comisai 1.0.44 → 1.0.46

package/node_modules/@comis/daemon/dist/api/session-handlers/session-archive.js

@@ -9,10 +9,10 @@
  *   - session.export: dump full session payload (admin-only)
  *   - session.reset_conversation: COMPLETE cross-mode forget — clears ALL
  *     THREE transcript layers: the LCD lossless-store history, the daemon
- *     sessionStore working transcript (Phase 164-06; supersedes Phase 164-03
- *     context.reset_lcd), and the pi runtime session (live finding 2026-06-11:
- *     without the runtime destroy the surviving JSONL re-ingested wholesale on
- *     the next turn and the "forgotten" conversation resurrected).
+ *     sessionStore working transcript, and the pi runtime session (observed
+ *     live: without the runtime destroy the surviving JSONL re-ingested
+ *     wholesale on the next turn and the "forgotten" conversation
+ *     resurrected).
  *
  * @module
  */
@@ -49,13 +49,13 @@ export function bindSessionArchiveHandlers(deps) {
             // Clear approval cache entries for the deleted session to prevent
             // stale cached approvals from auto-approving in a new session with the same key.
             deps.approvalGate?.clearApprovalCache(sessionKey);
-            // CR-02 (175-REVIEW): session destroy also drops the executor's
-            // session-scoped state for this key (schema snapshots, the GBNF-02
-            // strip-retry once-gate, JIT-guide delivery, cache latches) so a new
-            // session reusing the key starts genuinely fresh.
+            // Session destroy also drops the executor's session-scoped state for
+            // this key (schema snapshots, the grammar strip-retry once-gate,
+            // JIT-guide delivery, cache latches) so a new session reusing the key
+            // starts genuinely fresh.
             deps.clearAgentSessionState?.(sessionKey);
-            // Delete ⊇ reset: sever the OTHER two transcript layers too (live C7
-            // finding, 2026-06-12). Without the runtime destroy, the surviving
+            // Delete ⊇ reset: sever the OTHER two transcript layers too (observed
+            // live). Without the runtime destroy, the surviving
             // live JSONL re-surfaces the "deleted" session via session.list's
             // scanJsonlSessions merge; without the LCD delete, a recreated
             // same-key session re-reads the old conversation (the resurrection
@@ -109,7 +109,7 @@ export function bindSessionArchiveHandlers(deps) {
             const previousMessageCount = data.messages.length;
             // Clear messages but preserve metadata (identity)
             deps.sessionStore.saveByFormattedKey(sessionKey, [], data.metadata);
-            // COMPACT-STORE-MISS (30uc-20260624): a live chat is file-JSONL-only, so the
+            // A live chat is file-JSONL-only, so the
             // SQLite saveByFormattedKey([]) above is a NO-OP for it — the runtime destroy
             // is what actually clears the working transcript (mirrors session.delete +
             // reset_conversation). Without it, reset reported success while the JSONL
@@ -150,8 +150,7 @@ export function bindSessionArchiveHandlers(deps) {
                 updatedAt: data.updatedAt,
             };
         },
-        // Phase 164-06: COMPLETE cross-mode conversation reset.
-        // Supersedes Phase 164-03 context.reset_lcd (LCD-only).
+        // COMPLETE cross-mode conversation reset (an LCD-only reset is not enough).
         //
         // This operation clears BOTH layers to guarantee a clean slate in all modes:
         //   1. LCD store (dag mode: the durable history the model reads at turn-start)
@@ -178,10 +177,10 @@ export function bindSessionArchiveHandlers(deps) {
             const userParams = stripInternalFields(rawParams);
             const params = SessionResetConversationContract.request.parse(userParams);
             const startMs = systemNowMs();
-            // TARGET-01: this is an ADMIN RPC, so the caller is trusted to name which agent's
+            // This is an ADMIN RPC, so the caller is trusted to name which agent's
             // conversation to forget. An explicit `agentId` selects the scope; absent, fall
-            // back to the default. (tenantId stays from trusted daemon context.) Live finding
-            // 2026-06-13: hardcoding defaultAgentId reset the wrong agent's LCD (0 rows).
+            // back to the default. (tenantId stays from trusted daemon context.) Observed
+            // live: hardcoding defaultAgentId reset the wrong agent's LCD (0 rows).
             const resolvedAgentId = params.agentId ?? deps.defaultAgentId;
             const scope = {
                 conversationId: sessionKey,
@@ -204,7 +203,7 @@ export function bindSessionArchiveHandlers(deps) {
             // Clear approval cache to prevent stale approvals from auto-approving in a
             // fresh context after the reset (same pattern as session.delete + session.reset).
             deps.approvalGate?.clearApprovalCache(sessionKey);
-            // Layer 3: pi runtime session (live finding 2026-06-11). Without this
+            // Layer 3: pi runtime session. Without this
             // destroy, the surviving runtime JSONL re-ingests WHOLESALE on the next
             // turn (lcd-ingest epoch rebase — the deleted cursor makes live[0] a new
             // epoch) and the "forgotten" conversation resurrects into the DAG.
@@ -222,8 +221,8 @@ export function bindSessionArchiveHandlers(deps) {
                     hint: "destroyRuntimeSession not wired — the pi runtime transcript survives this reset and the conversation may resurrect on the next turn (lcd-ingest re-ingests the surviving JSONL)",
                 }, "Runtime session layer not wired (reset is LCD + sessionStore only)");
             }
-            // CR-02 (175-REVIEW): a COMPLETE forget must also drop the executor's
-            // session-scoped state for this key — most importantly the GBNF-02
+            // A COMPLETE forget must also drop the executor's
+            // session-scoped state for this key — most importantly the grammar
             // strip-retry once-gate (a reset session previously inherited the
             // closed gate and terminal-failed its first grammar-400 with zero
             // repair attempts), plus tool-schema snapshots / JIT-guide delivery /
@@ -242,7 +241,7 @@ export function bindSessionArchiveHandlers(deps) {
                 durationMs: systemNowMs() - startMs,
                 submodule: "session-reset-conversation",
             }, "Conversation reset (LCD + sessionStore + runtime)");
-            // Phase 172-03 (DIST-05): --memory honest reset. Deletes the RAG-memory
+            // --memory honest reset. Deletes the RAG-memory
             // rows by source_session_key — ONE query covers BOTH paired-conversation
             // memories AND lcd-distilled episodic memories — then unlinks them from
             // consolidated observations (orphan→delete, multi-source→keep). The
@@ -256,7 +255,7 @@ export function bindSessionArchiveHandlers(deps) {
                 lcdRowsDeleted,
                 sessionMessagesCleared,
                 runtimeSessionDestroyed,
-                resolvedAgentId, // TARGET-01: state the agent acted on (no silent default)
+                resolvedAgentId, // state the agent acted on (no silent default)
             };
             const requestMemory = (rawParams.memory ?? false);
             if (requestMemory) {
@@ -266,7 +265,7 @@ export function bindSessionArchiveHandlers(deps) {
                 let memoriesDeleted;
                 if (!deps.memoryPort?.deleteBySessionKey) {
                     // Graceful degrade: the deployment did not wire a MemoryPort (or the
-                    // adapter predates DIST-05). LCD + sessionStore are still cleared; the
+                    // adapter lacks deleteBySessionKey). LCD + sessionStore are still cleared; the
                     // --memory flag is honestly reported as ignored (no false success).
                     deps.logger.warn({
                         method: SessionResetConversationContract.method,
@@ -280,7 +279,7 @@ export function bindSessionArchiveHandlers(deps) {
                     // A real delete is attempted — report 0 even on failure (an honest
                     // "attempted, nothing deleted"), never undefined.
                     memoriesDeleted = 0;
-                    // WR-02: capture THIS session's memory ids BEFORE the destructive
+                    // Capture THIS session's memory ids BEFORE the destructive
                     // delete, so --purge-derived can be session-scoped (source_ids ∩
                     // thisSessionIds) instead of the coarse "any dangling source id" sweep
                     // that would over-delete unrelated observations. Non-fatal: if the
@@ -327,7 +326,7 @@ export function bindSessionArchiveHandlers(deps) {
                         // sources — orphan→delete, multi-source→keep. Only when something was
                         // deleted (nothing to unlink otherwise). Non-fatal.
                         if (memoriesDeleted > 0 && deps.consolidationStore) {
-                            // WR-05: thread agentId so the unlink scope matches the delete's
+                            // Thread agentId so the unlink scope matches the delete's
                             // (tenant, agent) scope exactly (a different agent's observation is
                             // never touched).
                             const unlinkResult = await deps.consolidationStore.unlinkDeletedSources(sessionKey, scope.tenantId, scope.agentId);
@@ -354,7 +353,7 @@ export function bindSessionArchiveHandlers(deps) {
                     // corroboration). Only fires when explicitly requested. Non-fatal.
                     const purgeDerived = (rawParams.purge_derived ?? false);
                     if (purgeDerived && deps.consolidationStore) {
-                        // WR-05: agentId scopes the purge to this agent. WR-02: thisSessionIds
+                        // agentId scopes the purge to this agent; thisSessionIds
                         // (captured before the delete) makes the purge match
                         // source_ids ∩ thisSessionIds — only observations derived from THIS
                         // session, never an unrelated observation with a prior dangling id.

package/node_modules/@comis/daemon/dist/api/session-handlers/session-helpers.d.ts

@@ -55,7 +55,7 @@ export declare function loadJsonlSession(filePath: string): {
     updatedAt: number;
 } | undefined;
 /**
- * COMPACT-STORE-MISS (30uc-20260624): load a session's transcript from EITHER
+ * Load a session's transcript from EITHER
  * store, keyed by the canonical formatted key. Live channel conversations are
  * persisted ONLY as file JSONL by the pi session manager
  * (`workspace/sessions/<tenant>/<channel>/<userId>~peer~<peerId>.jsonl`), never

package/node_modules/@comis/daemon/dist/api/session-handlers/session-helpers.js

@@ -36,7 +36,7 @@ export const IS_DEV = systemGetEnv("NODE_ENV") !== "production";
  * observability artifacts (`<file>.jsonl.trajectory.jsonl`). Both scanners
  * must share this predicate: counting trajectory EVENTS as session messages
  * re-surfaced a deleted session in session.list as
- * `default:<name>.jsonl.trajectory` (live C7 finding, 2026-06-12).
+ * `default:<name>.jsonl.trajectory` (observed live).
  */
 function isLiveTranscriptFile(file) {
     return file.endsWith(".jsonl") && !file.endsWith(".trajectory.jsonl");
@@ -151,8 +151,8 @@ export function scanWorkspaceSessions(workspaceDir) {
                     // file `111~peer~111.jsonl` produced the hybrid `tenant:111~peer~111:channel`
                     // that parseFormattedSessionKey + `explain`/`mirror` reject — "no trajectory
                     // found" on a session whose stored key is `tenant:111:channel:peer:111`
-                    // (UX-1 added channelDir but missed the peer encoding; live 2026-06-21 rig
-                    // Phase-0). Fall back to the legacy splice only when the path is unparseable.
+                    // (an earlier fix added channelDir but missed the peer encoding).
+                    // Fall back to the legacy splice only when the path is unparseable.
                     const parsedKey = pathToSessionKey(filePath, sessionsRoot);
                     const sessionKey = parsedKey
                         ? formatSessionKey(parsedKey)
@@ -220,7 +220,7 @@ export function loadJsonlSession(filePath) {
     }
 }
 /**
- * COMPACT-STORE-MISS (30uc-20260624): load a session's transcript from EITHER
+ * Load a session's transcript from EITHER
  * store, keyed by the canonical formatted key. Live channel conversations are
  * persisted ONLY as file JSONL by the pi session manager
  * (`workspace/sessions/<tenant>/<channel>/<userId>~peer~<peerId>.jsonl`), never

package/node_modules/@comis/daemon/dist/api/session-handlers/session-list.d.ts

@@ -17,8 +17,8 @@ import { type SessionHandlerDeps } from "./session-helpers.js";
  *
  * Shared so search mode can NEVER again drift from list mode: search previously did
  * `listDetailed()` ALONE and was blind to JSONL-only sessions, so `session.search`
- * returned 0 hits for content `session.history`/`session.list` could see (live
- * 2026-06-20: the chat-API session is JSONL-only — the SQLite `sessions` table was
+ * returned 0 hits for content `session.history`/`session.list` could see (observed
+ * live: the chat-API session is JSONL-only — the SQLite `sessions` table was
  * empty — so every search returned empty).
  */
 export declare function enumerateListableSessions(deps: SessionHandlerDeps, tenantId: string | undefined): ReturnType<SessionHandlerDeps["sessionStore"]["listDetailed"]>;

package/node_modules/@comis/daemon/dist/api/session-handlers/session-list.js

@@ -19,8 +19,8 @@ import { IS_DEV, scanJsonlSessions, scanWorkspaceSessions, loadJsonlSession, } f
  *
  * Shared so search mode can NEVER again drift from list mode: search previously did
  * `listDetailed()` ALONE and was blind to JSONL-only sessions, so `session.search`
- * returned 0 hits for content `session.history`/`session.list` could see (live
- * 2026-06-20: the chat-API session is JSONL-only — the SQLite `sessions` table was
+ * returned 0 hits for content `session.history`/`session.list` could see (observed
+ * live: the chat-API session is JSONL-only — the SQLite `sessions` table was
  * empty — so every search returned empty).
  */
 export function enumerateListableSessions(deps, tenantId) {
@@ -54,7 +54,7 @@ export function bindSessionListHandlers(deps) {
             // kind="all" + sinceMinutes=undefined). Internal-field reads BEFORE strip.
             const callerMetadata = rawParams._callerMetadata;
             const callerSessionKey = rawParams._callerSessionKey;
-            // CR-03: the tool.invoke rpc route injects `_agentId = lease.agentId`; its
+            // The tool.invoke rpc route injects `_agentId = lease.agentId`; its
             // PRESENCE is the unforgeable agent-origin signal (inbound _agentId is
             // stripped from external callers at the gateway). Admin/operator/CLI calls
             // arrive with NO _agentId and keep full enumeration.
@@ -88,12 +88,12 @@ export function bindSessionListHandlers(deps) {
                     }
                 });
             }
-            // AgentId self-scope (CR-03): an agent-origin caller may enumerate ONLY
+            // AgentId self-scope: an agent-origin caller may enumerate ONLY
             // its own sessions. Mirror session.search's `_agentId` filter exactly
             // (the predicate `parseFormattedSessionKey(s.sessionKey)?.agentId ===
             // callerAgentId`) so a jailed orch:read script cannot harvest the
             // directory of every agent's/user's sessions (the keys that would turn
-            // the CR-02 single-session read into a turnkey cross-tenant exfiltration,
+            // a single-session read into a turnkey cross-tenant exfiltration,
             // plus a userId/channelId enumeration leak in its own right). Fail CLOSED
             // (filter to the caller's own) — composes with the sub-agent narrowing
             // below. When `callerAgentId` is undefined (admin / operator / CLI) the
@@ -181,8 +181,8 @@ export function bindSessionListHandlers(deps) {
             // is a contiguous substring. The tool advertises "keywords"; a literal
             // indexOf on the joined query silently returned 0 for multi-keyword
             // queries whose terms were separated in the text (e.g. "axolotl Quark"
-            // vs "...axolotl named Quark") — a silent-empty footgun (live finding
-            // 2026-06-12). A single-token query degenerates to the prior substring
+            // vs "...axolotl named Quark") — a silent-empty footgun observed
+            // live. A single-token query degenerates to the prior substring
             // behavior, so existing phrase/keyword callers are unaffected.
             // Strip surrounding double-quotes per token: the tool-side FTS5
             // sanitizer wraps dotted/hyphenated terms (e.g. "chat-send", "v1.0")
@@ -200,7 +200,7 @@ export function bindSessionListHandlers(deps) {
                 // the OpenAI-compat chat session + any pi-agent-session-manager session is
                 // JSONL-only (the primary store's loadByFormattedKey returns null for it), so
                 // without this fallback session.search SKIPPED every such session → 0 hits for
-                // content session.history could read (live 2026-06-20). The enumerated entry
+                // content session.history could read (observed live). The enumerated entry
                 // carries the JSONL path from scanWorkspaceSessions.
                 if (!data && session.metadata?._workspaceJsonlPath) {
                     data = loadJsonlSession(session.metadata._workspaceJsonlPath);

package/node_modules/@comis/daemon/dist/api/session-handlers/session-mutate.js

@@ -46,7 +46,7 @@ export function bindSessionMutateHandlers(deps) {
             return result;
         },
         [SessionSpawnContract.method]: async (rawParams) => {
-            // CAP-03/05 (v8 §3.7): the capability gate lives HERE because the agent
+            // The capability gate lives HERE because the agent
             // loop reaches handlers without passing checkScope (the in-process
             // bypass). Read the injected _capabilities from raw params BEFORE the
             // strip; throws CapabilityDeniedError when orch:spawn is not held.
@@ -114,8 +114,8 @@ export function bindSessionMutateHandlers(deps) {
             // null ("full") → pass ReadonlySet<never> sentinel so gate still checks denylist;
             // non-null → pass the computed set for membership checks.
             const reachableToolNames = reachableToolNamesSet !== null ? reachableToolNamesSet : undefined;
-            // Phase 213 CR-01: establish the tree-stable rootRunId (+ parentLeaseId)
-            // BEFORE the spawn so the tree-wide ceiling (CEIL-01), killByRootRun, and
+            // Establish the tree-stable rootRunId (+ parentLeaseId)
+            // BEFORE the spawn so the tree-wide spawn ceiling, killByRootRun, and
             // the per-root budget all key on ONE id per spawn tree. Two cases:
             //   - DESCENDANT: this spawn was initiated by a running sub-agent calling
             //     sessions_spawn. The dispatcher injected THAT sub-agent's session key
@@ -123,8 +123,7 @@ export function bindSessionMutateHandlers(deps) {
             //     `run.sessionKey`. Inherit that run's rootRunId AND its parentLeaseId
             //     (the lease that authorized the parent) so the whole subtree shares
             //     one root — without this every descendant minted a fresh root and the
-            //     fork-bomb escaped the ceiling (RESEARCH Pitfall 1, the silent
-            //     under-count).
+            //     fork-bomb escaped the ceiling (a silent under-count).
             //   - TOP-LEVEL: an operator/channel turn with no parent run. Reuse the
             //     session's stable synthetic root via resolveRootRunId so the ceiling
             //     and the budget meter agree on the same tree id.
@@ -143,7 +142,7 @@ export function bindSessionMutateHandlers(deps) {
                 agentId: spawnAgentId,
                 callerSessionKey,
                 callerAgentId: callerAgentIdInternal,
-                // CEIL-01/REVOKE-03: propagate the resolved tree root + the authorizing
+                // Propagate the resolved tree root + the authorizing
                 // lease so the ceiling/kill/budget see one tree (omit when absent).
                 ...(resolvedRootRunId !== undefined ? { rootRunId: resolvedRootRunId } : {}),
                 ...(inheritedParentLeaseId !== undefined ? { parentLeaseId: inheritedParentLeaseId } : {}),
@@ -162,10 +161,10 @@ export function bindSessionMutateHandlers(deps) {
                 requiredTools,
                 includeParentHistory,
                 reachableToolNames,
-                // GEN-03: ride the parent's resolved reply language into child session
+                // Ride the parent's resolved reply language into child session
                 // metadata (same channel as objective/toolGroups); read off the live ALS.
                 resolvedLanguage: tryGetContext()?.resolvedLanguage,
-                // WT-01: thread the `worktree?` request from the RPC param so the runner
+                // Thread the `worktree?` request from the RPC param so the runner
                 // persists it onto the child session metadata; executeSubAgent then runs
                 // the child in an isolated git worktree (auto-clean-if-unchanged). Omit
                 // when absent so the no-worktree spawn stays byte-identical.
@@ -194,7 +193,7 @@ export function bindSessionMutateHandlers(deps) {
             return baseAsyncResponse;
         },
         [SessionCompactContract.method]: async (rawParams) => {
-            // COMPACT-KEY (30uc-20260624): self-resolve the CALLER's own session. An
+            // Self-resolve the CALLER's own session. An
             // agent should NOT have to construct/guess its own formatted key (it guessed
             // ":telegram:" where the real key uses ":peer:"). Read the dispatcher-injected
             // `_callerSessionKey` BEFORE the strip (the same internal field session.send
@@ -210,7 +209,7 @@ export function bindSessionMutateHandlers(deps) {
             const userParams = stripInternalFields(rawParams);
             const params = SessionCompactContract.request.parse(userParams);
             const instructions = params.instructions;
-            // COMPACT-STORE-MISS (30uc-20260624): read from EITHER store — a live channel
+            // Read from EITHER store — a live channel
             // chat is file-JSONL-only (the SQLite sessions table is empty for it), so a
             // SQLite-only read threw "Session not found" for the active session.
             const data = loadSessionAnyStore(deps, sessionKey);

package/node_modules/@comis/daemon/dist/api/session-handlers/session-read.js

@@ -55,7 +55,7 @@ export function bindSessionReadHandlers(deps) {
             // The session-not-found error message preserves the user-friendly hint
             // including the list of available keys — that path runs AFTER the
             // parse since session_key must be present to do the lookup.
-            // Internal-field read BEFORE strip (caller-scoping — CR-02). The
+            // Internal-field read BEFORE strip (caller-scoping). The
             // tool.invoke rpc route injects `_agentId = lease.agentId`; its PRESENCE
             // is the unforgeable agent-origin signal (inbound _agentId is stripped
             // from external callers at the gateway). Admin/operator/CLI calls arrive
@@ -66,7 +66,7 @@ export function bindSessionReadHandlers(deps) {
             const sessionKey = params.session_key;
             const offset = params.offset ?? 0;
             const limit = params.limit ?? 20;
-            // CR-02 self-scope: an agent-origin caller may read ONLY its own
+            // Agent self-scope: an agent-origin caller may read ONLY its own
             // session. Mirror session.search's `_agentId` filter exactly
             // (session-list.ts:163-168) — the session belongs to the caller iff
             // `parseFormattedSessionKey(sessionKey)?.agentId === callerAgentId`.

package/node_modules/@comis/daemon/dist/api/shared/assert-not-agent-origin.js

@@ -4,7 +4,7 @@
 // gateway/method-router converts it to a JSON-RPC error response (mirrors the
 // existing `_trustLevel === "admin"` admin-gate throws in *-handlers.ts).
 /**
- * ORIGIN-01 deny-by-origin guard (v8 §3.1 / §22.3 floor item 1).
+ * Deny-by-origin guard for admin-scoped control-plane methods.
  *
  * The confused-deputy mitigation for the control plane: the in-process agent
  * loop dispatches straight through `createRpcDispatch` (bypassing
@@ -12,7 +12,7 @@
  * call may reach an admin-scoped method (`secrets.*`/`tokens.*`/`config.*`/
  * `agents.*`/`mcp.*`/…).
  *
- * **Trust-tiered (30uc-20260624 decision):** an agent turn operating on behalf
+ * **Trust-tiered:** an agent turn operating on behalf
  * of an **admin-trust** user INHERITS that user's control-plane privileges — so
  * an admin-trust agent origin is ALLOWED through to the admin handler (which
  * re-checks `_trustLevel === "admin"`, defense-in-depth). A **non-admin** agent
@@ -23,10 +23,10 @@
  * (resolved per-message in `execution-pipeline`, default `"user"`).
  *
  * Soundness of the two signals:
- *   - `_agentId` — Plan 03 strips inbound `INTERNAL_FIELD_NAMES` (incl. `_agentId`)
- *     from external WS/REST callers before dispatch, so its *presence* here is an
- *     unforgeable agent-origin signal; the sole legitimate injector is
- *     `createAgentRpcCall` (ORIGIN-03).
+ *   - `_agentId` — the gateway strips inbound `INTERNAL_FIELD_NAMES` (incl.
+ *     `_agentId`) from external WS/REST callers before dispatch, so its *presence*
+ *     here is an unforgeable agent-origin signal; the sole legitimate injector is
+ *     `createAgentRpcCall`.
  *   - `_trustLevel` — ALSO in `INTERNAL_FIELD_NAMES` (external-stripped) AND
  *     re-injected by `createAgentRpcCall` from the framework ALS trust
  *     (post-spread, so a tool- or agent-supplied value cannot override the

package/node_modules/@comis/daemon/dist/api/shared/builtin-provider-guard.js

@@ -1,26 +1,4 @@
-// SPDX-License-Identifier: Apache-2.0
-/**
- * Built-in provider redundancy guard for providers.create.
- *
- * Rejects providers_manage create attempts that would shadow pi-ai's
- * dynamic catalog with a redundant custom entry. A built-in provider
- * (one in pi-ai's getProviders()) already has its full model list
- * available via the catalog -- custom entries are only legitimate for
- * proxies (different baseUrl) or non-SDK providers. Without this guard,
- * an LLM agent that creates a catalog-shadowing entry with a stale or
- * invented model id sets up downstream 404 / "model not found" failures
- * (production: 2026-05-01 08:53-08:54 trace).
- *
- * Generic by construction: rejection message uses ${providerId} +
- * ${apiKeyName} interpolation only -- no per-provider hardcoded names
- * in the source template (catalog-agnostic). Pinned by source-grep
- * regression test in builtin-provider-guard.test.ts.
- *
- * Mirrors credential-resolver.ts shape.
- *
- * @module
- */
-import { getProviders, getModels } from "@earendil-works/pi-ai";
+import { getProviders, getModels } from "@earendil-works/pi-ai/compat";
 /**
  * Check whether a providers.create call would land a redundant custom
  * entry that shadows pi-ai's dynamic catalog. Returns ok=true when the

package/node_modules/@comis/daemon/dist/api/shared/credential-resolver.js

@@ -1,38 +1,4 @@
-// SPDX-License-Identifier: Apache-2.0
-/**
- * Pre-write credential validator for agent provider/model patches.
- *
- * When a patch sets agents.<id>.provider, verify the API key is resolvable
- * from one of the sources pi-coding-agent will consult at runtime. Reject
- * fail-loud with an actionable error if no source resolves.
- *
- * Resolution chain (matches pi-coding-agent runtime semantics):
- *   1. KEYLESS_PROVIDER_TYPES.has(entry.type) — ollama / lm-studio
- *   2. providers.entries.<provider>.apiKeyName → secretManager.has(...)
- *   3. Comis OAuth profiles — agent.oauthProfiles[provider] resolved against an
- *      injected oauthProfileLoader (the OAuthCredentialStorePort handle held by
- *      the daemon, adapted to a synchronous has-check at the call site).
- *   4. Secret-store canonical key — for the DEFAULT_PROVIDER_KEYS providers
- *      (anthropic/openai/google/groq/mistral), secretManager.has(canonicalKey).
- *      This mirrors the runtime: createAuthStorageAdapter hydrates exactly these
- *      providers into AuthStorage via secretManager.get(canonicalKey), so a bare
- *      `provider: anthropic` agent (no providers.entries block) works in
- *      `security.storage: encrypted` mode where the key is NOT in process.env.
- *   5. pi-ai's getEnvApiKey(provider) — canonical env vars (incl. ANTHROPIC_OAUTH_TOKEN
- *      and AWS/ADC special-cases). Does NOT cover comis-managed OAuth profiles in
- *      ~/.comis/auth-profiles.json (e.g. openai-codex).
- *
- * Note on synchronous loader facade: `OAuthCredentialStorePort.has`
- * is async (returns Promise<Result<boolean, Error>>). To avoid an async cascade
- * through every call site, this resolver remains SYNCHRONOUS and accepts a
- * sync facade (`oauthProfileLoader: { has(profileId: string): boolean }`).
- * The async port `has()` call MUST be performed at the daemon edge
- * (config-handlers / agent-handlers) and adapted into the closure. This keeps
- * the port-side validator I/O-free (Hexagonal: validator does no I/O).
- *
- * @module
- */
-import { getEnvApiKey, getProviders, getModels } from "@earendil-works/pi-ai";
+import { getEnvApiKey, getProviders, getModels } from "@earendil-works/pi-ai/compat";
 import { KEYLESS_PROVIDER_TYPES } from "@comis/core";
 import { DEFAULT_PROVIDER_KEYS } from "@comis/agent";
 export function resolveProviderCredential(targetProvider, deps) {

package/node_modules/@comis/daemon/dist/api/shared/emit-capability-audit.d.ts

@@ -1,4 +1,4 @@
-import type { EventMap } from "@comis/core";
+import type { AgentCapability, EventMap } from "@comis/core";
 /**
  * The minimal structural deps the emitter reads. `ApiDispatchDeps` /
  * `CapabilityEndpointDeps` (whose `container.eventBus` is the full
@@ -30,22 +30,41 @@ export interface CapabilityAuditRecord {
     readonly runId?: string;
     /**
      * The tree-stable root (the real lease's rootRunId, or the synthetic in-process
-     * root). Optional (WR-02): a gated decision with no resolvable root is still a
+     * root). Optional: a gated decision with no resolvable root is still a
      * durable security fact and emits `audit:event`; only the `capability:audited`
      * TREE producer (which needs a placeable root) is suppressed when this is absent.
      */
     readonly rootRunId?: string;
-    /** The real lease id (socket). ABSENT in-process — NEVER fabricated (G1). */
+    /** The real lease id (socket). ABSENT in-process — NEVER fabricated. */
     readonly leaseId?: string;
     /** The parent lease id (socket, when present) — the spawn-tree parent edge. */
     readonly parentLeaseId?: string;
     /** The authorization outcome — a closed string-literal union (AGENTS §2.8). */
     readonly decision: "allow" | "deny";
 }
+/**
+ * The closed capability→action-class map for the durable audit trail's
+ * `classification` (the `read|mutate|destructive` enum on `AuditEventSchema`).
+ * Read-class caps (they observe) → `"read"`; mutate-class caps (they change
+ * state or send outward) → `"mutate"`. Typed `Record<AgentCapability, ...>` so a
+ * new `AGENT_CAPABILITIES` member is a COMPILE-VISIBLE gap here — never a silent
+ * miss. There is no `"destructive"` entry: the allow path attributes read/mutate;
+ * a DENY is the only `"destructive"` emitter (a denied call is the signal).
+ */
+export declare const CAPABILITY_ACTION_CLASS: Record<AgentCapability, "read" | "mutate">;
+/**
+ * Classify a capability into the audit `classification` enum — a PURE lookup (no
+ * I/O, no throw; the `attenuateCaps` pure discipline). Returns the `read`/`mutate`
+ * action class for a known {@link import("@comis/core").AgentCapability}, or
+ * `undefined` for ANY OTHER string (the in-process dispatch path may pass a
+ * non-`orch:` cap) — an honest unknown that OMITS the field rather than
+ * mislabeling it (e.g. tagging a mutate as read).
+ */
+export declare function classifyCapabilityAction(capability: string): "read" | "mutate" | undefined;
 /**
  * Emit the per-cap audit for a gated call's authorization decision — BOTH the
- * durable `audit:event` (AUDIT-02) and the `capability:audited` trajectory
- * record (TREE). Pure emitter: emits, never throws.
+ * durable `audit:event` and the `capability:audited` trajectory
+ * record. Pure emitter: emits, never throws.
  *
  * @param deps - structural deps carrying `container.eventBus` + tenant config.
  * @param record - the content-free per-cap fact. Optional fields

package/node_modules/@comis/daemon/dist/api/shared/emit-capability-audit.js

@@ -1,28 +1,34 @@
 // SPDX-License-Identifier: Apache-2.0
 /**
- * AUDIT-01 / AUDIT-02 / TREE (v2.29 Phase 215 Plan 01) — the per-capability
- * audit emitter at the gate chokepoints.
+ * The per-capability audit emitter at the gate chokepoints.
  *
  * For every capability-gated call (an ALLOWED *and* a DENIED one), this emits
  * the authorization decision at the SINGLE chokepoint as TWO bus events:
  *
- *   1. `audit:event` — the DURABLE trail (AUDIT-02). Rides the shipped
+ *   1. `audit:event` — the DURABLE trail. Rides the shipped
  *      `wireAuditSink` → `obs_audit_events` + `0600 security-audit.jsonl` +
  *      `.audit()` log, reconstructable offline (no gateway). The per-cap tuple
  *      rides the content-free `metadata` free-map (sanitized at the sink).
- *   2. `capability:audited` — the TREE record (the spawn-tree's per-node
- *      producer Plan 03 folds). A typed, content-free event on the trajectory.
+ *   2. `capability:audited` — the TREE record (folded by the spawn-tree's
+ *      per-node producer). A typed, content-free event on the trajectory.
  *
  * One chokepoint emits BOTH (see `rpc-dispatch.ts` in-process +
  * `setup-capability-endpoint.ts` socket). This module is a PURE emitter — it
  * emits, never throws (no `@allow-throw`); the throwing gate is the caller's
  * `requireCapability` / `assertNotAgentOrigin`.
  *
- * CONTENT-FREE (T-215-01 / Pitfall 5): the record carries ids + caps + tool
+ * CONTENT-FREE: the record carries ids + caps + tool
  * NAME + method + decision ONLY — NEVER the `tool.invoke` args, a message body,
  * a file path, or a secret name. There is deliberately no args/body parameter.
  *
- * Chokepoint asymmetry (G1): the in-process path has NO lease, so `leaseId` /
+ * CLASSIFICATION: the durable `audit:event.classification` is a member of the
+ * closed `AuditEventSchema` enum (`read | mutate | destructive`) or is OMITTED —
+ * never an out-of-enum sentinel (the sink coerces any such value to null,
+ * dropping the action class). A DENY is `destructive`; an ALLOW derives a
+ * `read`/`mutate` from the capability via {@link classifyCapabilityAction} and
+ * omits the field for an unrecognized cap (honest unknown, never a mislabel).
+ *
+ * Chokepoint asymmetry: the in-process path has NO lease, so `leaseId` /
  * `parentLeaseId` / `tool` are honestly ABSENT (omitted) and `rootRunId` is the
  * synthetic `root-session-<key>`. The socket path passes the full real tuple.
  * NEVER fabricate a `lease-<synthetic>` for the in-process record.
@@ -30,10 +36,45 @@
  * @module
  */
 import { systemNowMs } from "@comis/core";
+/**
+ * The closed capability→action-class map for the durable audit trail's
+ * `classification` (the `read|mutate|destructive` enum on `AuditEventSchema`).
+ * Read-class caps (they observe) → `"read"`; mutate-class caps (they change
+ * state or send outward) → `"mutate"`. Typed `Record<AgentCapability, ...>` so a
+ * new `AGENT_CAPABILITIES` member is a COMPILE-VISIBLE gap here — never a silent
+ * miss. There is no `"destructive"` entry: the allow path attributes read/mutate;
+ * a DENY is the only `"destructive"` emitter (a denied call is the signal).
+ */
+export const CAPABILITY_ACTION_CLASS = {
+    "orch:read": "read",
+    "orch:web": "read",
+    "orch:analyze": "read",
+    "orch:browse": "read",
+    // MCP calls observe the connected server — a read-class action. (A deny is
+    // always emitted as `destructive`, so this class is the ALLOW-path attribution.)
+    "orch:mcp": "read",
+    "orch:write": "mutate",
+    "orch:message": "mutate",
+    "orch:spawn": "mutate",
+    "orch:graph": "mutate",
+    "orch:cron": "mutate",
+    "orch:skill": "mutate",
+};
+/**
+ * Classify a capability into the audit `classification` enum — a PURE lookup (no
+ * I/O, no throw; the `attenuateCaps` pure discipline). Returns the `read`/`mutate`
+ * action class for a known {@link import("@comis/core").AgentCapability}, or
+ * `undefined` for ANY OTHER string (the in-process dispatch path may pass a
+ * non-`orch:` cap) — an honest unknown that OMITS the field rather than
+ * mislabeling it (e.g. tagging a mutate as read).
+ */
+export function classifyCapabilityAction(capability) {
+    return CAPABILITY_ACTION_CLASS[capability];
+}
 /**
  * Emit the per-cap audit for a gated call's authorization decision — BOTH the
- * durable `audit:event` (AUDIT-02) and the `capability:audited` trajectory
- * record (TREE). Pure emitter: emits, never throws.
+ * durable `audit:event` and the `capability:audited` trajectory
+ * record. Pure emitter: emits, never throws.
  *
  * @param deps - structural deps carrying `container.eventBus` + tenant config.
  * @param record - the content-free per-cap fact. Optional fields
@@ -44,8 +85,16 @@ export function emitCapabilityAudit(deps, record) {
     const isDeny = record.decision === "deny";
     const timestamp = systemNowMs();
     const tenantId = deps.container.config.tenantId ?? "default";
-    // 1. The durable AUDIT-02 trail — ALWAYS emitted for a gated decision (WR-02:
-    //    the security trail is NOT coupled to tree-root resolution). The per-cap
+    // The action class for the durable trail: a DENY is the destructive-intent
+    // signal; an ALLOW derives a read|mutate from the capability's mutation
+    // semantics and is OMITTED for an unrecognized cap (an honest unknown — never
+    // an out-of-enum sentinel the sink would drop to null). Mirrors the
+    // conditional-carry of `createAuditEvent`.
+    const classification = isDeny
+        ? "destructive"
+        : classifyCapabilityAction(record.capability);
+    // 1. The durable audit trail — ALWAYS emitted for a gated decision (the
+    //    security trail is NOT coupled to tree-root resolution). The per-cap
     //    tuple rides the content-free `metadata` free-map; optional ids (incl.
     //    rootRunId) are present only when known (honest absence in-process).
     deps.container.eventBus.emit("audit:event", {
@@ -55,7 +104,7 @@ export function emitCapabilityAudit(deps, record) {
         actionType: record.method,
         kind: isDeny ? "capability_denied" : "audit",
         outcome: isDeny ? "denied" : "success",
-        classification: isDeny ? "destructive" : "neutral",
+        ...(classification !== undefined ? { classification } : {}),
         metadata: {
             capability: record.capability,
             method: record.method,
@@ -69,7 +118,7 @@ export function emitCapabilityAudit(deps, record) {
         },
     });
     // 2. The TREE record (the spawn-tree's per-node producer) — emitted ONLY with a
-    //    resolvable root (WR-02): a node with no root is unplaceable in the tree,
+    //    resolvable root: a node with no root is unplaceable in the tree,
     //    and `capability:audited.rootRunId` is a required string. The translator
     //    (translate-orchestration-payload.ts) strips the envelope; this carries the
     //    typed content-free tuple.

package/node_modules/@comis/daemon/dist/api/shared/persist-to-config.d.ts

@@ -57,7 +57,7 @@ export declare function _pendingConfigMutations(): number;
  * Run `fn` inside a config-mutation fence so any SIGUSR2 restart that a
  * config-mutating tool schedules MID-`fn` is deferred until `fn` settles.
  *
- * RESTART-01 (live VPS 2026-06-20): a config-mutating agent tool
+ * Without the fence, a config-mutating agent tool
  * (heartbeat_manage / config.patch / agents_manage / …) called inside a
  * SYNCHRONOUS chat/responses-API turn triggered a debounced SIGUSR2 that
  * restarted the daemon UNDER the in-flight HTTP request → the request died