comisai 1.0.44 → 1.0.46

package/node_modules/@comis/daemon/dist/api/memory-ask-handlers.js

@@ -1,9 +1,7 @@
 // SPDX-License-Identifier: Apache-2.0
 /**
- * The memory.ask (dialectic) RPC handler — extracted from memory-handlers.ts
- * to keep that module under the 800-line production cap after the 2026-06-11
- * live-fix wave (reason-coded abstains, real SessionKey recall scope, dated
- * grounding lines).
+ * The memory.ask (dialectic) RPC handler — kept separate from
+ * memory-handlers.ts so that module stays under the 800-line production cap.
  *
  * @module
  */
@@ -23,7 +21,7 @@ const ABSTAIN_SENTINEL = { answer: "", citations: [], abstained: true };
 // `deps.memoryApi.search`, which bypasses the TRUST FILTER (the documented trap).
 // Recall trust-FILTERS but returns RAW `entry.content`; redaction/sanitization is
 // THIS handler's job (mirroring rag-retriever, never inside recall). Empty recall
-// ⇒ abstain in CODE WITHOUT the seam (Pitfall 5). Else: order trust-first
+// ⇒ abstain in CODE WITHOUT the seam. Else: order trust-first
 // (orderByTrust) → the SAME neutralization rag-retriever uses (sanitizeToolOutput
 // + wrapExternalContent) → clamp to the per-agent dialectic.maxRecall DoS bound →
 // the ONE injected query-time seam → assembleSynthesis (abstain-in-code + citations
@@ -38,10 +36,10 @@ export function bindMemoryAskHandler(deps) {
             // Scope is read PRE-strip (mirrors search_files + context.recall): the
             // dispatcher injects `_agentId` + `_callerSessionKey` on the agent tool
             // path; an external RPC caller (CLI / web dashboard / operator WS) has
-            // no `_agentId`, so it falls back to the DEFAULT agent — live finding
-            // 2026-06-11: without the fallback every external memory.ask call
-            // silently returned the bare abstain sentinel while the chat path
-            // recalled the same fact fine. No widening beyond existing token
+            // no `_agentId`, so it falls back to the DEFAULT agent — without the
+            // fallback every external memory.ask call would silently return the
+            // bare abstain sentinel while the chat path recalls the same fact
+            // fine. No widening beyond existing token
             // authority: memory.search serves the same rpc scope tenant-wide.
             const agentId = rawParams._agentId ?? deps.defaultAgentId;
             const callerSessionKey = rawParams._callerSessionKey;
@@ -51,9 +49,9 @@ export function bindMemoryAskHandler(deps) {
             // Graceful abstain when the dialectic is not wired (no key / seam not
             // applied) or no agent scope is resolvable — never throws. Each branch
             // carries a distinct `reason` + an INFO log so an infrastructure absence
-            // is never disguised as a semantic "no data" abstain (live finding
-            // 2026-06-11: all branches returned the identical bare sentinel with
-            // ZERO log lines — undiagnosable without reading the wiring).
+            // is never disguised as a semantic "no data" abstain (otherwise all
+            // branches would return the identical bare sentinel with ZERO log
+            // lines — undiagnosable without reading the wiring).
             if (deps.dialecticSeam === undefined || deps.buildDialecticRecall === undefined || agentId === undefined) {
                 const reason = agentId === undefined ? "no_agent_scope" : "dialectic_unavailable";
                 deps.logger?.info({
@@ -76,11 +74,11 @@ export function bindMemoryAskHandler(deps) {
             // sanitizes + wraps it below, NOT recall) — NOT memoryApi.search. The factory builds
             // a per-agent orchestrator with the daemon's store set + the agent's RagConfig.
             //
-            // The recall scope MUST be a real SessionKey OBJECT (live finding
-            // 2026-06-11): the previous `(callerSessionKey ?? "") as unknown as
-            // SessionKey` smuggled a STRING, so `sessionKey.tenantId` was undefined
-            // and the adapter's tenant-scoped hydration matched NOTHING — every
-            // memory.ask, on every caller path, abstained with an empty recall.
+            // The recall scope MUST be a real SessionKey OBJECT: a
+            // `(callerSessionKey ?? "") as unknown as SessionKey` cast would
+            // smuggle a STRING, leaving `sessionKey.tenantId` undefined so the
+            // adapter's tenant-scoped hydration matches NOTHING — every
+            // memory.ask, on every caller path, would abstain with an empty recall.
             // Parse the dispatcher-injected formatted key when present; otherwise a
             // synthetic key carrying the daemon tenant (the only field search scopes by).
             const recallScope = (callerSessionKey !== undefined ? parseFormattedSessionKey(callerSessionKey) : undefined) ?? {
@@ -91,7 +89,7 @@ export function bindMemoryAskHandler(deps) {
             const recall = deps.buildDialecticRecall(agentId);
             const recalled = await recall.recall(question, recallScope, agentId);
             // Empty / failed recall ⇒ abstain in CODE, WITHOUT calling the seam
-            // (Pitfall 5 — no grounding ⇒ no LLM call, no fabricated answer).
+            // (no grounding ⇒ no LLM call, no fabricated answer).
             if (!recalled.ok || recalled.value.length === 0) {
                 deps.logger?.info({ agentId, step: "dialectic", durationMs: systemNowMs() - askStart, abstained: true, reason: "empty_recall", citationCount: 0 }, "memory.ask abstained (empty recall)");
                 const sentinel = { ...ABSTAIN_SENTINEL, reason: "empty_recall" };
@@ -152,10 +150,10 @@ export function bindMemoryAskHandler(deps) {
                             : {}),
                     });
                 // The recorded date rides OUTSIDE the untrusted fence (code-derived
-                // from entry.createdAt, not memory content). Live finding
-                // 2026-06-11: without it, same-trust conflicts gave the model no
-                // recency signal and it resolved a date correction the WRONG way
-                // (answered the stale June 20 over the updated June 25).
+                // from entry.createdAt, not memory content). Without it, same-trust
+                // conflicts give the model no recency signal and it can resolve a
+                // date correction the WRONG way (answering the stale date over the
+                // updated one).
                 const recorded = systemDateFrom(r.entry.createdAt).toISOString().slice(0, 10);
                 return `[${r.entry.id}] (recorded ${recorded}) ${safe}`;
             })
@@ -176,12 +174,12 @@ export function bindMemoryAskHandler(deps) {
             // used) are HIGH-signal "used" attribution. Emit on the SAME event the usefulness-feedback
             // subscriber already consumes (wireMemoryUsefulness → recordUsage) — NO new event, NO new
             // subscriber. usedIds = the citations; ignoredIds = recalled ∖ citations. Guarded on
-            // !result.abstained so an abstained (no grounded answer) turn never attributes a "used"
-            // (Pitfall 4); the emit is fire-and-forget by the bus contract and the subscriber is
+            // !result.abstained so an abstained (no grounded answer) turn never attributes a
+            // "used"; the emit is fire-and-forget by the bus contract and the subscriber is
             // already non-fatal, so a usefulness-write failure can NEVER break the answer. ids/counts
             // ONLY — never the question, recalled content, or answer (AGENTS.md §2.7).
             //
-            // `intent` is OMITTED here (Pitfall 2): classifyIntent is NOT exported from @comis/agent
+            // `intent` is OMITTED here: classifyIntent is NOT exported from @comis/agent
             // — importing it would force a public-export-consumer + a daemon→agent-internal edge, and
             // the handler does not re-classify. Omitting it makes the subscriber record the GLOBAL
             // bucket; the per-intent write rides the turn-end emit (in-package).

package/node_modules/@comis/daemon/dist/api/memory-pinning-handlers.js

@@ -28,7 +28,7 @@ export function createMemoryPinningHandlers(deps) {
             const start = systemNowMs();
             const p = MemoryPinContract.request.parse(stripInternalFields(rawParams));
             const tenantId = p.tenant_id ?? deps.tenantId;
-            // CR-01: forward agent_id from the request so the UPDATE is scoped
+            // Forward agent_id from the request so the UPDATE is scoped
             // to (id, tenant_id, agent_id) — cross-agent pinning within a tenant is impossible.
             const agentId = p.agent_id;
             const r = await deps.memoryApi.pin(p.id, tenantId, agentId);
@@ -50,7 +50,7 @@ export function createMemoryPinningHandlers(deps) {
                 durationMs: systemNowMs() - start,
                 step: "memory-pin",
             }, "Memory pin complete");
-            // IN-02: surface `found` in the wire response so callers can distinguish
+            // Surface `found` in the wire response so callers can distinguish
             // "pinned" from "id not found". found=true: row existed; found=false: not found.
             return { pinned: true, found: r.value, id: p.id };
         },
@@ -66,7 +66,7 @@ export function createMemoryPinningHandlers(deps) {
             const start = systemNowMs();
             const p = MemoryUnpinContract.request.parse(stripInternalFields(rawParams));
             const tenantId = p.tenant_id ?? deps.tenantId;
-            // CR-01: forward agent_id from the request.
+            // Forward agent_id from the request so the UPDATE stays agent-scoped.
             const agentId = p.agent_id;
             const r = await deps.memoryApi.unpin(p.id, tenantId, agentId);
             if (!r.ok) {

package/node_modules/@comis/daemon/dist/api/memory-portability-handlers.js

@@ -36,7 +36,7 @@ export function createMemoryPortabilityHandlers(deps) {
             const exportTenantId = exportParams.tenant_id ?? deps.tenantId;
             const exportAgentId = exportParams.agent_id;
             const exportLimit = exportParams.limit ?? 10_000;
-            // WR-01: capture start time for accurate durationMs in the completion log.
+            // Capture start time for accurate durationMs in the completion log.
             const exportStart = systemNowMs();
             const exportEntries = deps.memoryApi.inspect({
                 tenantId: exportTenantId,
@@ -45,7 +45,7 @@ export function createMemoryPortabilityHandlers(deps) {
                 offset: 0,
             });
             const exportedEntries = exportEntries.map((e) => {
-                // CR-01: scrub ALL free-text fields — not just content — to prevent secret exfil
+                // Scrub ALL free-text fields — not just content — to prevent secret exfil
                 // via source provenance or tags. scrubSecretsFromText only redacts secret-shaped values;
                 // non-secret text (e.g. "operator", "discord") passes through unchanged.
                 const { text: scrubbedContent } = scrubSecretsFromText(e.content);
@@ -114,20 +114,20 @@ export function createMemoryPortabilityHandlers(deps) {
             const importTenantId = importParams.tenant_id ?? deps.tenantId;
             const importAgentId = importParams.agent_id;
             const importDryRun = importParams.dry_run ?? false;
-            // CR-02: fail-closed firewall guard — a missing validator is a wiring mistake.
+            // Fail-closed firewall guard — a missing validator is a wiring mistake.
             // Silently bypassing the security firewall is more dangerous than refusing the batch.
             // Production daemon always wires validateMemoryWrite (daemon.ts); this protects against
             // test-harness wiring errors and future DI mistakes.
             if (!deps.memoryWriteValidator) {
                 throw new Error("Memory import requires a memoryWriteValidator — refusing to import without security firewall");
             }
-            // WR-01: capture start time for accurate durationMs in the completion log.
+            // Capture start time for accurate durationMs in the completion log.
             const importStart = systemNowMs();
             let importCount = 0;
             let blockedCount = 0;
             let downgradedCount = 0;
             let dedupedCount = 0;
-            // MEM-IMPORT-DUP (30uc-20260624 UC-22): build the set of content already present in the
+            // Duplicate-content idempotency: build the set of content already present in the
             // TARGET scope so the import is idempotent — re-importing an export (or an overlapping set)
             // skips entries that already exist instead of inserting fresh-id duplicates (live: a 34-entry
             // re-import doubled a 33-row store to 67). A DELETED memory is still restored (its content is
@@ -190,7 +190,7 @@ export function createMemoryPortabilityHandlers(deps) {
                     const envelopeTrust = String(rawEntry["trust_level"] ?? "learned");
                     entryTrustLevel = envelopeTrust === "external" ? "external" : "learned";
                 }
-                // MEM-IMPORT-DUP: idempotent skip — content already present in the target scope (or earlier
+                // Idempotent skip — content already present in the target scope (or earlier
                 // in THIS batch). Counted separately from blocked (security) and downgraded. Security wins:
                 // a CRITICAL entry was already blocked above before reaching here.
                 if (existingContent.has(entryContent)) {
@@ -201,14 +201,14 @@ export function createMemoryPortabilityHandlers(deps) {
                 if (!importDryRun) {
                     const importEntryId = randomUUID();
                     const rawTags = rawEntry["tags"];
-                    // WR-03: filter to string elements only — z.record(z.string(), z.unknown()) allows
+                    // Filter to string elements only — z.record(z.string(), z.unknown()) allows
                     // non-string array elements in the imported payload; they must not reach the store.
                     const envelopeTags = Array.isArray(rawTags)
                         ? rawTags.filter((t) => typeof t === "string")
                         : [];
                     // Pinned pin state is NOT imported: `pinned` is deliberately absent from storeEntry.
                     // The `pinned` column defaults to 0 at the SQLite level — imported entries are never
-                    // pre-pinned. Pin state is local operator curation, not portable across scopes (R6).
+                    // pre-pinned. Pin state is local operator curation, not portable across scopes.
                     const storeEntry = {
                         id: importEntryId,
                         tenantId: importTenantId, // re-stamp to target — NEVER trust envelope's tenantId

package/node_modules/@comis/daemon/dist/api/message-handlers.js

@@ -98,7 +98,7 @@ function requireMethod(adapter, methodName, method) {
     return method;
 }
 /**
- * Phase 213 (QUOTA-01/02): the outward irreversible-action gate for an agent-
+ * The outward irreversible-action gate for an agent-
  * initiated orch:message send. Called AFTER authorizeChannelAccess, BEFORE
  * deliver, for message.send/reply/react. Consults `boundedAutonomy.tryOutward`
  * (origin-only + per-target grant + per-hour + volume); on a deny it throws a
@@ -127,15 +127,15 @@ function enforceOutwardQuota(deps, rawParams, channelId, volume) {
     }
 }
 /**
- * Phase 216 (ONCE-01/02): resolve the `(rootRunId, outwardStepIndex)` idempotency
+ * Resolve the `(rootRunId, outwardStepIndex)` idempotency
  * key for an outward send from the threaded raw params.
  *
  * `rootRunId` comes from `resolveRootRunId(parseFormattedSessionKey(...))` — the
  * tree-stable run root (present iff a caller session + resolver are wired). The
- * `_outwardStepIndex` is the monotonic step the RPC chokepoint (Plan 07 Task 4)
+ * `_outwardStepIndex` is the monotonic step the RPC chokepoint
  * allocated + injected for EVERY autonomy outward call.
  *
- * HIGH-1: `_outwardStepIndex` is read as-is — `undefined` ⇒ pass-through (no
+ * `_outwardStepIndex` is read as-is — `undefined` ⇒ pass-through (no
  * ledger) in {@link wrapOutwardSend}. It is NEVER defaulted to 0 here (two
  * un-indexed sends would collide on the idempotency key and one would be
  * silently dropped). A non-autonomy / interactive send has no rootRunId and no
@@ -147,7 +147,7 @@ function resolveOutwardLedgerContext(deps, rawParams) {
     // (mirrors graph-coordinator.ts) so a bad key is a pass-through, never a throw.
     const parsedCaller = callerSessionKey ? parseFormattedSessionKey(callerSessionKey) : undefined;
     const rootRunId = parsedCaller ? deps.resolveRootRunId?.(parsedCaller) : undefined;
-    // HIGH-1: read the injected step index verbatim — NEVER `?? 0`.
+    // Read the injected step index verbatim — NEVER `?? 0`.
     const outwardStepIndex = rawParams._outwardStepIndex;
     return { rootRunId, outwardStepIndex };
 }
@@ -159,7 +159,7 @@ function resolveOutwardLedgerContext(deps, rawParams) {
 export function createMessageHandlers(deps) {
     return {
         [MessageSendContract.method]: async (rawParams) => {
-            // CAP-03/05 (v8 §3.7): in-process capability gate — the agent loop skips
+            // In-process capability gate — the agent loop skips
             // checkScope, so orch:message is enforced here, reading the injected
             // _capabilities from raw params BEFORE the strip.
             requireCapability(rawParams._capabilities, "orch:message");
@@ -167,7 +167,7 @@ export function createMessageHandlers(deps) {
             const channelId = rawParams.channel_id;
             const text = rawParams.text;
             authorizeChannelAccess(rawParams._callerChannelId, channelId, rawParams._trustLevel);
-            // QUOTA-01/02: gate the outward send (origin/grant/per-hour/volume) for an
+            // Gate the outward send (origin/grant/per-hour/volume) for an
             // agent origin, before deliver. Volume = the message body length.
             enforceOutwardQuota(deps, rawParams, channelId, typeof text === "string" ? text.length : 1);
             const userParams = stripInternalFields(rawParams);
@@ -179,7 +179,7 @@ export function createMessageHandlers(deps) {
                 ...(rawParams.effects ? { effects: rawParams.effects } : {}),
                 ...(rawParams.thread_reply !== undefined ? { threadReply: rawParams.thread_reply } : {}),
             };
-            // Phase 216 (ONCE-01/02): wrap the EXISTING deliverToChannel with the
+            // Wrap the EXISTING deliverToChannel with the
             // three-state ledger (begin→markUnknown→commit). The quota gate above is
             // untouched and there is NO parallel send path — the real delivery still
             // happens inside doSend. A non-autonomy send (no rootRunId/step) is a
@@ -214,14 +214,14 @@ export function createMessageHandlers(deps) {
             return result;
         },
         [MessageReplyContract.method]: async (rawParams) => {
-            // CAP-03/05 (v8 §3.7): in-process capability gate (see message.send).
+            // In-process capability gate (see message.send).
             requireCapability(rawParams._capabilities, "orch:message");
             const channelType = rawParams.channel_type;
             const channelId = rawParams.channel_id;
             const text = rawParams.text;
             const messageId = resolveMessageId(deps.inboundMessageIdResolver, rawParams.message_id, channelType, channelId);
             authorizeChannelAccess(rawParams._callerChannelId, channelId, rawParams._trustLevel);
-            // QUOTA-01/02: gate the outward reply (volume = the reply body length).
+            // Gate the outward reply (volume = the reply body length).
             enforceOutwardQuota(deps, rawParams, channelId, typeof text === "string" ? text.length : 1);
             const userParams = stripInternalFields(rawParams);
             MessageReplyContract.request.parse(userParams);
@@ -232,7 +232,7 @@ export function createMessageHandlers(deps) {
                 ...(rawParams.effects ? { effects: rawParams.effects } : {}),
                 ...(rawParams.thread_reply !== undefined ? { threadReply: rawParams.thread_reply } : {}),
             };
-            // Phase 216 (ONCE-01/02): wrap the EXISTING delivery call as in message.send.
+            // Wrap the EXISTING delivery call as in message.send.
             const { rootRunId, outwardStepIndex } = resolveOutwardLedgerContext(deps, rawParams);
             const wrapResult = await wrapOutwardSend({
                 ledger: deps.outwardLedger,
@@ -264,7 +264,7 @@ export function createMessageHandlers(deps) {
             return result;
         },
         [MessageReactContract.method]: async (rawParams) => {
-            // CAP-03/05 (v8 §3.7): in-process capability gate (see message.send).
+            // In-process capability gate (see message.send).
             requireCapability(rawParams._capabilities, "orch:message");
             const channelType = rawParams.channel_type;
             assertCapability("message.react", channelType, deps.channelPlugins);
@@ -272,7 +272,7 @@ export function createMessageHandlers(deps) {
             const messageId = resolveMessageId(deps.inboundMessageIdResolver, rawParams.message_id, channelType, channelId);
             const emoji = rawParams.emoji;
             authorizeChannelAccess(rawParams._callerChannelId, channelId, rawParams._trustLevel);
-            // QUOTA-01/02: gate the outward reaction as ONE fixed unit (IN-01, 213-REVIEW).
+            // Gate the outward reaction as ONE fixed unit.
             // A reaction is a single irreversible action; counting it as `emoji.length`
             // (1–few chars) made the per-action volumeCap (4000) effectively inert for
             // reactions while giving the unit inconsistent meaning vs send/reply (which
@@ -283,7 +283,7 @@ export function createMessageHandlers(deps) {
             MessageReactContract.request.parse(userParams);
             const adapter = resolveAdapter(channelType, deps.adaptersByType);
             const reactToMessage = requireMethod(adapter, "reactToMessage", adapter.reactToMessage);
-            // Phase 216 (ONCE-01/02): wrap the EXISTING reactToMessage with the
+            // Wrap the EXISTING reactToMessage with the
             // three-state ledger. A reaction sends an emoji (not free text), so the
             // emoji is the digest input; it has no platform message id, so doSend
             // returns a fixed "reacted" sentinel on success. Same single path — no

package/node_modules/@comis/daemon/dist/api/model-handlers.js

@@ -10,7 +10,7 @@
  * @module
  */
 import { AuthorizationError } from "./errors.js";
-import { getProviders } from "@earendil-works/pi-ai";
+import { getProviders } from "@earendil-works/pi-ai/compat";
 import { ModelsListContract, ModelsListProvidersContract, ModelsTestContract, stripInternalFields, systemGetEnv, } from "@comis/core";
 // ---------------------------------------------------------------------------
 // Dev-mode response parse helper

package/node_modules/@comis/daemon/dist/api/obs-handlers/fleet-autonomy.d.ts

@@ -1,5 +1,5 @@
 /**
- * FLEET-01/02/04 (Phase 220-03) autonomy slice + findings — all the cross-run
+ * Autonomy slice + findings — all the cross-run
  * AUTONOMY-health logic for the `comis fleet` report, extracted into this sibling
  * module to keep `fleet-health.ts` + `fleet-findings.ts` under the obs-handlers
  * per-subdirectory 500-line cap (the `obs-autonomy-rows.ts` / `fleet-findings-
@@ -12,14 +12,14 @@
  *   - {@link computeAutonomySlice} — the structured `autonomy` block (run counts +
  *     degradedRate from `DurableRunPort.countByStatus`, resumed/killed/worst-run id
  *     from the event-sourced `health_signal` rows, breaker/cost read back from the
- *     synthetic-excluded `reduceFleetWindow`). The worst rootRunId is FLEET-04.
+ *     synthetic-excluded `reduceFleetWindow`), including the worst rootRunId.
  *   - {@link buildAutonomyFindings} — the three dedicated findings (durable_orphaned
  *     / autonomy_revoked / autonomy_killed; kill separable from revoke).
  *
- * SECURITY INVARIANT (H1 + the 159 digest-only schema): counts + closed enums + the
+ * SECURITY INVARIANT (the digest-only report schema): counts + closed enums + the
  * worst rootRunId (an id) ONLY — NEVER the engine's free-text orphan reason (mapped
- * to a closed enum at the source, Plan 01 T-220-01), a lease bearer/selector
- * (T-220-02), or any body. Every `details` field is parsed via the defensive
+ * to a closed enum at the source), a lease bearer/selector,
+ * or any body. Every `details` field is parsed via the defensive
  * `*FromRow` extractors that never echo a body. Safe to paste into a review.
  *
  * @module
@@ -45,9 +45,9 @@ export interface AutonomySlice {
     revoked: number;
     killed: number;
     breakerTrips: number;
-    /** FLEET-02 (Phase 220-05): the capability-DENIAL breaker trip count (event-sourced
+    /** The capability-DENIAL breaker trip count (event-sourced
      *  from the `autonomy_denial_breaker` rows) — SEPARABLE from `breakerTrips` (the
-     *  tool-failure breaker read-back). The two are distinct mechanisms (Phase 217). */
+     *  tool-failure breaker read-back). The two are distinct mechanisms. */
     denialBreakerTrips: number;
     budgetBreaches: number;
     costUsd: number;
@@ -61,7 +61,7 @@ export interface AutonomySlice {
  * - `orphaned`/`revoked` come from the crash-surviving `countByStatus` (kill folds
  *   into the table's `revoked` status, so `revoked` is the cooperative+hard total in
  *   the durable table — but the `killed` COUNT is recovered separately from the
- *   event-sourced `autonomy_killed` rows, the only count separator Plan 01 provides).
+ *   event-sourced `autonomy_killed` rows, the only count separator available).
  * - `resumed` = the count of `durable_resumed` rows (healthy recovery — event-sourced).
  * - `killed` = the SUM of the `autonomy_killed` row counts (event-sourced).
  * - `total` = running + completed + orphaned + revoked; `degraded` = orphaned + revoked
@@ -81,7 +81,7 @@ export declare function computeAutonomySlice(input: {
 /**
  * The three dedicated autonomy findings over the `health_signal` rows (the
  * node_budget_exceeded mold): durable_orphaned (reason-grouped), autonomy_revoked
- * and autonomy_killed (SEPARATE — the kill≠revoke separation Plan 01 enables). Each
+ * and autonomy_killed (SEPARATE — kill and revoke are distinct events). Each
  * has a zero-traffic guard, counts + a STATIC knob-naming hint ONLY. Returned as a
  * `Finding[]` the caller pushes into the report's findings (inheriting the
  * FLEET_FINDINGS_CAP bound + the highest-count-first sort).

package/node_modules/@comis/daemon/dist/api/obs-handlers/fleet-autonomy.js

@@ -1,6 +1,6 @@
 // SPDX-License-Identifier: Apache-2.0
 /**
- * FLEET-01/02/04 (Phase 220-03) autonomy slice + findings — all the cross-run
+ * Autonomy slice + findings — all the cross-run
  * AUTONOMY-health logic for the `comis fleet` report, extracted into this sibling
  * module to keep `fleet-health.ts` + `fleet-findings.ts` under the obs-handlers
  * per-subdirectory 500-line cap (the `obs-autonomy-rows.ts` / `fleet-findings-
@@ -13,22 +13,22 @@
  *   - {@link computeAutonomySlice} — the structured `autonomy` block (run counts +
  *     degradedRate from `DurableRunPort.countByStatus`, resumed/killed/worst-run id
  *     from the event-sourced `health_signal` rows, breaker/cost read back from the
- *     synthetic-excluded `reduceFleetWindow`). The worst rootRunId is FLEET-04.
+ *     synthetic-excluded `reduceFleetWindow`), including the worst rootRunId.
  *   - {@link buildAutonomyFindings} — the three dedicated findings (durable_orphaned
  *     / autonomy_revoked / autonomy_killed; kill separable from revoke).
  *
- * SECURITY INVARIANT (H1 + the 159 digest-only schema): counts + closed enums + the
+ * SECURITY INVARIANT (the digest-only report schema): counts + closed enums + the
  * worst rootRunId (an id) ONLY — NEVER the engine's free-text orphan reason (mapped
- * to a closed enum at the source, Plan 01 T-220-01), a lease bearer/selector
- * (T-220-02), or any body. Every `details` field is parsed via the defensive
+ * to a closed enum at the source), a lease bearer/selector,
+ * or any body. Every `details` field is parsed via the defensive
  * `*FromRow` extractors that never echo a body. Safe to paste into a review.
  *
  * @module
  */
 import { autonomyDenialBreakerFromRow, autonomyKilledFromRow, autonomyRevokedFromRow, durableOrphanedFromRow, durableResumedFromRow, nodeBudgetExceededFromRow, } from "./fleet-findings-extractors.js";
 /**
- * Severity rank for the worst-rootRunId pick (FLEET-04): an ORPHANED run (died on
- * restart, did not recover) outranks a DENIAL-BREAKER-aborted run (FLEET-02 — the
+ * Severity rank for the worst-rootRunId pick: an ORPHANED run (died on
+ * restart, did not recover) outranks a DENIAL-BREAKER-aborted run (the
  * run burned its denial budget and was force-aborted, a robustness fault) outranks
  * a KILLED run (operator-intentional forced teardown) outranks a REVOKED run
  * (cooperative authority revoke). Higher = worse. Deterministic, no clock — the
@@ -67,7 +67,7 @@ function autonomyRevokedRootRunId(row) {
  * - `orphaned`/`revoked` come from the crash-surviving `countByStatus` (kill folds
  *   into the table's `revoked` status, so `revoked` is the cooperative+hard total in
  *   the durable table — but the `killed` COUNT is recovered separately from the
- *   event-sourced `autonomy_killed` rows, the only count separator Plan 01 provides).
+ *   event-sourced `autonomy_killed` rows, the only count separator available).
  * - `resumed` = the count of `durable_resumed` rows (healthy recovery — event-sourced).
  * - `killed` = the SUM of the `autonomy_killed` row counts (event-sourced).
  * - `total` = running + completed + orphaned + revoked; `degraded` = orphaned + revoked
@@ -120,7 +120,7 @@ export function computeAutonomySlice(input) {
             considerWorst("autonomy_killed", kill.rootRunId);
             continue;
         }
-        // FLEET-02 (Phase 220-05): the capability-denial breaker trip — SEPARABLE from
+        // The capability-denial breaker trip — SEPARABLE from
         // both the tool-failure breaker (breakerTrips read-back) and kill/revoke. Each
         // row is one trip (the count defaults to 1); the worst-run pick CAN promote it
         // (rank 3, above killed) since a denial-breaker abort is a robustness fault.
@@ -168,7 +168,7 @@ export function computeAutonomySlice(input) {
 /**
  * The three dedicated autonomy findings over the `health_signal` rows (the
  * node_budget_exceeded mold): durable_orphaned (reason-grouped), autonomy_revoked
- * and autonomy_killed (SEPARATE — the kill≠revoke separation Plan 01 enables). Each
+ * and autonomy_killed (SEPARATE — kill and revoke are distinct events). Each
  * has a zero-traffic guard, counts + a STATIC knob-naming hint ONLY. Returned as a
  * `Finding[]` the caller pushes into the report's findings (inheriting the
  * FLEET_FINDINGS_CAP bound + the highest-count-first sort).
@@ -179,7 +179,7 @@ export function buildAutonomyFindings(healthSignals) {
     // after a restart + the DOMINANT closed orphan reason (which un-resumable class).
     // Counts + the closed reason enum + a STATIC hint naming `comis explain <rootRunId>`
     // + the heartbeat knob ONLY — NEVER the engine's free-text orphan reason (mapped to
-    // a closed enum at the source, Plan 01 T-220-01). Zero-traffic guard.
+    // a closed enum at the source). Zero-traffic guard.
     let orphanedCount = 0;
     const byReason = new Map();
     for (const row of healthSignals) {
@@ -201,10 +201,10 @@ export function buildAutonomyFindings(healthSignals) {
         });
     }
     // autonomy_revoked — the SUM of the per-row revoked counts (a cooperative lease/tree
-    // revoke an admin must see). SEPARATE from autonomy_killed below — Plan 01 emits
+    // revoke an admin must see). SEPARATE from autonomy_killed below — the runtime emits
     // DISTINCT events because a kill and a revoke both flip the durable status to
     // 'revoked' in the table, so the EVENT is the only count separator (kill≠revoke).
-    // Counts + a STATIC hint ONLY — never a lease bearer/selector (T-220-02).
+    // Counts + a STATIC hint ONLY — never a lease bearer/selector.
     let revokedSum = 0;
     for (const row of healthSignals) {
         const parsed = autonomyRevokedFromRow(row);
@@ -238,8 +238,8 @@ export function buildAutonomyFindings(healthSignals) {
             hint: "a run tree was hard-killed (run.kill) — a forced teardown, not a cooperative revoke; run `comis explain <rootRunId>` on the killed run to see why it was terminated",
         });
     }
-    // autonomy_denial_breaker (FLEET-02, Phase 220-05) — the SUM of the per-row
-    // denial-breaker trip counts (a Phase-217 capability-denial breaker aborted +
+    // autonomy_denial_breaker — the SUM of the per-row
+    // denial-breaker trip counts (the capability-denial breaker aborted +
     // killed a run tree after N consecutive floor-blocks). DISTINCT from the
     // tool-failure breaker (breakerTripTotal) and from kill/revoke — this is the
     // capability-denial breaker, the only fleet-visible signal that an unattended run

package/node_modules/@comis/daemon/dist/api/obs-handlers/fleet-cron-wake-gate.d.ts

@@ -0,0 +1,47 @@
+/**
+ * Cron wake-gate EFFICIENCY slice — the cross-session reducer for the `comis
+ * fleet` report, a sibling of `fleet-autonomy.ts`. Reduces the content-free
+ * `cron_wake_gate` DiagnosticRows (one per gated cron fire, written by
+ * `wakeGateEventToRow`) into a per-agent skip-rate + turns-saved + tool-call
+ * cost slice.
+ *
+ * ONE pure export over the already-read rows (NO clock, NO I/O, NO re-derivation
+ * over raw session rows):
+ *   - {@link computeCronWakeGateSlice} — the structured `cronWakeGate` block
+ *     (window totals + per-agent counts), or `undefined` when no gated fire is in
+ *     the window (honest omit — the `computeAutonomySlice` mold).
+ *
+ * The two legibility properties the slice carries:
+ *   - SUPPRESSION: a per-agent `skipRate == 1.0` is a gate that NEVER wakes the
+ *     model — visible whether it is working (savings) or silently poisoned.
+ *   - NET COST: `toolCalls` (the gate's cap-call cost) beside `turnsSaved` (the
+ *     avoided model turns) makes a gate that costs more than it saves legible.
+ *
+ * SECURITY INVARIANT (the digest-only report schema): counts + agent ids ONLY.
+ * Every `details` field is parsed via the defensive reader below, which reads
+ * ONLY the `wake` verdict + the `estTurnsSaved`/`toolCalls` counts — NEVER the
+ * gate's gathered payload, script source, or a secret. Safe to paste into a review.
+ *
+ * @module
+ */
+import type { DiagnosticRow } from "@comis/memory";
+import type { FleetHealthReport } from "@comis/core";
+/** The assembled wake-gate block (shape-identical to FleetHealthReport.cronWakeGate). */
+export type CronWakeGateSlice = NonNullable<FleetHealthReport["cronWakeGate"]>;
+/**
+ * Reduce the windowed `cron_wake_gate` rows into the per-agent efficiency slice.
+ * Returns `undefined` (block OMITTED) when there is NO gated fire in the window —
+ * the honest-degradation case (no cron ran a wake-gate, or the store is unwired).
+ *
+ * - `fires.total` = the gated fire count; `fires.skipped` = fires with
+ *   `wake === false`; `fires.skipRate` = skipped / total (0 when total is 0).
+ * - `turnsSaved` = summed `estTurnsSaved` (the avoided model turns).
+ * - `toolCalls` = summed cap-call cost (the net-cost numerator).
+ * - `perAgent[]` = the same counts keyed by `agentId`, so a 100%-skip gate
+ *   (`skipRate == 1`) and an uneconomic gate (`toolCalls > turnsSaved`) are both
+ *   legible per agent. Ordered highest-fires-first, then agentId asc (deterministic).
+ *
+ * PURE — keys only on its argument; NO clock, NO I/O. Foreign-category rows are
+ * ignored so the reducer is safe over a mixed row set.
+ */
+export declare function computeCronWakeGateSlice(rows: readonly DiagnosticRow[]): CronWakeGateSlice | undefined;