comisai 1.0.44 → 1.0.46

package/node_modules/@comis/daemon/dist/wiring/setup-gateway/setup-gateway-rpc.js

@@ -16,7 +16,7 @@ import { registerRpcMethods } from "../setup-gateway-api.js";
 import { agentSummaries, channelSummaries } from "./non-secret-projections.js";
 import { buildExecutionRequestedLogFields, buildSlashCommandDeps, createCommandHandler, deriveTrustLevel, detectGreetingTrigger, handleConfigChatCommand, resolveExecAgentId, } from "./setup-gateway-admin.js";
 /**
- * Non-secret section allowlist for the `getConfig` RPC (§17.8 security
+ * Non-secret section allowlist for the `getConfig` RPC (a security
  * sign-off). Exactly the scalar/projected fields the safe default object
  * emits — sections carrying credentials (`agents` auth/model profiles,
  * `security.secrets`, `channels` tokens, `providers` keys, raw `gateway.tokens`)
@@ -39,7 +39,8 @@ export function setupRpcBridge(deps) {
         }
         catch (err) {
             const errMsg = err instanceof Error ? err.message : String(err);
-            const classified = classifyRpcError(errMsg);
+            // Pass the error OBJECT (not err.message) so classifyRpcError's typed-refusal recognition resolves (OBS-RPC-REFUSAL-CLASS).
+            const classified = classifyRpcError(err);
             gatewayLogger.debug({
                 method,
                 err: errMsg,
@@ -302,7 +303,7 @@ export function buildRpcAdapterDeps(deps) {
             return { stats: stats };
         },
         getConfig: async (params) => {
-            // A non-secret section ALLOWLIST is enforced (§17.8 sign-off).
+            // A non-secret section ALLOWLIST is enforced.
             // The prior top-level-key passthrough returned ANY requested section
             // verbatim — including `agents` (per-provider auth/model profiles) and
             // `security.secrets` — a real secret-egress path. Only the
@@ -420,7 +421,7 @@ export function buildRpcAdapterDeps(deps) {
             // If session reset command succeeded, try LLM greeting
             if (result.handled && (parsed.command === "new" || parsed.command === "reset") && greetingGenerator) {
                 const greetingAgentConfig = agents[params.agentId ?? defaultAgentId] ?? agents[defaultAgentId];
-                // Interactivity signal (spec §12): a concrete channel surface
+                // Interactivity signal: a concrete channel surface
                 // (Discord/Telegram/…) is interactive; the bare "gateway" sentinel
                 // (the headless RPC default applied when no channelId is supplied —
                 // see `sk` above) marks the non-interactive/onboarding-limited path.

package/node_modules/@comis/daemon/dist/wiring/setup-gateway-api.js

@@ -55,7 +55,7 @@ export function registerRpcMethods(deps) {
     // runs once and registers the method under that scope. For multi-scope
     // contracts (none today; future-proof) the method registers separately
     // under each scope.
-    // ORIGIN-02 (v8 section 3.1): strip INTERNAL_FIELD_NAMES from external
+    // Strip INTERNAL_FIELD_NAMES from external
     // WS/REST caller params at BOTH branches before dispatch. External callers
     // must never be able to forge an `_X` control field; in particular, after
     // this strip the PRESENCE of `_agentId` is a sound, unforgeable agent-origin
@@ -64,13 +64,13 @@ export function registerRpcMethods(deps) {
     // `_trustLevel` is never stripped. The in-process `createAgentRpcCall` path
     // (the legitimate `_agentId` injector) does NOT pass through here.
     for (const c of API_CONTRACTS_ORDERED) {
-        // CAP-03 (gateway leg): M1 (#236) capability-gated the orchestration RPCs
-        // (graph/skills/session.spawn/cron/message-mutate) on the injected
-        // `_capabilities`, but only the in-process agent leg (createAgentRpcCall) and
-        // the jailed-child lease inject it — this gateway leg never did, so every
-        // authenticated operator/dashboard call (and the integration suite) hit
+        // Capability-gated orchestration RPCs
+        // (graph/skills/session.spawn/cron/message-mutate) check the injected
+        // `_capabilities`. Only the in-process agent leg (createAgentRpcCall) and
+        // the jailed-child lease inject it — this gateway leg does not, so every
+        // authenticated operator/dashboard call would hit
         // `Capability denied: orch:*`. `_capabilities` is a stripped internal field
-        // (a client cannot forge it — see the ORIGIN-02 strip below), so inject the
+        // (a client cannot forge it — see the strip below), so inject the
         // method's REQUIRED orch cap server-side here, AFTER the strip. Grant exactly
         // the one cap the method needs (least-privilege), mirroring the agent leg; the
         // gateway boundary is already gated by the token scope, and the capability

package/node_modules/@comis/daemon/dist/wiring/setup-gateway-routes.d.ts

@@ -51,6 +51,11 @@ export interface GatewayRouteDeps {
     /** Interactive-callback wiring: the single-use email approval-token map
      *  + resolver. When present, the `ALL /approve/:token` route is mounted. */
     interactiveCallbackWiring?: import("./setup-interactive-callback.js").InteractiveCallbackWiring;
+    /** Microsoft Teams inbound ingress sub-app. When present (the channel is
+     *  enabled and its credentials validated, so the composition root built a
+     *  caller-backed ingress), the `/channels/msteams` route is mounted; absent
+     *  ⇒ no route exists. Presence is the mount signal. */
+    msTeamsIngress?: import("hono").Hono;
     /** Deterministic unattended honest-fail backstop (webhook-claude-cli-tdd-20260701,
      *  `WEBHOOK-CLAUDE-AGENT-DRIVE-RELIABILITY`): after an unattended (webhook) agent turn, reap the
      *  LIVE terminal drives the turn created but NEVER tasked (no `send_text`) — the model

package/node_modules/@comis/daemon/dist/wiring/setup-gateway-routes.js

@@ -11,7 +11,7 @@ import { extractBearerToken, checkScope, createMappedWebhookEndpoint, getPresetM
 import { Hono } from "hono";
 import { bodyLimit } from "hono/body-limit";
 import { randomUUID } from "node:crypto";
-// RESTART-01: defer a mid-turn config-change SIGUSR2 until the synchronous
+// Defer a mid-turn config-change SIGUSR2 until the synchronous
 // chat/responses-API response flushes.
 import { withConfigMutationFence } from "../api/shared/persist-to-config.js";
 // ---------------------------------------------------------------------------
@@ -57,7 +57,7 @@ export function resolveContextTrustLevel(elevatedReply, senderId) {
  * - OpenAI-compatible API routes (/v1/chat/completions, /v1/models, /v1/embeddings, /v1/responses)
  */
 export function mountGatewayRoutes(deps) {
-    const { gatewayHandle, webhooksConfig, container, defaultAgentId, agents, gatewayLogger, tokenStore, getExecutor, assembleToolsForAgent, preprocessMessageText, cachedPort, defaultWorkspaceDir, interactiveCallbackWiring, reapNeverTaskedDrives, } = deps;
+    const { gatewayHandle, webhooksConfig, container, defaultAgentId, agents, gatewayLogger, tokenStore, getExecutor, assembleToolsForAgent, preprocessMessageText, cachedPort, defaultWorkspaceDir, interactiveCallbackWiring, msTeamsIngress, reapNeverTaskedDrives, } = deps;
     // -------------------------------------------------------------------------
     // Email approval-token route
     // -------------------------------------------------------------------------
@@ -75,6 +75,20 @@ export function mountGatewayRoutes(deps) {
         gatewayLogger.debug({ submodule: "approval-token" }, "Email approval-token route mounted at /approve/*");
     }
     // -------------------------------------------------------------------------
+    // Microsoft Teams inbound ingress
+    // -------------------------------------------------------------------------
+    // The net-new gateway ingress: a Hono sub-app that authenticates inbound
+    // activities (Bearer pre-gate → signed-token validation → fast ack) before
+    // driving them into the channel pipeline. Mounted ONLY when the composition
+    // root threaded a built ingress here (the channel is enabled and its
+    // credentials validated) — presence is the mount signal, so a disabled
+    // channel produces no route. This closes the dead-route failure mode where a
+    // handler factory ships with no production caller mounting it.
+    if (msTeamsIngress !== undefined) {
+        gatewayHandle.app.route("/channels/msteams", msTeamsIngress);
+        gatewayLogger.debug({ submodule: "msteams-ingress" }, "Microsoft Teams ingress mounted at /channels/msteams/*");
+    }
+    // -------------------------------------------------------------------------
     // Webhook mapping sub-app
     // -------------------------------------------------------------------------
     if (webhooksConfig?.enabled) {
@@ -301,7 +315,7 @@ export function mountGatewayRoutes(deps) {
             // finding 2026-06-18: without this, chat-API turn outcomes were observed but NEVER
             // resolved (no reward/forget/skill-promote) and were invisible to obs.
             const turnTraceId = randomUUID();
-            // RESTART-01: hold the config-mutation fence across the turn so a
+            // Hold the config-mutation fence across the turn so a
             // config-mutating tool (heartbeat_manage/config.patch/…) that schedules a
             // SIGUSR2 restart mid-turn defers it until this synchronous HTTP response
             // flushes — otherwise the daemon restarts under the in-flight request and
@@ -378,7 +392,7 @@ export function mountGatewayRoutes(deps) {
             // for the OpenResponses API — without runWithContext every executor log line is
             // traceId-less (no trace stitching) and the degraded reply cannot carry
             // its incident ref. One context per inbound request, minted here.
-            // RESTART-01: hold the config-mutation fence across the turn (see the
+            // Hold the config-mutation fence across the turn (see the
             // chat-completions path) so a mid-turn config-mutating tool's SIGUSR2
             // restart defers until this synchronous response flushes.
             const result = await withConfigMutationFence(() => runWithContext({

package/node_modules/@comis/daemon/dist/wiring/setup-image-provider.d.ts

@@ -1,21 +1,21 @@
 /**
- * Image-provider SELECTION (RES-02/RES-03/CRED-01).
+ * Image-provider SELECTION.
  *
  * `createImageProviderSelector` returns a lazy getter (read-on-use at boot —
  * mirrors `createImageGenProviderFactory` in setup-media.ts) that, per the
  * resolved config + the agent's main provider, decides between:
- *   - the Plan-03 pi-image-adapter (provider:"auto" / pi-ai-backed providers),
- *     following the main provider via the Plan-01 `resolveImageProvider` and
+ *   - the pi-image-adapter (provider:"auto" / pi-ai-backed providers),
+ *     following the main provider via `resolveImageProvider` and
  *     resolving the key from the SAME `SecretManager` the main provider uses
- *     (CRED-01 — no image-specific secret); or
+ *     (no image-specific secret); or
  *   - the relegated skills adapter (explicit `fal`/`openai`, additive legacy
  *     path); or
  *   - an honest-unavailable port (carrying the knob-naming hint) for an
- *     image-incapable main (RES-03) — NEVER a misroute to a different paid
+ *     image-incapable main — NEVER a misroute to a different paid
  *     provider, NEVER silence.
  *
  * The selector NEVER reads the raw environment (creds via `SecretManager`
- * only) and NEVER re-derives selection in the handler (RES-01 keystone: one
+ * only) and NEVER re-derives selection in the handler (one
  * source of truth — `resolveImageProvider`).
  *
  * Placement: `@comis/daemon` (pi-ai is a daemon dep, not a skills one). Kept in
@@ -28,7 +28,7 @@ import { type ImageErrorKind, type ImageGenerationConfig, type ImageGenerationPo
 import type { ComisLogger } from "@comis/infra";
 /**
  * A port whose `execute()` always returns a classified `ImageGenError` Result
- * err — the RES-03 honest-unavailable carrier. The agent gets a hint (naming
+ * err — the honest-unavailable carrier. The agent gets a hint (naming
  * the binding config knob), not silence. `isAvailable()` is `false` so callers
  * that probe it know it cannot serve.
  */
@@ -38,21 +38,21 @@ export declare function makeUnavailableImagePort(errorKind: ImageErrorKind, hint
  * config + `secretManager` on use; in practice the daemon invokes it ONCE at
  * boot (`daemon.ts` `getImageGenProvider()`), and the handler then holds that
  * boot-built adapter instance — so key rotation requires a daemon restart to
- * take effect (NOT live per-request; IN-01 183-REVIEW). Returns `undefined`
+ * take effect (NOT live per-request). Returns `undefined`
  * only when image generation is unconfigured (`imageGenConfig` absent) — an
- * image-incapable main yields an unavailable PORT (RES-03), never `undefined`,
+ * image-incapable main yields an unavailable PORT, never `undefined`,
  * so the handler is still constructed and surfaces the hint.
  */
 export declare function createImageProviderSelector(deps: {
     imageGenConfig: ImageGenerationConfig | undefined;
     secretManager: SecretManager;
-    /** Resolved at boot for the DEFAULT agent (the common case for Phase 183). */
+    /** Resolved at boot for the DEFAULT agent (the common case). */
     mainProviderId: string;
     /** The existing skills fal/openai getter (createImageGenGetter). */
     legacyGetter: () => ImageGenerationPort | undefined;
     logger: ComisLogger;
     /**
-     * The DEFAULT agent's OAuthTokenManager (184). The codex credential is OAuth,
+     * The DEFAULT agent's OAuthTokenManager. The codex credential is OAuth,
      * not a SecretManager env key — so codex availability + the per-call bearer
      * resolve through this manager, NOT `resolveImageApiKey`. Surfaced from
      * setupAgents → buildImageGenBundle (the composition-root threading gap).
@@ -70,7 +70,7 @@ export declare function createImageProviderSelector(deps: {
      * (encrypted-store mode), which the sync `hasCredentials` could not — the bug
      * that froze a Codex agent's image generation unavailable despite text working.
      * When omitted (callers/tests that don't pre-resolve it) the gate falls back to
-     * the sync `oauthManager.hasCredentials` (the pre-fix behavior).
+     * the sync `oauthManager.hasCredentials`.
      */
     codexCredentialsAvailable?: boolean;
     /**

package/node_modules/@comis/daemon/dist/wiring/setup-image-provider.js

@@ -1,22 +1,22 @@
 // SPDX-License-Identifier: Apache-2.0
 /**
- * Image-provider SELECTION (RES-02/RES-03/CRED-01).
+ * Image-provider SELECTION.
  *
  * `createImageProviderSelector` returns a lazy getter (read-on-use at boot —
  * mirrors `createImageGenProviderFactory` in setup-media.ts) that, per the
  * resolved config + the agent's main provider, decides between:
- *   - the Plan-03 pi-image-adapter (provider:"auto" / pi-ai-backed providers),
- *     following the main provider via the Plan-01 `resolveImageProvider` and
+ *   - the pi-image-adapter (provider:"auto" / pi-ai-backed providers),
+ *     following the main provider via `resolveImageProvider` and
  *     resolving the key from the SAME `SecretManager` the main provider uses
- *     (CRED-01 — no image-specific secret); or
+ *     (no image-specific secret); or
  *   - the relegated skills adapter (explicit `fal`/`openai`, additive legacy
  *     path); or
  *   - an honest-unavailable port (carrying the knob-naming hint) for an
- *     image-incapable main (RES-03) — NEVER a misroute to a different paid
+ *     image-incapable main — NEVER a misroute to a different paid
  *     provider, NEVER silence.
  *
  * The selector NEVER reads the raw environment (creds via `SecretManager`
- * only) and NEVER re-derives selection in the handler (RES-01 keystone: one
+ * only) and NEVER re-derives selection in the handler (one
  * source of truth — `resolveImageProvider`).
  *
  * Placement: `@comis/daemon` (pi-ai is a daemon dep, not a skills one). Kept in
@@ -25,7 +25,7 @@
  *
  * @module
  */
-import { getImageModels } from "@earendil-works/pi-ai";
+import { getImageModels } from "@earendil-works/pi-ai/compat";
 import { resolveImageProvider, } from "@comis/core";
 import { err } from "@comis/shared";
 import { createPiImageAdapter, resolveImageApiKey, ImageGenError, } from "../api/pi-image-adapter.js";
@@ -34,7 +34,7 @@ import { OPENAI_IMAGE_MODEL } from "../api/openai-images-transport.js";
 import { GOOGLE_IMAGE_MODEL } from "../api/google-images-transport.js";
 /**
  * A port whose `execute()` always returns a classified `ImageGenError` Result
- * err — the RES-03 honest-unavailable carrier. The agent gets a hint (naming
+ * err — the honest-unavailable carrier. The agent gets a hint (naming
  * the binding config knob), not silence. `isAvailable()` is `false` so callers
  * that probe it know it cannot serve.
  */
@@ -53,9 +53,9 @@ export function makeUnavailableImagePort(errorKind, hint, logger) {
  * config + `secretManager` on use; in practice the daemon invokes it ONCE at
  * boot (`daemon.ts` `getImageGenProvider()`), and the handler then holds that
  * boot-built adapter instance — so key rotation requires a daemon restart to
- * take effect (NOT live per-request; IN-01 183-REVIEW). Returns `undefined`
+ * take effect (NOT live per-request). Returns `undefined`
  * only when image generation is unconfigured (`imageGenConfig` absent) — an
- * image-incapable main yields an unavailable PORT (RES-03), never `undefined`,
+ * image-incapable main yields an unavailable PORT, never `undefined`,
  * so the handler is still constructed and surfaces the hint.
  */
 export function createImageProviderSelector(deps) {
@@ -64,17 +64,17 @@ export function createImageProviderSelector(deps) {
         if (!cfg)
             return undefined;
         // Explicit fal → the relegated skills adapter (additive legacy path,
-        // CFG-01 back-compat). 185 FOLD: `openai` is NO LONGER a legacy provider —
-        // it now resolves via the resolver path below (IMAGE_CAPABILITY["openai"] =
-        // "openai-images") → the Task-2 selector branch (the registered transport),
-        // eliminating the second parallel openai surface (design §5).
+        // back-compat). `openai` is NOT a legacy provider — it resolves via the
+        // resolver path below (IMAGE_CAPABILITY["openai"] = "openai-images") → the
+        // selector branch for the registered transport, so there is no second
+        // parallel openai surface.
         if (cfg.provider === "fal") {
             return deps.legacyGetter();
         }
         // auto / openrouter / openai-codex / google → the pi-ai path via the
-        // Plan-01 resolver (one source of truth; creds via SecretManager closure).
+        // resolver (one source of truth; creds via SecretManager closure).
         const sel = resolveImageProvider(cfg, deps.mainProviderId, 
-        // CRED-01: codex availability is the OAuth credential (the bearer is
+        // Codex availability is the OAuth credential (the bearer is
         // OAuth, not a SecretManager env key) — so a Codex-only agent with NO
         // FAL_KEY/OPENAI_API_KEY resolves available. The AUTHORITATIVE gate is the
         // store-aware `codexCredentialsAvailable` flag, pre-resolved by the async
@@ -91,7 +91,7 @@ export function createImageProviderSelector(deps) {
                 deps.oauthManager?.hasCredentials("openai-codex") ??
                 false)
             : resolveImageApiKey(imagesApi, deps.secretManager) !== undefined, 
-        // WR-04 (183-REVIEW): the once-per-resolution follow-main skip is the
+        // The once-per-resolution follow-main skip is the
         // load-bearing "why did images go unavailable" evidence — promote it to
         // INFO so it is visible at the default log level (§2.7). Per-fallback-
         // entry skips stay DEBUG (they only matter when a chain is configured).
@@ -99,12 +99,12 @@ export function createImageProviderSelector(deps) {
             ? deps.logger.info({ reason, step: "image_follow_main_skip" }, "Image follow-main resolution skipped")
             : deps.logger.debug({ reason, step: "image_fallback_skip" }, "Image fallback entry skipped"));
         if (!sel.ok) {
-            // RES-03 honest-unavailable: a port that surfaces the err (handler hint).
+            // Honest-unavailable: a port that surfaces the err (handler hint).
             return makeUnavailableImagePort(sel.errorKind, sel.hint, deps.logger);
         }
-        // 184: the Codex (ChatGPT-login) per-call-bearer adapter. Keyed EXACTLY on
-        // the codex images api — `openai-images`/`google-images` fall through to the
-        // not-yet-wired guard below (they land in 185, no scope creep).
+        // The Codex (ChatGPT-login) per-call-bearer adapter. Keyed EXACTLY on
+        // the codex images api — `openai-images`/`google-images` are handled by
+        // their own branch below.
         if (sel.imagesApi === "openai-codex-images") {
             // By construction `sel.imagesApi === "openai-codex-images"` is `ok` only
             // when credsAvailable returned true, which requires a present manager
@@ -132,16 +132,15 @@ export function createImageProviderSelector(deps) {
                 credentialsAvailable: deps.codexCredentialsAvailable,
             });
         }
-        // 185 (PRV-01/02 — the WIRING KEYSTONE): the openai / google native
-        // transports (registered in registerComisImageProviders()). UNLIKE codex,
-        // their credential is a STATIC env key (OPENAI_API_KEY / GOOGLE_API_KEY via
-        // the FIXED resolveImageApiKey — CRED-01), resolved once at boot — so the
-        // generic createPiImageAdapter (which does the generateImages dispatch +
-        // mapping) is the right adapter, NOT a per-call-bearer one. The hand-built
-        // ImagesModel literal carries the api/provider/default-id; sel.model (the
-        // tool/config override) wins over the default when present (IN-02). Keyed
-        // EXACTLY on these two apis — every other api still falls through to the
-        // honest-unavailable guard below (no misroute).
+        // The openai / google native transports (registered in
+        // registerComisImageProviders()). UNLIKE codex, their credential is a
+        // STATIC env key (OPENAI_API_KEY / GOOGLE_API_KEY via resolveImageApiKey),
+        // resolved once at boot — so the generic createPiImageAdapter (which does
+        // the generateImages dispatch + mapping) is the right adapter, NOT a
+        // per-call-bearer one. The hand-built ImagesModel literal carries the
+        // api/provider/default-id; sel.model (the tool/config override) wins over
+        // the default when present. Keyed EXACTLY on these two apis — every other
+        // api still falls through to the honest-unavailable guard below (no misroute).
         if (sel.imagesApi === "openai-images" || sel.imagesApi === "google-images") {
             const apiKey = resolveImageApiKey(sel.imagesApi, deps.secretManager);
             const model = sel.imagesApi === "openai-images" ? OPENAI_IMAGE_MODEL : GOOGLE_IMAGE_MODEL;
@@ -152,10 +151,9 @@ export function createImageProviderSelector(deps) {
                 logger: deps.logger,
             });
         }
-        // Phase 183 wires the built-in openrouter catalog; 184/185 wired
-        // codex/openai/google above. Any REMAINING custom transport lands in a later
-        // phase — until then, surface an honest-unavailable naming the opt-in path
-        // (not a misroute).
+        // The built-in openrouter catalog is wired below; codex/openai/google are
+        // wired above. Any REMAINING custom transport is not yet wired — surface an
+        // honest-unavailable naming the opt-in path (not a misroute).
         if (sel.imagesApi !== "openrouter-images") {
             return makeUnavailableImagePort("unsupported_provider", `Image provider "${sel.imagesApi}" is not yet wired (lands in a later phase). ` +
                 `Use provider:"openrouter" + OPENROUTER_API_KEY, or set ` +
@@ -168,7 +166,7 @@ export function createImageProviderSelector(deps) {
             apiKey,
             timeoutMs: cfg.timeoutMs,
             // maxRetries omitted — the adapter's `maxRetries ?? 1` default is the
-            // single source of truth (IN-02 183-REVIEW: avoid a duplicated magic 1).
+            // single source of truth (avoid a duplicated magic 1).
             logger: deps.logger,
         });
     };
@@ -180,9 +178,9 @@ export function createImageProviderSelector(deps) {
  * constraint, which a runtime `string` cannot satisfy — so look the id up in
  * the catalog (`getImageModels`) and fall back to the first catalog model when
  * the requested id is not present. The built-in openrouter catalog always has
- * at least one model (Phase 183 default `black-forest-labs/flux.2-pro`).
+ * at least one model (default `black-forest-labs/flux.2-pro`).
  *
- * WR-02 (183-REVIEW): when the configured/tool model is NOT in the catalog the
+ * When the configured/tool model is NOT in the catalog the
  * fallback would otherwise be a SILENT misroute — the operator's explicit
  * choice discarded with no signal. Emit a WARN naming the unresolved id, the
  * fallback, the binding knob, and an `errorKind` so the substitution is

package/node_modules/@comis/daemon/dist/wiring/setup-learning-corroboration.d.ts

@@ -1,5 +1,5 @@
 /**
- * FORGET-03 corroboration gate — the anti-induced-eviction SECURITY control shared
+ * Corroboration gate — the anti-induced-eviction SECURITY control shared
  * by the learned-skill demote path and the memory failure-accrual path in
  * `setup-learning.ts`. Extracted to its own leaf (zero imports from setup-learning.ts
  * → no cycle) to keep `setup-learning.ts` under the 800-line cap. `setup-learning.ts`
@@ -10,7 +10,7 @@
 /** Independent (distinct-session) failures required to corroborate a NON-deterministic failure. */
 export declare const CORROBORATION_MIN_INDEPENDENT = 2;
 /**
- * WR-01 bound on the FORGET-03 corroboration tally — the max distinct memoryIds the
+ * Bound on the corroboration tally — the max distinct memoryIds the
  * `failureCorroborationTally` Map tracks before evicting the oldest. The tally is a
  * daemon-lifetime in-process gauge (resets on restart); without a cap a busy fleet (or
  * an adversary on rotating session keys) grows it unbounded. 50_000 mirrors the
@@ -19,7 +19,7 @@ export declare const CORROBORATION_MIN_INDEPENDENT = 2;
  */
 export declare const MAX_TRACKED_FAILURE_MEMORIES = 50000;
 /**
- * FORGET-03 anti-induced-eviction corroboration gate (a SECURITY control). A
+ * Anti-induced-eviction corroboration gate (a SECURITY control). A
  * `failure_count` accrual is permitted ONLY when corroborated:
  *  - (a) the fused verdict has a DETERMINISTIC source (`tool`/`pipeline`) — one
  *    suffices (it cannot be spoofed by an external sender), OR
@@ -27,13 +27,13 @@ export declare const MAX_TRACKED_FAILURE_MEMORIES = 50000;
  *    memory within the subscriber's lifetime.
  * Below the gate → no accrual (Defer ≠ Retry — a single low-trust/`external` failure
  * is benign). Daemon-side half of the two-layer control; the high-proof/system/pinned
- * EVICTION exemption is store-side (Plan 05), so the daemon reads NO per-memory
+ * EVICTION exemption is store-side, so the daemon reads NO per-memory
  * proof/trust/pinned here (`ResolvedOutcome` carries none — no hot-path DB read).
  *
  * Mutates `tally` (memoryId → distinct sessionIds seen failing it) so the across-call
  * distinct-session count accumulates. Returns true when the accrual should fire.
  *
- * WR-01 BOUNDED (two caps, no daemon-lifetime growth): (1) the inner per-memory Set
+ * BOUNDED (two caps, no daemon-lifetime growth): (1) the inner per-memory Set
  * STOPS growing at `CORROBORATION_MIN_INDEPENDENT` (past the gate the exact count is
  * irrelevant); (2) the outer Map is capped at `maxTracked` (default
  * {@link MAX_TRACKED_FAILURE_MEMORIES}) and evicts the OLDEST-touched memoryId

package/node_modules/@comis/daemon/dist/wiring/setup-learning-corroboration.js

@@ -1,6 +1,6 @@
 // SPDX-License-Identifier: Apache-2.0
 /**
- * FORGET-03 corroboration gate — the anti-induced-eviction SECURITY control shared
+ * Corroboration gate — the anti-induced-eviction SECURITY control shared
  * by the learned-skill demote path and the memory failure-accrual path in
  * `setup-learning.ts`. Extracted to its own leaf (zero imports from setup-learning.ts
  * → no cycle) to keep `setup-learning.ts` under the 800-line cap. `setup-learning.ts`
@@ -8,12 +8,12 @@
  *
  * @module
  */
-/** The DETERMINISTIC fused-verdict sources — a single one of these satisfies the FORGET-03 gate. */
+/** The DETERMINISTIC fused-verdict sources — a single one of these satisfies the corroboration gate. */
 const DETERMINISTIC_FUSION_SOURCES = new Set(["tool", "pipeline"]);
 /** Independent (distinct-session) failures required to corroborate a NON-deterministic failure. */
 export const CORROBORATION_MIN_INDEPENDENT = 2;
 /**
- * WR-01 bound on the FORGET-03 corroboration tally — the max distinct memoryIds the
+ * Bound on the corroboration tally — the max distinct memoryIds the
  * `failureCorroborationTally` Map tracks before evicting the oldest. The tally is a
  * daemon-lifetime in-process gauge (resets on restart); without a cap a busy fleet (or
  * an adversary on rotating session keys) grows it unbounded. 50_000 mirrors the
@@ -22,7 +22,7 @@ export const CORROBORATION_MIN_INDEPENDENT = 2;
  */
 export const MAX_TRACKED_FAILURE_MEMORIES = 50_000;
 /**
- * FORGET-03 anti-induced-eviction corroboration gate (a SECURITY control). A
+ * Anti-induced-eviction corroboration gate (a SECURITY control). A
  * `failure_count` accrual is permitted ONLY when corroborated:
  *  - (a) the fused verdict has a DETERMINISTIC source (`tool`/`pipeline`) — one
  *    suffices (it cannot be spoofed by an external sender), OR
@@ -30,13 +30,13 @@ export const MAX_TRACKED_FAILURE_MEMORIES = 50_000;
  *    memory within the subscriber's lifetime.
  * Below the gate → no accrual (Defer ≠ Retry — a single low-trust/`external` failure
  * is benign). Daemon-side half of the two-layer control; the high-proof/system/pinned
- * EVICTION exemption is store-side (Plan 05), so the daemon reads NO per-memory
+ * EVICTION exemption is store-side, so the daemon reads NO per-memory
  * proof/trust/pinned here (`ResolvedOutcome` carries none — no hot-path DB read).
  *
  * Mutates `tally` (memoryId → distinct sessionIds seen failing it) so the across-call
  * distinct-session count accumulates. Returns true when the accrual should fire.
  *
- * WR-01 BOUNDED (two caps, no daemon-lifetime growth): (1) the inner per-memory Set
+ * BOUNDED (two caps, no daemon-lifetime growth): (1) the inner per-memory Set
  * STOPS growing at `CORROBORATION_MIN_INDEPENDENT` (past the gate the exact count is
  * irrelevant); (2) the outer Map is capped at `maxTracked` (default
  * {@link MAX_TRACKED_FAILURE_MEMORIES}) and evicts the OLDEST-touched memoryId

package/node_modules/@comis/daemon/dist/wiring/setup-learning-judge.d.ts

@@ -1,5 +1,5 @@
 /**
- * OUTCOME-04 conversational-breadth LLM-judge fallback — the LEAF for the v2.26
+ * Conversational-breadth LLM-judge fallback — the LEAF for the
  * Verified Learning outcome judge.
  *
  * Extracted to its own leaf (like `setup-learning-corroboration.ts`) so neither
@@ -115,7 +115,7 @@ export interface OutcomeJudgeWiringResult {
     readTurnTranscript?: (scope: JudgeScope) => string | undefined;
 }
 /**
- * Construct the OUTCOME-04 conversational-breadth judge fallback daemon-side, behind the
+ * Construct the conversational-breadth judge fallback daemon-side, behind the
  * byte-identity gate. Mirrors `buildReactionWiringDeps`'s "build only when needed" posture
  * and keeps the bulk OUT of setup-memory.ts.
  *
@@ -150,7 +150,7 @@ export interface JudgeUpgradeDeps {
     readTurnTranscript?: (scope: JudgeScope) => string | undefined;
 }
 /**
- * OUTCOME-04 conversational-breadth upgrade — the LLM-judge fallback for an `unknown`
+ * Conversational-breadth upgrade — the LLM-judge fallback for an `unknown`
  * deterministic verdict. Returns the (possibly UPGRADED) verdict the rest of the consume
  * chain runs on. Entered ONLY when:
  *  - the deterministic resolve fused to `unknown` (a resolved tool/pipeline turn skips the

package/node_modules/@comis/daemon/dist/wiring/setup-learning-judge.js

@@ -1,6 +1,6 @@
 // SPDX-License-Identifier: Apache-2.0
 /**
- * OUTCOME-04 conversational-breadth LLM-judge fallback — the LEAF for the v2.26
+ * Conversational-breadth LLM-judge fallback — the LEAF for the
  * Verified Learning outcome judge.
  *
  * Extracted to its own leaf (like `setup-learning-corroboration.ts`) so neither
@@ -77,7 +77,7 @@ function resolveOutcomeJudge(agent, container, agentId, clock, logger) {
     const apiKeyName = providerEntry?.apiKeyName || `${resolved.provider.toUpperCase()}_API_KEY`;
     const apiKey = container.secretManager.get(apiKeyName) ??
         // Keyless by TYPE, not config NAME — a user-named ollama entry must resolve keyless, else the
-        // outcome judge is a silent no-op on a local keyless daemon (package-delivery-20260628). Mirrors
+        // outcome judge is a silent no-op on a local keyless daemon. Mirrors
         // setup-dialectic + the completion path. Guarded by test/architecture/keyless-provider-by-type.
         (KEYLESS_PROVIDER_TYPES.has(providerEntry?.type ?? resolved.provider) ? KEYLESS_API_KEY_SENTINEL : "");
     if (!apiKey)
@@ -103,7 +103,7 @@ function resolveOutcomeJudge(agent, container, agentId, clock, logger) {
     };
 }
 /**
- * Construct the OUTCOME-04 conversational-breadth judge fallback daemon-side, behind the
+ * Construct the conversational-breadth judge fallback daemon-side, behind the
  * byte-identity gate. Mirrors `buildReactionWiringDeps`'s "build only when needed" posture
  * and keeps the bulk OUT of setup-memory.ts.
  *
@@ -125,8 +125,7 @@ export function buildOutcomeJudgeWiring(container, clock, logger, lcdStore) {
     // always MATERIALIZE the nested `judge` default for an explicitly-present-but-partial
     // `learningOutcome` block (e.g. `{enabled:true, correction:{enabled:true}}` leaves `judge`
     // undefined) — so a defaulted/absent `judge.enabled` (the common case) MUST read as ON.
-    // The master `memory.enabled` kill-switch (renamed from costFeatures.enabled in Phase 226)
-    // still gates everything.
+    // The master `memory.enabled` kill-switch still gates everything.
     const learningOutcomeJudgeEnabled = (agentId) => costFeaturesEnabled &&
         agents[agentId]?.learningOutcome?.enabled !== false &&
         agents[agentId]?.learningOutcome?.judge?.enabled !== false;
@@ -184,7 +183,7 @@ export function buildOutcomeJudgeWiring(container, clock, logger, lcdStore) {
     return { outcomeJudge, learningOutcomeJudgeEnabled, readTurnTranscript };
 }
 /**
- * OUTCOME-04 conversational-breadth upgrade — the LLM-judge fallback for an `unknown`
+ * Conversational-breadth upgrade — the LLM-judge fallback for an `unknown`
  * deterministic verdict. Returns the (possibly UPGRADED) verdict the rest of the consume
  * chain runs on. Entered ONLY when:
  *  - the deterministic resolve fused to `unknown` (a resolved tool/pipeline turn skips the