comisai 1.0.44 → 1.0.46

package/node_modules/@comis/daemon/dist/wiring/setup-tools-autonomy.d.ts

@@ -1,5 +1,5 @@
 /**
- * `setup-tools-autonomy` — the Phase-212 Gap-3 dormancy-activation tool wiring,
+ * `setup-tools-autonomy` — the dormancy-activation tool wiring,
  * extracted from `setup-tools.ts` to keep it under the 800-line cap (mirrors the
  * `setup-broker-activation` / `setup-terminal-tools` / `setup-context-tools`
  * extractions). It owns the per-assembly cap-lease MINT + the `orchestrate` tool
@@ -9,11 +9,12 @@
  *   - {@link buildCapabilityMint}: from the KEPT cap-layer handle
  *     (`constructCapabilityLayer`) + the agent's resolved autonomy caps, build the
  *     `CapabilityMintDeps` that `buildBrokerSpawnEnv`'s 3rd arg consumes (mints the
- *     per-spawn lease, registers the bearer in OutputGuard — Pitfall 1, injects
+ *     per-spawn lease, registers the bearer in OutputGuard so it is scrubbed from
+ *     agent-visible output, injects
  *     `COMIS_CAP_LEASE`/`COMIS_ORCH_SOCKET`). `undefined` for a non-autonomy agent
  *     (or no handle) → `buildBrokerSpawnEnv`'s 2-arg behavior holds (no regression).
- *   - {@link maybeBuildOrchestrateTool}: assemble the Surface-2 `orchestrate` runner
- *     (Plan 04) when the agent is autonomy-bearing AND a sandbox provider exists
+ *   - {@link maybeBuildOrchestrateTool}: assemble the `orchestrate` runner
+ *     when the agent is autonomy-bearing AND a sandbox provider exists
  *     (the jail is buildable). The autonomy resolver IS the gate — no speculative
  *     `builtinTools.orchestrate` flag (AGENTS §2.3). The runner gets the cap socket,
  *     the SAME minted `brokerSpawnEnv` (so its jailed SDK authenticates), and a
@@ -21,9 +22,10 @@
  *
  * @module
  */
-import { type ComisLogger, type PerAgentConfig, type SessionKey } from "@comis/core";
+import { type ApprovalGate, type ComisLogger, type PerAgentConfig, type SessionKey, type TypedEventBus } from "@comis/core";
 import type { PlatformToolProvider } from "@comis/skills";
-import type { SandboxProvider } from "@comis/skills/tools";
+import type { OrchestrateDurableRuns, SandboxProvider } from "@comis/skills/tools";
+import type { CapabilityClass, OrchestrateRepairSeam } from "@comis/agent";
 /** The daemon tool-assembly array element type (an `AgentTool`), derived via skills
  *  (mirrors setup-context-tools.ts / setup-terminal-tools.ts) so this file does not
  *  type-import `@earendil-works/pi-agent-core` directly (which @comis/daemon does not declare). */
@@ -45,7 +47,7 @@ export interface AutonomyToolInputs {
     /** The OS sandbox provider — REQUIRED for the orchestrate jail; absent ⇒ no orchestrate tool. */
     readonly sandboxProvider: SandboxProvider | undefined;
     /**
-     * PROFILE-05/JAIL-03/JAIL-05 — the host namespace preflight RESULT (the
+     * The host namespace preflight RESULT (the
      * unprivileged-userns + `--unshare-net` probe `constructCapabilityLayer` runs
      * once at boot). `false` means the jail CANNOT be built on this host, so the
      * autonomy surface must genuinely degrade to `assistant` here (no orchestrate
@@ -58,17 +60,59 @@ export interface AutonomyToolInputs {
     /** The session key the lease is minted for, or undefined (heartbeat/cron). */
     readonly sessionKey: SessionKey | undefined;
     /**
-     * The CALLER's tree-stable rootRunId (Phase 213 CEIL-01/BUDGET), when this
+     * The CALLER's tree-stable rootRunId, when this
      * assembly is itself a sub-agent whose spawn metadata carried one. When present
-     * the minted lease INHERITS it (so the whole tree shares one id — RESEARCH
-     * Pitfall 1, the silent under-count). Absent ⇒ this is a tree root and a fresh
-     * id is minted here.
+     * the minted lease INHERITS it — the whole tree must share one id, or the
+     * per-tree budget/semaphore accounting silently under-counts. Absent ⇒ this is
+     * a tree root and a fresh id is minted here.
      */
     readonly callerRootRunId?: string;
     /** The skills-scoped logger (instrument the runner + the store). */
     readonly logger: ComisLogger;
-    /** The filtered inherited env the runner scrubs (ORCH-02); the lease vars ride placeholders. */
+    /** The filtered inherited env the runner scrubs; the lease vars ride placeholders. */
     readonly baseEnv: Record<string, string | undefined> | undefined;
+    /**
+     * The assembly event bus. Threaded into the orchestrate runner so each run
+     * emits a content-free `orchestrate:run_summary` from the TOOL (where this bus
+     * reaches the live per-session trajectory bridge — NOT a daemon graph handler).
+     * Absent ⇒ the runner does not emit (no regression to the older wiring).
+     */
+    readonly eventBus?: TypedEventBus;
+    /**
+     * The approval gate, threaded into the orchestrate runner's static pre-flight:
+     * when present, a run fires ONE approval on its whole capability footprint before
+     * spawn. Present ONLY when `config.approvals.enabled` (the daemon threads it from the
+     * same `deps.approvalGate` exec uses) — so seam-presence IS "approvals configured".
+     * Absent ⇒ no approval fire (no regression to older wiring).
+     */
+    readonly approvalGate?: ApprovalGate;
+    /**
+     * The resolved effective capability class (operator override → provider-family →
+     * the `small` fail-safe), threaded from setup-tools. The orchestrate runner's
+     * one-shot auto-repair is class-gated off it — ON for weaker models (small/nano),
+     * OFF for stronger (frontier/mid). No config toggle: the class is the sole control.
+     * Absent ⇒ the runner treats it as the fail-safe class where consumed.
+     */
+    readonly capabilityClass?: CapabilityClass;
+    /**
+     * The daemon-minted one-shot repair closure, resolved per agent by
+     * `buildOrchestrateRepairResolver` ONLY when the class is repair-eligible AND a
+     * utility model resolves. Threaded into the orchestrate runner (like {@link mintRunLease})
+     * so a recoverable failed script gets ONE utility-model re-prompt + one re-run.
+     * Absent ⇒ no repair (frontier/mid, or no resolvable utility model).
+     */
+    readonly repairSeam?: OrchestrateRepairSeam;
+    /**
+     * The durable-run store port. The composition root threads it whenever the
+     * durable-resume subsystem is constructed (i.e. durability is enabled for some
+     * agent); this wiring forwards it into the orchestrate runner ONLY when THIS
+     * agent's `autonomy.durability.orchestrateResume` is on (the surface gate,
+     * resolved below off the same config path as the capability-endpoint's
+     * `orchestrateResumeEnabled` predicate). Forwarded ⇒ the runner registers a
+     * resumable row + honors `resumeRunId` + skips cleanupRun on a timeout. Off /
+     * absent ⇒ no durable row, normal cleanup (byte-identical to a non-resumable run).
+     */
+    readonly durableRuns?: OrchestrateDurableRuns;
 }
 /** The wiring {@link buildAutonomyToolWiring} returns: the minted env + the orchestrate tool. */
 export interface AutonomyToolWiring {
@@ -78,14 +122,14 @@ export interface AutonomyToolWiring {
     readonly orchestrateTool: AgentTool | undefined;
 }
 /**
- * The Phase-212 Gap-3 autonomy tool wiring for one agent assembly: mint the
+ * The autonomy tool wiring for one agent assembly: mint the
  * per-spawn lease ONCE (the SAME env feeds exec + orchestrate, one lease per
  * assembly — mirrors the broker token's per-assembly lifecycle) and assemble the
  * `orchestrate` tool when the agent is autonomy-bearing AND a sandbox provider
  * exists (the jail is buildable). `capMint`/`orchestrateTool` are `undefined` for
  * a non-autonomy agent, no handle, or no sandbox → `buildBrokerSpawnEnv`'s 2-arg
- * behavior + NO orchestrate tool (never an unjailed run; no regression — 211-06
- * covered both broker paths). The autonomy resolver IS the gate (no speculative
+ * behavior + NO orchestrate tool (never an unjailed run; both broker paths keep
+ * their existing behavior). The autonomy resolver IS the gate (no speculative
  * `builtinTools.orchestrate` flag — AGENTS §2.3); the runner's `resolveJailNode`
  * honest-degrade is the second line behind the sandbox gate.
  */

package/node_modules/@comis/daemon/dist/wiring/setup-tools-autonomy.js

@@ -1,6 +1,6 @@
 // SPDX-License-Identifier: Apache-2.0
 /**
- * `setup-tools-autonomy` — the Phase-212 Gap-3 dormancy-activation tool wiring,
+ * `setup-tools-autonomy` — the dormancy-activation tool wiring,
  * extracted from `setup-tools.ts` to keep it under the 800-line cap (mirrors the
  * `setup-broker-activation` / `setup-terminal-tools` / `setup-context-tools`
  * extractions). It owns the per-assembly cap-lease MINT + the `orchestrate` tool
@@ -10,11 +10,12 @@
  *   - {@link buildCapabilityMint}: from the KEPT cap-layer handle
  *     (`constructCapabilityLayer`) + the agent's resolved autonomy caps, build the
  *     `CapabilityMintDeps` that `buildBrokerSpawnEnv`'s 3rd arg consumes (mints the
- *     per-spawn lease, registers the bearer in OutputGuard — Pitfall 1, injects
+ *     per-spawn lease, registers the bearer in OutputGuard so it is scrubbed from
+ *     agent-visible output, injects
  *     `COMIS_CAP_LEASE`/`COMIS_ORCH_SOCKET`). `undefined` for a non-autonomy agent
  *     (or no handle) → `buildBrokerSpawnEnv`'s 2-arg behavior holds (no regression).
- *   - {@link maybeBuildOrchestrateTool}: assemble the Surface-2 `orchestrate` runner
- *     (Plan 04) when the agent is autonomy-bearing AND a sandbox provider exists
+ *   - {@link maybeBuildOrchestrateTool}: assemble the `orchestrate` runner
+ *     when the agent is autonomy-bearing AND a sandbox provider exists
  *     (the jail is buildable). The autonomy resolver IS the gate — no speculative
  *     `builtinTools.orchestrate` flag (AGENTS §2.3). The runner gets the cap socket,
  *     the SAME minted `brokerSpawnEnv` (so its jailed SDK authenticates), and a
@@ -26,19 +27,19 @@ import { resolveAutonomy, degradeAutonomy, systemNowMs, formatSessionKey, } from
 import { createOrchestrateTool, createResultRefStore } from "@comis/skills/tools";
 import { buildBrokerSpawnEnv, } from "./setup-broker-activation.js";
 /**
- * The Phase-212 Gap-3 autonomy tool wiring for one agent assembly: mint the
+ * The autonomy tool wiring for one agent assembly: mint the
  * per-spawn lease ONCE (the SAME env feeds exec + orchestrate, one lease per
  * assembly — mirrors the broker token's per-assembly lifecycle) and assemble the
  * `orchestrate` tool when the agent is autonomy-bearing AND a sandbox provider
  * exists (the jail is buildable). `capMint`/`orchestrateTool` are `undefined` for
  * a non-autonomy agent, no handle, or no sandbox → `buildBrokerSpawnEnv`'s 2-arg
- * behavior + NO orchestrate tool (never an unjailed run; no regression — 211-06
- * covered both broker paths). The autonomy resolver IS the gate (no speculative
+ * behavior + NO orchestrate tool (never an unjailed run; both broker paths keep
+ * their existing behavior). The autonomy resolver IS the gate (no speculative
  * `builtinTools.orchestrate` flag — AGENTS §2.3); the runner's `resolveJailNode`
  * honest-degrade is the second line behind the sandbox gate.
  */
 export function buildAutonomyToolWiring(input) {
-    // PROFILE-05 / JAIL-03 / JAIL-05 — the honest-degrade must gate the SURFACE, not
+    // The honest-degrade must gate the SURFACE, not
     // just the boot log. When the host namespace preflight failed the jail cannot be
     // built, so `degradeAutonomy` downshifts the resolved posture to `assistant`
     // (enabled:false, zero caps) HERE — the SAME shipped single-source-of-truth the
@@ -51,21 +52,34 @@ export function buildAutonomyToolWiring(input) {
     const resolved = degradeAutonomy(resolveAutonomy(input.agentConfig?.autonomy), {
         namespacePreflightOk: input.namespacePreflightOk ?? true,
     }).resolved;
+    // The resume surface gate (default-OFF, deny-by-absence): the durable-run store
+    // is forwarded into the runner ONLY when THIS agent has opted into resumable
+    // orchestrate runs. Reads the SAME config path as the capability endpoint's
+    // orchestrateResumeEnabled predicate (`=== true` so an absent/typo'd durability
+    // block resolves OFF) — so a store the composition root always threads under a
+    // durability-enabled boot goes live in the runner only for an opted-in agent.
+    const orchestrateResumeOn = input.agentConfig?.autonomy?.durability?.orchestrateResume === true;
     const handle = input.capEndpointHandle;
-    // Tree-stable rootRunId (Phase 213 — RESEARCH Pitfall 1): INHERIT the caller's
+    // Tree-stable rootRunId: INHERIT the caller's
     // id when this assembly is a sub-agent (so the whole tree shares one id the
-    // semaphore/budget/kill key on); mint a fresh root id ONLY when there is no
+    // semaphore/budget/kill key on — a fresh id per sub-agent would silently
+    // under-count the tree); mint a fresh root id ONLY when there is no
     // caller id (the tree root). Uses systemNowMs (the sanctioned-root time helper).
     const rootRunId = input.callerRootRunId ?? `root-${input.agentId}-${systemNowMs().toString(36)}`;
+    // Extract the budget/session refs ONCE so the assembly capMint AND the per-run
+    // child-lease seam mint against the SAME accounting refs — a child that drifted
+    // onto a different budgetRef/sessionKey would mis-attribute spend and break the
+    // audience-bound sessionKey correlation. budgetRef is a per-assembly id.
+    const budgetRef = `run-${input.agentId}-${systemNowMs().toString(36)}`;
+    const sessionKey = input.sessionKey ? formatSessionKey(input.sessionKey) : input.agentId;
     const capMint = handle && resolved.enabled
         ? {
             leaseManager: handle.leaseManager,
             outputGuard: handle.outputGuard,
             capSocketPath: handle.capSocketPath,
             resolvedCaps: resolved.capabilities,
-            // budgetRef is the Phase-213 budget seam; an M1 per-assembly id.
-            budgetRef: `run-${input.agentId}-${systemNowMs().toString(36)}`,
-            sessionKey: input.sessionKey ? formatSessionKey(input.sessionKey) : input.agentId,
+            budgetRef,
+            sessionKey,
             rootRunId,
             // Anchor the tree root in the bounded-autonomy service right after the
             // mint (the per-root budget wall-clock + the rootRunId↔leaseId index).
@@ -73,6 +87,47 @@ export function buildAutonomyToolWiring(input) {
         }
         : undefined;
     const brokerSpawnEnv = buildBrokerSpawnEnv(input.brokerContext, input.agentId, capMint);
+    // The per-run child-lease mint seam (D5, EXPLAIN-01) — the correlation
+    // keystone. A closure the runner calls ONCE per orchestrate run to mint a
+    // short-TTL CHILD lease off the assembly lease: same caps + SAME rootRunId
+    // (tree accounting untouched — registerRoot is NOT called, so the per-root
+    // budget/semaphore/kill stays keyed on the single registered assembly lease,
+    // INV-7), parentLeaseId = the assembly leaseId, and a TTL the RUNNER sizes and
+    // passes in (ttlMs === maxTtlMs === the runner-passed ttlMs): the run timeout,
+    // or the run timeout + the one-shot-repair budget when auto-repair is enabled,
+    // so the single lease outlives the repair-completion await into the repaired
+    // re-run. The child bearer is registered in OutputGuard at mint
+    // (Pitfall 1 — never logged) BEFORE it leaves the closure. revokeByRootRun still
+    // reaches the child (it scans by the inherited rootRunId), so kill is preserved.
+    // Built ONLY when an assembly lease exists (brokerSpawnEnv.leaseId present);
+    // otherwise undefined → the runner falls back to the assembly bearer (the
+    // older/non-autonomy path — never an unauthenticated run). A plain closure so
+    // @comis/skills never imports the LeaseManager: the mint is daemon-side, the
+    // runner only receives the bearer.
+    const assemblyLeaseId = brokerSpawnEnv?.leaseId;
+    const mintRunLease = handle && resolved.enabled && assemblyLeaseId !== undefined
+        ? (runId, ttlMs) => {
+            // runId is the runner's correlator; the child lease minted here is
+            // correlated by its OWN fresh leaseId + the inherited rootRunId.
+            const issued = handle.leaseManager.mintLease({
+                agentId: input.agentId,
+                caps: resolved.capabilities,
+                budgetRef,
+                sessionKey,
+                rootRunId,
+                parentLeaseId: assemblyLeaseId,
+                ttlMs,
+                maxTtlMs: ttlMs,
+            });
+            // Register the child bearer BEFORE it leaves the closure (Pitfall 1 —
+            // a NEW bearer that is not registered can leak via a log/model echo).
+            handle.outputGuard.registerSecret(issued.bearer);
+            // Intentionally NO boundedAutonomy.registerRoot for the child (D5) —
+            // the child inherits the assembly's rootRunId, so tree accounting is
+            // untouched (INV-7); revokeByRootRun still reaches it.
+            return { leaseId: issued.leaseId, bearer: issued.bearer };
+        }
+        : undefined;
     const orchestrateTool = handle && resolved.enabled && input.sandboxProvider
         ? createOrchestrateTool({
             logger: input.logger,
@@ -80,8 +135,39 @@ export function buildAutonomyToolWiring(input) {
             capSocketPath: handle.capSocketPath,
             sandbox: input.sandboxProvider,
             brokerSpawnEnv, // the SAME minted COMIS_CAP_LEASE/COMIS_ORCH_SOCKET
+            mintRunLease, // per-run child bearer overrides the assembly bearer (D5)
             store: createResultRefStore({ logger: input.logger }),
             baseEnv: input.baseEnv ?? {},
+            // The static pre-flight's held-cap set: the SAME resolved.capabilities the
+            // assembly/child leases are minted with — the advisory pre-spawn cap
+            // fail-fast keys on it (the cap-socket endpoint stays the authoritative
+            // gate). No drift by construction.
+            allowedCaps: resolved.capabilities,
+            // The approval gate — threaded ONLY when the daemon wired one
+            // (config.approvals.enabled), mirroring the eventBus conditional-spread.
+            // Absent ⇒ the runner fires no approval.
+            ...(input.approvalGate !== undefined ? { approvalGate: input.approvalGate } : {}),
+            // The run_summary emit channel + the self-attribution keys (the
+            // daemon-shared bus fans out to every session bridge — the payload
+            // carries rootRunId + sessionKey so it lands on the right report).
+            ...(input.eventBus !== undefined ? { eventBus: input.eventBus } : {}),
+            // The one-shot auto-repair class-gate + the daemon-minted repair closure
+            // — conditional-spread like eventBus. capabilityClass gates the runner's
+            // repair branch (a pure class-gate off the model profile; no config
+            // toggle); repairSeam is the injected one-attempt completion. Both absent
+            // for a stronger model / an unresolvable utility model ⇒ the runner does
+            // not repair (no regression to older wiring).
+            ...(input.capabilityClass !== undefined ? { capabilityClass: input.capabilityClass } : {}),
+            ...(input.repairSeam !== undefined ? { repairSeam: input.repairSeam } : {}),
+            // The durable-run store — forwarded ONLY when the resume surface is on
+            // for this agent (orchestrateResumeOn gates the store the composition
+            // root always threads), making the runner resumable. Off ⇒ omitted → the
+            // runner writes no durable row + cleans normally (default-off byte-identity).
+            ...(input.durableRuns !== undefined && orchestrateResumeOn
+                ? { durableRuns: input.durableRuns }
+                : {}),
+            rootRunId,
+            sessionKey,
         })
         : undefined;
     return { brokerSpawnEnv, orchestrateTool };

package/node_modules/@comis/daemon/dist/wiring/setup-tools-capabilities.d.ts

@@ -4,7 +4,7 @@
  * Extracted from setup-tools.ts (file-size cap) WITHOUT behavior change. The
  * single export `makeCreateAgentRpcCall` returns the per-agent `createAgentRpcCall`
  * builder that, for a given agentId, resolves the agent's held capability set
- * (CAP-03, v8 §3.1) and injects `_capabilities` alongside `_agentId` plus the
+ * and injects `_capabilities` alongside `_agentId` plus the
  * caller's session/delivery/channel context into every in-process RPC call.
  * @module
  */
@@ -19,17 +19,17 @@ export interface AgentRpcCallFactoryDeps {
     /** Default agent ID from routing config (fallback for unknown agentIds). */
     defaultAgentId: string;
     /**
-     * Phase 216 (HIGH-1 / NEW-4): the durable-run store — the SOLE source of the
+     * The durable-run store — the SOLE source of the
      * monotonic `_outwardStepIndex` (allocateOutwardStep). For an OUTWARD message
      * method the factory allocates a UNIQUE per-root index and injects it alongside
-     * `_callerSessionKey` so Plan 05's wrap reads a distinct `(rootRunId, stepIndex)`
-     * per in-process send. Optional; **absent ⇒ no index injected** → the wrap is a
-     * pass-through (byte-identical pre-216). The daemon wires it ONLY when
+     * `_callerSessionKey` so the exactly-once dispatch wrap reads a distinct
+     * `(rootRunId, stepIndex)` per in-process send. Optional; **absent ⇒ no index
+     * injected** → the wrap is a pass-through. The daemon wires it ONLY when
      * durability is enabled.
      */
     durableRuns?: DurableRunPort;
     /**
-     * Phase 216 (NEW-4): resolve a `SessionKey` to its tree-stable `rootRunId` (the
+     * Resolve a `SessionKey` to its tree-stable `rootRunId` (the
      * same resolver the RPC dispatch uses). Required to allocate the outward index
      * for an in-process send (the index keys on `rootRunId`, not the session key).
      * Optional; absent ⇒ no index allocated (pass-through). Paired with
@@ -41,8 +41,8 @@ export interface AgentRpcCallFactoryDeps {
  * Build the per-agent `createAgentRpcCall(agentId)` factory over the injected deps.
  *
  * The returned factory creates an agent-scoped rpcCall that injects _agentId,
- * _capabilities, _callerSessionKey, and _deliveryTarget into every call. (O3/WR-01
- * Phase-157 producer hook: inject resolved capabilityClass on graph.* params here —
- * see graph-helpers.ts.)
+ * _capabilities, _callerSessionKey, and _deliveryTarget into every call. (This is
+ * also the producer hook that injects the resolved capabilityClass on graph.*
+ * params — see graph-helpers.ts.)
  */
 export declare function makeCreateAgentRpcCall(deps: AgentRpcCallFactoryDeps): (agentId: string) => RpcCall;

package/node_modules/@comis/daemon/dist/wiring/setup-tools-capabilities.js

@@ -5,18 +5,18 @@
  * Extracted from setup-tools.ts (file-size cap) WITHOUT behavior change. The
  * single export `makeCreateAgentRpcCall` returns the per-agent `createAgentRpcCall`
  * builder that, for a given agentId, resolves the agent's held capability set
- * (CAP-03, v8 §3.1) and injects `_capabilities` alongside `_agentId` plus the
+ * and injects `_capabilities` alongside `_agentId` plus the
  * caller's session/delivery/channel context into every in-process RPC call.
  * @module
  */
 import { tryGetContext, parseFormattedSessionKey, resolveAutonomy } from "@comis/core";
 /**
- * The OUTWARD message methods (Phase 216, HIGH-1 / NEW-4) — the genuinely-outward
- * subset (§3.5) that needs a monotonic `_outwardStepIndex` for the exactly-once
+ * The OUTWARD message methods — the genuinely-outward
+ * subset that needs a monotonic `_outwardStepIndex` for the exactly-once
  * ledger. An in-process agent-loop `message.send` reaches the dispatch sink via
- * THIS factory carrying `_callerSessionKey`; without the index, Plan 05's wrap
- * would default to 0 and a second send in the same run would collide on
- * `(rootRunId, 0)` and be silently dropped (the NEW-4 gap). Mirrors the
+ * THIS factory carrying `_callerSessionKey`; without the index, the exactly-once
+ * dispatch wrap would default to 0 and a second send in the same run would
+ * collide on `(rootRunId, 0)` and be silently dropped. Mirrors the
  * `OUTWARD_MESSAGE_METHODS` set in setup-capability-endpoint.ts (the jail leg).
  */
 const OUTWARD_MESSAGE_METHODS = new Set([
@@ -28,26 +28,26 @@ const OUTWARD_MESSAGE_METHODS = new Set([
  * Build the per-agent `createAgentRpcCall(agentId)` factory over the injected deps.
  *
  * The returned factory creates an agent-scoped rpcCall that injects _agentId,
- * _capabilities, _callerSessionKey, and _deliveryTarget into every call. (O3/WR-01
- * Phase-157 producer hook: inject resolved capabilityClass on graph.* params here —
- * see graph-helpers.ts.)
+ * _capabilities, _callerSessionKey, and _deliveryTarget into every call. (This is
+ * also the producer hook that injects the resolved capabilityClass on graph.*
+ * params — see graph-helpers.ts.)
  */
 export function makeCreateAgentRpcCall(deps) {
     const { rpcCall, agents, defaultAgentId, durableRuns, resolveRootRunId } = deps;
     return function createAgentRpcCall(agentId) {
-        // CAP-03: resolve the agent's held capability set ONCE per closure — the
-        // in-process injection point for _capabilities (v8 §3.1, beside _agentId).
-        // A zero-config agent resolves to the `standard` profile (MIG-01: an
-        // explicit grant via the default posture, not a back-compat shim), whose
+        // Resolve the agent's held capability set ONCE per closure — the
+        // in-process injection point for _capabilities (beside _agentId).
+        // A zero-config agent resolves to the `standard` profile (an
+        // explicit grant via the default posture, not a compatibility shim), whose
         // floor set keeps its orchestration tools reachable now that they are
-        // capability-gated. Caps do not change mid-turn (RESEARCH Open Q1); the
-        // lease in Phase 211 carries the authoritative caps for the socket path.
+        // capability-gated. Caps do not change mid-turn; the minted
+        // lease carries the authoritative caps for the socket path.
         // The bare cap-string list is what the handler-boundary requireCapability
         // predicate reads (the per-cap autoApprovable detail stays on the resolver
-        // result for Plan 06's auto-allow door).
-        // Phase 217 (UNATT-01): resolve ONCE and read BOTH caps and mode from the SAME
+        // result for the auto-allow door).
+        // Resolve ONCE and read BOTH caps and mode from the SAME
         // object so the injected `_capabilities` and `_autonomyMode` cannot drift
-        // (T-217-11 — a single source of truth, not two resolve calls).
+        // (a single source of truth, not two resolve calls).
         const resolved = resolveAutonomy((agents[agentId] ?? agents[defaultAgentId])?.autonomy);
         const heldCapabilities = resolved.capabilities;
         return async (method, params) => {
@@ -63,14 +63,14 @@ export function makeCreateAgentRpcCall(deps) {
                     channelType: ctx?.channelType,
                 };
             }
-            // HIGH-1 / NEW-4 (Phase 216): an in-process agent-loop OUTWARD send reaches
+            // An in-process agent-loop OUTWARD send reaches
             // the dispatch sink THROUGH here with `_callerSessionKey`, so it MUST carry a
             // UNIQUE `_outwardStepIndex` too — otherwise it is an un-ledgered pass-through
             // (a second send in one run would collide on (rootRunId, 0) and be dropped).
             // Resolve rootRunId from the session key (the same resolver the RPC dispatch
             // uses), then allocate the monotonic index. A non-outward method, an absent
             // store/resolver, or an unresolvable session ⇒ no index (the wrap is then a
-            // pass-through). `_outwardStepIndex` is in INTERNAL_FIELD_NAMES (NEW-3), so a
+            // pass-through). `_outwardStepIndex` is in INTERNAL_FIELD_NAMES, so a
             // forged inbound value never survives to here — this is the trusted allocation.
             let outwardStepIndex;
             if (durableRuns && resolveRootRunId && parsedSession && OUTWARD_MESSAGE_METHODS.has(method)) {
@@ -87,13 +87,13 @@ export function makeCreateAgentRpcCall(deps) {
                 ...params,
                 _agentId: agentId,
                 _capabilities: heldCapabilities,
-                // Phase 217 (UNATT-01): the trusted autonomy mode for THIS run, from the
+                // The trusted autonomy mode for THIS run, from the
                 // same resolve as caps. Always injected (resolveAutonomy always yields a
-                // mode), so the Wave-2 chokepoint's in-process leg always sees the run's
-                // true mode through this forgery-proof channel. `_autonomyMode` is in
+                // mode), so the unattended-mode chokepoint's in-process leg always sees the
+                // run's true mode through this forgery-proof channel. `_autonomyMode` is in
                 // INTERNAL_FIELD_NAMES, so a forged inbound value was stripped before here.
                 _autonomyMode: resolved.mode,
-                // ORIGIN-01 trust-tier (30uc-20260624): re-inject the run's REAL per-message
+                // Trust-tier re-injection: re-inject the run's REAL per-message
                 // trust from the framework ALS (set by execution-pipeline from
                 // elevatedReply.senderTrustMap, default "user"). Placed AFTER `...params` so a
                 // tool- or agent-supplied `_trustLevel` cannot override the authentic value —

package/node_modules/@comis/daemon/dist/wiring/setup-tools-coordinator.d.ts

@@ -1,5 +1,5 @@
 /**
- * COORD-01 (218-01): the lean-coordinator tool-surface selection.
+ * The lean-coordinator tool-surface selection.
  *
  * Split from `setup-tools.ts` (file-size cap discipline; mirrors the
  * `setup-tools-autonomy.ts` sibling precedent). A PURE selector that decides the
@@ -7,8 +7,8 @@
  * coordinator` lead with NO explicit `tool_groups` is narrowed to the
  * coordinator orchestration surface (`resolveAutonomy().coordinatorToolGroups`);
  * an explicit `tool_groups` (or "full") still wins (operator intent —
- * progressive disclosure, T-218-04); `role:worker` (the default) leaves the
- * surface untouched (byte-identical to today). This narrows the TOOL SURFACE
+ * progressive disclosure); `role:worker` (the default) leaves the
+ * surface untouched. This narrows the TOOL SURFACE
  * only — the resolved capability set is unchanged.
  *
  * @module

package/node_modules/@comis/daemon/dist/wiring/setup-tools-orchestrate-repair.d.ts

@@ -0,0 +1,62 @@
+/**
+ * `setup-tools-orchestrate-repair` — the class-gated, keyless-safe resolver that
+ * mints the daemon-side one-shot orchestrate repair seam per agent.
+ *
+ * {@link buildOrchestrateRepairResolver} returns a per-agent resolver the tool
+ * wiring calls once per assembly. Given an agent config + its effective
+ * capability class, it returns an {@link OrchestrateRepairSeam} closure ONLY when:
+ *  1. the class is repair-eligible (`autoRepairForClass` — small/nano ON,
+ *     frontier/mid OFF). The class-gate is checked FIRST, so a stronger model
+ *     resolves no model and no key (the cost axis stays off for the classes that
+ *     do not benefit — the resolver returns before any lookup).
+ *  2. a utility model + key resolve. It mirrors `resolveOutcomeJudge` verbatim:
+ *     the cheap `outcomeJudge` operation tier, the provider/model by NAME, the API
+ *     key from the secret manager (the keyless sentinel for keyless provider
+ *     types), and `buildCustomJudgeModelSpec` so a custom/local YAML provider
+ *     (ollama / lm-studio / …) whose model is absent from the pi-ai catalog still
+ *     resolves. A missing key → `undefined` (a no-op branch: Defer != Retry).
+ *
+ * The seam is built via `createOrchestrateRepairSeam` (from `@comis/agent`), so
+ * `@comis/skills` never imports the model layer — the daemon mints the closure and
+ * the runner only receives it (mirrors the `mintRunLease` seam). Auto-repair is a
+ * pure class-gate off the model profile: there is NO config toggle.
+ *
+ * @module
+ */
+import { type ClockPort, type ComisLogger } from "@comis/core";
+import { type CapabilityClass, type OrchestrateRepairSeam } from "@comis/agent";
+import { type JudgeProviderEntry } from "./setup-learning-judge.js";
+/** The per-agent config fields the repair resolver reads (a narrow own type — no back-import). */
+export interface RepairAgentConfig {
+    provider?: string;
+    model?: string;
+    operationModels?: Record<string, unknown>;
+}
+/** The slice of daemon deps the repair resolver reads (providers.entries is the model/key source). */
+export interface OrchestrateRepairResolverDeps {
+    config: {
+        providers?: {
+            entries?: Record<string, JudgeProviderEntry | undefined>;
+        };
+    };
+    /** The secret manager — resolves the utility-model API key by NAME (keyless sentinel for keyless types). */
+    secretManager: {
+        get(name: string): string | undefined;
+    };
+    /** Injected clock — the per-message timestamp for the one repair completion. */
+    clock: ClockPort;
+    /** Counts/ids-only logger threaded into the seam (a repair failure logs a hint + errorKind, never the script). */
+    logger: ComisLogger;
+}
+/** The per-agent resolver signature: (agentConfig, agentId, class) → a repair seam, or undefined (ineligible / no key). */
+export type OrchestrateRepairResolver = (agentConfig: RepairAgentConfig | undefined, agentId: string, capabilityClass: CapabilityClass) => OrchestrateRepairSeam | undefined;
+/**
+ * Build the per-agent class-gated repair-seam resolver. Mirrors
+ * `resolveOutcomeJudge`: the class-gate runs FIRST (no model resolve for
+ * frontier/mid), then the cheap `outcomeJudge`-tier model + key + customModel
+ * resolve exactly as the judge does; a missing key returns `undefined`. On a
+ * repair-eligible class with a resolvable model it returns the
+ * `createOrchestrateRepairSeam` closure the orchestrate runner invokes at most
+ * once per run.
+ */
+export declare function buildOrchestrateRepairResolver(deps: OrchestrateRepairResolverDeps): OrchestrateRepairResolver;

package/node_modules/@comis/daemon/dist/wiring/setup-tools-orchestrate-repair.js

@@ -0,0 +1,86 @@
+// SPDX-License-Identifier: Apache-2.0
+/**
+ * `setup-tools-orchestrate-repair` — the class-gated, keyless-safe resolver that
+ * mints the daemon-side one-shot orchestrate repair seam per agent.
+ *
+ * {@link buildOrchestrateRepairResolver} returns a per-agent resolver the tool
+ * wiring calls once per assembly. Given an agent config + its effective
+ * capability class, it returns an {@link OrchestrateRepairSeam} closure ONLY when:
+ *  1. the class is repair-eligible (`autoRepairForClass` — small/nano ON,
+ *     frontier/mid OFF). The class-gate is checked FIRST, so a stronger model
+ *     resolves no model and no key (the cost axis stays off for the classes that
+ *     do not benefit — the resolver returns before any lookup).
+ *  2. a utility model + key resolve. It mirrors `resolveOutcomeJudge` verbatim:
+ *     the cheap `outcomeJudge` operation tier, the provider/model by NAME, the API
+ *     key from the secret manager (the keyless sentinel for keyless provider
+ *     types), and `buildCustomJudgeModelSpec` so a custom/local YAML provider
+ *     (ollama / lm-studio / …) whose model is absent from the pi-ai catalog still
+ *     resolves. A missing key → `undefined` (a no-op branch: Defer != Retry).
+ *
+ * The seam is built via `createOrchestrateRepairSeam` (from `@comis/agent`), so
+ * `@comis/skills` never imports the model layer — the daemon mints the closure and
+ * the runner only receives it (mirrors the `mintRunLease` seam). Auto-repair is a
+ * pure class-gate off the model profile: there is NO config toggle.
+ *
+ * @module
+ */
+import { KEYLESS_PROVIDER_TYPES, KEYLESS_API_KEY_SENTINEL, } from "@comis/core";
+import { autoRepairForClass, createOrchestrateRepairSeam, resolveOperationModel, resolveProviderFamily, } from "@comis/agent";
+import { buildCustomJudgeModelSpec } from "./setup-learning-judge.js";
+/**
+ * Per-call output bound for one repair completion. Bounded (the cost axis — the
+ * seam issues exactly one completion), yet large enough to regenerate a complete
+ * corrected script rather than a truncated fragment.
+ */
+const ORCHESTRATE_REPAIR_MAX_OUTPUT_TOKENS = 4096;
+/**
+ * Build the per-agent class-gated repair-seam resolver. Mirrors
+ * `resolveOutcomeJudge`: the class-gate runs FIRST (no model resolve for
+ * frontier/mid), then the cheap `outcomeJudge`-tier model + key + customModel
+ * resolve exactly as the judge does; a missing key returns `undefined`. On a
+ * repair-eligible class with a resolvable model it returns the
+ * `createOrchestrateRepairSeam` closure the orchestrate runner invokes at most
+ * once per run.
+ */
+export function buildOrchestrateRepairResolver(deps) {
+    return (agentConfig, agentId, capabilityClass) => {
+        // Class-gate FIRST — a repair-ineligible class (frontier/mid) resolves no
+        // model and no key, so the cost axis stays off for a stronger model before
+        // any lookup runs.
+        if (!autoRepairForClass(capabilityClass))
+            return undefined;
+        const agent = agentConfig ?? {};
+        const agentProvider = agent.provider ?? "anthropic";
+        const resolved = resolveOperationModel({
+            operationType: "outcomeJudge",
+            agentProvider,
+            agentModel: agent.model ?? "anthropic:claude-sonnet-4-20250514",
+            operationModels: (agent.operationModels ?? {}),
+            providerFamily: resolveProviderFamily(agentProvider),
+        });
+        const providerEntry = deps.config.providers?.entries?.[resolved.provider];
+        const apiKeyName = providerEntry?.apiKeyName || `${resolved.provider.toUpperCase()}_API_KEY`;
+        const apiKey = deps.secretManager.get(apiKeyName) ??
+            // Keyless by TYPE, not config NAME — a user-named ollama/lm-studio entry must
+            // resolve keyless, else repair is a silent no-op on a local keyless daemon
+            // (the very small models this targets). Mirrors the outcome judge.
+            (KEYLESS_PROVIDER_TYPES.has(providerEntry?.type ?? resolved.provider)
+                ? KEYLESS_API_KEY_SENTINEL
+                : "");
+        if (!apiKey)
+            return undefined; // no key → no repair (Defer != Retry)
+        // Custom YAML providers (ollama/lm-studio/…) are absent from pi-ai's catalog,
+        // so build a custom-model spec (the normalized `/v1` baseUrl) — repair runs locally too.
+        const customModel = buildCustomJudgeModelSpec(providerEntry, resolved.provider, resolved.modelId);
+        return createOrchestrateRepairSeam({
+            provider: resolved.provider,
+            modelId: resolved.modelId,
+            apiKey,
+            maxOutputTokens: ORCHESTRATE_REPAIR_MAX_OUTPUT_TOKENS,
+            clock: deps.clock,
+            logger: deps.logger,
+            agentId,
+            customModel,
+        });
+    };
+}