comisai 1.0.44 → 1.0.46

package/node_modules/@comis/core/dist/api-contracts/fleet-health-report.js

@@ -1,27 +1,23 @@
 // SPDX-License-Identifier: Apache-2.0
 /**
- * The `obs.fleet.health` wire shape (Phase 161 RPC response) — the cross-session
+ * The `obs.fleet.health` wire shape — the cross-session
  * fleet-health digest. DISTINCT from the per-session `IncidentReport`
  * (`incident-report.ts`): this rolls up a WINDOW of sessions, not one session.
  *
- * Bounded/digest-only/deterministic (v2.15 R1): capped top-N findings + merged
+ * Bounded/digest-only/deterministic: capped top-N findings + merged
  * `errorKinds`, counts + hints ONLY (no raw WARN bodies), a deterministic
- * `likelyRootCause`-style verdict, an honest `truncations[]` ledger, and a v2.14
+ * `likelyRootCause`-style verdict, an honest `truncations[]` ledger, and a
  * `coverage` honesty block (which fleet sources were read). Same window → same
  * verdict: the report root carries NO wall-clock field (the `IncidentReport`
  * precedent has none either) — `windowHours` is the only time reference.
  *
- * Phase 159 ships the SCHEMA only. The bounding pass (mirror `obs-explain-bound.ts`)
- * and the heuristic registry (mirror `obs-explain-heuristics.ts`) that POPULATE
- * `likelyRootCause` + `truncations` land in the Phase-161 handler — the schema is
- * SHAPED (arrays-of-bounded-records + `truncations[]` + digestible scalars) so they
- * apply. This is a BARE z.object schema (it is deliberately NOT wired as an RPC
- * contract, and is NOT registered in `OBSERVABILITY_CONTRACTS`), so it does NOT
- * trip `contract-codegen-drift` / `contract-handler-parity`; the RPC/handler/CLI
- * are Phase 161. It IS barrel re-exported (via `observability.ts`)
- * so the Phase-161 handler can import it; the no-in-repo-consumer dead-export gate
- * is satisfied by a `public-api-policy.ts` entry (the `IncidentReportSchema`
- * precedent) until that handler lands.
+ * This module declares the SCHEMA + the RPC contract. The bounding pass (mirror
+ * `obs-explain-bound.ts`) and the heuristic registry (mirror
+ * `obs-explain-heuristics.ts`) that POPULATE `likelyRootCause` + `truncations`
+ * live in the daemon handler — the schema is SHAPED
+ * (arrays-of-bounded-records + `truncations[]` + digestible scalars) so they
+ * apply. Barrel re-exported via `observability.ts`, which also registers
+ * {@link ObsFleetHealthContract} in `OBSERVABILITY_CONTRACTS`.
  *
  * @module
  */
@@ -46,7 +42,7 @@ export const FleetHealthReportSchema = z.object({
     /** Merged across the window + capped top-N (counts only — no raw bodies). */
     topErrorKinds: z.array(z.object({ kind: z.string(), count: z.number() })),
     /**
-     * QT2/QT3 — the fleet-level degradation detector: degraded session COUNTS
+     * The fleet-level degradation detector: degraded session COUNTS
      * bucketed by the named `endReason` cause ("N degraded by context_exhausted, M
      * by output_starved"). ONLY degraded sessions contribute; a missing/blank cause
      * folds into `"unknown"`. Bounded (capped top-N, counts only — no raw bodies)
@@ -67,7 +63,7 @@ export const FleetHealthReportSchema = z.object({
     }),
     /**
      * Capped top-N findings — counts + short codes + hints ONLY (no raw WARN
-     * bodies). The Phase-161 bounding pass trims to top-N and records the drop in
+     * bodies). The bounding pass trims to top-N and records the drop in
      * `truncations[]`. Mirrors the `IncidentReport` digest-only discipline.
      */
     findings: z.array(z.object({
@@ -78,7 +74,7 @@ export const FleetHealthReportSchema = z.object({
     })),
     /**
      * The deterministic report-level verdict — `null` when no heuristic matches.
-     * Mirrors `IncidentReport.likelyRootCause` 1:1 (the Phase-161 heuristic
+     * Mirrors `IncidentReport.likelyRootCause` 1:1 (the heuristic
      * registry populates it; PURE, ordered first-match-wins).
      */
     likelyRootCause: z
@@ -91,7 +87,7 @@ export const FleetHealthReportSchema = z.object({
     /** Report-level guidance (independent of the per-verdict steps above). */
     suggestedNextSteps: z.array(z.string()),
     /**
-     * The honest size-drop ledger — what the (Phase-161) bounding pass shed to
+     * The honest size-drop ledger — what the bounding pass shed to
      * stay digest-only/bounded. Mirrors `IncidentReport.truncations[]`.
      */
     truncations: z.array(z.object({
@@ -101,15 +97,15 @@ export const FleetHealthReportSchema = z.object({
     })),
     /**
      * READ-coverage breadcrumb (meta-observability): which FLEET sources the
-     * (Phase-161) handler actually located + read. DISTINCT from `truncations[]`
+     * handler actually located + read. DISTINCT from `truncations[]`
      * (SIZE-drops): `coverage` records whether the INPUTS were read, so a
      * silently-empty fleet report ("0 rows / N days missing") is self-evident
-     * instead of masquerading as a clean zero-activity window. Mirrors the v2.14
+     * instead of masquerading as a clean zero-activity window. Mirrors the
      * `IncidentReport.coverage` pattern (`obs-explain-assemble.ts`). Optional
      * (schemaVersion stays 1) — additive; pre-existing constructors omit it.
      *
-     * The shape maps to the Phase-159 aggregates: `sessionSummary` (A1/A2 store
-     * rows), `sessionIndex` (A3 multi-day reader's `daysRead`/`daysMissing`),
+     * The shape maps to the fleet aggregates: `sessionSummary` (session-summary
+     * store rows), `sessionIndex` (the multi-day index reader's `daysRead`/`daysMissing`),
      * `billing` (present flag for the cost source).
      */
     coverage: z
@@ -120,25 +116,25 @@ export const FleetHealthReportSchema = z.object({
     })
         .optional(),
     /**
-     * TELEM-02: the pre-committed pipeline-authoring decision verdict (gates Phase
-     * 174). Optional (schemaVersion stays 1) — additive; pre-existing constructors
+     * The pre-committed pipeline-authoring decision verdict.
+     * Optional (schemaVersion stays 1) — additive; pre-existing constructors
      * omit it. Declared INLINE here because core depends only on shared (it cannot
      * import the observability package — that would invert the dep graph + trip the
      * cycle gate); the daemon assigns the observability `PipelineAuthoringVerdict`,
      * structurally `{buildAuthor, reason}`, into this field. Counts/boolean verdict
      * only — no body/secret. Without this field the non-strict z.object STRIPS the
-     * verdict on parse, so it never reaches the operator (T-173-12 Tampering — the
-     * round-trip test proves it).
+     * verdict on parse, so it never reaches the operator (a tampering hazard — the
+     * round-trip test proves it survives).
      */
     pipelineAuthoringGate: z
         .object({ buildAuthor: z.boolean(), reason: z.string() })
         .optional(),
     /**
-     * FLEET-01/02/04 (Phase 220): the cross-run AUTONOMY-health slice. Counts + an
+     * The cross-run AUTONOMY-health slice. Counts + an
      * id ONLY (the worst rootRunId to drill into via `comis explain`) — NO
      * body/reason/secret (the smuggled-key test proves the non-strict z.object
-     * strips any extra field; T-220-10). Optional (schemaVersion stays 1) —
-     * additive; pre-220 constructors omit it.
+     * strips any extra field). Optional (schemaVersion stays 1) —
+     * additive; pre-existing constructors omit it.
      *
      * Sourced from `DurableRunPort.countByStatus` (autonomy runs ARE durable_runs
      * by construction — no synthetic notion, no session-rollup schema change) +
@@ -148,9 +144,8 @@ export const FleetHealthReportSchema = z.object({
      *
      * `costUsd` is the window's autonomy-inclusive operator cost (the
      * synthetic-excluded `fleet.costUsd` read-back — NOT a separate re-derivation
-     * over raw rows, which would re-introduce WR-01). A stricter autonomy-only
-     * cost is a later follow-up; FLEET-01 requires an aggregate cost, satisfied
-     * here.
+     * over raw rows, which could diverge from the fleet read). A stricter
+     * autonomy-only cost is a possible follow-up; an aggregate cost suffices here.
      */
     autonomy: z
         .object({
@@ -162,18 +157,18 @@ export const FleetHealthReportSchema = z.object({
         /** The TOOL-FAILURE breaker subset of breakerTripTotal (the synthetic-excluded
          *  session-rollup `breakerTripCount` read-back). DISTINCT from `denialBreakerTrips`
          *  below — the tool-failure breaker and the capability-denial breaker are
-         *  separate Phase-217 mechanisms and must not be conflated. */
+         *  separate mechanisms and must not be conflated. */
         breakerTrips: z.number(),
         /**
-         * FLEET-02 (Phase 220-05): the CAPABILITY-DENIAL breaker trip count — N
-         * consecutive floor-blocks aborted + killed an unattended run tree (Phase
-         * 217). EVENT-SOURCED from the content-free `autonomy_denial_breaker`
+         * The CAPABILITY-DENIAL breaker trip count — N
+         * consecutive floor-blocks aborted + killed an unattended run tree.
+         * EVENT-SOURCED from the content-free `autonomy_denial_breaker`
          * health_signal rows, NOT the session-rollup `breakerTripCount`: a
          * denial-breaker abort is NEVER a session endReason and NEVER a
          * breakerTripCount, so `breakerTrips` (the tool-failure read-back) can never
          * see it — and the aborted run lands in durable status 'completed', so it is
          * 0 in orphaned/revoked/killed too. This separable count is the ONLY fleet
-         * surface for the denial breaker (the milestone-audit FLEET-02 gap). Counts
+         * surface for the denial breaker. Counts
          * only — never the engine's free-text deny reason. The assembler always
          * emits it within the (optional) autonomy block; a `denial_breaker`-aborted
          * run's id can also surface as `worstRootRunId` + an `autonomy_denial_breaker`
@@ -182,15 +177,66 @@ export const FleetHealthReportSchema = z.object({
         denialBreakerTrips: z.number(),
         budgetBreaches: z.number(),
         costUsd: z.number(),
-        /** FLEET-04: the worst autonomy run to drill into via `comis explain`. */
+        /** The worst autonomy run to drill into via `comis explain`. */
         worstRootRunId: z.string().optional(),
     })
         .optional(),
+    /**
+     * The cross-session wake-gate EFFICIENCY slice — per-agent
+     * skip-rate + turns-saved + tool-call cost, rolled up from the content-free
+     * `cron_wake_gate` diagnostic rows. Counts + agent ids ONLY (never the gate's
+     * gathered payload / script source / a secret — the smuggled-key test proves
+     * the non-strict z.object strips any extra field). Optional (schemaVersion
+     * stays 1) — additive; the block is ABSENT when no gated fire happened in the
+     * window (honest omit).
+     *
+     * The two legibility properties this block carries:
+     *   - SUPPRESSION: `perAgent[].skipRate == 1.0` is a gate that NEVER wakes the
+     *     model — either working hard (savings) OR silently poisoned to suppress a
+     *     monitor. Either way it is visible, never silent.
+     *   - NET COST: `toolCalls` (the gate's cap-call cost) beside `turnsSaved`
+     *     (the avoided model turns) makes a gate that costs more than it saves
+     *     legible — the operator compares the two numbers directly.
+     */
+    cronWakeGate: z
+        .object({
+        /** Window totals: `total` gated fires, `skipped` (wake===false) fires,
+         *  `skipRate = skipped/total`, `failedOpen` (fail-open wakes: crash/timeout/
+         *  over-cap/no-verdict) and `failOpenRate = failedOpen/total` (0 when total
+         *  is 0). `failOpenRate` is the signal symmetric to a 100% `skipRate`: a
+         *  broken gate that fails open every fire saves nothing and costs its own
+         *  cap-calls, yet otherwise looks like a healthy always-waking monitor. */
+        fires: z.object({
+            total: z.number(),
+            skipped: z.number(),
+            skipRate: z.number(),
+            failedOpen: z.number(),
+            failOpenRate: z.number(),
+        }),
+        /** Sum of the derived per-fire `estTurnsSaved` (the avoided model turns). */
+        turnsSaved: z.number(),
+        /** Sum of the gate's cap-call cost across the window (the net-cost numerator). */
+        toolCalls: z.number(),
+        /** Per-agent breakdown — the suppression (skipRate), the broken-gate signal
+         *  (failOpenRate), and net-cost (toolCalls vs turnsSaved) legibility keyed
+         *  by agent id. */
+        perAgent: z.array(z.object({
+            agentId: z.string(),
+            fires: z.number(),
+            skipped: z.number(),
+            skipRate: z.number(),
+            failedOpen: z.number(),
+            failOpenRate: z.number(),
+            turnsSaved: z.number(),
+            toolCalls: z.number(),
+        })),
+    })
+        .optional(),
 });
 /**
- * `obs.fleet.health` — the cross-session fleet-health triage RPC (v2.15 R2,
- * Phase 161). Admin-only; the daemon handler fans the Phase-159 A-track
- * aggregation + Phase-160 I-track diagnostics into the {@link FleetHealthReport}
+ * `obs.fleet.health` — the cross-session fleet-health triage RPC.
+ * Admin-only; the daemon handler fans the cross-session
+ * aggregation + log-derived diagnostics into the {@link FleetHealthReport}
  * digest above. The SIBLING of {@link ObsExplainContract} (`incident-report.ts`):
  * `obs.explain` post-mortems ONE session; this rolls up a WINDOW.
  *

package/node_modules/@comis/core/dist/api-contracts/incident-report-sections.d.ts

@@ -5,9 +5,9 @@
  * file-size cap (the obs-handlers fold-extraction discipline). These are the
  * self-contained, content-free sections the `obs.explain` normalizer folds from
  * the trajectory and the report/`IncidentSignals` both reference:
- *   - `IncidentContextBudgetSchema` (W3) — the per-LLM-call budget equation.
- *   - `IncidentPromptTimeoutSchema` (LAT-04) — the terminal prompt-timeout attribution.
- *   - `SpawnTreeNodeSchema` (TREE-01/02) — one node of the per-cap spawn tree.
+ *   - `IncidentContextBudgetSchema` — the per-LLM-call budget equation.
+ *   - `IncidentPromptTimeoutSchema` — the terminal prompt-timeout attribution.
+ *   - `SpawnTreeNodeSchema` — one node of the per-cap spawn tree.
  *
  * Barrel-only: external consumers import these from `"@comis/core"` (re-exported
  * by `incident-report.ts` → `observability.ts`), so the public surface is unchanged.
@@ -16,7 +16,7 @@
  */
 import { z } from "zod";
 /**
- * W3 (obs-llm-troubleshooting): the per-LLM-call context budget equation,
+ * The per-LLM-call context budget equation,
  * extracted from the trajectory's `context.budget` records (last record wins —
  * the terminal fit check explains the end state). Carried on the report so a
  * `context_exhausted` abort is explainable with numbers (assembled vs window,
@@ -48,7 +48,26 @@ export declare const IncidentContextBudgetSchema: z.ZodObject<{
 /** The per-call context budget equation (see {@link IncidentContextBudgetSchema}). */
 export type IncidentContextBudget = z.infer<typeof IncidentContextBudgetSchema>;
 /**
- * E2 (obs-sweep package-delivery-20260628): one COMPACT per-turn budget-check entry — the cascade
+ * The woke-fire wake-gate fact (content-free — counts/ids/boolean ONLY, no free
+ * text). A wake gate that WOKE the model runs the job in its main session, so
+ * that fire (and only that fire) has a session/trajectory to post-mortem; the
+ * `obs.explain` normalizer folds its `scheduler.wake_gate` trajectory record here
+ * (LAST wins). A SKIPPED fire opens no session and produces no IncidentReport at
+ * all — its lens is the enriched `cron.runs` row, not `comis explain`. The gate's
+ * gathered finding / script source never rides this fact (bounded z.object; any
+ * off-vocabulary key is stripped on parse).
+ */
+export declare const IncidentCronWakeGateSchema: z.ZodObject<{
+    jobId: z.ZodString;
+    wake: z.ZodBoolean;
+    durationMs: z.ZodNumber;
+    toolCalls: z.ZodNumber;
+    estTurnsSaved: z.ZodNumber;
+}, z.core.$strip>;
+/** The woke-fire wake-gate fact (see {@link IncidentCronWakeGateSchema}). */
+export type IncidentCronWakeGate = z.infer<typeof IncidentCronWakeGateSchema>;
+/**
+ * One COMPACT per-turn budget-check entry — the cascade
  * shape. `IncidentReport.contextBudget` keeps only the TERMINAL fit-check; a `context_exhausted`
  * abort needs the PROGRESSION (each turn's assembled-input growth + eviction + verdict) to see the
  * tightening toward exhaustion. The history folds these (dedup'd on transition, most-recent capped) so
@@ -68,13 +87,13 @@ export declare const IncidentContextBudgetHistoryEntrySchema: z.ZodObject<{
 /** One per-turn context-budget cascade entry (see {@link IncidentContextBudgetHistoryEntrySchema}). */
 export type IncidentContextBudgetHistoryEntry = z.infer<typeof IncidentContextBudgetHistoryEntrySchema>;
 /**
- * LAT-04 (177): the terminal prompt-timeout attribution record — the LAST
+ * The terminal prompt-timeout attribution record — the LAST
  * `execution.prompt_timeout` trajectory row. Content-free: numbers + closed
  * enums + the pre-rendered config-KEY string (`bindingKnob` — knob NAME + ids
  * only, never values/bodies). Wholesale-validated by the signals normalizer
  * (the contextBudget discipline); a malformed/partial record is ignored
  * (forward-compatible). Signals-only — NOT on `IncidentReportSchema`
- * (mirroring the GBNF-02 `toolSchemaUnsupported` precedent: the heuristic
+ * (mirroring the `toolSchemaUnsupported` precedent: the heuristic
  * verdict carries what the operator needs).
  */
 export declare const IncidentPromptTimeoutSchema: z.ZodObject<{
@@ -93,14 +112,14 @@ export declare const IncidentPromptTimeoutSchema: z.ZodObject<{
 /** The terminal prompt-timeout attribution record (see {@link IncidentPromptTimeoutSchema}). */
 export type IncidentPromptTimeout = z.infer<typeof IncidentPromptTimeoutSchema>;
 /**
- * TREE-01/02 (215): one node of the root→children SPAWN TREE folded from a
+ * One node of the root→children SPAWN TREE folded from a
  * session's `capability.audited` records (one per `leaseId`) — the attenuated
  * `caps` held, the tool NAMES invoked, and any `CapabilityDeniedError` cap in
- * `denials` (TREE-02). `parentLeaseId` is the child→root edge (absent on the root
+ * `denials`. `parentLeaseId` is the child→root edge (absent on the root
  * and on the lease-less in-process path, which groups under its synthetic
- * `rootRunId`, G1); `budgetTokensUsed` is honest-optional (G3 — the live `whoami`
+ * `rootRunId`); `budgetTokensUsed` is honest-optional (the live `whoami`
  * owns remaining budget; this is post-mortem topology). Content-free (ids / caps
- * / tool-NAMES / denials ONLY, §2.7). Single source of truth for BOTH
+ * / tool-NAMES / denials ONLY). Single source of truth for BOTH
  * `IncidentReportSchema.spawnTree` and `IncidentSignals.spawnTree`.
  */
 export declare const SpawnTreeNodeSchema: z.ZodObject<{
@@ -115,3 +134,53 @@ export declare const SpawnTreeNodeSchema: z.ZodObject<{
 }, z.core.$strip>;
 /** One spawn-tree node (see {@link SpawnTreeNodeSchema}). */
 export type SpawnTreeNode = z.infer<typeof SpawnTreeNodeSchema>;
+/**
+ * One `orchestrate` PTC RUN folded from the session's
+ * `orchestrate.run_summary` trajectory record (one entry per run — a session may
+ * hold several runs). The per-run child `leaseId` (the daemon-minted correlator) is
+ * what groups each run's `toolCalls` — including a `decision:"deny"` — under THAT
+ * run, so an in-jail denial is attributed to the run that made it, not the assembly.
+ * Content-free by construction: ids + closed enums + counts + token ESTIMATES only —
+ * never the script, the stderr tail, tool args, or a secret. `failureClass` is the
+ * closed run-failure union (absent on a clean exit; a `lease_absent` may ride a clean
+ * exit-0 run — a distinct diagnostic from a run that ran with no lease AND failed).
+ * `savings` is a LABELED estimate (materialized-bytes counterfactual vs post-bounce
+ * re-entry), not exact accounting. Single source of truth for BOTH
+ * `IncidentReportSchema.orchestrate` and `IncidentSignals.orchestrate`.
+ */
+export declare const OrchestrateRunSchema: z.ZodObject<{
+    runId: z.ZodString;
+    leaseId: z.ZodOptional<z.ZodString>;
+    outcome: z.ZodEnum<{
+        success: "success";
+        failure: "failure";
+    }>;
+    durationMs: z.ZodNumber;
+    exitCode: z.ZodNumber;
+    failureClass: z.ZodOptional<z.ZodEnum<{
+        timeout: "timeout";
+        stdout_cap: "stdout_cap";
+        nonzero_exit: "nonzero_exit";
+        spawn_fail: "spawn_fail";
+        lease_absent: "lease_absent";
+    }>>;
+    toolCalls: z.ZodArray<z.ZodObject<{
+        tool: z.ZodString;
+        capability: z.ZodString;
+        decision: z.ZodEnum<{
+            allow: "allow";
+            deny: "deny";
+        }>;
+        count: z.ZodNumber;
+    }, z.core.$strip>>;
+    resultRefs: z.ZodObject<{
+        count: z.ZodNumber;
+        bytes: z.ZodNumber;
+    }, z.core.$strip>;
+    savings: z.ZodOptional<z.ZodObject<{
+        estSavedTokens: z.ZodNumber;
+        savedRatio: z.ZodNumber;
+    }, z.core.$strip>>;
+}, z.core.$strip>;
+/** One orchestrate PTC run (see {@link OrchestrateRunSchema}). */
+export type OrchestrateRun = z.infer<typeof OrchestrateRunSchema>;

package/node_modules/@comis/core/dist/api-contracts/incident-report-sections.js

@@ -6,9 +6,9 @@
  * file-size cap (the obs-handlers fold-extraction discipline). These are the
  * self-contained, content-free sections the `obs.explain` normalizer folds from
  * the trajectory and the report/`IncidentSignals` both reference:
- *   - `IncidentContextBudgetSchema` (W3) — the per-LLM-call budget equation.
- *   - `IncidentPromptTimeoutSchema` (LAT-04) — the terminal prompt-timeout attribution.
- *   - `SpawnTreeNodeSchema` (TREE-01/02) — one node of the per-cap spawn tree.
+ *   - `IncidentContextBudgetSchema` — the per-LLM-call budget equation.
+ *   - `IncidentPromptTimeoutSchema` — the terminal prompt-timeout attribution.
+ *   - `SpawnTreeNodeSchema` — one node of the per-cap spawn tree.
  *
  * Barrel-only: external consumers import these from `"@comis/core"` (re-exported
  * by `incident-report.ts` → `observability.ts`), so the public surface is unchanged.
@@ -17,7 +17,7 @@
  */
 import { z } from "zod";
 /**
- * W3 (obs-llm-troubleshooting): the per-LLM-call context budget equation,
+ * The per-LLM-call context budget equation,
  * extracted from the trajectory's `context.budget` records (last record wins —
  * the terminal fit check explains the end state). Carried on the report so a
  * `context_exhausted` abort is explainable with numbers (assembled vs window,
@@ -30,9 +30,9 @@ export const IncidentContextBudgetSchema = z.object({
     /** The model's declared contextWindow before any cap (== windowTokens when uncapped). */
     rawContextWindowTokens: z.number(),
     /** What clamped the window. The cap members are contextEngine.budget.* knob
-     *  names; "served" (KNOB-02) means the Ollama-served num_ctx bound the window
+     *  names; "served" means the Ollama-served num_ctx bound the window
      *  (knobs: OLLAMA_CONTEXT_LENGTH env / Modelfile PARAMETER num_ctx);
-     *  "capabilityClass" (WR-01) means the executor-side class cap from the
+     *  "capabilityClass" means the executor-side class cap from the
      *  operator's providers.entries.<id>.capabilities.capabilityClass pin bound
      *  — the pin is the lever (the budget knobs are inert on that branch). */
     windowCapSource: z.enum(["effectiveContextCapSmall", "effectiveContextCapNano", "served", "capabilityClass", "none"]),
@@ -52,7 +52,29 @@ export const IncidentContextBudgetSchema = z.object({
     verdict: z.enum(["fits", "downshifted", "exhausted"]),
 });
 /**
- * E2 (obs-sweep package-delivery-20260628): one COMPACT per-turn budget-check entry — the cascade
+ * The woke-fire wake-gate fact (content-free — counts/ids/boolean ONLY, no free
+ * text). A wake gate that WOKE the model runs the job in its main session, so
+ * that fire (and only that fire) has a session/trajectory to post-mortem; the
+ * `obs.explain` normalizer folds its `scheduler.wake_gate` trajectory record here
+ * (LAST wins). A SKIPPED fire opens no session and produces no IncidentReport at
+ * all — its lens is the enriched `cron.runs` row, not `comis explain`. The gate's
+ * gathered finding / script source never rides this fact (bounded z.object; any
+ * off-vocabulary key is stripped on parse).
+ */
+export const IncidentCronWakeGateSchema = z.object({
+    /** The cron job whose gated fire woke the model. */
+    jobId: z.string(),
+    /** Always true on the report path — only a woke fire has a session (a skip records nothing here). */
+    wake: z.boolean(),
+    /** Wall-clock ms the gate's pre-flight took. */
+    durationMs: z.number(),
+    /** Tool calls the gate's pre-flight made (reconstructed in detail via the content-free cap-audit stream). */
+    toolCalls: z.number(),
+    /** Model turns the gate estimated it saved (0 on a wake — the model ran). */
+    estTurnsSaved: z.number(),
+});
+/**
+ * One COMPACT per-turn budget-check entry — the cascade
  * shape. `IncidentReport.contextBudget` keeps only the TERMINAL fit-check; a `context_exhausted`
  * abort needs the PROGRESSION (each turn's assembled-input growth + eviction + verdict) to see the
  * tightening toward exhaustion. The history folds these (dedup'd on transition, most-recent capped) so
@@ -66,13 +88,13 @@ export const IncidentContextBudgetHistoryEntrySchema = z.object({
     verdict: z.enum(["fits", "downshifted", "exhausted"]),
 });
 /**
- * LAT-04 (177): the terminal prompt-timeout attribution record — the LAST
+ * The terminal prompt-timeout attribution record — the LAST
  * `execution.prompt_timeout` trajectory row. Content-free: numbers + closed
  * enums + the pre-rendered config-KEY string (`bindingKnob` — knob NAME + ids
  * only, never values/bodies). Wholesale-validated by the signals normalizer
  * (the contextBudget discipline); a malformed/partial record is ignored
  * (forward-compatible). Signals-only — NOT on `IncidentReportSchema`
- * (mirroring the GBNF-02 `toolSchemaUnsupported` precedent: the heuristic
+ * (mirroring the `toolSchemaUnsupported` precedent: the heuristic
  * verdict carries what the operator needs).
  */
 export const IncidentPromptTimeoutSchema = z.object({
@@ -80,9 +102,9 @@ export const IncidentPromptTimeoutSchema = z.object({
     timeoutMs: z.number(),
     /** Elapsed wall-clock ms at kill. */
     durationMs: z.number().optional(),
-    /** Which limit fired: stall budget vs makespan ceiling. Absent = whole-turn (retry-path/pre-LAT-02 rows). */
+    /** Which limit fired: stall budget vs makespan ceiling. Absent = whole-turn (retry-path rows, or a row that omits it). */
     limit: z.enum(["stall", "makespan"]).optional(),
-    /** Binding resolution level (LAT-01 — the agent-side TimeoutSource union). */
+    /** Binding resolution level (the agent-side TimeoutSource union). */
     source: z.string().optional(),
     /** Pre-rendered config-key string from the agent-side source→knob table. */
     bindingKnob: z.string().optional(),
@@ -91,14 +113,14 @@ export const IncidentPromptTimeoutSchema = z.object({
     makespanMs: z.number().optional(),
 });
 /**
- * TREE-01/02 (215): one node of the root→children SPAWN TREE folded from a
+ * One node of the root→children SPAWN TREE folded from a
  * session's `capability.audited` records (one per `leaseId`) — the attenuated
  * `caps` held, the tool NAMES invoked, and any `CapabilityDeniedError` cap in
- * `denials` (TREE-02). `parentLeaseId` is the child→root edge (absent on the root
+ * `denials`. `parentLeaseId` is the child→root edge (absent on the root
  * and on the lease-less in-process path, which groups under its synthetic
- * `rootRunId`, G1); `budgetTokensUsed` is honest-optional (G3 — the live `whoami`
+ * `rootRunId`); `budgetTokensUsed` is honest-optional (the live `whoami`
  * owns remaining budget; this is post-mortem topology). Content-free (ids / caps
- * / tool-NAMES / denials ONLY, §2.7). Single source of truth for BOTH
+ * / tool-NAMES / denials ONLY). Single source of truth for BOTH
  * `IncidentReportSchema.spawnTree` and `IncidentSignals.spawnTree`.
  */
 export const SpawnTreeNodeSchema = z.object({
@@ -111,3 +133,33 @@ export const SpawnTreeNodeSchema = z.object({
     denials: z.array(z.string()),
     budgetTokensUsed: z.number().optional(),
 });
+/**
+ * One `orchestrate` PTC RUN folded from the session's
+ * `orchestrate.run_summary` trajectory record (one entry per run — a session may
+ * hold several runs). The per-run child `leaseId` (the daemon-minted correlator) is
+ * what groups each run's `toolCalls` — including a `decision:"deny"` — under THAT
+ * run, so an in-jail denial is attributed to the run that made it, not the assembly.
+ * Content-free by construction: ids + closed enums + counts + token ESTIMATES only —
+ * never the script, the stderr tail, tool args, or a secret. `failureClass` is the
+ * closed run-failure union (absent on a clean exit; a `lease_absent` may ride a clean
+ * exit-0 run — a distinct diagnostic from a run that ran with no lease AND failed).
+ * `savings` is a LABELED estimate (materialized-bytes counterfactual vs post-bounce
+ * re-entry), not exact accounting. Single source of truth for BOTH
+ * `IncidentReportSchema.orchestrate` and `IncidentSignals.orchestrate`.
+ */
+export const OrchestrateRunSchema = z.object({
+    runId: z.string(),
+    leaseId: z.string().optional(),
+    outcome: z.enum(["success", "failure"]),
+    durationMs: z.number(),
+    exitCode: z.number(),
+    failureClass: z.enum(["timeout", "stdout_cap", "nonzero_exit", "spawn_fail", "lease_absent"]).optional(),
+    toolCalls: z.array(z.object({
+        tool: z.string(),
+        capability: z.string(),
+        decision: z.enum(["allow", "deny"]),
+        count: z.number(),
+    })),
+    resultRefs: z.object({ count: z.number(), bytes: z.number() }),
+    savings: z.object({ estSavedTokens: z.number(), savedRatio: z.number() }).optional(),
+});