comisai 1.0.44 → 1.0.46

package/node_modules/@comis/core/dist/ports/session-store-types.d.ts

@@ -1,9 +1,9 @@
 /**
  * Row DTOs for SessionStorePort. Type-only.
  *
- * memory's session-store.ts no longer declares these directly;
+ * memory's session-store.ts does not declare these directly;
  * memory/src/index.ts re-exports them from "@comis/core" so daemon's
- * value-imports (`from "@comis/memory"`) continue to resolve.
+ * value-imports (`from "@comis/memory"`) resolve.
  *
  * These stay in core/src/ports/ (NOT core/src/domain/) to preserve the
  * domain/persistence boundary — they are raw row shapes, NOT domain

package/node_modules/@comis/core/dist/ports/session-store-types.js

@@ -2,9 +2,9 @@
 /**
  * Row DTOs for SessionStorePort. Type-only.
  *
- * memory's session-store.ts no longer declares these directly;
+ * memory's session-store.ts does not declare these directly;
  * memory/src/index.ts re-exports them from "@comis/core" so daemon's
- * value-imports (`from "@comis/memory"`) continue to resolve.
+ * value-imports (`from "@comis/memory"`) resolve.
  *
  * These stay in core/src/ports/ (NOT core/src/domain/) to preserve the
  * domain/persistence boundary — they are raw row shapes, NOT domain

package/node_modules/@comis/core/dist/ports/session-store.d.ts

@@ -2,8 +2,8 @@
  * SessionStorePort: hexagonal architecture boundary for session persistence.
  *
  * Type-only mirror of @comis/memory's SessionStore. The declaration covers
- * every public method memory's SessionStore exposes, so memory's
- * createSessionStore return-type swap is a pure rename.
+ * every public method memory's SessionStore exposes, so the two types stay
+ * interchangeable.
  *
  * Row DTOs (SessionData, SessionListEntry, SessionDetailedEntry) live in
  * core/src/ports/session-store-types.ts.
@@ -27,7 +27,7 @@ import type { SessionData, SessionListEntry, SessionDetailedEntry } from "./sess
  *   - Mutation        (2 methods: delete, deleteStale)
  *
  * Total: 7 methods. The structural shape MUST match memory's interface
- * exactly so the retarget is a pure name swap.
+ * exactly so the port and the implementation stay interchangeable.
  */
 export interface SessionStorePort {
     save(key: SessionKey, messages: unknown[], metadata?: Record<string, unknown>): void;

package/node_modules/@comis/core/dist/ports/session-store.js

@@ -3,8 +3,8 @@
  * SessionStorePort: hexagonal architecture boundary for session persistence.
  *
  * Type-only mirror of @comis/memory's SessionStore. The declaration covers
- * every public method memory's SessionStore exposes, so memory's
- * createSessionStore return-type swap is a pure rename.
+ * every public method memory's SessionStore exposes, so the two types stay
+ * interchangeable.
  *
  * Row DTOs (SessionData, SessionListEntry, SessionDetailedEntry) live in
  * core/src/ports/session-store-types.ts.

package/node_modules/@comis/core/dist/ports/tool-capability.d.ts

@@ -47,7 +47,7 @@ export interface PromptSkillCapability {
     readonly replacesPackages: readonly string[];
     /**
      * Where the skill was discovered from. Mirrors `@comis/skills` `SkillSource`:
-     * "learned" is the verified-learning procedural source (v2.26), set
+     * "learned" is the verified-learning procedural source, set
      * explicitly by the daemon merge helper (never model-asserted).
      */
     readonly source?: "bundled" | "workspace" | "local" | "learned";

package/node_modules/@comis/core/dist/ports/triple-store.d.ts

@@ -9,8 +9,8 @@ import type { LearningScope } from "./outcome-signal-port.js";
  * versions of a (subject, predicate) coexist) and a single CURRENT truth per
  * (tenant, agent, subject, predicate).
  *
- * This is a NEW port — like MemoryCausalStore / MemoryEntityStore /
- * MemoryTemporalStore it deliberately does NOT widen the security-reviewed
+ * Like MemoryCausalStore / MemoryEntityStore /
+ * MemoryTemporalStore, this port deliberately does NOT widen the security-reviewed
  * `MemoryPort` (store/search/delete). New capabilities arrive as their own
  * segregated port. The sole adapter is in @comis/memory (it owns the `db` handle
  * and runs all SQL over the additive `memory_triples` table); the agent-side
@@ -28,15 +28,15 @@ import type { LearningScope } from "./outcome-signal-port.js";
  * no zod, no @comis/memory import.
  */
 /**
- * The isolation boundary for every triple operation (the §5.2 entity-scoping
+ * The isolation boundary for every triple operation (the entity-scoping
  * pattern). Every adapter statement — INSERT, UPDATE, SELECT, AND the
  * recursive-CTE walk's JOIN — filters on `(tenantId, agentId)`. This is a
  * load-bearing SECURITY scope in a multi-agent DB, not a nicety: a triple
  * written under one (tenant, agent) must NEVER be returned for another scope by
  * subject/object-string coincidence.
  *
- * SIMPLIFY-02: UNIFIED onto the canonical {@link LearningScope} — the isolation
- * fields are NOT re-declared (the 15× per-port repetition the collapse kills).
+ * UNIFIED onto the canonical {@link LearningScope} — the isolation
+ * fields are NOT re-declared (avoiding a per-port repetition of the same pair).
  * A thin alias that DERIVES `tenantId`/`agentId` from `LearningScope` and
  * re-narrows the injected clock `now` to REQUIRED (the `upsertTriple` write
  * path). The KG recall lane (`spreadLane`, the live graphSpread consumer) reads

package/node_modules/@comis/core/dist/provider/keyless-providers.d.ts

@@ -5,9 +5,9 @@
  * and @comis/daemon (credential-resolver). Canonical set = {ollama, lm-studio}.
  *
  * Rationale: lm-studio, like ollama, is a local inference server that does not
- * require authentication by default. The agent-side Set previously contained only
- * "ollama" — a divergence from the daemon (which correctly included lm-studio).
- * This constant closes that divergence.
+ * require authentication by default. Sharing one constant keeps the agent- and
+ * daemon-side sets from diverging (a per-package copy could drop a member on
+ * one side only).
  *
  * @module
  */

package/node_modules/@comis/core/dist/provider/keyless-providers.js

@@ -6,9 +6,9 @@
  * and @comis/daemon (credential-resolver). Canonical set = {ollama, lm-studio}.
  *
  * Rationale: lm-studio, like ollama, is a local inference server that does not
- * require authentication by default. The agent-side Set previously contained only
- * "ollama" — a divergence from the daemon (which correctly included lm-studio).
- * This constant closes that divergence.
+ * require authentication by default. Sharing one constant keeps the agent- and
+ * daemon-side sets from diverging (a per-package copy could drop a member on
+ * one side only).
  *
  * @module
  */

package/node_modules/@comis/core/dist/reflection/delta-ops.d.ts

@@ -1,6 +1,6 @@
 /**
- * Reflection delta-ops APPLY — the v2.31 Reflection engine's byte-stable
- * doc-refresh primitive (REFLECT-04, Hindsight's drift-killer). The runtime
+ * Reflection delta-ops APPLY — the Reflection engine's byte-stable
+ * doc-refresh primitive (the drift-killer). The runtime
  * counterpart to the type-only `../ports/reflection-port.ts` (the runtime values
  * live HERE because `core/src/ports/*.ts` is type-only by the port-shape rule —
  * the no-op-factory / `profile-id` precedent). Re-exported on the public
@@ -12,7 +12,7 @@
  * reference** — the same object survives into the result. Reference identity IS
  * the byte-identity guarantee: an untouched section is never re-serialized, so a
  * one-section refresh produces a one-section diff and the slow drift a
- * full-rewrite causes (Hindsight's failure mode) cannot happen. The function is
+ * full-rewrite causes cannot happen. The function is
  * PURE (no IO, no clock, no randomness) and TOTAL (an op whose target id does not
  * exist is a no-op for that op — never a throw, never a doc-corruption), and it
  * never mutates `prev`.
@@ -27,7 +27,7 @@ import type { StructuredBody, DeltaOp } from "../ports/reflection-port.js";
 /**
  * Apply a list of {@link DeltaOp}s to a structured body, returning the NEXT body.
  *
- * THE DRIFT-KILLER (REFLECT-04): every section NOT targeted by an op is copied
+ * THE DRIFT-KILLER: every section NOT targeted by an op is copied
  * **by reference** — `result.sections[i] === prev.sections[i]` for an untouched
  * section. Only an `add`'s/`replace`'s `section` object is new. Pure (never
  * mutates `prev`), total (a target id that does not exist is a no-op for that op,

package/node_modules/@comis/core/dist/reflection/delta-ops.js

@@ -1,7 +1,7 @@
 // SPDX-License-Identifier: Apache-2.0
 /**
- * Reflection delta-ops APPLY — the v2.31 Reflection engine's byte-stable
- * doc-refresh primitive (REFLECT-04, Hindsight's drift-killer). The runtime
+ * Reflection delta-ops APPLY — the Reflection engine's byte-stable
+ * doc-refresh primitive (the drift-killer). The runtime
  * counterpart to the type-only `../ports/reflection-port.ts` (the runtime values
  * live HERE because `core/src/ports/*.ts` is type-only by the port-shape rule —
  * the no-op-factory / `profile-id` precedent). Re-exported on the public
@@ -13,7 +13,7 @@
  * reference** — the same object survives into the result. Reference identity IS
  * the byte-identity guarantee: an untouched section is never re-serialized, so a
  * one-section refresh produces a one-section diff and the slow drift a
- * full-rewrite causes (Hindsight's failure mode) cannot happen. The function is
+ * full-rewrite causes cannot happen. The function is
  * PURE (no IO, no clock, no randomness) and TOTAL (an op whose target id does not
  * exist is a no-op for that op — never a throw, never a doc-corruption), and it
  * never mutates `prev`.
@@ -27,7 +27,7 @@
 /**
  * Apply a list of {@link DeltaOp}s to a structured body, returning the NEXT body.
  *
- * THE DRIFT-KILLER (REFLECT-04): every section NOT targeted by an op is copied
+ * THE DRIFT-KILLER: every section NOT targeted by an op is copied
  * **by reference** — `result.sections[i] === prev.sections[i]` for an untouched
  * section. Only an `add`'s/`replace`'s `section` object is new. Pure (never
  * mutates `prev`), total (a target id that does not exist is a no-op for that op,

package/node_modules/@comis/core/dist/runtime/file-lock.d.ts

@@ -9,9 +9,9 @@
  * for non-scheduler consumers (CLI, agent OAuth call sites, agent
  * session-write-lock).
  *
- * The `withExecutionLock` + `isLocked` named-export helpers below are the
- * legacy direct-call surface; they have no in-repo consumer from @comis/core
- * (the scheduler-side caller `cron-store.ts` still imports them from its
+ * The `withExecutionLock` + `isLocked` named-export helpers below are a
+ * direct-call surface with no in-repo consumer from @comis/core
+ * (the scheduler-side caller `cron-store.ts` imports them from its
  * own `../execution/execution-lock.js`).
  */
 import type { Result } from "@comis/shared";

package/node_modules/@comis/core/dist/runtime/file-lock.js

@@ -10,9 +10,9 @@
  * for non-scheduler consumers (CLI, agent OAuth call sites, agent
  * session-write-lock).
  *
- * The `withExecutionLock` + `isLocked` named-export helpers below are the
- * legacy direct-call surface; they have no in-repo consumer from @comis/core
- * (the scheduler-side caller `cron-store.ts` still imports them from its
+ * The `withExecutionLock` + `isLocked` named-export helpers below are a
+ * direct-call surface with no in-repo consumer from @comis/core
+ * (the scheduler-side caller `cron-store.ts` imports them from its
  * own `../execution/execution-lock.js`).
  */
 import { ok, err } from "@comis/shared";

package/node_modules/@comis/core/dist/runtime/is-remote-env.d.ts

@@ -10,6 +10,8 @@
  * so operators can override the heuristic when it guesses wrong (e.g. tmux
  * over SSH where DISPLAY is set by tunneling but they still want manual paste).
  *
+ * Derived from third-party code; see NOTICE.
+ *
  * @module
  */
 /** Input shape for isRemoteEnvironment. Pure: no process.env reads internally. */
@@ -22,8 +24,8 @@ export interface IsRemoteEnvironmentInput {
 /**
  * Decide whether to skip browser-open and go straight to manual-paste.
  *
- * Heuristic (simplified from OpenClaw's remote-env.ts — no WAYLAND_DISPLAY,
- * no isWSLEnv check; Comis is Linux-only per CLAUDE.md):
+ * Heuristic (deliberately minimal — no WAYLAND_DISPLAY and no WSL check;
+ * Comis is Linux-only per CLAUDE.md):
  *   - force === "remote" → true
  *   - force === "local"  → false
  *   - SSH_CLIENT or SSH_TTY present → true

package/node_modules/@comis/core/dist/runtime/is-remote-env.js

@@ -11,13 +11,15 @@
  * so operators can override the heuristic when it guesses wrong (e.g. tmux
  * over SSH where DISPLAY is set by tunneling but they still want manual paste).
  *
+ * Derived from third-party code; see NOTICE.
+ *
  * @module
  */
 /**
  * Decide whether to skip browser-open and go straight to manual-paste.
  *
- * Heuristic (simplified from OpenClaw's remote-env.ts — no WAYLAND_DISPLAY,
- * no isWSLEnv check; Comis is Linux-only per CLAUDE.md):
+ * Heuristic (deliberately minimal — no WAYLAND_DISPLAY and no WSL check;
+ * Comis is Linux-only per CLAUDE.md):
  *   - force === "remote" → true
  *   - force === "local"  → false
  *   - SSH_CLIENT or SSH_TTY present → true

package/node_modules/@comis/core/dist/runtime/poll-deadline.d.ts

@@ -26,7 +26,7 @@ export type PollOutcome<S> = {
 };
 /**
  * Bounded poll loop. Calls `poll()` until `isDone(status)` (→ done),
- * `isFailed(status)` (→ failed short-circuit, VPORT-02), or the deadline
+ * `isFailed(status)` (→ failed short-circuit — no further polls), or the deadline
  * (→ timeout). Sleeps `pollIntervalMs` (clamped to the remaining budget) between
  * attempts. Inject `nowMs` (via the `deadline`) and `sleep` for fake-timer
  * tests. Honors `signal?.aborted` (returns `timeout` so the caller surfaces a

package/node_modules/@comis/core/dist/runtime/poll-deadline.js

@@ -1,9 +1,9 @@
 // SPDX-License-Identifier: Apache-2.0
 /**
- * Shared bounded-poll helper (DIVERGENCE 5).
+ * Shared bounded-poll helper.
  *
  * There is no other bounded-poll utility in the repo. It is authored in
- * `@comis/core/runtime` — NOT in `@comis/skills` — so Phase 189's daemon
+ * `@comis/core/runtime` — NOT in `@comis/skills` — so the daemon's
  * background poller imports it without a package-boundary violation (it needs
  * the SAME loop the inline `execute()` baseline uses, byte-for-byte). The
  * `@comis/skills` FAL adapter consumes it in `execute()`.
@@ -16,7 +16,8 @@
  * The helper is deliberately PROVIDER-AGNOSTIC: it returns a `PollOutcome`
  * discriminator (`done` / `failed` / `timeout`) and constructs no domain error.
  * The FAL adapter maps `{ kind: "timeout" }` onto a `VideoErrorKind:"job_timeout"`
- * Result carrying the loggable jobId — keeping this loop reusable by Phase 189.
+ * Result carrying the loggable jobId — keeping this loop reusable by the
+ * daemon's background poller.
  *
  * @module
  */
@@ -34,7 +35,7 @@ export function createPollDeadline(timeoutMs, nowMs = systemNowMs) {
 }
 /**
  * Bounded poll loop. Calls `poll()` until `isDone(status)` (→ done),
- * `isFailed(status)` (→ failed short-circuit, VPORT-02), or the deadline
+ * `isFailed(status)` (→ failed short-circuit — no further polls), or the deadline
  * (→ timeout). Sleeps `pollIntervalMs` (clamped to the remaining budget) between
  * attempts. Inject `nowMs` (via the `deadline`) and `sleep` for fake-timer
  * tests. Honors `signal?.aborted` (returns `timeout` so the caller surfaces a

package/node_modules/@comis/core/dist/security/audit.d.ts

@@ -1,15 +1,15 @@
 import { z } from "zod";
 import type { ActionClassification } from "./action-classifier.js";
 /**
- * Audit event KIND — the closed event-family discriminator (AUDIT-03 / E4).
+ * Audit event KIND — the closed event-family discriminator.
  *
- * The original schema conflated two concepts into one required
- * `classification` enum (`read|mutate|destructive`). Live emit sites were
- * passing values OUTSIDE that enum (`"security"`/`"write"`/`"neutral"`),
- * silently violating it because the event-bus payload types
- * `classification` as a loose `string`. E4 splits the event FAMILY (`kind`,
- * required, closed) from the access-class (`classification`, optional,
- * present only when meaningful — chiefly the generic `audit` kind).
+ * The event FAMILY (`kind`, required, closed) is deliberately split from the
+ * access-class (`classification`, optional, present only when meaningful —
+ * chiefly the generic `audit` kind). Conflating the two into one required
+ * `classification` enum (`read|mutate|destructive`) forces emit sites to pass
+ * values OUTSIDE that enum (`"security"`/`"write"`/`"neutral"`) — a silent
+ * violation, because the event-bus payload types `classification` as a loose
+ * `string`.
  *
  * Closed string-literal union (AGENTS §2.8) — NEVER `kind: string`. Adding a
  * member here without handling it in {@link kindIsSecuritySignal} fails the
@@ -77,8 +77,8 @@ export type AuditEvent = z.infer<typeof AuditEventSchema>;
  * Parameters for creating an audit event.
  * The id and timestamp are auto-generated; everything else must be provided.
  *
- * `kind` (the event family) is required; `classification` is optional (E4 —
- * present only when the access-class is meaningful).
+ * `kind` (the event family) is required; `classification` is optional
+ * (present only when the access-class is meaningful).
  */
 export interface CreateAuditEventParams {
     tenantId: string;
@@ -97,8 +97,8 @@ export interface CreateAuditEventParams {
  *
  * This is the SOLE constructor for an {@link AuditEvent} — every emit site
  * routes through it so every event is schema-valid before it can be
- * persisted (Plan 03's sink). `classification` is only included when
- * provided (E4 — the schema makes it optional).
+ * persisted by the audit sink. `classification` is only included when
+ * provided (the schema makes it optional).
  *
  * @param params - Event parameters (id and timestamp are auto-generated)
  * @returns A validated AuditEvent

package/node_modules/@comis/core/dist/security/audit.js

@@ -3,15 +3,15 @@ import { randomUUID } from "node:crypto";
 import { z } from "zod";
 import { systemNowDate } from "../runtime/system-time.js";
 /**
- * Audit event KIND — the closed event-family discriminator (AUDIT-03 / E4).
+ * Audit event KIND — the closed event-family discriminator.
  *
- * The original schema conflated two concepts into one required
- * `classification` enum (`read|mutate|destructive`). Live emit sites were
- * passing values OUTSIDE that enum (`"security"`/`"write"`/`"neutral"`),
- * silently violating it because the event-bus payload types
- * `classification` as a loose `string`. E4 splits the event FAMILY (`kind`,
- * required, closed) from the access-class (`classification`, optional,
- * present only when meaningful — chiefly the generic `audit` kind).
+ * The event FAMILY (`kind`, required, closed) is deliberately split from the
+ * access-class (`classification`, optional, present only when meaningful —
+ * chiefly the generic `audit` kind). Conflating the two into one required
+ * `classification` enum (`read|mutate|destructive`) forces emit sites to pass
+ * values OUTSIDE that enum (`"security"`/`"write"`/`"neutral"`) — a silent
+ * violation, because the event-bus payload types `classification` as a loose
+ * `string`.
  *
  * Closed string-literal union (AGENTS §2.8) — NEVER `kind: string`. Adding a
  * member here without handling it in {@link kindIsSecuritySignal} fails the
@@ -43,10 +43,10 @@ export const AUDIT_KINDS = [
     /** A sandbox downgrade was refused (fail-closed) — sandbox governance. */
     "sandbox_downgrade_refused",
     /** A capability or deny-by-origin gate rejected a call — capability.ts /
-     *  assert-not-agent-origin (Phase 210). */
+     *  assert-not-agent-origin. */
     "capability_denied",
     /** An outbound URL was blocked by the SSRF guard (validateUrl) — metadata IP /
-     *  RFC1918 / loopback / non-http target. hermes-usecases obs-loop 2026-06-25. */
+     *  RFC1918 / loopback / non-http target. */
     "ssrf_blocked",
 ];
 /**
@@ -104,7 +104,7 @@ export const AuditEventSchema = z.strictObject({
     /** Event family (closed union — the single source is AUDIT_KINDS). */
     kind: z.enum(AUDIT_KINDS),
     /**
-     * Risk classification of the action — OPTIONAL (E4). Present only when
+     * Risk classification of the action — OPTIONAL. Present only when
      * meaningful (chiefly the generic `audit` kind); security-signal kinds
      * leave it unset.
      */
@@ -123,8 +123,8 @@ export const AuditEventSchema = z.strictObject({
  *
  * This is the SOLE constructor for an {@link AuditEvent} — every emit site
  * routes through it so every event is schema-valid before it can be
- * persisted (Plan 03's sink). `classification` is only included when
- * provided (E4 — the schema makes it optional).
+ * persisted by the audit sink. `classification` is only included when
+ * provided (the schema makes it optional).
  *
  * @param params - Event parameters (id and timestamp are auto-generated)
  * @returns A validated AuditEvent
@@ -138,7 +138,7 @@ export function createAuditEvent(params) {
         userId: params.userId,
         actionType: params.actionType,
         kind: params.kind,
-        // Only carry classification when meaningful (E4 — present chiefly for
+        // Only carry classification when meaningful (present chiefly for
         // the generic `audit` kind; security-signal kinds leave it unset).
         ...(params.classification !== undefined ? { classification: params.classification } : {}),
         outcome: params.outcome,

package/node_modules/@comis/core/dist/security/bind-mount-validator.js

@@ -2,8 +2,8 @@
 import * as fs from "node:fs";
 import * as path from "node:path";
 /**
- * JAIL-03 bind-mount validator — a PURE denylist backstop on top of the
- * allow-list jail binds (v8 invariant 10: the validator does NOT decide what to
+ * Bind-mount validator — a PURE denylist backstop on top of the
+ * allow-list jail binds (the validator does NOT decide what to
  * bind, it only refuses dangerous binds).
  *
  * It rejects three classic jail-escape shapes (escapes are symlink/parent-mount,

package/node_modules/@comis/core/dist/security/callback-signing.d.ts

@@ -1,7 +1,7 @@
 import { type Result } from "@comis/shared";
 /** The closed set of approval choices a callback may carry. */
 export type CallbackChoice = "approve" | "deny" | "details";
-/** Fallible render outcomes (closed union per §6.4.4). */
+/** Fallible render outcomes (closed union). */
 export type CallbackRenderError = {
     kind: "invalid_choice";
 } | {

package/node_modules/@comis/core/dist/security/callback-signing.js

@@ -4,7 +4,7 @@ import { err, ok } from "@comis/shared";
 /**
  * Signed interactive-approval callback primitive.
  *
- * Wire format (spec §6.4.2): `v1.<choice>.<shortId>.<hmac>` where
+ * Wire format: `v1.<choice>.<shortId>.<hmac>` where
  * - `choice` ∈ {approve|deny|details}
  * - `shortId` = 12 base62 chars (minted by `mintApprovalShortId`)
  * - `hmac` = first 16 base64url chars of `HMAC-SHA256(secret, "<choice>.<shortId>")`
@@ -12,7 +12,7 @@ import { err, ok } from "@comis/shared";
  * The HMAC is computed over `(choice, shortId)` ONLY — never `sessionKey`. The
  * verifier has the choice and shortId from the wire string and the secret from
  * the daemon, so it can recompute and compare; signing the (un-transmitted)
- * sessionKey would make verification impossible (§6.4 reviewer finding).
+ * sessionKey would make verification impossible.
  *
  * Worst case `v1.approve.<12>.<16>` = 40 bytes, under the 64-byte Telegram
  * callback_data budget.

package/node_modules/@comis/core/dist/security/capability.d.ts

@@ -1,5 +1,5 @@
 /**
- * Agent orchestration-capability primitive (CAP-01 / CAP-02 / CAP-05).
+ * Agent orchestration-capability primitive.
  *
  * The single authority predicate for the in-process agent loop — an
  * orthogonal axis to the gateway's `Scope` (`api-contracts/types.ts:19`). The
@@ -12,9 +12,9 @@
  *   1. NO wildcard branch. `checkScope` has a `*`-implies-all rule;
  *      `checkCapability` is a plain membership test. With no lattice and no
  *      catch-all, least-privilege holds by construction — no member can imply
- *      `admin`/`rpc`/all (CAP-02). Copying `checkScope` verbatim would FAIL the
+ *      `admin`/`rpc`/all. Copying `checkScope` verbatim would FAIL the
  *      `capability-scope-disjoint.test.ts` arch-test.
- *   2. The union is DISJOINT from `Scope` (CAP-01) — capabilities are
+ *   2. The union is DISJOINT from `Scope` — capabilities are
  *      `orch:*`, scopes are `rpc|admin|mcp-client`; the arch-test asserts the
  *      intersection is empty.
  *
@@ -35,22 +35,22 @@
  * @module
  */
 /**
- * Closed orchestration-capability union (v8 §3.3/§3.8). Each member gates one
+ * Closed orchestration-capability union. Each member gates one
  * orchestration surface. `orch:browse` is part of the UNION but is OFF in every
- * default profile (Plan 02 owns the profile defaults — the union must still
+ * default profile (the profile defaults live elsewhere — the union must still
  * contain it so the type is total).
  *
  * Closed string-literal tuple (AGENTS §2.8): `AGENT_CAPABILITIES` is the single
  * source of truth; `AgentCapability` is inferred from it so the runtime list and
  * the static type can never drift.
  */
-export declare const AGENT_CAPABILITIES: readonly ["orch:spawn", "orch:graph", "orch:cron", "orch:message", "orch:skill", "orch:read", "orch:web", "orch:analyze", "orch:write", "orch:browse"];
+export declare const AGENT_CAPABILITIES: readonly ["orch:spawn", "orch:graph", "orch:cron", "orch:message", "orch:skill", "orch:read", "orch:web", "orch:analyze", "orch:write", "orch:browse", "orch:mcp"];
 /** The closed orchestration-capability union (inferred from {@link AGENT_CAPABILITIES}). */
 export type AgentCapability = (typeof AGENT_CAPABILITIES)[number];
 /**
  * Pure capability predicate — a plain membership test with NO wildcard branch.
  *
- * CRITICAL (CAP-02): unlike `checkScope`'s asterisk-implies-all rule, there is
+ * CRITICAL: unlike `checkScope`'s asterisk-implies-all rule, there is
  * no lattice and no catch-all here. A held set is exactly the caps it lists; no
  * entry (an asterisk string included) confers any other cap. That is what makes
  * least-privilege hold by construction.
@@ -58,14 +58,14 @@ export type AgentCapability = (typeof AGENT_CAPABILITIES)[number];
 export declare function checkCapability(held: readonly string[], required: AgentCapability): boolean;
 /**
  * Mint attenuation — the single trust boundary against capability broadening
- * down a delegation tree (LEASE-04, v8 §4.2). Pure set-intersection: the result
+ * down a delegation tree. Pure set-intersection: the result
  * is exactly `parent ∩ requested`, so a child lease can NEVER hold a cap the
  * parent does not, and never a cap that was not requested. This is the only
  * broadening-prevention an opaque lease has, which is why it is property/fuzz-
  * tested over 1000+ random (parent, requested) pairs rather than by example.
  *
  * Same discipline as {@link checkCapability}: a plain membership filter with NO
- * wildcard branch (CAP-02) — no member implies admin/rpc/all-authority. The
+ * wildcard branch — no member implies admin/rpc/all-authority. The
  * requested order is preserved on the surviving subset.
  */
 export declare function attenuateCaps(parent: readonly AgentCapability[], requested: readonly AgentCapability[]): AgentCapability[];
@@ -83,7 +83,7 @@ export declare class CapabilityDeniedError extends Error {
     constructor(required: AgentCapability);
 }
 /**
- * Handler-boundary capability gate (v8 §3.7 — the single gate). Throws
+ * Handler-boundary capability gate (the single gate). Throws
  * {@link CapabilityDeniedError} when the caller does not hold `required`
  * (including the missing/undefined `_capabilities` case). On success it returns
  * `void`.

package/node_modules/@comis/core/dist/security/capability.js

@@ -1,6 +1,6 @@
 // SPDX-License-Identifier: Apache-2.0
 /**
- * Agent orchestration-capability primitive (CAP-01 / CAP-02 / CAP-05).
+ * Agent orchestration-capability primitive.
  *
  * The single authority predicate for the in-process agent loop — an
  * orthogonal axis to the gateway's `Scope` (`api-contracts/types.ts:19`). The
@@ -13,9 +13,9 @@
  *   1. NO wildcard branch. `checkScope` has a `*`-implies-all rule;
  *      `checkCapability` is a plain membership test. With no lattice and no
  *      catch-all, least-privilege holds by construction — no member can imply
- *      `admin`/`rpc`/all (CAP-02). Copying `checkScope` verbatim would FAIL the
+ *      `admin`/`rpc`/all. Copying `checkScope` verbatim would FAIL the
  *      `capability-scope-disjoint.test.ts` arch-test.
- *   2. The union is DISJOINT from `Scope` (CAP-01) — capabilities are
+ *   2. The union is DISJOINT from `Scope` — capabilities are
  *      `orch:*`, scopes are `rpc|admin|mcp-client`; the arch-test asserts the
  *      intersection is empty.
  *
@@ -36,9 +36,9 @@
  * @module
  */
 /**
- * Closed orchestration-capability union (v8 §3.3/§3.8). Each member gates one
+ * Closed orchestration-capability union. Each member gates one
  * orchestration surface. `orch:browse` is part of the UNION but is OFF in every
- * default profile (Plan 02 owns the profile defaults — the union must still
+ * default profile (the profile defaults live elsewhere — the union must still
  * contain it so the type is total).
  *
  * Closed string-literal tuple (AGENTS §2.8): `AGENT_CAPABILITIES` is the single
@@ -56,11 +56,14 @@ export const AGENT_CAPABILITIES = [
     "orch:analyze",
     "orch:write",
     "orch:browse",
+    // MCP-in-jail inbound surface — a daemon-side executor route (the jail stays
+    // network-closed); default-off (granted only via the `mcp` toggle, no floor).
+    "orch:mcp",
 ];
 /**
  * Pure capability predicate — a plain membership test with NO wildcard branch.
  *
- * CRITICAL (CAP-02): unlike `checkScope`'s asterisk-implies-all rule, there is
+ * CRITICAL: unlike `checkScope`'s asterisk-implies-all rule, there is
  * no lattice and no catch-all here. A held set is exactly the caps it lists; no
  * entry (an asterisk string included) confers any other cap. That is what makes
  * least-privilege hold by construction.
@@ -70,14 +73,14 @@ export function checkCapability(held, required) {
 }
 /**
  * Mint attenuation — the single trust boundary against capability broadening
- * down a delegation tree (LEASE-04, v8 §4.2). Pure set-intersection: the result
+ * down a delegation tree. Pure set-intersection: the result
  * is exactly `parent ∩ requested`, so a child lease can NEVER hold a cap the
  * parent does not, and never a cap that was not requested. This is the only
  * broadening-prevention an opaque lease has, which is why it is property/fuzz-
  * tested over 1000+ random (parent, requested) pairs rather than by example.
  *
  * Same discipline as {@link checkCapability}: a plain membership filter with NO
- * wildcard branch (CAP-02) — no member implies admin/rpc/all-authority. The
+ * wildcard branch — no member implies admin/rpc/all-authority. The
  * requested order is preserved on the surviving subset.
  */
 export function attenuateCaps(parent, requested) {
@@ -102,7 +105,7 @@ export class CapabilityDeniedError extends Error {
     }
 }
 /**
- * Handler-boundary capability gate (v8 §3.7 — the single gate). Throws
+ * Handler-boundary capability gate (the single gate). Throws
  * {@link CapabilityDeniedError} when the caller does not hold `required`
  * (including the missing/undefined `_capabilities` case). On success it returns
  * `void`.