comisai 1.0.44 → 1.0.46

package/node_modules/@comis/agent/dist/spawn/child-prompt-economy.js

@@ -1,16 +1,15 @@
 // SPDX-License-Identifier: Apache-2.0
 /**
- * Child-prompt economy (STRIP-01 / STRIP-02): drop the heavy inherited context
- * blocks from a READ-ONLY spawned child's assembled system prompt, on the SPAWN
- * side, while preserving the constitutional anti-injection safety core.
+ * Child-prompt economy: drop the heavy inherited context blocks from a
+ * READ-ONLY spawned child's assembled system prompt, on the SPAWN side, while
+ * preserving the constitutional anti-injection safety core.
  *
  * A read-only child still ingests untrusted web/MCP/file content, so it remains
- * a prompt-injection target and MUST keep the safety floor (Pitfall 5 / STRIP-5).
+ * a prompt-injection target and MUST keep the safety floor.
  * The drop narrows CONTEXT only — it never widens capability.
  *
  * ===========================================================================
- * Task-0 spike findings (Q-STRIP-1) — the spawn → child-prompt path at HEAD
- * (feature/v2.30). These pin the drop points + the chosen mechanism.
+ * The spawn → child-prompt path — the drop points + the chosen mechanism.
  * ===========================================================================
  *
  * 1. The child's resolved PromptMode.
@@ -19,8 +18,7 @@
  *    `resolvePromptModeForProfile(baseMode, operationType, modelProfile,
  *    compactPrompt)` (prompt-assembly.ts:981) — typically "full" for a
  *    frontier/mid child (or "compact-secure" for a small/nano child).
- *    The RESEARCH assumption (A3/A4 — that the "minimal" mode already drops the
- *    heavy STRIP-01 blocks) is CONFIRMED WRONG: in system-prompt-assembler.ts
+ *    No mode already drops the heavy blocks: in system-prompt-assembler.ts
  *    the heavy sections use MODES_ALL (incl. "minimal"), and the `m==="minimal"`
  *    flag only shortens each builder's TEXT — it does not OMIT the section.
  *    ⇒ a real drop mechanism is required; we cannot just pick a mode.
@@ -30,12 +28,10 @@
  *    are real SECTIONS in the assembled system-prompt string
  *    (system-prompt-assembler.ts SECTIONS table, lines 278-356), each emitting a
  *    stable `## <Heading>`, joined by SECTION_SEPARATOR ("\n\n---\n\n",
- *    system-prompt-assembler.ts:58). The RESEARCH "CLAUDE.md-equivalent overlay"
- *    maps to `## Project Context` (it injects AGENTS.md/ROLE.md — the project-
- *    instruction overlay, context-sections.ts:181). The RESEARCH "usage trailer"
- *    has NO Comis analogue in the prompt — token-budget is a DEBUG log line
- *    (prompt-assembly.ts:1989), never prompt text — so there is nothing to strip
- *    for it.
+ *    system-prompt-assembler.ts:58). `## Project Context` is the project-
+ *    instruction overlay (it injects AGENTS.md/ROLE.md, context-sections.ts:181).
+ *    Token-budget usage is a DEBUG log line (prompt-assembly.ts:1989), never
+ *    prompt text — so there is nothing to strip for it.
  *
  * 3. WHERE the safety core lives — same assembled string:
  *      - `## Safety`                        (core-sections.ts:28; ALWAYS the
@@ -48,12 +44,12 @@
  *    OWN assembled `systemPrompt` — split on SECTION_SEPARATOR, drop the sections
  *    whose heading is in READ_ONLY_CHILD_DROP_HEADINGS, keep everything else
  *    (so the safety core survives by construction). Rationale:
- *      (a) cap-safe — ALL logic lives here; the two capped files
- *          (sub-agent-runner.ts 2643L, prompt-assembly.ts 2035L) take only a
- *          single call-site hook (Task 2), no section-builder edits;
+ *      (a) cap-safe — ALL logic lives here; the two length-capped files
+ *          (sub-agent-runner.ts, prompt-assembly.ts) take only a
+ *          single call-site hook, no section-builder edits;
  *      (b) testable in isolation — pure string → string;
  *      (c) per-child — operates on the child's own assembled prompt, never the
- *          shared SECTIONS state (T-221-STRIP-03), and works on BOTH assembly
+ *          shared SECTIONS state, and works on BOTH assembly
  *          paths (full assembly + the parent-cache reuse path, prompt-assembly.ts
  *          806-974) because both yield a `systemPrompt` string.
  *
@@ -65,10 +61,10 @@ import { SECTION_SEPARATOR } from "../bootstrap/index.js";
 // The drop / keep heading contract
 // ---------------------------------------------------------------------------
 /**
- * The heavy inherited section headings dropped for a read-only child (STRIP-01).
+ * The heavy inherited section headings dropped for a read-only child.
  * Each is a real `## <Heading>` emitted by the SECTIONS builders (see the
- * Task-0 spike notes above for the file:line of each). `## Project Context` is
- * the CLAUDE.md-equivalent overlay; `## Extended Thinking` / `## Reasoning
+ * module notes above for the file:line of each). `## Project Context` is
+ * the project-instruction overlay; `## Extended Thinking` / `## Reasoning
  * Format` are the two thinking-guidance variants the reasoning builder emits.
  */
 export const READ_ONLY_CHILD_DROP_HEADINGS = [
@@ -80,8 +76,8 @@ export const READ_ONLY_CHILD_DROP_HEADINGS = [
     "## Reasoning Format",
 ];
 /**
- * The constitutional anti-injection floor that MUST survive the drop
- * (STRIP-5 / Pitfall 5). Used by the safety-core assertion; kept disjoint from
+ * The constitutional anti-injection floor that MUST survive the drop.
+ * Used by the safety-core assertion; kept disjoint from
  * the drop set by an arch-style test in child-prompt-economy.test.ts.
  */
 export const READ_ONLY_CHILD_KEEP_HEADINGS = [
@@ -100,7 +96,7 @@ const DROP_SET = new Set(READ_ONLY_CHILD_DROP_HEADINGS);
  * read-only (every tool ⊆ the read-only set per `isReadOnlyTool`), OR it
  * carries an explicit read-only role.
  *
- * Conservative by construction (T-221-STRIP-02): a child is read-only ONLY when
+ * Conservative by construction: a child is read-only ONLY when
  * we can PROVE it. Any tool that is not provably read-only — a mutating tool
  * (`exec`/`edit`/`write`/...) OR an unknown/unregistered tool — makes the child
  * NOT read-only, and a mutating tool overrides even an explicit read-only role
@@ -141,7 +137,7 @@ function sectionHeading(section) {
 /**
  * Drop the heavy inherited blocks (READ_ONLY_CHILD_DROP_HEADINGS) from an
  * assembled child system prompt, preserving every other section — including the
- * full safety core (STRIP-01 + STRIP-5).
+ * full safety core.
  *
  * Splits on SECTION_SEPARATOR (the exact joiner the assembler uses), removes the
  * sections whose leading `## Heading` is in the drop set, and re-joins the
@@ -163,11 +159,11 @@ export function economiseChildPrompt(assembledPrompt) {
     return kept.join(SECTION_SEPARATOR);
 }
 /**
- * Apply the read-only-child prompt economy on the SPAWN side (STRIP-02): if the
+ * Apply the read-only-child prompt economy on the SPAWN side: if the
  * child is read-only, drop the heavy inherited blocks from BOTH the assembled
  * `systemPrompt` string AND the `systemPromptBlocks.semiStableBody`; otherwise
  * pass everything through byte-identically (a mutating or unknown-tool child
- * gets the full prompt — conservative, T-221-STRIP-02).
+ * gets the full prompt — conservative).
  *
  * Both representations must be stripped because the multi-block path
  * (request-body/breakpoint-orchestration.ts) builds the system message from

package/node_modules/@comis/agent/dist/spawn/coordinator-progress-fork.d.ts

@@ -1,5 +1,5 @@
 /**
- * COORD-03 — the ~30s read-only progress fork.
+ * The ~30s read-only progress fork.
  *
  * A multi-day coordinator spawns children that may run for minutes. Without a
  * progress signal a long child advances invisibly until it returns. This helper
@@ -7,7 +7,7 @@
  * `session:sub_agent_progress` event — a 3-5 word status line + elapsed +
  * steps — WITHOUT the child completing.
  *
- * It is deliberately NOT a re-execution (RESEARCH Pitfall 6 / T-218-13). "Fork"
+ * It is deliberately NOT a re-execution. "Fork"
  * here means a cheap read-only *summary* of the in-flight child's current step
  * state, NOT a second run. The helper has NO reference to `executeAgent`, a
  * spawner, a tool dispatcher, or a model — its ONLY input is a pure
@@ -16,7 +16,7 @@
  * spawn (fork-bomb); this one cannot, by construction.
  *
  * Discipline:
- *   - §2.7 CONTENT-FREE (T-218-14): the event carries identifiers + a short
+ *   - CONTENT-FREE (AGENTS.md §2.7): the event carries identifiers + a short
  *     status `progressLine` + counts + a timestamp ONLY — never the child's
  *     output, message body, or any tool result.
  *   - No-globals (AGENTS §2.5; globals.test.ts): time is read from the injected
@@ -24,7 +24,7 @@
  *     {@link TimerPort} — never `setInterval`/`Date.now`. The handle is
  *     `.unref()`'d so it never blocks event-loop exit, and `stop()` cancels it
  *     via `handle.cancel()` (never raw `clearInterval`), so the fork never
- *     outlives the child (T-218-15: no leaked timer).
+ *     outlives the child (no leaked timer).
  *   - No model call: the `progressLine` is built deterministically from the step
  *     count — it is a state summary, not an LLM summarization (cheap +
  *     deterministic).
@@ -35,7 +35,7 @@
  * @module
  */
 import type { ClockPort, TimerPort, EventMap } from "@comis/core";
-/** Default progress cadence — the v8 §23.10 ~30s fork. */
+/** Default progress cadence (~30s). */
 export declare const COORDINATOR_PROGRESS_INTERVAL_MS = 30000;
 /**
  * The minimal event-bus surface the fork needs: it ONLY ever emits the
@@ -69,8 +69,8 @@ export interface CoordinatorProgressForkDeps {
      * Pure read of the in-flight child's current step state. The fork's ONLY
      * input besides the clock/timers — there is no re-execution channel. When the
      * runner cannot cheaply read a live step count it returns `{ stepsExecuted: 0 }`
-     * and the elapsed wall-clock is the advance signal (RESEARCH: a count-only
-     * advance is still NOT a re-execution).
+     * and the elapsed wall-clock is the advance signal (a count-only advance is
+     * still NOT a re-execution).
      */
     getStepState: () => {
         stepsExecuted: number;
@@ -89,7 +89,7 @@ export interface CoordinatorProgressForkHandle {
     stop(): void;
 }
 /**
- * Create the COORD-03 read-only progress fork. See the module doc for the full
+ * Create the read-only progress fork. See the module doc for the full
  * read-only / content-free / no-globals / no-leak contract.
  */
 export declare function createCoordinatorProgressFork(deps: CoordinatorProgressForkDeps): CoordinatorProgressForkHandle;

package/node_modules/@comis/agent/dist/spawn/coordinator-progress-fork.js

@@ -1,15 +1,15 @@
-/** Default progress cadence — the v8 §23.10 ~30s fork. */
+/** Default progress cadence (~30s). */
 export const COORDINATOR_PROGRESS_INTERVAL_MS = 30_000;
 /**
  * Build a short, content-free progress status line from the step count. ≤ ~6
- * words by construction (T-218-14, §2.7) — a status descriptor, NOT child
+ * words by construction (AGENTS.md §2.7) — a status descriptor, NOT child
  * content. NEVER incorporate the child's output here.
  */
 function buildProgressLine(stepsExecuted) {
     return `running, step ${stepsExecuted}`;
 }
 /**
- * Create the COORD-03 read-only progress fork. See the module doc for the full
+ * Create the read-only progress fork. See the module doc for the full
  * read-only / content-free / no-globals / no-leak contract.
  */
 export function createCoordinatorProgressFork(deps) {
@@ -36,7 +36,8 @@ export function createCoordinatorProgressFork(deps) {
                 return; // idempotent — never schedule two intervals
             startMs = clock.now();
             handle = timers.setInterval(tick, intervalMs);
-            // Never block event-loop exit (mirrors the HB-01 keep-alive in the runner).
+            // Never block event-loop exit (the runner's keep-alive interval is
+            // unref()'d for the same reason).
             handle.unref();
         },
         stop() {

package/node_modules/@comis/agent/dist/spawn/index.js

@@ -18,8 +18,8 @@ export { sweepResultFiles, buildAnnouncementMessage, deliverFailureNotification,
 // and MAX_DELIVERED_KEYS stay agent-internal (used only within spawn/ + the agent's
 // own tests via relative import) — not re-exported, to avoid a dead public export.
 export { createDeliveryDedup } from "./announce-key.js";
-// Pure sandbox-posture primitive (SANDBOX-01). The comparator + resolver are a
-// @comis/agent leaf; the daemon wiring (Plan 02) injects a resolver closure over
+// Pure sandbox-posture primitive. The comparator + resolver are a
+// @comis/agent leaf; the daemon wiring injects a resolver closure over
 // container.config.agents into the sub-agent runner, so the TYPE + comparator must
 // cross the package boundary here.
 export { comparePosture, resolvePostureFromSkills } from "./sandbox-posture.js";

package/node_modules/@comis/agent/dist/spawn/lifecycle-hooks.d.ts

@@ -74,11 +74,9 @@ export declare function createLifecycleHooks(deps: LifecycleHooksDeps): {
     }): Promise<void>;
 };
 /**
- * Derive a subagent context engine config from parent config + subagent overrides.
- * Derive context engine config for a subagent from the parent's config.
- * Subagent inherits parent pipeline settings via spread copy (parent not mutated).
- *
- * Config inheritance.
+ * Derive a subagent context engine config from the parent's config.
+ * The subagent inherits the parent pipeline settings via spread copy
+ * (the parent config is not mutated).
  *
  * NOTE: autoCompactThreshold (0.95) is NOT mapped here. Its relationship to the
  * context engine's COMPACTION_TRIGGER_PERCENT constant is unclear.

package/node_modules/@comis/agent/dist/spawn/lifecycle-hooks.js

@@ -101,11 +101,9 @@ export function createLifecycleHooks(deps) {
 // Config inheritance (standalone pure function, not inside the factory)
 // ---------------------------------------------------------------------------
 /**
- * Derive a subagent context engine config from parent config + subagent overrides.
- * Derive context engine config for a subagent from the parent's config.
- * Subagent inherits parent pipeline settings via spread copy (parent not mutated).
- *
- * Config inheritance.
+ * Derive a subagent context engine config from the parent's config.
+ * The subagent inherits the parent pipeline settings via spread copy
+ * (the parent config is not mutated).
  *
  * NOTE: autoCompactThreshold (0.95) is NOT mapped here. Its relationship to the
  * context engine's COMPACTION_TRIGGER_PERCENT constant is unclear.

package/node_modules/@comis/agent/dist/spawn/narrative-caster.d.ts

@@ -34,12 +34,12 @@ export interface CastParams {
     /** Sub-agent session key for reference. */
     sessionKey: string;
     /**
-     * Phase 218 (SUMREF-02): the child's full output materialized to its jailed
-     * workspace as a structured handle. When present, the "Full result" line
-     * becomes the drill-in handle (ref + bytes + kind) the lead queries on demand
+     * The child's full output materialized to its jailed workspace as a
+     * structured handle. When present, the "Full result" line becomes the
+     * drill-in handle (ref + bytes + kind) the lead queries on demand
      * (read/grep/jq), instead of the bare condenser diskPath — so the lead's
      * window grows by a summary + a handle, never the megabyte body. Absent ⇒ the
-     * line falls back to `condensedResult.diskPath` (today's behavior).
+     * line falls back to `condensedResult.diskPath`.
      */
     resultRef?: ResultRef;
 }
@@ -58,7 +58,7 @@ export declare const TRAILING_INSTRUCTION = "Inform the user about this complete
  *
  * The returned `cast()` method is pure synchronous string formatting.
  * When `config.enabled` is false, output falls back to the untagged
- * `[System Message]` format matching legacy `buildAnnouncementMessage`.
+ * `[System Message]` format produced by `buildAnnouncementMessage`.
  */
 export declare function createNarrativeCaster(config: NarrativeCasterConfig): {
     cast(params: CastParams): string;

package/node_modules/@comis/agent/dist/spawn/narrative-caster.js

@@ -40,7 +40,7 @@ const LEVEL_NAMES = {
  *
  * The returned `cast()` method is pure synchronous string formatting.
  * When `config.enabled` is false, output falls back to the untagged
- * `[System Message]` format matching legacy `buildAnnouncementMessage`.
+ * `[System Message]` format produced by `buildAnnouncementMessage`.
  */
 export function createNarrativeCaster(config) {
     return {
@@ -69,14 +69,14 @@ function truncateLabel(text) {
     return clean.slice(0, MAX_LABEL_LENGTH - 3) + "...";
 }
 // ---------------------------------------------------------------------------
-// Full-result drill-in line (SUMREF-02)
+// Full-result drill-in line
 // ---------------------------------------------------------------------------
 /**
  * The "Full result" announcement line. When a materialized {@link ResultRef}
  * handle is present, the lead drills into it on demand (read/grep/jq) so only a
  * summary + a handle enter its window (the longevity invariant); otherwise the
- * bare condenser `diskPath` is used (today's behavior — no store/handle, so the
- * on-disk condensed result IS the pointer). Kept byte-aligned with the runner's
+ * bare condenser `diskPath` is used (no store/handle, so the on-disk
+ * condensed result IS the pointer). Kept byte-aligned with the runner's
  * buildAnnouncementMessage body so both announcement paths agree.
  */
 function formatFullResultLine(diskPath, resultRef) {
@@ -148,8 +148,8 @@ function formatTaggedResult(params, tagPrefix) {
     sections.push(`Condensation: Level ${condensedResult.level} | ` +
         `Original: ${condensedResult.originalTokens} tokens | ` +
         `Ratio: ${condensedResult.compressionRatio.toFixed(2)}`);
-    // 12. Full result drill-in (the structured ResultRef handle when present —
-    // SUMREF-02 — else the condenser diskPath).
+    // 12. Full result drill-in (the structured ResultRef handle when present,
+    // else the condenser diskPath).
     sections.push(formatFullResultLine(condensedResult.diskPath, resultRef));
     // 13. Session line
     sections.push(`Session: ${sessionKey}`);

package/node_modules/@comis/agent/dist/spawn/result-condenser.js

@@ -185,9 +185,8 @@ async function condenseInternal(params, deps) {
 // Token estimation
 // ---------------------------------------------------------------------------
 function estimateTokens(text) {
-    // Script-factored (TOK-01): sub-agent results can be non-Latin (GEN-03 /
-    // Phase 181 increases this) — honest condensation thresholds are the
-    // conservative direction.
+    // Script-factored: sub-agent results can be non-Latin — honest
+    // condensation thresholds are the conservative direction.
     return Math.ceil(text.length / (CHARS_PER_TOKEN * scriptTokenFactor(text)));
 }
 // ---------------------------------------------------------------------------
@@ -310,14 +309,14 @@ Output ONLY the JSON object, no markdown fencing, no explanation.`;
 // Level 3: Head+tail truncation
 // ---------------------------------------------------------------------------
 function headTailTruncate(fullResult, maxTokens, task) {
-    // Review WR-02: factor the char budget by the same script factor this
-    // module's estimateTokens divides by. tokens->chars is the OUTPUT direction
+    // Factor the char budget by the same script factor this module's
+    // estimateTokens divides by. tokens->chars is the OUTPUT direction
     // here — a flat maxTokens*4 budget over-emits dense scripts ~2x past
     // maxResultTokens under the module's own (factored) measure, the inverse
     // of the conservative tokens->chars reservation sites. The full result's
     // factor approximates the head+tail slices' factor (strictly conservative
     // for the budget direction); ASCII factor 1.0 keeps the budget
-    // byte-identical (I1).
+    // byte-identical to a flat maxTokens*4.
     const budget = Math.floor(maxTokens * CHARS_PER_TOKEN * scriptTokenFactor(fullResult));
     const headBudget = Math.floor(budget * HEAD_RATIO);
     const tailBudget = Math.floor(budget * TAIL_RATIO);

package/node_modules/@comis/agent/dist/spawn/sandbox-posture.d.ts

@@ -1,12 +1,12 @@
 /**
- * Pure sandbox-posture primitive (SANDBOX-01).
+ * Pure sandbox-posture primitive.
  *
  * One tested source of truth for the partial-order confinement semantics used
- * by the sub-agent spawn no-downgrade invariant (P0-C): a spawned child must
+ * by the sub-agent spawn no-downgrade invariant: a spawned child must
  * never be *less* confined than its spawner. This module is the dependency-free
  * foundation — no I/O, no event bus, no full daemon-config import. It is a
- * `@comis/agent` leaf so the daemon wiring can later INJECT a resolver into the
- * sub-agent runner (Plan 02) without inverting the dependency direction.
+ * `@comis/agent` leaf so the daemon wiring can INJECT a resolver into the
+ * sub-agent runner without inverting the dependency direction.
  *
  * ## The 4 config-derived dimensions (strict → loose)
  * Each dimension's enum labels are the EXACT operator-config strings from
@@ -23,21 +23,18 @@
  * total one): the child can tighten one dimension and loosen another and still be
  * a downgrade.
  *
- * ## Design-vs-config reconciliation (ROADMAP success-criterion 1)
- * The design doc (§5 P0-C) and ROADMAP criterion-1 describe a `broker-only > open`
- * exec-network dimension and a "sandboxed (broker-only) parent → open child"
- * example. **That dimension does NOT exist as operator config.**
+ * ## Why there is no `broker-only > open` exec-network dimension
  * `broker-only`/`open`/`none` are RUNTIME sandbox network *modes* derived at spawn
  * time (`packages/skills/src/tools/builtin/sandbox/types.ts:36`), not a Zod config
  * field; the config-level exec sandbox is ONLY `enabled: always|never`. The
- * criterion-1 "broker-only parent → open child refused" therefore maps to the real
+ * "broker-only parent → open child refused" intuition therefore maps to the real
  * config model as: **a more-confined parent (e.g. exec `always`) spawning a
- * less-confined child (exec `never`) is refused.** We deliberately do NOT model the
- * bogus `broker-only > open` config dimension — it would be unverifiable. If a
- * future "exec network mode" config field is added, the comparator extends
- * additively via a new rank map.
+ * less-confined child (exec `never`) is refused.** We deliberately do NOT model a
+ * `broker-only > open` config dimension — it would be unverifiable against real
+ * operator config. If a future "exec network mode" config field is added, the
+ * comparator extends additively via a new rank map.
  *
- * ## Missing-field-safe-default (threat T-172-01)
+ * ## Missing-field-safe-default
  * A missing/absent field on ANY dimension resolves to the MOST-confined enum
  * (highest rank) BEFORE comparison — a posture is NEVER inferred more permissive
  * than reality, so a config gap cannot silently open a downgrade.
@@ -49,9 +46,9 @@
  *
  * For the sub-agent spawn path, **exec is the active dimension** today;
  * `filesystem`/`network`/`uid` are present in the type so the comparator composes
- * when the deferred terminal-posture path lands (A1), but they resolve to their
+ * when the deferred terminal-posture path lands, but they resolve to their
  * most-confined default when absent (see {@link comparePosture}). The sub-agent
- * resolver ({@link resolvePostureFromSkills}) leaves them unset in P0-C scope.
+ * resolver ({@link resolvePostureFromSkills}) leaves them unset today.
  */
 export interface SandboxPosture {
     /** Exec sandbox enablement. `always` = sandbox wraps the command (more confined). */
@@ -79,7 +76,7 @@ export interface PostureComparison {
  * dimension names) iff the child is strictly LESS confined than the parent on
  * ANY single dimension. Equal posture and a more-confined (upgrade) child both
  * compare as allowed. Absent fields on either side fold to the most-confined
- * value before comparison (T-172-01).
+ * value before comparison.
  *
  * Pure: no I/O, no config import, deterministic for a given input pair.
  */
@@ -88,9 +85,9 @@ export declare function comparePosture(parent: SandboxPosture, child: SandboxPos
  * The minimal structural slice of an agent's skills config this resolver reads.
  *
  * Declared inline (NOT imported from the full daemon config) so this module
- * stays a `@comis/agent` leaf: Plan 02's daemon wiring injects a resolver closure
+ * stays a `@comis/agent` leaf: the daemon wiring injects a resolver closure
  * built over the per-agent skills config it holds, which structurally satisfies
- * this shape. Only `execSandbox.enabled` is consumed in P0-C scope.
+ * this shape. Only `execSandbox.enabled` is consumed today.
  */
 export interface SkillsPostureSlice {
     execSandbox?: {
@@ -100,7 +97,7 @@ export interface SkillsPostureSlice {
 /**
  * Fold an agent's skills config slice into a {@link SandboxPosture}.
  *
- * P0-C scope (A1): only the **exec** dimension is populated, from
+ * Only the **exec** dimension is populated, from
  * `skills.execSandbox.enabled`. An absent slice or absent `enabled` resolves to
  * `"always"` — the most-confined default, matching the schema default
  * (`ExecSandboxSchema.enabled.default("always")`). The `filesystem`/`network`/`uid`
@@ -112,3 +109,26 @@ export interface SkillsPostureSlice {
  * Pure: no I/O, no config import beyond the structural {@link SkillsPostureSlice}.
  */
 export declare function resolvePostureFromSkills(skills: SkillsPostureSlice | undefined): SandboxPosture;
+/**
+ * Thrown by the sub-agent spawn path (the no-downgrade gate) when a child's
+ * sandbox posture is strictly LESS confined than its spawner's on ≥1 dimension.
+ *
+ * A TYPED refusal (mirrors {@link RequiredToolsUnreachableError} in `@comis/core`):
+ * the daemon's `classifyRpcError` matches it to `precondition`/**warn**, so this
+ * fail-closed SECURITY refusal does NOT read as an `internal`/**error** handler
+ * fault in an operator's ERROR-level health sweep. The refuse decision, the
+ * `security:sandbox_downgrade_refused` event, and the message are all unchanged —
+ * this only carries the type so the dispatch layer can classify it correctly.
+ *
+ * `violatedDimensions` are enum LABELS only — never posture values, paths, or
+ * hosts, so no operator data leaks into the error payload.
+ *
+ * @allow-throw: spawn() is consumed exclusively by daemon RPC handlers
+ * (@allow-throw boundary in sub-agent-runner.ts); rpc-dispatch converts this to a
+ * JSON-RPC error response.
+ */
+export declare class SandboxDowngradeError extends Error {
+    readonly kind: "sandbox_downgrade";
+    readonly violatedDimensions: readonly PostureDimension[];
+    constructor(message: string, violatedDimensions: readonly PostureDimension[]);
+}

package/node_modules/@comis/agent/dist/spawn/sandbox-posture.js

@@ -1,13 +1,13 @@
 // SPDX-License-Identifier: Apache-2.0
 /**
- * Pure sandbox-posture primitive (SANDBOX-01).
+ * Pure sandbox-posture primitive.
  *
  * One tested source of truth for the partial-order confinement semantics used
- * by the sub-agent spawn no-downgrade invariant (P0-C): a spawned child must
+ * by the sub-agent spawn no-downgrade invariant: a spawned child must
  * never be *less* confined than its spawner. This module is the dependency-free
  * foundation — no I/O, no event bus, no full daemon-config import. It is a
- * `@comis/agent` leaf so the daemon wiring can later INJECT a resolver into the
- * sub-agent runner (Plan 02) without inverting the dependency direction.
+ * `@comis/agent` leaf so the daemon wiring can INJECT a resolver into the
+ * sub-agent runner without inverting the dependency direction.
  *
  * ## The 4 config-derived dimensions (strict → loose)
  * Each dimension's enum labels are the EXACT operator-config strings from
@@ -24,21 +24,18 @@
  * total one): the child can tighten one dimension and loosen another and still be
  * a downgrade.
  *
- * ## Design-vs-config reconciliation (ROADMAP success-criterion 1)
- * The design doc (§5 P0-C) and ROADMAP criterion-1 describe a `broker-only > open`
- * exec-network dimension and a "sandboxed (broker-only) parent → open child"
- * example. **That dimension does NOT exist as operator config.**
+ * ## Why there is no `broker-only > open` exec-network dimension
  * `broker-only`/`open`/`none` are RUNTIME sandbox network *modes* derived at spawn
  * time (`packages/skills/src/tools/builtin/sandbox/types.ts:36`), not a Zod config
  * field; the config-level exec sandbox is ONLY `enabled: always|never`. The
- * criterion-1 "broker-only parent → open child refused" therefore maps to the real
+ * "broker-only parent → open child refused" intuition therefore maps to the real
  * config model as: **a more-confined parent (e.g. exec `always`) spawning a
- * less-confined child (exec `never`) is refused.** We deliberately do NOT model the
- * bogus `broker-only > open` config dimension — it would be unverifiable. If a
- * future "exec network mode" config field is added, the comparator extends
- * additively via a new rank map.
+ * less-confined child (exec `never`) is refused.** We deliberately do NOT model a
+ * `broker-only > open` config dimension — it would be unverifiable against real
+ * operator config. If a future "exec network mode" config field is added, the
+ * comparator extends additively via a new rank map.
  *
- * ## Missing-field-safe-default (threat T-172-01)
+ * ## Missing-field-safe-default
  * A missing/absent field on ANY dimension resolves to the MOST-confined enum
  * (highest rank) BEFORE comparison — a posture is NEVER inferred more permissive
  * than reality, so a config gap cannot silently open a downgrade.
@@ -96,11 +93,11 @@ const UID_MOST_CONFINED = 1; // "dedicated"
 /**
  * Rank a single dimension of a posture, folding an absent field to the
  * most-confined value (highest rank) BEFORE ranking. This is the load-bearing
- * safe default (T-172-01): a missing field is never read as more permissive than
+ * safe default: a missing field is never read as more permissive than
  * reality. The pre-map `?? <most-confined>` IS the safe default for an absent
  * field; the trailing `?? <most-confined>` is the fail-closed fallback for a
  * present-but-unknown enum value (unreachable via the Zod-validated config path,
- * but if a caller hand-builds a posture it must still fail CLOSED — IN-01).
+ * but if a caller hand-builds a posture it must still fail CLOSED).
  */
 function rankOf(posture, dimension) {
     switch (dimension) {
@@ -126,7 +123,7 @@ function rankOf(posture, dimension) {
  * dimension names) iff the child is strictly LESS confined than the parent on
  * ANY single dimension. Equal posture and a more-confined (upgrade) child both
  * compare as allowed. Absent fields on either side fold to the most-confined
- * value before comparison (T-172-01).
+ * value before comparison.
  *
  * Pure: no I/O, no config import, deterministic for a given input pair.
  */
@@ -148,7 +145,7 @@ export function comparePosture(parent, child) {
 /**
  * Fold an agent's skills config slice into a {@link SandboxPosture}.
  *
- * P0-C scope (A1): only the **exec** dimension is populated, from
+ * Only the **exec** dimension is populated, from
  * `skills.execSandbox.enabled`. An absent slice or absent `enabled` resolves to
  * `"always"` — the most-confined default, matching the schema default
  * (`ExecSandboxSchema.enabled.default("always")`). The `filesystem`/`network`/`uid`
@@ -162,6 +159,34 @@ export function comparePosture(parent, child) {
 export function resolvePostureFromSkills(skills) {
     return {
         exec: skills?.execSandbox?.enabled ?? "always",
-        // filesystem / network / uid intentionally unset (present-but-inert, A1).
+        // filesystem / network / uid intentionally unset (present-but-inert until the
+        // terminal-posture wiring populates them).
     };
 }
+/**
+ * Thrown by the sub-agent spawn path (the no-downgrade gate) when a child's
+ * sandbox posture is strictly LESS confined than its spawner's on ≥1 dimension.
+ *
+ * A TYPED refusal (mirrors {@link RequiredToolsUnreachableError} in `@comis/core`):
+ * the daemon's `classifyRpcError` matches it to `precondition`/**warn**, so this
+ * fail-closed SECURITY refusal does NOT read as an `internal`/**error** handler
+ * fault in an operator's ERROR-level health sweep. The refuse decision, the
+ * `security:sandbox_downgrade_refused` event, and the message are all unchanged —
+ * this only carries the type so the dispatch layer can classify it correctly.
+ *
+ * `violatedDimensions` are enum LABELS only — never posture values, paths, or
+ * hosts, so no operator data leaks into the error payload.
+ *
+ * @allow-throw: spawn() is consumed exclusively by daemon RPC handlers
+ * (@allow-throw boundary in sub-agent-runner.ts); rpc-dispatch converts this to a
+ * JSON-RPC error response.
+ */
+export class SandboxDowngradeError extends Error {
+    kind = "sandbox_downgrade";
+    violatedDimensions;
+    constructor(message, violatedDimensions) {
+        super(message);
+        this.name = "SandboxDowngradeError";
+        this.violatedDimensions = violatedDimensions;
+    }
+}

package/node_modules/@comis/agent/dist/spawn/spawn-packet-builder.d.ts

@@ -27,7 +27,7 @@ export interface SpawnPacketBuildParams {
     toolGroups?: string[];
     includeParentHistory?: "none" | "summary";
     domainKnowledge?: string[];
-    /** Inherited conversation language (DET-02 tag); omitted from the packet when undefined. */
+    /** Inherited conversation language; omitted from the packet when undefined. */
     language?: string;
 }
 /**