDowngradeError`) are warn-level; unmatched cases fall through to `error/internal`.
  *
- * The legacy message-pattern (substring-match) fallbacks were deleted.
- * OBS-10 (reflect-obs-20260627): the admin-trust denials — every `throw new Error(
- * "Admin access required …")` across the ~26 control-plane handlers — were migrated to
- * `throw new AuthorizationError(...)`, so an operator's wrong-trust call classifies as
- * `auth`/`warn` instead of `internal`/`error` (it was reading as a fleet ERROR + tripping
- * operator alerts though the gate fired correctly). The remaining bare-Error handlers
- * ("immutable" preconditions, etc.) still classify as `internal`/`error` until migrated
- * to `PreconditionError`/`ValidationError` — that migration is incremental hardening. The
- * substring-fallback deletion is intentional; typed errors are the sanctioned path.
+ * The typed-refusal → kind/hint/level mapping lives in `@comis/core`
+ * ({@link classifyTypedRpcError}) as the SINGLE source of truth, because the SAME error is
+ * ALSO classified by the `@comis/gateway` method-router trace wrapper — which cannot
+ * `instanceof` these classes (dependency direction) and so keys off `Error.name`. Before
+ * that shared classifier the two layers drifted and the gateway kept logging intentional
+ * refusals as internal/ERROR after this layer was fixed (OBS-RPC-REFUSAL-CLASS,
+ * orchestration-excellence-20260701). **Add a new typed refusal in `@comis/core`, not
+ * here.** The legacy substring-match fallbacks remain deleted; typed errors are the
+ * sanctioned path (OBS-10: admin-trust denials throw `AuthorizationError`; bare-Error
+ * handlers still classify internal/error until migrated to a typed class).
  */
 export function classifyRpcError(err) {
-    // Typed errors: instanceof checks. Add new typed classes here as
-    // handlers migrate; do NOT re-introduce substring-match fallbacks.
-    if (err instanceof PreconditionError)
-        return { errorKind: "precondition", hint: "Caller precondition not met; check resource state before retry", level: "warn" };
-    if (err instanceof ValidationError)
-        return { errorKind: "validation", hint: "Check parameter types and values against the schema", level: "warn" };
-    // OBS-10 (reflect-obs-20260627): an admin-trust denial is an EXPECTED authorization refusal, not an
-    // internal/handler fault — warn/auth, so an operator's wrong-trust call doesn't read as a fleet ERROR.
-    if (err instanceof AuthorizationError)
-        return { errorKind: "auth", hint: "Caller lacks admin trust for this control-plane method; use an admin-scoped token or the documented operator route (e.g. `comis explain` assembles obs reports offline)", level: "warn" };
-    // RequiredToolsUnreachableError is a caller-side validation failure (caller passed
-    // invalid required_tools). Classify as validation/warn — NOT internal/error.
-    if (err instanceof RequiredToolsUnreachableError)
-        return { errorKind: "validation", hint: "Adjust required_tools and/or tool_groups per the per-tool hints in the error message", level: "warn" };
+    const typed = classifyTypedRpcError(err);
+    if (typed)
+        return typed;
     return { errorKind: "internal", hint: "Check the RPC method handler and its dependencies", level: "error" };
 }
 // ---------------------------------------------------------------------------

package/node_modules/@comis/daemon/dist/wiring/setup-gateway/setup-gateway-rpc.js

@@ -39,7 +39,8 @@ export function setupRpcBridge(deps) {
         }
         catch (err) {
             const errMsg = err instanceof Error ? err.message : String(err);
-            const classified = classifyRpcError(errMsg);
+            // Pass the error OBJECT (not err.message) so classifyRpcError's typed-refusal recognition resolves (OBS-RPC-REFUSAL-CLASS).
+            const classified = classifyRpcError(err);
             gatewayLogger.debug({
                 method,
                 err: errMsg,

package/node_modules/@comis/daemon/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@comis/daemon",
   "private": true,
-  "version": "1.0.44",
+  "version": "1.0.45",
   "author": "Moshe Anconina",
   "license": "Apache-2.0",
   "description": "Background daemon and orchestrator for the Comis platform",

package/node_modules/@comis/gateway/dist/rpc/method-router.js

@@ -1,6 +1,6 @@
 import { JSONRPCServer, JSONRPCErrorException } from "json-rpc-2.0";
 import { checkScope } from "../auth/token-auth.js";
-import { tryGetContext } from "@comis/core";
+import { classifyTypedRpcError, tryGetContext } from "@comis/core";
 /**
  * Map of method names to their required scope.
  */
@@ -45,6 +45,18 @@ export function createDynamicMethodRouter(initialMethods, logger) {
      * Classify an RPC method error for structured logging.
      */
     function classifyRpcMethodError(err) {
+        // OBS-RPC-REFUSAL-CLASS (orchestration-excellence-20260701): typed policy/security/
+        // validation refusals → non-internal (warn) via the SINGLE source of truth in
+        // `@comis/core`, which the daemon's `classifyRpcError` (rpc-dispatch.ts) ALSO delegates
+        // to. They reach this outer trace wrapper with their `Error.name` intact; this package
+        // cannot `instanceof` the daemon/@comis/agent error classes (dependency direction), and
+        // `classifyTypedRpcError` keys off that name — so the two log layers cannot drift (the
+        // drift is exactly what let this layer keep logging refusals as internal/ERROR after the
+        // dispatch layer was fixed). A refusal must NOT log error(50) — a health sweep counts it.
+        const typed = classifyTypedRpcError(err);
+        if (typed)
+            return { errorKind: typed.errorKind, hint: typed.hint };
+        // Unrecognized errors keep the gateway's own message-substring fallbacks, then internal.
         const msg = err instanceof Error ? err.message : String(err);
         const excerpt = msg.length > 120 ? msg.slice(0, 120) + "..." : msg;
         if (msg.includes("immutable"))

package/node_modules/@comis/gateway/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@comis/gateway",
   "private": true,
-  "version": "1.0.44",
+  "version": "1.0.45",
   "author": "Moshe Anconina",
   "license": "Apache-2.0",
   "description": "HTTP, JSON-RPC, and WebSocket gateway for Comis",

package/node_modules/@comis/infra/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@comis/infra",
   "private": true,
-  "version": "1.0.44",
+  "version": "1.0.45",
   "author": "Moshe Anconina",
   "license": "Apache-2.0",
   "description": "Structured logging infrastructure for Comis",

package/node_modules/@comis/memory/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@comis/memory",
   "private": true,
-  "version": "1.0.44",
+  "version": "1.0.45",
   "author": "Moshe Anconina",
   "license": "Apache-2.0",
   "description": "SQLite memory, embeddings, and RAG storage for Comis agents",

package/node_modules/@comis/observability/dist/trajectory/event-bus-bridge.d.ts

@@ -68,6 +68,7 @@ export declare const TRAJECTORY_BRIDGE_MAPPING: {
     readonly "subagent:steered": "subagent.steered";
     readonly "security:sandbox_downgrade_refused": "security.sandbox_downgrade_refused";
     readonly "subagent:delivery_deadlettered": "subagent.delivery_deadlettered";
+    readonly "subagent:delivery_retried": "subagent.delivery_retried";
     readonly "subagent:budget_exceeded": "subagent.budget_exceeded";
     readonly "capability:audited": "capability.audited";
     readonly "graph:node_spawned": "graph.node_spawned";

package/node_modules/@comis/observability/dist/trajectory/event-bus-bridge.js

@@ -150,6 +150,16 @@ export const TRAJECTORY_BRIDGE_MAPPING = {
     // the fleet lens via obs-persistence-wiring (the daemon-wide aggregate surface).
     "security:sandbox_downgrade_refused": "security.sandbox_downgrade_refused",
     "subagent:delivery_deadlettered": "subagent.delivery_deadlettered",
+    // OE-6b (orchestration-excellence-20260701-fullregression): the self-healing transient RETRY
+    // — the sibling of subagent:delivery_deadlettered. It was emitted by the announcement-batcher
+    // via `?.emit` (which the trajectory-event-types-known arch regex missed pre-fix), so it was
+    // bridged to NOTHING while its terminal sibling was fully wired — P0-B's self-heal was invisible
+    // to `comis explain` (spec §7/§10 + the "all 7 events bridged/surfaced" claim). Bridged here for
+    // per-session visibility (how many retries a completion took before landing). Content-free
+    // (translate-orchestration-payload.ts): runId + closed channelType + attempt count + transient tag
+    // ONLY. NOTE: unlike its deadlettered sibling, retried is trajectory-only for now (NOT yet a fleet
+    // health_signal/finding — a self-healed retry as a daemon-wide aggregate is a follow-up; §10).
+    "subagent:delivery_retried": "subagent.delivery_retried",
     "subagent:budget_exceeded": "subagent.budget_exceeded",
     // AUDIT-01 / TREE (v2.29 Phase 215 Plan 01): the per-capability authorization
     // decision for a gated call (allow + deny) — the spawn-tree's per-node

package/node_modules/@comis/observability/dist/trajectory/translate-orchestration-payload.d.ts

@@ -17,7 +17,7 @@
  * @module
  */
 /** The authoring / sub-agent orchestration EventBus event names the bridge maps. */
-export type OrchestrationBridgedEventName = "pipeline:authored" | "graph:repaired" | "graph:synthesized_from_intent" | "subagent:steered" | "security:sandbox_downgrade_refused" | "subagent:delivery_deadlettered" | "subagent:budget_exceeded" | "capability:audited" | "graph:node_spawned";
+export type OrchestrationBridgedEventName = "pipeline:authored" | "graph:repaired" | "graph:synthesized_from_intent" | "subagent:steered" | "security:sandbox_downgrade_refused" | "subagent:delivery_deadlettered" | "subagent:delivery_retried" | "subagent:budget_exceeded" | "capability:audited" | "graph:node_spawned";
 /**
  * Translate a v2.27 authoring / orchestration EventBus payload into the
  * content-free `data` of its trajectory event. The envelope keys are stripped

package/node_modules/@comis/observability/dist/trajectory/translate-orchestration-payload.js

@@ -47,6 +47,12 @@ export function translateOrchestrationPayload(eventName, payload) {
             // (retries-exhausted vs immediate-permanent) tag ONLY — NEVER the announcement body or
             // the error string (§2.7). timestamp envelope-only.
             return { runId: payload.runId, channelType: payload.channelType, transient: payload.transient };
+        case "subagent:delivery_retried":
+            // OE-6b (DELIVERY-03): the self-healing transient retry — run id + closed channelType +
+            // the 1-based attempt count + the transient tag ONLY (the `explain` view wants the attempt
+            // number so an operator can see HOW MANY retries a completion took before it landed) —
+            // NEVER the announcement body or the error string (§2.7). timestamp envelope-only.
+            return { runId: payload.runId, channelType: payload.channelType, attempt: payload.attempt, transient: payload.transient };
         case "subagent:budget_exceeded":
             // ORCH-OBS (BUDGET-03): the per-incident breach view for `comis explain` — graphId/
             // nodeId ids + the closed capSource + the two token NUMBERS (counts, §2.7-safe; the

package/node_modules/@comis/observability/dist/trajectory/translate-payload.js

@@ -274,6 +274,7 @@ export function translatePayload(eventName, rawPayload) {
         case "subagent:steered":
         case "security:sandbox_downgrade_refused":
         case "subagent:delivery_deadlettered":
+        case "subagent:delivery_retried": // OE-6b: the self-healing transient retry (sibling of delivery_deadlettered) — content-free {runId, channelType, attempt, transient}
         case "subagent:budget_exceeded":
         case "capability:audited":
         case "graph:node_spawned":

package/node_modules/@comis/observability/dist/trajectory/types.d.ts

@@ -33,7 +33,7 @@ import type { ComisLogger } from "@comis/core";
  * skill → memory → delivery → lifecycle envelopes → control-plane sentinel).
  * Append-only — insertion order is part of the SemVer contract for v1.
  */
-export declare const TRAJECTORY_EVENT_TYPES: readonly ["session.started", "session.ended", "session.summary", "context.compiled", "prompt.submitted", "model.completed", "model.fallback_attempt", "model.fallback_exhausted", "model.auth_cooldown", "tool.call", "tool.result", "tool.timeout", "tool.policy_filtered", "tool.breaker_opened", "tool.breaker_reset", "tool.result_offloaded", "skill.prompt_loaded", "skill.prompt_invoked", "memory.skill_used", "memory.skill_surfaced", "memory.injected", "memory.recalled", "memory.reranked", "memory.generation_quality", "cache.break", "learning.outcome_observed", "learning.memory_demoted", "learning.memory_evicted", "learning.memory_failure_attributed", "reflect.admitted", "reflect.funnel", "learning.skill_promoted", "learning.skill_demoted", "pipeline.authored", "graph.repaired", "graph.synthesized_from_intent", "subagent.steered", "security.sandbox_downgrade_refused", "subagent.delivery_deadlettered", "subagent.budget_exceeded", "capability.audited", "graph.node_spawned", "background_task.promoted", "background_task.completed", "background_task.failed", "terminal.drive_promoted", "delivery.queued", "delivery.dispatched", "trace.metadata", "trace.artifacts", "trace.truncated", "trace.write_failures", "queue.enqueued", "queue.dequeued", "queue.overflow", "queue.coalesced", "execution.aborted", "execution.budget_warning", "execution.prompt_timeout", "execution.output_escalated", "execution.replay_recovered", "execution.tool_schema_unsupported", "security.injection_detected", "sender.blocked", "delivery.retry", "delivery.retry_exhausted", "delivery.markdown_fallback", "mcp.disconnected", "mcp.reconnecting", "mcp.reconnect_failed", "mcp.reconnected", "mcp.tools_changed", "channel.health_changed", "channel.lifecycle", "security.memory_tainted", "security.warn", "compaction.started", "compaction.flush", "compaction.recommended", "context.budget", "context.evicted", "context.masked", "context.reread", "context.overflow", "context.integrity", "context.rehydrated", "context.script_zero_hit", "context.summary_language_mismatch", "approval.requested", "approval.resolved", "dedup.duplicate_inbound", "health.budget_exceeded", "session.transcript.entry", "image.requested", "image.generated", "image.delivered", "image.failed", "media.vision.requested", "media.vision.completed", "media.vision.failed", "video.requested", "video.submitted", "video.generated", "video.delivered", "video.failed", "media.stt.requested", "media.stt.completed", "media.stt.failed", "media.tts.requested", "media.tts.completed", "media.tts.failed", "spend.warning", "spend.exceeded", "spend.unpriceable"];
+export declare const TRAJECTORY_EVENT_TYPES: readonly ["session.started", "session.ended", "session.summary", "context.compiled", "prompt.submitted", "model.completed", "model.fallback_attempt", "model.fallback_exhausted", "model.auth_cooldown", "tool.call", "tool.result", "tool.timeout", "tool.policy_filtered", "tool.breaker_opened", "tool.breaker_reset", "tool.result_offloaded", "skill.prompt_loaded", "skill.prompt_invoked", "memory.skill_used", "memory.skill_surfaced", "memory.injected", "memory.recalled", "memory.reranked", "memory.generation_quality", "cache.break", "learning.outcome_observed", "learning.memory_demoted", "learning.memory_evicted", "learning.memory_failure_attributed", "reflect.admitted", "reflect.funnel", "learning.skill_promoted", "learning.skill_demoted", "pipeline.authored", "graph.repaired", "graph.synthesized_from_intent", "subagent.steered", "security.sandbox_downgrade_refused", "subagent.delivery_deadlettered", "subagent.delivery_retried", "subagent.budget_exceeded", "capability.audited", "graph.node_spawned", "background_task.promoted", "background_task.completed", "background_task.failed", "terminal.drive_promoted", "delivery.queued", "delivery.dispatched", "trace.metadata", "trace.artifacts", "trace.truncated", "trace.write_failures", "queue.enqueued", "queue.dequeued", "queue.overflow", "queue.coalesced", "execution.aborted", "execution.budget_warning", "execution.prompt_timeout", "execution.output_escalated", "execution.replay_recovered", "execution.tool_schema_unsupported", "security.injection_detected", "sender.blocked", "delivery.retry", "delivery.retry_exhausted", "delivery.markdown_fallback", "mcp.disconnected", "mcp.reconnecting", "mcp.reconnect_failed", "mcp.reconnected", "mcp.tools_changed", "channel.health_changed", "channel.lifecycle", "security.memory_tainted", "security.warn", "compaction.started", "compaction.flush", "compaction.recommended", "context.budget", "context.evicted", "context.masked", "context.reread", "context.overflow", "context.integrity", "context.rehydrated", "context.script_zero_hit", "context.summary_language_mismatch", "approval.requested", "approval.resolved", "dedup.duplicate_inbound", "health.budget_exceeded", "session.transcript.entry", "image.requested", "image.generated", "image.delivered", "image.failed", "media.vision.requested", "media.vision.completed", "media.vision.failed", "video.requested", "video.submitted", "video.generated", "video.delivered", "video.failed", "media.stt.requested", "media.stt.completed", "media.stt.failed", "media.tts.requested", "media.tts.completed", "media.tts.failed", "spend.warning", "spend.exceeded", "spend.unpriceable"];
 /** Closed union of trajectory event type strings. */
 export type TrajectoryEventType = (typeof TRAJECTORY_EVENT_TYPES)[number];
 /**

package/node_modules/@comis/observability/dist/trajectory/types.js

@@ -138,6 +138,13 @@ export const TRAJECTORY_EVENT_TYPES = [
     // landing); the other two ride whichever session bridge is active when they fire.
     "security.sandbox_downgrade_refused",
     "subagent.delivery_deadlettered",
+    // OE-6b (orchestration-excellence-20260701-fullregression): the self-healing transient
+    // RETRY — the sibling of subagent.delivery_deadlettered. Emitted by the announcement-batcher
+    // via `?.emit` (which the trajectory-event-types-known arch regex missed pre-fix), so it was
+    // bridged to NOTHING while its terminal sibling was fully wired — P0-B's self-heal was invisible
+    // to `comis explain` (spec §7/§10 + the "all 7 bridged" claim). Content-free: runId + closed
+    // channelType + attempt count + the transient tag ONLY — never an announcement body / error string.
+    "subagent.delivery_retried",
     "subagent.budget_exceeded",
     // AUDIT-01 / TREE (v2.29 Phase 215 Plan 01): the per-capability authorization
     // decision for a gated call — the spawn-tree's per-node producer (Plan 03's

package/node_modules/@comis/observability/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@comis/observability",
   "private": true,
-  "version": "1.0.44",
+  "version": "1.0.45",
   "author": "Moshe Anconina",
   "license": "Apache-2.0",
   "description": "Observability substrate (queued writer, payload bounding, sanitization, path guards) for Comis diagnostics artifacts",