comisai 1.0.44 → 1.0.46

package/node_modules/@comis/daemon/dist/wiring/msteams-test-seams.d.ts

@@ -0,0 +1,62 @@
+/**
+ * Microsoft Teams live-test wiring seams — OFF BY DEFAULT.
+ *
+ * The Teams channel is architecturally impossible to point at a loopback emulator
+ * with a single config key the way Telegram (`apiRoot`) / Signal (`baseUrl`) are:
+ * inbound arrives as a Bot-Framework-JWT-signed webhook the daemon must VERIFY
+ * against the remote Bot Framework JWKS, and outbound goes to the Connector host
+ * `smba.trafficmanager.net`, which `isSafeServiceUrl` hard-allowlists. These two
+ * helpers bridge that gap for a live-test rig WITHOUT weakening either control,
+ * and they activate ONLY when their `COMIS_MSTEAMS_TEST_*` env var is set — with
+ * the env unset the daemon behaves byte-identically to production (the default
+ * remote-JWKS validator + the global fetch). They are NEVER a production knob:
+ * the vars are documented test-only in `docs/channels/msteams.mdx` and the
+ * self-drive runbook.
+ *
+ *   - `COMIS_MSTEAMS_TEST_JWKS` = a path to a public JWKS JSON. The emulator holds
+ *     the matching private key and signs inbound activity tokens; this swaps the
+ *     ingress validator for a LOCAL-JWKS one (a FULL signature + issuer + audience
+ *     verify — not a bypass) so the emulator's tokens verify offline. Production
+ *     keeps the live remote-JWKS `validateActivityJwt` untouched.
+ *   - `COMIS_MSTEAMS_TEST_CONNECTOR` = a loopback base (`http://127.0.0.1:PORT`).
+ *     This returns a `fetchImpl` that REDIRECTS the network egress of the exact
+ *     Connector hosts (+ the AAD token host) to that loopback base, keeping the
+ *     path + query verbatim — the programmatic equivalent of a hosts-override. The
+ *     `isSafeServiceUrl` host allowlist is NOT relaxed: it still runs on the real
+ *     `smba.trafficmanager.net` serviceUrl inside the adapter/connector BEFORE the
+ *     token mint; only the transport is redirected AFTER the gate passes.
+ *
+ * @module
+ */
+import type { ComisLogger } from "@comis/core";
+import type { Result } from "@comis/shared";
+/** Reads an environment variable (injected so the resolvers stay pure + testable). */
+export type EnvGetter = (key: string) => string | undefined;
+/** The env var that points the inbound validator at a local test JWKS (off by default). */
+export declare const MSTEAMS_TEST_JWKS_ENV = "COMIS_MSTEAMS_TEST_JWKS";
+/** The env var that redirects outbound Connector egress to a loopback emulator (off by default). */
+export declare const MSTEAMS_TEST_CONNECTOR_ENV = "COMIS_MSTEAMS_TEST_CONNECTOR";
+/**
+ * Resolve the inbound activity-JWT validator for the ingress, bound to `appId`.
+ *
+ * Default (env unset): the production remote-JWKS `validateActivityJwt`. When
+ * `COMIS_MSTEAMS_TEST_JWKS` names a readable JWKS file, a LOCAL-JWKS validator
+ * verifying against that key set instead (still a full signature/issuer/audience
+ * verify). The returned closure has the ingress's expected `(authHeader)` shape
+ * with the audience already closed over.
+ */
+export declare function resolveTestActivityValidator(appId: string, getEnv: EnvGetter, deps?: {
+    readonly readFileImpl?: (path: string) => string;
+    readonly logger?: ComisLogger;
+}): (authHeader: string | undefined) => Promise<Result<void, Error>>;
+/**
+ * Resolve the outbound `fetchImpl` the Teams adapter uses for its Connector +
+ * token calls.
+ *
+ * Default (env unset): `undefined` — the adapter falls back to the global fetch
+ * (production, unchanged). When `COMIS_MSTEAMS_TEST_CONNECTOR` names a loopback
+ * base, a fetch that rewrites the exact Connector/AAD hosts to that base (path +
+ * query preserved) and passes every other host through untouched. `baseFetch` is
+ * injected for testability; it defaults to the global fetch.
+ */
+export declare function resolveTestConnectorFetch(getEnv: EnvGetter, baseFetch?: typeof fetch): typeof fetch | undefined;

package/node_modules/@comis/daemon/dist/wiring/msteams-test-seams.js

@@ -0,0 +1,108 @@
+// SPDX-License-Identifier: Apache-2.0
+/**
+ * Microsoft Teams live-test wiring seams — OFF BY DEFAULT.
+ *
+ * The Teams channel is architecturally impossible to point at a loopback emulator
+ * with a single config key the way Telegram (`apiRoot`) / Signal (`baseUrl`) are:
+ * inbound arrives as a Bot-Framework-JWT-signed webhook the daemon must VERIFY
+ * against the remote Bot Framework JWKS, and outbound goes to the Connector host
+ * `smba.trafficmanager.net`, which `isSafeServiceUrl` hard-allowlists. These two
+ * helpers bridge that gap for a live-test rig WITHOUT weakening either control,
+ * and they activate ONLY when their `COMIS_MSTEAMS_TEST_*` env var is set — with
+ * the env unset the daemon behaves byte-identically to production (the default
+ * remote-JWKS validator + the global fetch). They are NEVER a production knob:
+ * the vars are documented test-only in `docs/channels/msteams.mdx` and the
+ * self-drive runbook.
+ *
+ *   - `COMIS_MSTEAMS_TEST_JWKS` = a path to a public JWKS JSON. The emulator holds
+ *     the matching private key and signs inbound activity tokens; this swaps the
+ *     ingress validator for a LOCAL-JWKS one (a FULL signature + issuer + audience
+ *     verify — not a bypass) so the emulator's tokens verify offline. Production
+ *     keeps the live remote-JWKS `validateActivityJwt` untouched.
+ *   - `COMIS_MSTEAMS_TEST_CONNECTOR` = a loopback base (`http://127.0.0.1:PORT`).
+ *     This returns a `fetchImpl` that REDIRECTS the network egress of the exact
+ *     Connector hosts (+ the AAD token host) to that loopback base, keeping the
+ *     path + query verbatim — the programmatic equivalent of a hosts-override. The
+ *     `isSafeServiceUrl` host allowlist is NOT relaxed: it still runs on the real
+ *     `smba.trafficmanager.net` serviceUrl inside the adapter/connector BEFORE the
+ *     token mint; only the transport is redirected AFTER the gate passes.
+ *
+ * @module
+ */
+import { readFileSync } from "node:fs";
+import { createLocalActivityJwtValidator, validateActivityJwt, } from "@comis/channels";
+/** The env var that points the inbound validator at a local test JWKS (off by default). */
+export const MSTEAMS_TEST_JWKS_ENV = "COMIS_MSTEAMS_TEST_JWKS";
+/** The env var that redirects outbound Connector egress to a loopback emulator (off by default). */
+export const MSTEAMS_TEST_CONNECTOR_ENV = "COMIS_MSTEAMS_TEST_CONNECTOR";
+/**
+ * The exact Bot Framework Connector hosts (+ the AAD login host) the outbound
+ * redirect rewrites to loopback. Mirrors `CLOUD_CONNECTOR_HOSTS` in
+ * msteams-connector.ts plus the client-credentials token host. Every other host
+ * passes through untouched — this is never a blanket redirect.
+ */
+const REDIRECT_HOSTS = new Set([
+    "smba.trafficmanager.net",
+    "botframework.azure.cn",
+    "login.microsoftonline.com",
+]);
+/**
+ * Resolve the inbound activity-JWT validator for the ingress, bound to `appId`.
+ *
+ * Default (env unset): the production remote-JWKS `validateActivityJwt`. When
+ * `COMIS_MSTEAMS_TEST_JWKS` names a readable JWKS file, a LOCAL-JWKS validator
+ * verifying against that key set instead (still a full signature/issuer/audience
+ * verify). The returned closure has the ingress's expected `(authHeader)` shape
+ * with the audience already closed over.
+ */
+export function resolveTestActivityValidator(appId, getEnv, deps) {
+    const jwksPath = getEnv(MSTEAMS_TEST_JWKS_ENV);
+    if (jwksPath === undefined || jwksPath.length === 0) {
+        // Production/default path: verify against the live Bot Framework JWKS.
+        return (authHeader) => validateActivityJwt(authHeader, appId);
+    }
+    // Test-only offline path: verify against a local JWKS the emulator wrote.
+    const readFileImpl = 
+    // eslint-disable-next-line security/detect-non-literal-fs-filename -- jwksPath is an operator-set test-only env var, not user input
+    deps?.readFileImpl ?? ((path) => readFileSync(path, "utf8"));
+    const jwks = JSON.parse(readFileImpl(jwksPath));
+    const issuer = getEnv("COMIS_MSTEAMS_TEST_ISSUER");
+    const validate = createLocalActivityJwtValidator(jwks, issuer !== undefined && issuer.length > 0 ? { issuer } : undefined);
+    deps?.logger?.warn({
+        channelType: "msteams",
+        hint: "Unset COMIS_MSTEAMS_TEST_JWKS in production — the msteams ingress is verifying inbound tokens against a LOCAL test JWKS, not the Bot Framework signing keys",
+        errorKind: "config",
+    }, "Microsoft Teams ingress using a LOCAL test JWKS (test-only seam)");
+    return (authHeader) => validate(authHeader, appId);
+}
+/**
+ * Resolve the outbound `fetchImpl` the Teams adapter uses for its Connector +
+ * token calls.
+ *
+ * Default (env unset): `undefined` — the adapter falls back to the global fetch
+ * (production, unchanged). When `COMIS_MSTEAMS_TEST_CONNECTOR` names a loopback
+ * base, a fetch that rewrites the exact Connector/AAD hosts to that base (path +
+ * query preserved) and passes every other host through untouched. `baseFetch` is
+ * injected for testability; it defaults to the global fetch.
+ */
+export function resolveTestConnectorFetch(getEnv, baseFetch = fetch) {
+    const loopback = getEnv(MSTEAMS_TEST_CONNECTOR_ENV);
+    if (loopback === undefined || loopback.length === 0)
+        return undefined;
+    const base = new URL(loopback);
+    const redirect = async (input, init) => {
+        const href = typeof input === "string"
+            ? input
+            : input instanceof URL
+                ? input.href
+                : input.url;
+        const target = new URL(href);
+        if (REDIRECT_HOSTS.has(target.hostname.toLowerCase())) {
+            target.protocol = base.protocol;
+            target.host = base.host;
+            return baseFetch(target.toString(), init);
+        }
+        return baseFetch(input, init);
+    };
+    return redirect;
+}

package/node_modules/@comis/daemon/dist/wiring/obs-mcp-closures.d.ts

@@ -4,7 +4,7 @@ import { assembleFleetHealthReport } from "../api/obs-handlers/index.js";
  * (operator-allowlisted `obs_explain` / `obs_fleet_health` tools). Extracted from
  * daemon.ts `bootGateway` to keep daemon.ts within the ≤3000-line architecture cap.
  *
- * SECURITY (154-03 / 161-02): these closures run the SAME assemblers the admin RPC
+ * SECURITY: these closures run the SAME assemblers the admin RPC
  * handlers delegate to, DIRECTLY under daemon authority — they do NOT go through the
  * admin-gated obs.* RPC, do NOT inject `_trustLevel:"admin"`, and are NOT reached via
  * daemonRpcForMcpClient. The only authorization boundary is the per-client
@@ -20,9 +20,9 @@ import { assembleFleetHealthReport } from "../api/obs-handlers/index.js";
  * — a "." crashes boot with PathTraversalError.
  *
  * `clock` is the SAME ClockPort wired into the RPC handler deps (load-bearing,
- * `deps.clock!`). `durableRuns` (FLEET-01/02/04, Phase 220-03) is the live durable-run
+ * `deps.clock!`). `durableRuns` is the live durable-run
  * store for the autonomy block — this closure bypasses buildRpcDispatchDeps (the RPC
- * path already wires it at daemon.ts:893), so it is the NET-NEW thread; pass
+ * path already wires it), so it is the NET-NEW thread; pass
  * `boot.durableRunStore`. Absent (durability off) ⇒ honest degradation (the autonomy
  * block is omitted), byte-identical with the offline path.
  */

package/node_modules/@comis/daemon/dist/wiring/orchestrate-replay-socket.d.ts

@@ -0,0 +1,65 @@
+/**
+ * `createOrchestrateReplaySocket` — the SEPARATE operator replay socket (REPLAY-02).
+ *
+ * A standalone `net.createServer` on its OWN 0600 socket path that speaks the SAME
+ * `{bearer, method, params}` newline-JSON cap-socket wire the jailed SDK sends, but
+ * SERVES RECORDED RESULTS: it reads the run's content-free `results/replay.jsonl`
+ * and, for a request whose `{method, sha256(params)}` matches the NEXT recorded
+ * entry (in recorded ORDER), returns the recorded pointer file's bytes as
+ * `{ result }`. Any divergence (wrong method, diverged params, exhausted log, a
+ * gone pointer) returns `{ error }` — an honest divergence signal, NEVER a
+ * fabricated success and NEVER a real dispatch.
+ *
+ * INV-1 (the load-bearing boundary): this is a PHYSICALLY SEPARATE socket, never a
+ * MODE of the production capability endpoint. It has NO LeaseManager, NO rpcCall
+ * sink, and NO tool registry — it cannot dispatch a real tool even in principle, so
+ * a re-spawned jailed script pointed at it (`COMIS_ORCH_SOCKET` → this path) can
+ * only ever re-consume its own recorded results. The authoritative production gate
+ * (`setup-capability-endpoint.ts` `startSocket`) stays single-purpose. The socket
+ * is operator-invoked + ephemeral: plan 06's admin handler binds it per-replay and
+ * tears it down in a `finally`; it is NOT bound during a normal run.
+ *
+ * The wire (buffer / MAX_LINE_BYTES fail-closed overflow / 0600 chmod / open-socket
+ * tracking for a non-hanging close) MIRRORS `setup-capability-endpoint.ts`
+ * `startSocket` so a re-spawned script cannot tell the difference at the transport
+ * layer — only the SERVED bytes differ (recorded, not live). The bearer is accepted
+ * as-is here: the socket's security is that it serves ONLY recorded, content-free-
+ * keyed results and is not reachable during normal operation (plan 06 mints an
+ * ephemeral OutputGuard-registered bearer for defense-in-depth).
+ *
+ * @module
+ */
+import { type ComisLogger } from "@comis/core";
+/** Deps for {@link createOrchestrateReplaySocket}. */
+export interface OrchestrateReplaySocketDeps {
+    /**
+     * The run's jailed workspace — `<workspacePath>/results/replay.jsonl` + the
+     * recorded pointer files live here. The socket reads (never writes) under it.
+     */
+    workspacePath: string;
+    /** Boundary logger (optional; the unit tests omit it → the handlers degrade to no-ops). */
+    logger?: ComisLogger;
+}
+/** The replay socket handle — the 0600 socket lifecycle plan 06 binds per-replay. */
+export interface OrchestrateReplaySocket {
+    /** Load the recorded entries + bind the 0600 owner-only unix socket at `socketPath`. */
+    start(socketPath: string): Promise<void>;
+    /** Stop the socket server + unlink the socket file. Idempotent. */
+    close(): Promise<void>;
+    /**
+     * Whether ANY served request diverged (an exhausted log, a method/params-digest
+     * mismatch, or a gone/escaped recorded pointer) — a sticky flag set the first time
+     * `handleReplayCall` throws. Divergence is signalled to the jailed child over the
+     * socket as `{error}`, which the parent respawn cannot observe; the session reads
+     * this AFTER the re-spawn so a diverged replay is reported honestly (not a clean
+     * success). Read once the re-spawn has settled (every cap call has been served).
+     */
+    diverged(): boolean;
+}
+/**
+ * Build the separate replay-serving socket over the run's `results/replay.jsonl`.
+ * The recorded entries load once at {@link OrchestrateReplaySocket.start}; a single
+ * cursor (shared across the per-call connections a re-spawned script opens, in
+ * order) advances ONLY on a matched, served entry.
+ */
+export declare function createOrchestrateReplaySocket(deps: OrchestrateReplaySocketDeps): OrchestrateReplaySocket;

package/node_modules/@comis/daemon/dist/wiring/orchestrate-replay-socket.js

@@ -0,0 +1,269 @@
+// SPDX-License-Identifier: Apache-2.0
+// @allow-throw: replay-divergence boundary. handleReplayCall THROWS on any
+// divergence (no further recorded entry, method/params-digest mismatch, a
+// path-escape or gone pointer) as the serving contract — the socket server's
+// catch converts the throw to a content-free {error} line to the (re-spawned)
+// client (mirrors setup-capability-endpoint.ts startSocket, whose deny branches
+// throw and are caught into a content-free JSON error the same way).
+/**
+ * `createOrchestrateReplaySocket` — the SEPARATE operator replay socket (REPLAY-02).
+ *
+ * A standalone `net.createServer` on its OWN 0600 socket path that speaks the SAME
+ * `{bearer, method, params}` newline-JSON cap-socket wire the jailed SDK sends, but
+ * SERVES RECORDED RESULTS: it reads the run's content-free `results/replay.jsonl`
+ * and, for a request whose `{method, sha256(params)}` matches the NEXT recorded
+ * entry (in recorded ORDER), returns the recorded pointer file's bytes as
+ * `{ result }`. Any divergence (wrong method, diverged params, exhausted log, a
+ * gone pointer) returns `{ error }` — an honest divergence signal, NEVER a
+ * fabricated success and NEVER a real dispatch.
+ *
+ * INV-1 (the load-bearing boundary): this is a PHYSICALLY SEPARATE socket, never a
+ * MODE of the production capability endpoint. It has NO LeaseManager, NO rpcCall
+ * sink, and NO tool registry — it cannot dispatch a real tool even in principle, so
+ * a re-spawned jailed script pointed at it (`COMIS_ORCH_SOCKET` → this path) can
+ * only ever re-consume its own recorded results. The authoritative production gate
+ * (`setup-capability-endpoint.ts` `startSocket`) stays single-purpose. The socket
+ * is operator-invoked + ephemeral: plan 06's admin handler binds it per-replay and
+ * tears it down in a `finally`; it is NOT bound during a normal run.
+ *
+ * The wire (buffer / MAX_LINE_BYTES fail-closed overflow / 0600 chmod / open-socket
+ * tracking for a non-hanging close) MIRRORS `setup-capability-endpoint.ts`
+ * `startSocket` so a re-spawned script cannot tell the difference at the transport
+ * layer — only the SERVED bytes differ (recorded, not live). The bearer is accepted
+ * as-is here: the socket's security is that it serves ONLY recorded, content-free-
+ * keyed results and is not reachable during normal operation (plan 06 mints an
+ * ephemeral OutputGuard-registered bearer for defense-in-depth).
+ *
+ * @module
+ */
+import net from "node:net";
+import { chmodSync, unlinkSync, readFileSync, existsSync } from "node:fs";
+import { safePath } from "@comis/core";
+import { replayParamsDigest } from "./setup-capability-endpoint.js";
+/**
+ * Max bytes a single connection may buffer before a newline-terminated request is
+ * seen — mirrors the production endpoint. On overflow the socket is destroyed
+ * (fail-closed): a client that never sends a `\n` cannot grow `buf` without bound.
+ */
+const MAX_LINE_BYTES = 64 * 1024;
+/** The run's content-free replay log location under the jailed workspace. */
+const RESULTS_DIR = "results";
+const REPLAY_LOG_NAME = "replay.jsonl";
+/**
+ * Build the separate replay-serving socket over the run's `results/replay.jsonl`.
+ * The recorded entries load once at {@link OrchestrateReplaySocket.start}; a single
+ * cursor (shared across the per-call connections a re-spawned script opens, in
+ * order) advances ONLY on a matched, served entry.
+ */
+export function createOrchestrateReplaySocket(deps) {
+    const log = deps.logger?.child({ submodule: "orchestrate-replay-socket" });
+    let server = null;
+    let boundSocketPath = null;
+    const openSockets = new Set();
+    // The recorded entries in ORDER + a shared cursor. The re-spawned script opens
+    // one connection per cap call, in the recorded order, so the cursor advances in
+    // lockstep with a faithful replay; a diverging call leaves it put and gets {error}.
+    let entries = [];
+    let cursor = 0;
+    // Sticky divergence flag — set the first time handleReplayCall throws (any
+    // divergence). The session reads it via `diverged()` after the re-spawn settles.
+    let divergedFlag = false;
+    /** Load + parse `results/replay.jsonl` (best-effort; a missing/garbled line is skipped). */
+    function loadEntries() {
+        entries = [];
+        cursor = 0;
+        let logPath;
+        try {
+            logPath = safePath(deps.workspacePath, RESULTS_DIR, REPLAY_LOG_NAME);
+        }
+        catch {
+            return; // workspace escape — serve nothing (every request diverges).
+        }
+        // eslint-disable-next-line security/detect-non-literal-fs-filename -- safePath-confined to the run workspace; the basename is a fixed literal
+        if (!existsSync(logPath))
+            return;
+        let raw;
+        try {
+            // eslint-disable-next-line security/detect-non-literal-fs-filename -- safePath-confined to the run workspace; the basename is a fixed literal
+            raw = readFileSync(logPath, "utf8");
+        }
+        catch {
+            return;
+        }
+        for (const line of raw.split("\n")) {
+            const trimmed = line.trim();
+            if (trimmed.length === 0)
+                continue;
+            try {
+                entries.push(JSON.parse(trimmed));
+            }
+            catch {
+                // A malformed line — skip it; the resulting order gap surfaces as a
+                // divergence downstream (never a fabricated match).
+            }
+        }
+    }
+    /**
+     * Serve the NEXT recorded entry IF it matches `{method, sha256(params)}`, reading
+     * the recorded pointer's bytes; else throw (the socket's `.catch` renders the
+     * throw as a content-free `{ error }`). NEVER a real dispatch — the only outputs
+     * are a recorded pointer's bytes or a divergence error (INV-1). Advances the
+     * cursor ONLY on a matched, served entry so a divergence does not consume a slot.
+     */
+    async function handleReplayCall(_bearer, method, params) {
+        const entry = entries.at(cursor);
+        if (entry === undefined) {
+            throw new Error("replay diverged: no further recorded results");
+        }
+        if (entry.method !== method || entry.paramsDigest !== replayParamsDigest(params)) {
+            throw new Error("replay diverged: request does not match the next recorded call");
+        }
+        // Read the recorded pointer's bytes (workspace-confined). A gone/expired blob or
+        // a path escape is a divergence, never a fabricated result.
+        let abs;
+        try {
+            abs = safePath(deps.workspacePath, entry.result);
+        }
+        catch {
+            throw new Error("replay diverged: recorded result path escapes the workspace");
+        }
+        let bytes;
+        try {
+            // eslint-disable-next-line security/detect-non-literal-fs-filename -- safePath-confined; entry.result is a store-minted results/ pointer
+            bytes = readFileSync(abs, "utf8");
+        }
+        catch {
+            throw new Error("replay diverged: recorded result blob is gone");
+        }
+        cursor += 1; // advance ONLY on a matched, served entry (in-order)
+        // The recorded bytes are `JSON.stringify(result)`; parse them back so the socket
+        // wire (`{ result }`) reconstructs the original reply byte-identically.
+        return JSON.parse(bytes);
+    }
+    function start(socketPath) {
+        loadEntries();
+        return new Promise((resolve, reject) => {
+            const srv = net.createServer((socket) => {
+                openSockets.add(socket);
+                socket.on("close", () => {
+                    openSockets.delete(socket);
+                });
+                let buf = "";
+                socket.setEncoding("utf8");
+                socket.on("data", (chunk) => {
+                    buf += chunk;
+                    if (buf.length > MAX_LINE_BYTES) {
+                        log?.warn({
+                            submodule: "orchestrate-replay-socket",
+                            errorKind: "validation",
+                            hint: "replay socket request exceeded the max line size before a newline — connection destroyed",
+                            maxLineBytes: MAX_LINE_BYTES,
+                        }, "Replay socket receive buffer overflow");
+                        socket.destroy();
+                        return;
+                    }
+                    const nl = buf.indexOf("\n");
+                    if (nl === -1)
+                        return;
+                    const line = buf.slice(0, nl);
+                    buf = buf.slice(nl + 1);
+                    let req;
+                    try {
+                        req = JSON.parse(line);
+                    }
+                    catch {
+                        socket.end(JSON.stringify({ error: "malformed request" }) + "\n");
+                        return;
+                    }
+                    void handleReplayCall(req.bearer, req.method, req.params ?? {})
+                        .then((result) => {
+                        socket.end(JSON.stringify({ result }) + "\n");
+                    })
+                        .catch((err) => {
+                        // Any handleReplayCall throw is a divergence (exhausted log,
+                        // method/params-digest mismatch, gone/escaped pointer). Record the
+                        // sticky flag BEFORE replying so the session reads a settled value
+                        // after the re-spawn, then emit the content-free divergence signal
+                        // to the (re-spawned) client — a fixed reason, never params/bytes.
+                        divergedFlag = true;
+                        const message = err instanceof Error ? err.message : "replay call failed";
+                        socket.end(JSON.stringify({ error: message }) + "\n");
+                    });
+                });
+                socket.on("error", (err) => {
+                    log?.debug({
+                        submodule: "orchestrate-replay-socket",
+                        err,
+                        errorKind: "network",
+                        hint: "replay socket connection error (typically a client disconnecting mid-write)",
+                    }, "Replay socket connection error");
+                });
+            });
+            server = srv;
+            // A persistent server-error logger survives after the reject handler is spent.
+            srv.on("error", (err) => {
+                log?.error({
+                    submodule: "orchestrate-replay-socket",
+                    err,
+                    errorKind: "network",
+                    hint: "replay socket server error",
+                }, "Replay socket server error");
+            });
+            srv.on("error", reject);
+            // Unlink a stale socket before binding (prevents EADDRINUSE).
+            try {
+                // eslint-disable-next-line security/detect-non-literal-fs-filename -- caller-supplied replay socket path (ephemeral, operator-invoked)
+                unlinkSync(socketPath);
+            }
+            catch {
+                /* not present — ok */
+            }
+            srv.listen({ path: socketPath }, () => {
+                // Restrict the socket to owner-only (rw-------) — mirrors the prod endpoint.
+                try {
+                    // eslint-disable-next-line security/detect-non-literal-fs-filename -- caller-supplied replay socket path (ephemeral, operator-invoked)
+                    chmodSync(socketPath, 0o600);
+                }
+                catch {
+                    /* non-POSIX FS — ok */
+                }
+                boundSocketPath = socketPath;
+                log?.info({ submodule: "orchestrate-replay-socket", socketPath, recorded: entries.length }, "Replay socket bound (0600 owner-only; serving recorded results)");
+                resolve();
+            });
+        });
+    }
+    function close() {
+        return new Promise((resolve) => {
+            const srv = server;
+            if (!srv) {
+                resolve();
+                return;
+            }
+            server = null;
+            // Destroy every tracked connection FIRST so a stuck client cannot wedge
+            // srv.close() (which otherwise waits for open connections to drain).
+            for (const socket of openSockets) {
+                socket.destroy();
+            }
+            openSockets.clear();
+            srv.close(() => {
+                if (boundSocketPath) {
+                    try {
+                        // eslint-disable-next-line security/detect-non-literal-fs-filename -- the path we bound (ephemeral, operator-invoked)
+                        unlinkSync(boundSocketPath);
+                    }
+                    catch {
+                        /* already gone — ok */
+                    }
+                    boundSocketPath = null;
+                }
+                resolve();
+            });
+        });
+    }
+    function diverged() {
+        return divergedFlag;
+    }
+    return { start, close, diverged };
+}

package/node_modules/@comis/daemon/dist/wiring/preflight-doctor.d.ts

@@ -1,6 +1,6 @@
 /**
  * Preflight native-dependency doctor — extracted from `daemon.ts` to keep the
- * composition root under its 3000-line architecture cap (the v2.25 audio wiring
+ * composition root under its 3000-line architecture cap (adding audio wiring
  * pushed daemon.ts to 3001; this self-contained, behavior-neutral probe is the
  * natural extraction). `daemon.ts` re-exports `runPreflightDoctor` so its public
  * surface (and `daemon.test.ts`'s `import … from "./daemon.js"`) is unchanged.
@@ -8,7 +8,7 @@
  * The timestamp is read via `@comis/core`'s `systemNowDate()` (the sanctioned
  * runtime-root clock indirection) rather than a bare `new Date()`: extracting
  * this probe out of the globals-exempt `daemon.ts` bootstrap root would
- * otherwise trip the `globals` architecture gate (Phase 196 CR-01). The helper
+ * otherwise trip the `globals` architecture gate. The helper
  * keeps the same wall-clock behavior while routing the read through the
  * classifier-exempt `packages/core/src/runtime/` root.
  *
@@ -40,9 +40,9 @@ interface AgentAutonomySlice {
 }
 /**
  * One per-agent record the boot banner logs at INFO — the legible resolved
- * posture (PROFILE-03 / CLAUDE.md "promote load-bearing evidence to INFO").
+ * posture (CLAUDE.md "promote load-bearing evidence to INFO").
  * Carries exactly the four legibility facts (profile, enabled caps, the budget
- * ceiling, the one field to change it) plus the M1 over-grant notice.
+ * ceiling, the one field to change it) plus the over-grant notice.
  */
 export interface AutonomyBootLogRecord {
     readonly agentId: string;
@@ -54,14 +54,14 @@ export interface AutonomyBootLogRecord {
     readonly aggregateBudgetUsd: number;
     /** The ONE config field that changes all of the above — the legibility contract. */
     readonly changeField: "autonomy.profile";
-    /** Present for `unattended` (Phase-217 mode-active notice) + `max` (M3 clamp notice). */
+    /** Present for `unattended` (mode-active notice) + `max` (clamp notice). */
     readonly m1Notice?: string;
 }
 /**
  * Build the per-agent legible-posture records the boot banner logs at INFO.
  *
  * PURE — resolves each agent's `autonomy` block via {@link resolveAutonomy} and
- * projects the four legibility facts + the M1 notice. One record per agent, in
+ * projects the four legibility facts + the over-grant notice. One record per agent, in
  * config order. The daemon logs each as an INFO line so an operator can read,
  * from boot logs alone, exactly what every agent was granted and how to change
  * it — without `logLevel: debug`.
@@ -71,7 +71,7 @@ export interface AutonomyBootLogRecord {
 export declare function buildAutonomyBootLog(agents: Record<string, AgentAutonomySlice>): AutonomyBootLogRecord[];
 /**
  * A `doctor` finding mirroring the file's existing finding shape (severity +
- * message + hint + errorKind). The PROFILE-03 namespace-downshift finding is
+ * message + hint + errorKind). The namespace-downshift finding is
  * WARN-class — autonomy degrades to `assistant`, the daemon still serves — so it
  * never exits the process (unlike the fatal better-sqlite3 probe above).
  */
@@ -82,16 +82,16 @@ export interface PreflightFinding {
     readonly errorKind: "precondition";
 }
 /**
- * Build the namespace-preflight downshift `doctor` finding (PROFILE-03).
+ * Build the namespace-preflight downshift `doctor` finding.
  *
- * PURE — driven by the preflight-RESULT INPUT (the probe is Phase 211). Returns
+ * PURE — driven by the preflight-RESULT INPUT (the probe lives elsewhere). Returns
  * `undefined` when the preflight passed. When it failed, derives the finding's
  * reason/hint from {@link degradeAutonomy} (a `standard` posture is the canonical
  * "would have been autonomy-bearing" case) so the doctor finding and the
  * resolver's surfaced WARN share ONE source of truth — same hint, same
  * `errorKind`, no drift.
  *
- * @param preflight the host preconditions (210: caller-supplied; 211: probed).
+ * @param preflight the host preconditions (a caller-supplied input; filled by the namespace probe when wired).
  */
 export declare function buildNamespaceDownshiftFinding(preflight: AutonomyPreflightResult): PreflightFinding | undefined;
 export {};

package/node_modules/@comis/daemon/dist/wiring/preflight-doctor.js

@@ -1,7 +1,7 @@
 // SPDX-License-Identifier: Apache-2.0
 /**
  * Preflight native-dependency doctor — extracted from `daemon.ts` to keep the
- * composition root under its 3000-line architecture cap (the v2.25 audio wiring
+ * composition root under its 3000-line architecture cap (adding audio wiring
  * pushed daemon.ts to 3001; this self-contained, behavior-neutral probe is the
  * natural extraction). `daemon.ts` re-exports `runPreflightDoctor` so its public
  * surface (and `daemon.test.ts`'s `import … from "./daemon.js"`) is unchanged.
@@ -9,7 +9,7 @@
  * The timestamp is read via `@comis/core`'s `systemNowDate()` (the sanctioned
  * runtime-root clock indirection) rather than a bare `new Date()`: extracting
  * this probe out of the globals-exempt `daemon.ts` bootstrap root would
- * otherwise trip the `globals` architecture gate (Phase 196 CR-01). The helper
+ * otherwise trip the `globals` architecture gate. The helper
  * keeps the same wall-clock behavior while routing the read through the
  * classifier-exempt `packages/core/src/runtime/` root.
  *
@@ -59,7 +59,7 @@ export async function runPreflightDoctor(exitFn, opts = {}) {
  * Build the per-agent legible-posture records the boot banner logs at INFO.
  *
  * PURE — resolves each agent's `autonomy` block via {@link resolveAutonomy} and
- * projects the four legibility facts + the M1 notice. One record per agent, in
+ * projects the four legibility facts + the over-grant notice. One record per agent, in
  * config order. The daemon logs each as an INFO line so an operator can read,
  * from boot logs alone, exactly what every agent was granted and how to change
  * it — without `logLevel: debug`.
@@ -81,16 +81,16 @@ export function buildAutonomyBootLog(agents) {
     });
 }
 /**
- * Build the namespace-preflight downshift `doctor` finding (PROFILE-03).
+ * Build the namespace-preflight downshift `doctor` finding.
  *
- * PURE — driven by the preflight-RESULT INPUT (the probe is Phase 211). Returns
+ * PURE — driven by the preflight-RESULT INPUT (the probe lives elsewhere). Returns
  * `undefined` when the preflight passed. When it failed, derives the finding's
  * reason/hint from {@link degradeAutonomy} (a `standard` posture is the canonical
  * "would have been autonomy-bearing" case) so the doctor finding and the
  * resolver's surfaced WARN share ONE source of truth — same hint, same
  * `errorKind`, no drift.
  *
- * @param preflight the host preconditions (210: caller-supplied; 211: probed).
+ * @param preflight the host preconditions (a caller-supplied input; filled by the namespace probe when wired).
  */
 export function buildNamespaceDownshiftFinding(preflight) {
     // Ask the resolver what a representative autonomy-bearing posture would do