comisai 1.0.44 → 1.0.46

package/node_modules/@comis/daemon/dist/api/rpc-dispatch.js

@@ -11,22 +11,22 @@
  * the field set inline.
  * @module
  */
-import { PreconditionError, ValidationError, AuthorizationError } from "./errors.js";
-import { RequiredToolsUnreachableError, API_CONTRACTS_ORDERED, HANDLER_CAPABILITY_MAP, CapabilityDeniedError, parseFormattedSessionKey, 
-// Phase 217-05 (the keystone): the never-hang mode-aware deny decision.
-// resolveEffectiveMode = the EVICT-02 fail-closed primitive (Plan 01);
-// resolveAutonomy = the jail-leg server-side mode resolve (Plan 03); systemNowMs
-// = the execution:aborted timestamp (mirrors bridge-safety-controls.ts).
+import { classifyTypedRpcError, API_CONTRACTS_ORDERED, HANDLER_CAPABILITY_MAP, CapabilityDeniedError, parseFormattedSessionKey, 
+// The never-hang mode-aware deny decision. resolveEffectiveMode is the
+// fail-closed primitive (absent/forged/unknown mode → "default");
+// resolveAutonomy is the server-side mode resolve for legs that inject no
+// mode; systemNowMs = the execution:aborted timestamp (mirrors
+// bridge-safety-controls.ts).
 resolveEffectiveMode, resolveAutonomy, systemNowMs, } from "@comis/core";
-// ORIGIN-01 deny-by-origin chokepoint: the in-process agent loop dispatches
+// Deny-by-origin chokepoint: the in-process agent loop dispatches
 // straight through this closure (bypassing the gateway scope-router's
 // checkScope), so the positive control-plane boundary MUST live here in the
 // dispatch closure — the convergence point of the in-process and gateway legs.
 import { assertNotAgentOrigin } from "./shared/assert-not-agent-origin.js";
-// AUDIT-01 (Phase 215): the per-cap audit emitter — emits audit:event (the
-// durable AUDIT-02 trail) + capability:audited (the spawn-tree producer) for an
+// The per-cap audit emitter — emits audit:event (the durable security-audit
+// trail) + capability:audited (the spawn-tree producer) for an
 // allowed AND a denied gated call at THIS chokepoint. The in-process leg has no
-// lease (G1): rootRunId via resolveRootRunId, leaseId honestly absent.
+// lease: rootRunId via resolveRootRunId, leaseId honestly absent.
 import { emitCapabilityAudit } from "./shared/emit-capability-audit.js";
 import { createCronHandlers } from "./cron-handlers.js";
 import { createMemoryHandlers } from "./memory-handlers.js";
@@ -49,13 +49,20 @@ import { createSecretsHandlers } from "./secrets-handlers.js";
 import { createAuthHandlers } from "./auth-handlers.js";
 import { createBrowserHandlers } from "./browser-handlers.js";
 import { createSubagentHandlers } from "./subagent-handlers.js";
-// Phase 213-06 (REVOKE-01/03): the operator-facing live-control RPC handlers.
-// lease.revoke / run.kill are scopes:["admin"] (Plan 03) → ADMIN_METHODS →
+// The operator-facing live-control RPC handlers.
+// lease.revoke / run.kill are scopes:["admin"] → ADMIN_METHODS →
 // deny-by-origin is automatic via the chokepoint below (no manual _agentId check
 // in the handler). They drive the LeaseManager revoke fan-outs + the runner's
 // killByRootRun.
 import { createAutonomyHandlers } from "./autonomy-handlers.js";
-// INTRO-01/02 (Phase 215-04): capabilities.introspect — the read-only,
+// orchestrate.replay — the operator deterministic-replay RPC.
+// scopes:["admin"] → ADMIN_METHODS → deny-by-origin is automatic via the
+// chokepoint below (no manual _agentId check in the handler). The thin RPC slice
+// delegates to wiring/setup-orchestrate-replay.ts (the SEPARATE replay socket +
+// pinned-byte re-spawn, never a mode of the production endpoint — INV-1). Gated
+// on the composition root wiring the replay cluster + a durable store.
+import { createOrchestrateReplayHandlers } from "./orchestrate-replay-handlers.js";
+// capabilities.introspect — the read-only,
 // agent-reachable `comis whoami` surface. scopes:["rpc"] + "ungated" (NO
 // requireCapability, NOT in ADMIN_METHODS), self-scoped to the caller's
 // _agentId. Gated on deps.boundedAutonomy being wired (the snapshot source).
@@ -71,7 +78,7 @@ import { createDaemonHandlers } from "./daemon-handlers.js";
 import { createMcpHandlers } from "./mcp-handlers.js";
 import { createMcpOauthHandlers } from "./mcp-oauth-handlers.js";
 import { createGraphHandlers } from "./graph-handlers/index.js";
-// AUTHOR-01 (Phase 174-03): the daemon composition site is the boundary-clean
+// The daemon composition site is the boundary-clean
 // place to import @comis/agent and inject the conservative repair matcher into
 // the graph handlers (buildGraphInput receives it via deps.repairMatch — never a
 // direct daemon→agent import in the pure helper).
@@ -98,7 +105,7 @@ import { createProviderHandlers } from "./provider-handlers.js";
 // Any remaining legacy `*HandlerDeps` interfaces in api/*-handlers.ts are
 // assignable from ApiDispatchDeps via structural subtyping.
 // ---------------------------------------------------------------------------
-// WR-04: media methods whose params carry a large base64/binary payload
+// Media methods whose params carry a large base64/binary payload
 // (`source`/`image`/`video`/`audio`/`file`). The dispatcher error log writes
 // `params` for triage, but Pino's key-name redaction does NOT cover these
 // fields, so on a throw branch the whole image/video/audio body would land in
@@ -122,43 +129,30 @@ const BINARY_PARAM_KEYS = ["source", "image", "video", "audio", "file"];
 /**
  * Classify an RPC error for structured logging.
  *
- * Accepts the raw error object (not just its message) so `instanceof`
- * checks against `PreconditionError` / `ValidationError` resolve. Returns
- * an ErrorKind, an actionable hint, AND a `level` (`"warn" | "error"`)
- * that the dispatcher uses to pick `logger.warn` vs `logger.error`. The
- * goal is to keep operator alerts meaningful: caller mistakes
- * (preconditions, validation) are warn-level via typed-class throws;
- * unmatched cases fall through to `error/internal`.
+ * Returns an ErrorKind, an actionable hint, AND a `level` (`"warn" | "error"`) that the
+ * dispatcher uses to pick `logger.warn` vs `logger.error`. The goal is to keep operator
+ * alerts meaningful: caller mistakes / policy / security refusals (`PreconditionError`,
+ * `ValidationError`, `AuthorizationError`, `RequiredToolsUnreachableError`,
+ * `SandboxDowngradeError`) are warn-level; unmatched cases fall through to `error/internal`.
  *
- * The legacy message-pattern (substring-match) fallbacks were deleted.
- * OBS-10 (reflect-obs-20260627): the admin-trust denials — every `throw new Error(
- * "Admin access required …")` across the ~26 control-plane handlers — were migrated to
- * `throw new AuthorizationError(...)`, so an operator's wrong-trust call classifies as
- * `auth`/`warn` instead of `internal`/`error` (it was reading as a fleet ERROR + tripping
- * operator alerts though the gate fired correctly). The remaining bare-Error handlers
- * ("immutable" preconditions, etc.) still classify as `internal`/`error` until migrated
- * to `PreconditionError`/`ValidationError` — that migration is incremental hardening. The
- * substring-fallback deletion is intentional; typed errors are the sanctioned path.
+ * The typed-refusal → kind/hint/level mapping lives in `@comis/core`
+ * ({@link classifyTypedRpcError}) as the SINGLE source of truth, because the SAME error is
+ * ALSO classified by the `@comis/gateway` method-router trace wrapper — which cannot
+ * `instanceof` these classes (dependency direction) and so keys off `Error.name`. Before
+ * that shared classifier the two layers drifted and the gateway kept logging intentional
+ * refusals as internal/ERROR after this layer was fixed. **Add a new typed refusal
+ * in `@comis/core`, not here.** The legacy substring-match fallbacks remain deleted;
+ * typed errors are the sanctioned path (admin-trust denials throw `AuthorizationError`;
+ * bare-Error handlers still classify internal/error until migrated to a typed class).
  */
 export function classifyRpcError(err) {
-    // Typed errors: instanceof checks. Add new typed classes here as
-    // handlers migrate; do NOT re-introduce substring-match fallbacks.
-    if (err instanceof PreconditionError)
-        return { errorKind: "precondition", hint: "Caller precondition not met; check resource state before retry", level: "warn" };
-    if (err instanceof ValidationError)
-        return { errorKind: "validation", hint: "Check parameter types and values against the schema", level: "warn" };
-    // OBS-10 (reflect-obs-20260627): an admin-trust denial is an EXPECTED authorization refusal, not an
-    // internal/handler fault — warn/auth, so an operator's wrong-trust call doesn't read as a fleet ERROR.
-    if (err instanceof AuthorizationError)
-        return { errorKind: "auth", hint: "Caller lacks admin trust for this control-plane method; use an admin-scoped token or the documented operator route (e.g. `comis explain` assembles obs reports offline)", level: "warn" };
-    // RequiredToolsUnreachableError is a caller-side validation failure (caller passed
-    // invalid required_tools). Classify as validation/warn — NOT internal/error.
-    if (err instanceof RequiredToolsUnreachableError)
-        return { errorKind: "validation", hint: "Adjust required_tools and/or tool_groups per the per-tool hints in the error message", level: "warn" };
+    const typed = classifyTypedRpcError(err);
+    if (typed)
+        return typed;
     return { errorKind: "internal", hint: "Check the RPC method handler and its dependencies", level: "error" };
 }
 // ---------------------------------------------------------------------------
-// ORIGIN-01 deny-by-origin: the authoritative admin-method set.
+// Deny-by-origin: the authoritative admin-method set.
 // ---------------------------------------------------------------------------
 //
 // Derived ONCE from the contract registry (`scopes.includes("admin")`) — the
@@ -167,9 +161,9 @@ export function classifyRpcError(err) {
 // chokepoint below; there is NO hand-maintained method list to fall out of
 // sync. The chokepoint (in the dispatch closure) calls `assertNotAgentOrigin`
 // for exactly the methods in this set, so an agent-origin (`_agentId`-bearing)
-// call can never reach an admin handler, INDEPENDENT of its ALS `_trustLevel`
-// (v8 §3.1 / §22.3 floor item 1). Non-admin methods are NOT in this set, so an
-// agent's own `_agentId` rides them untouched for self-scoping (Pitfall 2).
+// call can never reach an admin handler, INDEPENDENT of its ALS `_trustLevel`.
+// Non-admin methods are NOT in this set, so an agent's own `_agentId` rides
+// them untouched for self-scoping.
 const ADMIN_METHODS = new Set(API_CONTRACTS_ORDERED.filter((c) => c.scopes.includes("admin")).map((c) => c.method));
 // ---------------------------------------------------------------------------
 // Factory
@@ -233,8 +227,8 @@ export function createRpcDispatch(deps) {
         }),
         ...createBrowserHandlers(deps),
         ...createSubagentHandlers(deps),
-        // Phase 213-06: lease.revoke + run.kill. Gated on deps.leaseManager being
-        // wired (Plan 07 constructs it at the composition root); subAgentRunner +
+        // lease.revoke + run.kill. Gated on deps.leaseManager being
+        // wired (constructed at the composition root); subAgentRunner +
         // logger ride the OrchestratorApiDeps slice. Deny-by-origin fires in the
         // dispatch chokepoint below for these admin-scoped methods (no manual check).
         // When leaseManager is absent (a partial boot) the methods are simply not
@@ -243,25 +237,48 @@ export function createRpcDispatch(deps) {
             ? createAutonomyHandlers({
                 ...deps,
                 leaseManager: deps.leaseManager,
-                // FLEET-03: the LIVE autonomy:revoked/killed bus (the same typed bus the
-                // execution:aborted emit uses below, ~:678) + systemNowMs as the
+                // The LIVE autonomy:revoked/killed bus (the same typed bus the
+                // execution:aborted emit uses below) + systemNowMs as the
                 // wiring-layer clock (globals-gate-safe; no Date.now() here). Without
                 // this the handler's optional eventBus? is absent in prod → the daemon
-                // emits nothing → Plan 03's counts are silently zero.
+                // emits nothing → the revoke/kill counts are silently zero.
                 eventBus: deps.container.eventBus,
                 now: systemNowMs,
             })
             : {}),
-        // INTRO-01/02 (Phase 215-04): capabilities.introspect (the `comis whoami`
-        // read). Gated on deps.boundedAutonomy (the remaining-budget snapshot
-        // source, Plan 02). The handler resolves the CALLER's per-agent
-        // AutonomyConfig itself from deps.agents (caps are per-caller; the handler is
-        // built once) — do NOT pre-resolve a single config at wiring time. It is
-        // scopes:["rpc"] + "ungated" (no requireCapability, NOT in ADMIN_METHODS) so
-        // the agent reaches it; the spread closes the contract↔handler parity gate
+        // orchestrate.replay — the operator deterministic-replay RPC. Gated on the
+        // composition root wiring the replay cluster (the daemon-wide OutputGuard +
+        // the sandbox-backed pinned-byte re-spawn seam) AND a durable store (the
+        // runId → real orchestrate row validation). scopes:["admin"] → the
+        // deny-by-origin chokepoint below rejects any agent origin (INV-3); the
+        // handler starts a SEPARATE replay socket + points COMIS_ORCH_SOCKET at it
+        // (never the production endpoint — INV-1). Absent wiring ⇒ not registered
+        // (a stray call hits the dispatcher's unknown-method path).
+        ...(deps.orchestrateReplay && deps.durableRuns
+            ? createOrchestrateReplayHandlers({
+                durableRuns: deps.durableRuns,
+                // The run's jailed workspace (the replay socket reads its
+                // results/replay.jsonl). Single-agent default resolver; the
+                // run→workspace mapping refines at the composition root for the
+                // multi-agent drive.
+                resolveWorkspace: () => deps.defaultWorkspaceDir,
+                outputGuard: deps.orchestrateReplay.outputGuard,
+                respawn: deps.orchestrateReplay.respawn,
+                ...(deps.orchestrateReplay.createReplaySocket
+                    ? { createReplaySocket: deps.orchestrateReplay.createReplaySocket }
+                    : {}),
+                logger: deps.logger,
+            })
+            : {}),
+        // capabilities.introspect (the `comis whoami` read). The remaining-budget
+        // snapshot comes from deps.boundedAutonomy. The handler resolves the CALLER's
+        // per-agent AutonomyConfig itself from deps.agents (caps are per-caller; the
+        // handler is built once) — do NOT pre-resolve a single config at wiring time.
+        // It is scopes:["rpc"] + "ungated" (no requireCapability, NOT in ADMIN_METHODS)
+        // so the agent reaches it; the spread closes the contract↔handler parity gate
         // via [CapabilitiesIntrospectContract.method] in the SAME wave the handler +
-        // codegen land (the 188 BLOCKER-1 same-wave rule).
-        // Finding E (30uc-20260624): register UNCONDITIONALLY (no longer gated on deps.boundedAutonomy).
+        // codegen land.
+        // Register UNCONDITIONALLY (NOT gated on deps.boundedAutonomy).
         // When no autonomy agent is wired, the handler returns a clean disabled-state ({enabled:false,
         // caps:[]}) — `comis whoami` / capabilities.introspect must never be "Unknown RPC method".
         // The budget snapshot is omitted when boundedAutonomy is absent (handler guards it).
@@ -289,15 +306,15 @@ export function createRpcDispatch(deps) {
             tenantId: deps.tenantId,
             dataDir: deps.container.config.dataDir || ".",
             nodeTypeRegistry: deps.nodeTypeRegistry,
-            // TELEM-01 (Phase 173-02): construct the per-agent capabilityClass
+            // Construct the per-agent capabilityClass
             // resolver for the daemon-side `pipeline:authored` emit. Resolve the tier
             // server-side from the agent's provider (deps.agents[agentId].provider →
-            // getProviderCapabilityClass) — NEVER a tool-supplied param (Spoofing
-            // mitigation T-173-03). Constructing it HERE (not just typing it) is the
-            // load-bearing guard against the 172-WR-02 silent-dead-metric class
-            // (T-173-13): without this line every emit fail-defaults to "unknown".
+            // getProviderCapabilityClass) — NEVER a tool-supplied param (spoofing
+            // mitigation). Constructing it HERE (not just typing it) is the
+            // load-bearing guard against the silent-dead-metric class:
+            // without this line every emit fail-defaults to "unknown".
             resolveCapabilityClass: (agentId) => 
-            // IN-02 (Phase 173 review): a dynamic-key READ (not a write) on the typed
+            // A dynamic-key READ (not a write) on the typed
             // Record<string, PerAgentConfig>; the key is the server-trusted agentId.
             // A key like "__proto__" returns the prototype's `provider` (undefined) →
             // fail-safes to "unknown", never a pollution write. No eslint-disable is
@@ -306,22 +323,22 @@ export function createRpcDispatch(deps) {
             // so adding the directive here is reported as unused — this plain comment
             // documents the intentional safe read instead.
             //
-            // TELEM-01 fix (2026-06-19): fall back to the provider-family heuristic when no operator
+            // Fall back to the provider-family heuristic when no operator
             // `providers.entries.<p>.capabilities.capabilityClass` override is pinned. Without this
             // fallback the override-only resolver returned undefined for every un-pinned config (the
-            // common case), so `pipeline:authored` always emitted capabilityClass:"unknown" and P1's
+            // common case), so `pipeline:authored` always emitted capabilityClass:"unknown" and the
             // small-model-authoring-rate metric was dead. The heuristic (anthropic/openai→frontier,
             // google→mid, else→small) is the same one the executor's live ModelProfile derives.
             (() => {
                 const provider = deps.agents[agentId ?? ""]?.provider;
                 return deps.getProviderCapabilityClass?.(provider) ?? capabilityClassFromProvider(provider);
             })(),
-            // AUTHOR-01 (Phase 174-03): thread the orchestration.authoring gate +
+            // Thread the orchestration.authoring gate +
             // inject the conservative repair matcher. The daemon→agent boundary is
             // crossed HERE (the composition site legitimately imports @comis/agent),
             // never inside buildGraphInput — mirroring the resolveCapabilityClass
             // injection above. With repairProducer:false (the default) the gate is off
-            // and buildGraphInput is byte-identical to pre-174.
+            // and buildGraphInput leaves the raw graph unchanged.
             authoringConfig: deps.container.config.orchestration?.authoring,
             repairMatch: matchRawGraphToTemplate,
         }) : {}),
@@ -514,16 +531,16 @@ export function createRpcDispatch(deps) {
         ...(deps.imageHandlerDeps
             ? createImageHandlers(deps.imageHandlerDeps)
             : {}),
-        // v2.24 Phase 188: Video generation handler (video.generate). Gated on the
+        // Video generation handler (video.generate). Gated on the
         // video bundle being wired (provider + rate limiter present); the spread
         // closes the contract↔handler parity gate via [VideoGenerateContract.method].
         ...(deps.videoHandlerDeps
             ? createVideoHandlers(deps.videoHandlerDeps)
             : {}),
-        // v2.24 Phase 189 (JOB-04): Video status handler (video.status). Gated on the
+        // Video status handler (video.status). Gated on the
         // status deps being wired (the agent-scoped store + logger); the spread closes
         // the contract↔handler parity gate via [VideoStatusContract.method] in the SAME
-        // wave the contract is declared (no cross-wave strand — the 188 BLOCKER-1 class).
+        // wave the contract is declared (no cross-wave strand).
         ...(deps.videoStatusHandlerDeps
             ? createVideoStatusHandlers(deps.videoStatusHandlerDeps)
             : {}),
@@ -537,12 +554,12 @@ export function createRpcDispatch(deps) {
             throw new Error(`Unknown RPC method: ${method}`);
         }
         try {
-            // ORIGIN-01 deny-by-origin chokepoint. BOTH the in-process agent path
+            // Deny-by-origin chokepoint. BOTH the in-process agent path
             // (createAgentRpcCall -> the same injected rpcCall) AND the gateway path
             // funnel through this one closure to reach every handler — so this is the
             // single seam at which an agent-origin call to an admin-scoped method is
-            // rejected. `params._agentId` is the trusted agent-origin signal (Plan 03
-            // strips external forgeries, so presence == agent-origin). The guard fires
+            // rejected. `params._agentId` is the trusted agent-origin signal (external
+            // forgeries are stripped, so presence == agent-origin). The guard fires
             // only for ADMIN_METHODS; a non-admin method's `_agentId` passes untouched.
             // assertNotAgentOrigin emits the content-free audited denial and throws;
             // the catch below logs + re-throws it as the JSON-RPC error (so the denial
@@ -550,11 +567,11 @@ export function createRpcDispatch(deps) {
             if (ADMIN_METHODS.has(method)) {
                 assertNotAgentOrigin(params, deps, method);
             }
-            // AUDIT-01 (Phase 215): the per-CAPABILITY audit. Emit ONLY when the
+            // The per-CAPABILITY audit. Emit ONLY when the
             // method maps to a real AgentCapability in HANDLER_CAPABILITY_MAP (skip
             // "ungated" + "deny-by-origin" — the latter already audits via
             // assertNotAgentOrigin above, so excluding it here avoids the double-audit
-            // for the admin path). The in-process leg has NO lease (G1): source
+            // for the admin path). The in-process leg has NO lease: source
             // rootRunId from the synthetic-root resolver; leaseId is honestly ABSENT.
             const classification = HANDLER_CAPABILITY_MAP[method];
             const isCapGated = classification !== undefined &&
@@ -568,34 +585,34 @@ export function createRpcDispatch(deps) {
             // the whole record when there is no session key + no resolver — never fabricate.
             const parsedKey = callerSessionKey ? parseFormattedSessionKey(callerSessionKey) : undefined;
             const rootRunId = parsedKey !== undefined ? deps.resolveRootRunId?.(parsedKey) : undefined;
-            // WR-02: gate the durable AUDIT-02 trail on a real cap + agent origin ONLY —
+            // Gate the durable audit trail on a real cap + agent origin ONLY —
             // a gated decision is a security fact regardless of tree-root resolution.
             // emitCapabilityAudit emits `audit:event` unconditionally and SUPPRESSES the
             // `capability:audited` tree producer when rootRunId is absent (an unplaceable
             // node), so a missing _callerSessionKey no longer silently drops the security
             // row — only the tree node. rootRunId is honestly absent in-process when
-            // unresolvable (never fabricated, G1).
+            // unresolvable (never fabricated).
             const shouldAudit = isCapGated && agentOrigin !== undefined;
-            // Phase 217-05 (the keystone): the run's EFFECTIVE autonomy mode at THIS gate
-            // decision (research Pattern 3 + EVICT-02/03). The order is load-bearing:
+            // The run's EFFECTIVE autonomy mode at THIS gate
+            // decision. The order is load-bearing:
             //   1. evicted (operator's autonomy.evict) → "default" FIRST — the demotion
             //      overrides any injected/resolved mode and takes effect at the NEXT gate
-            //      decision (mid-run, EVICT-03), not next spawn.
-            //   2. else the trusted in-process-injected `_autonomyMode` (Plan 03) →
+            //      decision (mid-run), not next spawn.
+            //   2. else the trusted in-process-injected `_autonomyMode` →
             //      resolveEffectiveMode (valid passthrough; absent/forged/unknown →
-            //      "default", EVICT-02 fail-closed).
-            //   3. else (the jail leg injects no mode — Plan 03) → server-resolve from
+            //      "default", fail-closed).
+            //   3. else (the jail leg injects no mode) → server-resolve from
             //      deps.agents[agentOrigin] (this chokepoint HAS deps.agents in scope,
             //      unlike the boot file) → resolveEffectiveMode (unresolvable → "default").
-            // TODO(2026-06-24, T-217-06/T-217-15): wire evictRegistry.clear + denialBreaker.evict on NORMAL run-end (not just the trip/kill path). The chokepoint is per-call and has no clean run-end hook; the durable run-lifecycle / sessionEnd seam (setup-durable-resume / the runner's run-complete) is the right place to drop a completed root's breaker counter + evict flag so the in-memory maps cannot grow under a storm of per-cron-fire roots. The trip/kill path already clears; this TODO covers the happy-path completion only.
+            // TODO: wire evictRegistry.clear + denialBreaker.evict on NORMAL run-end (not just the trip/kill path). The chokepoint is per-call and has no clean run-end hook; the durable run-lifecycle / sessionEnd seam (setup-durable-resume / the runner's run-complete) is the right place to drop a completed root's breaker counter + evict flag so the in-memory maps cannot grow under a storm of per-cron-fire roots. The trip/kill path already clears; this TODO covers the happy-path completion only.
             const effectiveMode = () => {
                 if (rootRunId !== undefined && deps.evictRegistry?.isEvicted(rootRunId))
                     return "default";
                 const injected = params._autonomyMode;
                 if (typeof injected === "string")
                     return resolveEffectiveMode(injected);
-                // Jail leg: no injected mode → server-resolve from deps.agents. Fail-CLOSED
-                // (EVICT-02): an absent agents map or a missing/unresolvable agent entry
+                // Jail leg: no injected mode → server-resolve from deps.agents. Fail-CLOSED:
+                // an absent agents map or a missing/unresolvable agent entry
                 // yields `undefined` → resolveEffectiveMode → "default" (never the broader
                 // standard profile resolveAutonomy(undefined) would return).
                 const agentEntry = agentOrigin !== undefined ? deps.agents?.[agentOrigin] : undefined;
@@ -615,7 +632,7 @@ export function createRpcDispatch(deps) {
                         decision: "allow",
                     });
                 }
-                // Phase 217-05 (BREAK reset): a successful gated call resets the per-root
+                // Breaker reset: a successful gated call resets the per-root
                 // consecutive-floor-block counter, so a single deny inside a PRODUCTIVE
                 // loop never accumulates to a trip (the productive run is not aborted).
                 if (rootRunId !== undefined)
@@ -635,11 +652,11 @@ export function createRpcDispatch(deps) {
                         decision: "deny",
                     });
                 }
-                // Phase 217-05 (the keystone): the mode-aware deny-vs-escalate + breaker
+                // The mode-aware deny-vs-escalate + breaker
                 // drive. COUNT-ONLY-FLOOR-BLOCKS — this branch fires ONLY for a genuine
                 // CapabilityDeniedError. `assertNotAgentOrigin` (admin deny-by-origin)
                 // throws a PLAIN Error and a generic handler error is a non-CapabilityDeniedError,
-                // so neither reaches recordDenial (research recommendation #5, BY CONSTRUCTION
+                // so neither reaches recordDenial (BY CONSTRUCTION
                 // via this instanceof guard). The throw at the end is UNCHANGED — the run
                 // ALWAYS sees the deny and adapts (never hangs); NO escalation is awaited.
                 if (innerErr instanceof CapabilityDeniedError) {
@@ -647,7 +664,7 @@ export function createRpcDispatch(deps) {
                     if (rootRunId !== undefined && deps.denialBreaker) {
                         const verdict = deps.denialBreaker.recordDenial(rootRunId);
                         if (verdict.tripped) {
-                            // BREAK-02: the Nth consecutive floor-block → ABORT the tree (not an
+                            // The Nth consecutive floor-block → ABORT the tree (not an
                             // infinite retry loop) + escalate. Mirror bridge-safety-controls.ts's
                             // execution:aborted emit shape; the obs layer consumes the reason.
                             if (parsedKey !== undefined) {
@@ -658,13 +675,13 @@ export function createRpcDispatch(deps) {
                                     timestamp: systemNowMs(),
                                 });
                             }
-                            // FLEET-02 (Phase 220-05): ALSO emit the dedicated content-free
+                            // ALSO emit the dedicated content-free
                             // autonomy:denial_breaker_tripped event so `comis fleet` surfaces the
                             // trip as a separable `denialBreakerTrips` count. The execution:aborted
                             // emit above flips a UI phase only (no fleet-ingestion path) and its
                             // `denial_breaker` reason is never a session endReason/breakerTripCount,
-                            // so the trip would otherwise be INVISIBLE to the fleet lens (the
-                            // milestone-audit gap). rootRunId is in scope (the `!== undefined` guard
+                            // so the trip would otherwise be INVISIBLE to the fleet lens.
+                            // rootRunId is in scope (the `!== undefined` guard
                             // above); systemNowMs is the globals-gate-safe wiring clock (no Date.now).
                             // Content-free: the rootRunId (an id) + timestamp ONLY — the deny reason
                             // rides the escalate() below, never the typed event.
@@ -679,13 +696,13 @@ export function createRpcDispatch(deps) {
                                 reason: "consecutive floor-blocks reached denialBreakerN",
                                 hint: "the run was aborted to avoid burning the budget on a deny loop (autonomy.denialBreakerN)",
                             });
-                            // LOW-2: the tree is now dead — drop its per-root breaker + evict state
+                            // The tree is now dead — drop its per-root breaker + evict state
                             // so the in-memory maps cannot leak (the trip/kill cleanup path).
                             deps.evictRegistry?.clear(rootRunId);
                             deps.denialBreaker.evict(rootRunId);
                         }
                         else if (mode === "unattended") {
-                            // UNATT-01/03: a would-ask deny under unattended escalates (out-of-band
+                            // A would-ask deny under unattended escalates (out-of-band
                             // + auditable) and the run CONTINUES (the re-throw below). Content-free.
                             deps.escalate?.({
                                 kind: "would_ask_denied",
@@ -732,7 +749,7 @@ export function createRpcDispatch(deps) {
                 safeParams = rest;
             }
             else if (BINARY_PARAM_METHODS.has(method)) {
-                // WR-04: omit large base64/binary payload fields (image/video/audio
+                // Omit large base64/binary payload fields (image/video/audio
                 // bytes) from the log payload — content-hygiene (never log message
                 // bodies). Shallow-copy minus the binary keys; the method + small
                 // params (prompt, mimeType, language) remain for triage.
@@ -744,7 +761,14 @@ export function createRpcDispatch(deps) {
             deps.logger[classified.level]({
                 method,
                 params: safeParams,
-                err,
+                // An expected typed refusal (auth/validation/precondition — level
+                // "warn") logs its MESSAGE only: passing the Error object makes the
+                // serializer emit the full stack, and a routine operator flow (every
+                // `comis explain` run probes the admin-gated obs.explain before
+                // falling back offline) then reads as a fault in the daemon log.
+                // Stack traces are DEBUG-only; unclassified internal errors keep the
+                // full err (the stack IS the diagnostic there).
+                err: classified.level === "warn" ? (err instanceof Error ? err.message : String(err)) : err,
                 hint: classified.hint,
                 errorKind: classified.errorKind,
             }, "JSON-RPC method error");

package/node_modules/@comis/daemon/dist/api/secrets-handlers.js

@@ -277,7 +277,7 @@ export function createSecretsHandlers(deps) {
                     agentId: "system",
                     tenantId: deps.container.config.tenantId ?? "default",
                     actionType: "secrets.set",
-                    // AUDIT-04 / M1: a secret MUTATION is a security signal — set `kind`
+                    // A secret MUTATION is a security signal — set `kind`
                     // explicitly (mirror secrets.get) so it persists as a security-signal
                     // kind, not the generic `audit`/info family.
                     kind: "secret_access",
@@ -301,7 +301,7 @@ export function createSecretsHandlers(deps) {
                 agentId: "system",
                 tenantId: deps.container.config.tenantId ?? "default",
                 actionType: "secrets.set",
-                // AUDIT-04 / M1: security-signal kind for the secret mutation.
+                // Security-signal kind for the secret mutation.
                 kind: "secret_access",
                 classification: "destructive",
                 outcome: "success",
@@ -426,7 +426,7 @@ export function createSecretsHandlers(deps) {
                     agentId: "system",
                     tenantId: deps.container.config.tenantId ?? "default",
                     actionType: "secrets.delete",
-                    // AUDIT-04 / M1: security-signal kind for the secret mutation.
+                    // Security-signal kind for the secret mutation.
                     kind: "secret_access",
                     classification: "destructive",
                     outcome: "failure",
@@ -448,7 +448,7 @@ export function createSecretsHandlers(deps) {
                 agentId: "system",
                 tenantId: deps.container.config.tenantId ?? "default",
                 actionType: "secrets.delete",
-                // AUDIT-04 / M1: security-signal kind for the secret mutation.
+                // Security-signal kind for the secret mutation.
                 kind: "secret_access",
                 classification: "destructive",
                 outcome: "success",

package/node_modules/@comis/daemon/dist/api/session-handlers/session-archive.d.ts

@@ -7,10 +7,10 @@
  *   - session.export: dump full session payload (admin-only)
  *   - session.reset_conversation: COMPLETE cross-mode forget — clears ALL
  *     THREE transcript layers: the LCD lossless-store history, the daemon
- *     sessionStore working transcript (Phase 164-06; supersedes Phase 164-03
- *     context.reset_lcd), and the pi runtime session (live finding 2026-06-11:
- *     without the runtime destroy the surviving JSONL re-ingested wholesale on
- *     the next turn and the "forgotten" conversation resurrected).
+ *     sessionStore working transcript, and the pi runtime session (observed
+ *     live: without the runtime destroy the surviving JSONL re-ingested
+ *     wholesale on the next turn and the "forgotten" conversation
+ *     resurrected).
  *
  * @module
  */