comisai 1.0.44 → 1.0.46

package/node_modules/@comis/core/dist/config/schema-agent/schema-agent-autonomy-mcp.js

@@ -0,0 +1,93 @@
+// SPDX-License-Identifier: Apache-2.0
+/**
+ * Agent config — Autonomy MCP inbound-allowlist sub-block.
+ *
+ * The nested `z.strictObject` leaf that governs which connected-MCP-server
+ * tools an autonomy-bearing agent may call from the jailed SDK. It is the
+ * SECOND default-deny layer: the `orch:mcp` capability grant (the surface gate)
+ * is layer one; even holding `orch:mcp`, a `{server,tool}` pair absent from
+ * `allow` — or on a server without an explicit inbound classification — is
+ * denied here.
+ *
+ * Follows the `durability`/`message` nested-block precedent: a `z.strictObject`
+ * with every field `.default()`-ed and `strictObject` as the typo guard
+ * (fails-closed). `enabled` defaults FALSE and `allow` defaults `{}`, so a
+ * fully-omitted block resolves to a dark surface — no tool reachable.
+ *
+ * The 3-tier inbound classification MIRRORS THE SHAPE of the per-tool export
+ * policy (`"safe" | "permission-gated" | absent ⇒ deny`) but is a SEPARATE
+ * inbound field — the outbound export policy is NOT the inbound gate.
+ *
+ * `permitsMcpTool` is the PURE predicate the daemon-side executor calls per
+ * invocation: it answers "is this `{server,tool}` listed AND classified
+ * reachable?" — deny by absence at every step (unlisted server, unlisted tool,
+ * or an absent classification all return false). Prototype-safe: an untrusted
+ * server name never resolves an inherited object.
+ *
+ * Pure schema leaf — imports only `zod`. No `process.env` / `Date.now` /
+ * `path.join`.
+ *
+ * @module
+ */
+import { z } from "zod";
+/**
+ * The inbound MCP allowlist posture. `enabled` is the surface gate (paired with
+ * the `orch:mcp` capability grant); `allow` maps a connected server name to the
+ * explicit set of tool names reachable on it plus a required inbound
+ * classification. An absent classification is treated as unreachable (the
+ * default-deny safety net) — it is NOT an accepted inbound tier.
+ */
+export const AutonomyMcpConfigSchema = z.strictObject({
+    /**
+     * Surface gate (default FALSE). Pairs with the `orch:mcp` capability grant: an
+     * operator turns this on for an autonomy-bearing agent that must reach
+     * connected MCP-server tools from the jailed SDK. Off ⇒ the cap is not granted
+     * and the whole surface is dark.
+     */
+    enabled: z.boolean().default(false),
+    /**
+     * Per-server inbound allowlist. Keys are connected-server names; each value
+     * lists the EXPLICIT tool names reachable on that server (no `"*"` wildcard —
+     * an explicit list) plus the inbound classification tier. Default `{}` ⇒
+     * nothing listed ⇒ everything denied (deny by absence).
+     */
+    allow: z
+        .record(z.string(), z.strictObject({
+        /** Explicit reachable tool names on this server (no wildcard). */
+        tools: z.array(z.string()).default([]),
+        /**
+         * Inbound classification tier. `"safe"` ⇒ reachable; `"permission-gated"`
+         * ⇒ reachable but the approval gate fires in the executor; ABSENT ⇒
+         * unreachable (deny). Deliberately omits the outbound `"never-export"`
+         * value — absent already means deny inbound.
+         */
+        classification: z.enum(["safe", "permission-gated"]).optional(),
+    }))
+        .default({}),
+});
+/**
+ * Pure inbound-allowlist predicate — the layer-two default-deny gate the
+ * daemon-side MCP executor calls per invocation. Returns `true` ONLY when the
+ * server is listed in `allow`, the tool is in that server's explicit `tools`
+ * list, AND the server carries an inbound classification of `"safe"` or
+ * `"permission-gated"`. Every other case — an unlisted server, an unlisted
+ * tool, or an absent classification — returns `false` (deny by absence).
+ *
+ * A `"permission-gated"` server is PERMITTED here; the approval-gate firing is
+ * the executor's concern — this predicate only answers "listed & classified".
+ *
+ * Iterates own entries (never indexes `allow` with the untrusted `server`), so
+ * an adversarial `"__proto__"`/`"constructor"` name resolves nothing.
+ *
+ * PURE — a function of its arguments only (no env/clock/fs).
+ */
+export function permitsMcpTool(cfg, server, tool) {
+    const match = Object.entries(cfg.allow).find(([name]) => name === server);
+    if (match === undefined)
+        return false; // unlisted server ⇒ deny
+    const [, entry] = match;
+    if (!entry.tools.includes(tool))
+        return false; // tool not on the server's explicit list ⇒ deny
+    // Absent classification ⇒ unreachable (the default-deny safety net).
+    return entry.classification === "safe" || entry.classification === "permission-gated";
+}

package/node_modules/@comis/core/dist/config/schema-agent/schema-agent-autonomy-mode.d.ts

@@ -2,9 +2,9 @@
  * Agent config — Autonomy MODE vocabulary + fail-closed resolution + the
  * per-profile posture notices.
  *
- * Split from `schema-agent-autonomy.ts` (213-03 file-size cap discipline): the
- * `mode` axis (the §22 operator-set autonomy mode the agent CANNOT self-raise),
- * the EVICT-02 fail-closed `resolveEffectiveMode` primitive, and the two
+ * Split from `schema-agent-autonomy.ts` (file-size cap discipline): the
+ * `mode` axis (the operator-set autonomy mode the agent CANNOT self-raise),
+ * the fail-closed `resolveEffectiveMode` primitive, and the two
  * `unattended`/`max` posture-notice strings are a self-contained unit the main
  * autonomy leaf imports. One-directional dependency (mode → consumed by
  * autonomy), no cycle; re-exported by the `schema-agent/index.ts` barrel so
@@ -14,31 +14,32 @@
  *
  * @module
  */
-/** §22 autonomy modes. `default` is the SAFE mode the fail-closed path collapses to. */
+/** Autonomy modes. `default` is the SAFE mode the fail-closed path collapses to. */
 export declare const AUTONOMY_MODES: readonly ["default", "accept-reversible", "unattended", "max"];
 export type AutonomyMode = (typeof AUTONOMY_MODES)[number];
 /**
- * EVICT-02 fail-closed mode resolution. Given a (possibly absent/forged/unparseable)
+ * Fail-closed mode resolution. Given a (possibly absent/forged/unparseable)
  * mode value — e.g. the chokepoint's injected `_autonomyMode`, or a future external
  * policy read — return the SAFE mode. A recognized AutonomyMode passes through; anything
  * else (undefined, non-string, an unknown string) collapses to "default", never to a
- * broader profile. This is the single fail-closed point EVICT-02's "unreachable policy
+ * broader profile. This is the single fail-closed point the "unreachable policy
  * source -> default" contract is tested against. PURE (no env/clock/fs).
  */
 export declare function resolveEffectiveMode(raw: unknown): AutonomyMode;
 /**
- * The `unattended` posture notice (Phase 217). The never-hang behaviors the
- * `unattended` MODE selects — a would-ask resolves to deny+escalate (never a
- * blocking prompt), the consecutive-denial circuit breaker, and operator
- * evict-from-mode — are ACTIVE as of this phase (UNATT/BREAK/EVICT). The
- * capability SET stays standard-equivalent (the §22.3 floor still bounds every
- * cap — no over-grant), and the structural floor is unchanged: outward actions
- * remain escalate-not-ask (propose), never auto-send. Content-free.
+ * The `unattended` posture notice. The never-hang behaviors the `unattended`
+ * MODE selects — a would-ask resolves to deny+escalate (never a blocking
+ * prompt), the consecutive-denial circuit breaker, and operator
+ * evict-from-mode — are ACTIVE. The capability SET stays standard-equivalent
+ * (the always-on structural floor still bounds every cap — no over-grant), and
+ * outward actions remain escalate-not-ask (propose), never auto-send.
+ * Content-free.
  */
-export declare const UNATTENDED_NOTICE = "Unattended mode: never-hang behaviors are active (a would-ask becomes deny+escalate, the denial breaker aborts a retry-loop, and an operator can evict to default). The capability set stays standard-equivalent (the \u00A722.3 floor bounds every cap; outward actions escalate, never auto-send).";
+export declare const UNATTENDED_NOTICE = "Unattended mode: never-hang behaviors are active (a would-ask becomes deny+escalate, the denial breaker aborts a retry-loop, and an operator can evict to default). The capability set stays standard-equivalent (the structural floor bounds every cap; outward actions escalate, never auto-send).";
 /**
- * The M1 clamp notice for `max`. `max` still resolves to the
- * `standard`-equivalent cap set today; its extra surface (max-mode sandbox
- * auto-allow) lands in M3 (v8 §3.8 / ROADMAP criterion 5). No silent over-grant.
+ * The clamp notice for `max`. `max` resolves to the `standard`-equivalent cap
+ * set today; its extra surface (max-mode sandbox auto-allow) is not yet
+ * available. The notice discloses the clamp so there is no silent over-grant
+ * and no pretense of a larger surface.
  */
-export declare const MAX_M1_CLAMP_NOTICE = "Resolved to standard-equivalent in M1: the max-mode surface (sandbox auto-allow) is available in M3.";
+export declare const MAX_M1_CLAMP_NOTICE = "Resolved to standard-equivalent: the max-mode surface (sandbox auto-allow) is not yet available.";

package/node_modules/@comis/core/dist/config/schema-agent/schema-agent-autonomy-mode.js

@@ -3,9 +3,9 @@
  * Agent config — Autonomy MODE vocabulary + fail-closed resolution + the
  * per-profile posture notices.
  *
- * Split from `schema-agent-autonomy.ts` (213-03 file-size cap discipline): the
- * `mode` axis (the §22 operator-set autonomy mode the agent CANNOT self-raise),
- * the EVICT-02 fail-closed `resolveEffectiveMode` primitive, and the two
+ * Split from `schema-agent-autonomy.ts` (file-size cap discipline): the
+ * `mode` axis (the operator-set autonomy mode the agent CANNOT self-raise),
+ * the fail-closed `resolveEffectiveMode` primitive, and the two
  * `unattended`/`max` posture-notice strings are a self-contained unit the main
  * autonomy leaf imports. One-directional dependency (mode → consumed by
  * autonomy), no cycle; re-exported by the `schema-agent/index.ts` barrel so
@@ -15,14 +15,14 @@
  *
  * @module
  */
-/** §22 autonomy modes. `default` is the SAFE mode the fail-closed path collapses to. */
+/** Autonomy modes. `default` is the SAFE mode the fail-closed path collapses to. */
 export const AUTONOMY_MODES = ["default", "accept-reversible", "unattended", "max"];
 /**
- * EVICT-02 fail-closed mode resolution. Given a (possibly absent/forged/unparseable)
+ * Fail-closed mode resolution. Given a (possibly absent/forged/unparseable)
  * mode value — e.g. the chokepoint's injected `_autonomyMode`, or a future external
  * policy read — return the SAFE mode. A recognized AutonomyMode passes through; anything
  * else (undefined, non-string, an unknown string) collapses to "default", never to a
- * broader profile. This is the single fail-closed point EVICT-02's "unreachable policy
+ * broader profile. This is the single fail-closed point the "unreachable policy
  * source -> default" contract is tested against. PURE (no env/clock/fs).
  */
 export function resolveEffectiveMode(raw) {
@@ -31,18 +31,19 @@ export function resolveEffectiveMode(raw) {
         : "default";
 }
 /**
- * The `unattended` posture notice (Phase 217). The never-hang behaviors the
- * `unattended` MODE selects — a would-ask resolves to deny+escalate (never a
- * blocking prompt), the consecutive-denial circuit breaker, and operator
- * evict-from-mode — are ACTIVE as of this phase (UNATT/BREAK/EVICT). The
- * capability SET stays standard-equivalent (the §22.3 floor still bounds every
- * cap — no over-grant), and the structural floor is unchanged: outward actions
- * remain escalate-not-ask (propose), never auto-send. Content-free.
+ * The `unattended` posture notice. The never-hang behaviors the `unattended`
+ * MODE selects — a would-ask resolves to deny+escalate (never a blocking
+ * prompt), the consecutive-denial circuit breaker, and operator
+ * evict-from-mode — are ACTIVE. The capability SET stays standard-equivalent
+ * (the always-on structural floor still bounds every cap — no over-grant), and
+ * outward actions remain escalate-not-ask (propose), never auto-send.
+ * Content-free.
  */
-export const UNATTENDED_NOTICE = "Unattended mode: never-hang behaviors are active (a would-ask becomes deny+escalate, the denial breaker aborts a retry-loop, and an operator can evict to default). The capability set stays standard-equivalent (the §22.3 floor bounds every cap; outward actions escalate, never auto-send).";
+export const UNATTENDED_NOTICE = "Unattended mode: never-hang behaviors are active (a would-ask becomes deny+escalate, the denial breaker aborts a retry-loop, and an operator can evict to default). The capability set stays standard-equivalent (the structural floor bounds every cap; outward actions escalate, never auto-send).";
 /**
- * The M1 clamp notice for `max`. `max` still resolves to the
- * `standard`-equivalent cap set today; its extra surface (max-mode sandbox
- * auto-allow) lands in M3 (v8 §3.8 / ROADMAP criterion 5). No silent over-grant.
+ * The clamp notice for `max`. `max` resolves to the `standard`-equivalent cap
+ * set today; its extra surface (max-mode sandbox auto-allow) is not yet
+ * available. The notice discloses the clamp so there is no silent over-grant
+ * and no pretense of a larger surface.
  */
-export const MAX_M1_CLAMP_NOTICE = "Resolved to standard-equivalent in M1: the max-mode surface (sandbox auto-allow) is available in M3.";
+export const MAX_M1_CLAMP_NOTICE = "Resolved to standard-equivalent: the max-mode surface (sandbox auto-allow) is not yet available.";

package/node_modules/@comis/core/dist/config/schema-agent/schema-agent-autonomy-role.d.ts

@@ -1,15 +1,15 @@
 /**
  * Agent config — Autonomy ROLE vocabulary + the coordinator tool-surface
- * expansion (COORD-01, §23.10 lean-coordinator).
+ * expansion (lean-coordinator).
  *
- * Split from `schema-agent-autonomy.ts` (213-03 / 218-01 file-size cap
+ * Split from `schema-agent-autonomy.ts` (file-size cap
  * discipline): the `role` axis (the operator-set lean-coordinator posture the
  * agent CANNOT self-raise) and the pure `coordinator → coordinatorToolGroups`
  * expansion are a self-contained unit the main autonomy leaf imports. The role
  * NARROWS the resolved tool surface ONLY — it never adds a capability (the
- * resolved `capabilities[]` set is role-invariant), and the §22.3 structural
+ * resolved `capabilities[]` set is role-invariant), and the structural
  * floor + the `requireCapability` gate are unchanged. Default `worker` ⇒
- * byte-identical to today (no migration code, no posture flag).
+ * byte-identical to a role-less config (no migration code, no posture flag).
  *
  * One-directional dependency (role → consumed by autonomy), no cycle;
  * re-exported by the `schema-agent/index.ts` barrel so consumers reach these via
@@ -19,25 +19,25 @@
  * @module
  */
 /**
- * §23.10 lean-coordinator roles. `worker` (default) leaves the resolved tool
+ * Lean-coordinator roles. `worker` (default) leaves the resolved tool
  * surface untouched; `coordinator` narrows it to the orchestration set
  * (sessions_spawn/pipeline/cron/message + the orch:read drill-in tools +
  * obs_query) under a delegate-then-synthesize doctrine — heavy/long/high-volume
- * work always routes to a fresh-window child, never inline (COORD-02).
+ * work always routes to a fresh-window child, never inline.
  */
 export declare const AUTONOMY_ROLES: readonly ["worker", "coordinator"];
 export type AutonomyRole = (typeof AUTONOMY_ROLES)[number];
 /**
  * The tool-group allowlist the `coordinator` role resolves to — the single name
  * `setup-tools` expands into the `coordinator` TOOL_PROFILE. Surfaced on
- * `ResolvedAutonomy.coordinatorToolGroups` so the assembly seam and the COORD-01
- * arch-test read one source of truth off the compiled resolver.
+ * `ResolvedAutonomy.coordinatorToolGroups` so the assembly seam and the
+ * coordinator arch-test read one source of truth off the compiled resolver.
  */
 export declare const COORDINATOR_TOOL_GROUPS: readonly ["coordinator"];
 /**
- * Expand a resolved role into its tool-group allowlist (COORD-01). `coordinator`
+ * Expand a resolved role into its tool-group allowlist. `coordinator`
  * → the `["coordinator"]` allowlist `setup-tools` applies; `worker` → `undefined`
- * (no narrowing, so a default install resolves byte-identically to today). PURE
+ * (no narrowing, so a default install resolves with the full surface). PURE
  * (no env/clock/fs). NARROWS the tool surface only — never the cap set.
  */
 export declare function resolveCoordinatorToolGroups(role: AutonomyRole): readonly string[] | undefined;

package/node_modules/@comis/core/dist/config/schema-agent/schema-agent-autonomy-role.js

@@ -1,16 +1,16 @@
 // SPDX-License-Identifier: Apache-2.0
 /**
  * Agent config — Autonomy ROLE vocabulary + the coordinator tool-surface
- * expansion (COORD-01, §23.10 lean-coordinator).
+ * expansion (lean-coordinator).
  *
- * Split from `schema-agent-autonomy.ts` (213-03 / 218-01 file-size cap
+ * Split from `schema-agent-autonomy.ts` (file-size cap
  * discipline): the `role` axis (the operator-set lean-coordinator posture the
  * agent CANNOT self-raise) and the pure `coordinator → coordinatorToolGroups`
  * expansion are a self-contained unit the main autonomy leaf imports. The role
  * NARROWS the resolved tool surface ONLY — it never adds a capability (the
- * resolved `capabilities[]` set is role-invariant), and the §22.3 structural
+ * resolved `capabilities[]` set is role-invariant), and the structural
  * floor + the `requireCapability` gate are unchanged. Default `worker` ⇒
- * byte-identical to today (no migration code, no posture flag).
+ * byte-identical to a role-less config (no migration code, no posture flag).
  *
  * One-directional dependency (role → consumed by autonomy), no cycle;
  * re-exported by the `schema-agent/index.ts` barrel so consumers reach these via
@@ -20,24 +20,24 @@
  * @module
  */
 /**
- * §23.10 lean-coordinator roles. `worker` (default) leaves the resolved tool
+ * Lean-coordinator roles. `worker` (default) leaves the resolved tool
  * surface untouched; `coordinator` narrows it to the orchestration set
  * (sessions_spawn/pipeline/cron/message + the orch:read drill-in tools +
  * obs_query) under a delegate-then-synthesize doctrine — heavy/long/high-volume
- * work always routes to a fresh-window child, never inline (COORD-02).
+ * work always routes to a fresh-window child, never inline.
  */
 export const AUTONOMY_ROLES = ["worker", "coordinator"];
 /**
  * The tool-group allowlist the `coordinator` role resolves to — the single name
  * `setup-tools` expands into the `coordinator` TOOL_PROFILE. Surfaced on
- * `ResolvedAutonomy.coordinatorToolGroups` so the assembly seam and the COORD-01
- * arch-test read one source of truth off the compiled resolver.
+ * `ResolvedAutonomy.coordinatorToolGroups` so the assembly seam and the
+ * coordinator arch-test read one source of truth off the compiled resolver.
  */
 export const COORDINATOR_TOOL_GROUPS = ["coordinator"];
 /**
- * Expand a resolved role into its tool-group allowlist (COORD-01). `coordinator`
+ * Expand a resolved role into its tool-group allowlist. `coordinator`
  * → the `["coordinator"]` allowlist `setup-tools` applies; `worker` → `undefined`
- * (no narrowing, so a default install resolves byte-identically to today). PURE
+ * (no narrowing, so a default install resolves with the full surface). PURE
  * (no env/clock/fs). NARROWS the tool surface only — never the cap set.
  */
 export function resolveCoordinatorToolGroups(role) {

package/node_modules/@comis/core/dist/config/schema-agent/schema-agent-autonomy.d.ts

@@ -1,24 +1,24 @@
 /**
  * Agent config — Autonomy (named-profile) schema + resolver.
  *
- * Owns the v8 §3.8 named-profile posture: the `AutonomyConfigSchema` Zod leaf
+ * Owns the named-profile posture: the `AutonomyConfigSchema` Zod leaf
  * (whose `.default()` produces the `standard` posture — the zero-config
- * great-out-of-box default and the MIG-01 migration target), the
- * `AUTONOMY_PROFILES` resolved cap/guard table, and the PURE `resolveAutonomy()`
- * that expands a `profile:` into the full §3.3 cap/guard block (any explicit
- * field OVERRIDES the profile — progressive disclosure).
+ * great-out-of-box default), the `AUTONOMY_PROFILES` resolved cap/guard
+ * table, and the PURE `resolveAutonomy()` that expands a `profile:` into the
+ * full cap/guard block (any explicit field OVERRIDES the profile —
+ * progressive disclosure).
  *
  * Imports nothing from sibling leaves (model/context/prompt/runtime) —
  * one-directional dependency graph; the top-level `PerAgentConfigSchema` in
  * `schema-agent-runtime.ts` composes from this leaf.
  *
- * Design anchors: v8 §3.3 (the knob block), §3.8 (the named-profile table +
- * zero-config + the M1 clamp for `unattended`/`max`), §22.3 (the structural
- * floor — the `autoApprovable:false` caps that escalate, never auto, in EVERY
- * profile forever). Pure config→caps transform: NO `process.env` / `Date.now`
- * / `path.join` (AGENTS §2.2). The resolver's downshift (PROFILE-03) is driven
- * by a preflight-result INPUT, never a live bwrap probe (that probe is Phase
- * 211); this leaf only provides the profile→caps expansion.
+ * Design anchors: the knob block, the named-profile table (zero-config
+ * default + the clamp for `unattended`/`max`), and the structural floor —
+ * the `autoApprovable:false` caps that escalate, never auto, in EVERY
+ * profile forever. Pure config→caps transform: NO `process.env` / `Date.now`
+ * / `path.join` (AGENTS §2.2). The resolver's downshift is driven by a
+ * preflight-result INPUT, never a live bwrap probe (the probe is the
+ * caller's job); this leaf only provides the profile→caps expansion.
  *
  * @module
  */
@@ -28,23 +28,23 @@ import { type AutonomyBudgetConfig, type AutonomyRateConfig, type AutonomySpawnC
 import { type AutonomyMode } from "./schema-agent-autonomy-mode.js";
 import { type AutonomyRole } from "./schema-agent-autonomy-role.js";
 /**
- * The nine FLOOR-CONTAINED orchestration caps the `standard` profile turns on
- * (v8 §3.8 / §22.3). A profile MAY auto-allow these because the non-removable
- * §22.3 floor (deny-by-origin, secrets/host unreachability, the always-on
+ * The nine FLOOR-CONTAINED orchestration caps the `standard` profile turns on.
+ * A profile MAY auto-allow these because the non-removable structural floor
+ * (deny-by-origin, secrets/host unreachability, the always-on
  * budget/rate/spawn-ceiling, live revoke) bounds their blast radius.
  *
- * `orch:message` IS a member (210-GAP MIG-01 / v8 §3.8 line 253 profile table /
- * §3.3 line 190): the `standard` profile turns ON origin-channel messaging, and
- * Plan 04 gates `message.send/reply/react` on `requireCapability(_,
- * "orch:message")`. The held cap is what lets the most fundamental agent action
- * — sending a message to the channel it was spoken to — pass that gate. The
- * ORIGIN-vs-new-channel scoping rides the separate `message.channels` config
- * (`["origin"]` by default): origin sends are auto-allowable under quota, while
- * a send to a NEW channel is an `autoApprovable:false` floor item (§3.5/§22.3)
- * enforced by the message config + the §8.4 per-target grant — NOT by removing
- * the cap from the held set. The cap-literal `orch:message` is therefore
- * floor-contained + `autoApprovable:true` (origin); only its non-origin TARGET
- * escalates. (§3.5: the cap covers the genuinely-outward subset send/reply/react
+ * `orch:message` IS a member: the `standard` profile turns ON origin-channel
+ * messaging, and the daemon gates `message.send/reply/react` on
+ * `requireCapability(_, "orch:message")`. The held cap is what lets the most
+ * fundamental agent action — sending a message to the channel it was spoken to
+ * — pass that gate. The ORIGIN-vs-new-channel scoping rides the separate
+ * `message.channels` config (`["origin"]` by default): origin sends are
+ * auto-allowable under quota, while a send to a NEW channel is an
+ * `autoApprovable:false` floor item enforced by the message config + the
+ * per-target grant — NOT by removing the cap from the held set. The
+ * cap-literal `orch:message` is therefore floor-contained +
+ * `autoApprovable:true` (origin); only its non-origin TARGET escalates.
+ * (The cap covers the genuinely-outward subset send/reply/react
  * ONLY — edit/delete/fetch/attach stay admin-only and are not part of it.)
  */
 export declare const STANDARD_FLOOR_CAPABILITIES: readonly ["orch:read", "orch:web", "orch:write", "orch:analyze", "orch:spawn", "orch:graph", "orch:cron", "orch:skill", "orch:message"];
@@ -52,7 +52,7 @@ export declare const STANDARD_FLOOR_CAPABILITIES: readonly ["orch:read", "orch:w
 export declare const AUTONOMY_PROFILE_NAMES: readonly ["assistant", "standard", "unattended", "max"];
 export type AutonomyProfileName = (typeof AUTONOMY_PROFILE_NAMES)[number];
 /**
- * The origin-channel message posture (§3.5/§8.4). `standard` resolves
+ * The origin-channel message posture. `standard` resolves
  * `channels: ["origin"]` (own channel only) under an hourly quota; any NEW
  * target is an explicit per-target grant (`autoApprovable:false`).
  */
@@ -61,9 +61,9 @@ export declare const AutonomyMessageConfigSchema: z.ZodObject<{
     maxPerHour: z.ZodDefault<z.ZodNumber>;
 }, z.core.$strict>;
 /**
- * `AutonomyConfigSchema` — the §3.3 knob surface. Every field carries a
- * `.default()` (§6.4); a fully-omitted block parses to the `standard` posture
- * (PROFILE-01 + MIG-01). `strictObject` is the typo guard.
+ * `AutonomyConfigSchema` — the autonomy knob surface. Every field carries a
+ * `.default()`; a fully-omitted block parses to the `standard` posture.
+ * `strictObject` is the typo guard.
  *
  * Most operators set ONLY `profile:` (or nothing → `standard`). The fields
  * below are the full resolved surface a profile expands to; any explicit field
@@ -92,6 +92,7 @@ export declare const AutonomyConfigSchema: z.ZodObject<{
         "orch:analyze": "orch:analyze";
         "orch:write": "orch:write";
         "orch:browse": "orch:browse";
+        "orch:mcp": "orch:mcp";
     }>>>;
     mode: z.ZodOptional<z.ZodEnum<{
         default: "default";
@@ -137,6 +138,17 @@ export declare const AutonomyConfigSchema: z.ZodObject<{
         staleHeartbeatMs: z.ZodDefault<z.ZodNumber>;
         keepAliveMs: z.ZodDefault<z.ZodNumber>;
         recoveryBudgetMs: z.ZodDefault<z.ZodNumber>;
+        orchestrateResume: z.ZodDefault<z.ZodBoolean>;
+    }, z.core.$strict>>;
+    mcp: z.ZodDefault<z.ZodObject<{
+        enabled: z.ZodDefault<z.ZodBoolean>;
+        allow: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodObject<{
+            tools: z.ZodDefault<z.ZodArray<z.ZodString>>;
+            classification: z.ZodOptional<z.ZodEnum<{
+                safe: "safe";
+                "permission-gated": "permission-gated";
+            }>>;
+        }, z.core.$strict>>>;
     }, z.core.$strict>>;
     web: z.ZodOptional<z.ZodBoolean>;
     analyze: z.ZodOptional<z.ZodBoolean>;
@@ -148,15 +160,15 @@ export declare const AutonomyConfigSchema: z.ZodObject<{
 export type AutonomyConfig = z.infer<typeof AutonomyConfigSchema>;
 export type AutonomyMessageConfig = z.infer<typeof AutonomyMessageConfigSchema>;
 /**
- * The resolved cap/guard sets for the four named profiles (v8 §3.8).
+ * The resolved cap/guard sets for the four named profiles.
  *
  * - `assistant`: enabled off, zero orchestration surfaces.
  * - `standard` (default): enabled on, the nine floor-contained caps (incl.
  *   origin-channel `orch:message`), guards ON, origin-only message.
  * - `unattended`: cap set standard-equivalent (no over-grant) + a notice that
  *   the never-hang MODE behaviors (deny+escalate, denial breaker, evict) are
- *   ACTIVE as of Phase 217 (UNATT/BREAK/EVICT). `max`: CLAMPED to `standard`'s
- *   cap set in M1 + a clamp notice (sandbox auto-allow is M3 — no larger cap set).
+ *   ACTIVE. `max`: CLAMPED to `standard`'s cap set + a clamp notice
+ *   (sandbox auto-allow is not implemented — no larger cap set).
  */
 export declare const AUTONOMY_PROFILES: {
     readonly assistant: {
@@ -204,7 +216,7 @@ export declare const AUTONOMY_PROFILES: {
             channels: string[];
             maxPerHour: number;
         };
-        readonly m1Notice: "Unattended mode: never-hang behaviors are active (a would-ask becomes deny+escalate, the denial breaker aborts a retry-loop, and an operator can evict to default). The capability set stays standard-equivalent (the §22.3 floor bounds every cap; outward actions escalate, never auto-send).";
+        readonly m1Notice: "Unattended mode: never-hang behaviors are active (a would-ask becomes deny+escalate, the denial breaker aborts a retry-loop, and an operator can evict to default). The capability set stays standard-equivalent (the structural floor bounds every cap; outward actions escalate, never auto-send).";
         readonly budget: AutonomyBudgetConfig;
         readonly rate: AutonomyRateConfig;
         readonly spawn: AutonomySpawnConfig;
@@ -225,7 +237,7 @@ export declare const AUTONOMY_PROFILES: {
             channels: string[];
             maxPerHour: number;
         };
-        readonly m1Notice: "Resolved to standard-equivalent in M1: the max-mode surface (sandbox auto-allow) is available in M3.";
+        readonly m1Notice: "Resolved to standard-equivalent: the max-mode surface (sandbox auto-allow) is not yet available.";
         readonly budget: AutonomyBudgetConfig;
         readonly rate: AutonomyRateConfig;
         readonly spawn: AutonomySpawnConfig;
@@ -242,52 +254,52 @@ export declare const AUTONOMY_PROFILES: {
         readonly mode: "max";
     };
 };
-/** A resolved capability carrying its §3.7/§22.3 `autoApprovable` bit. */
+/** A resolved capability carrying its `autoApprovable` bit. */
 export interface ResolvedCapability {
     readonly capability: AgentCapability;
     /**
      * Whether the held cap may be auto-decided vs must escalate. `false` for the
-     * §22.3 floor caps (orch:browse, and orch:message to a non-origin channel) in
-     * EVERY profile forever; `true` for the floor-contained caps.
+     * structural-floor caps (orch:browse, and orch:message to a non-origin channel)
+     * in EVERY profile forever; `true` for the floor-contained caps.
      */
     readonly autoApprovable: boolean;
 }
-/** The fully-resolved autonomy posture a consumer (Plan 04/06) reads. */
+/** The fully-resolved autonomy posture daemon-side consumers read. */
 export interface ResolvedAutonomy {
     readonly profile: AutonomyProfileName;
-    /** §23.10 lean-coordinator role (COORD-01) — narrows the tool surface only; caps are role-invariant. */
+    /** Lean-coordinator role — narrows the tool surface only; caps are role-invariant. */
     readonly role: AutonomyRole;
     /** `["coordinator"]` when `role:coordinator` (the allowlist `setup-tools` applies); `undefined` for `worker`. */
     readonly coordinatorToolGroups?: readonly string[];
     readonly enabled: boolean;
     /** The resolved orch:* caps (deduped). */
     readonly capabilities: readonly AgentCapability[];
-    /** The same caps with their `autoApprovable` bits (Plan-04 auto-allow + the PROFILE-02 arch-test read this). */
+    /** The same caps with their `autoApprovable` bits (the daemon auto-allow path + the floor architecture test read this). */
     readonly resolvedCapabilities: readonly ResolvedCapability[];
     readonly mode: AutonomyMode;
     readonly aggregateBudgetUsd: number;
     readonly maxConcurrentSelfAgents: number;
     readonly maxSelfSpawnRatePerMin: number;
     readonly cronSelfMax: number;
-    /** Consecutive floor-blocks → abort+escalate; the denial breaker (BREAK-01) reads this. */
+    /** Consecutive floor-blocks → abort+escalate; the denial breaker reads this. */
     readonly denialBreakerN: number;
-    /** Fail-closed to `default` on an unresolvable mode (EVICT-02); the chokepoint reads this. */
+    /** Fail-closed to `default` on an unresolvable mode; the chokepoint reads this. */
     readonly evictOnPolicyUnreachable: boolean;
-    /** Lease renewal ceiling in minutes (LEASE-02) — the LeaseManager (211-01) clamps renew to it. */
+    /** Lease renewal ceiling in minutes — the LeaseManager clamps renew to it. */
     readonly leaseMaxTtlMin: number;
     readonly message: AutonomyMessageConfig;
     readonly budget: AutonomyBudgetConfig;
     readonly rate: AutonomyRateConfig;
     readonly spawn: AutonomySpawnConfig;
     readonly outward: AutonomyOutwardConfig;
-    /** Present for `unattended` (mode-active notice) + `max` (M3 clamp notice). */
+    /** Present for `unattended` (mode-active notice) + `max` (clamp notice). */
     readonly m1Notice?: string;
 }
 /**
  * Expand a (possibly partial) autonomy config into the full resolved posture.
  *
  * PURE — a function of `cfg` only (no env/clock/fs, AGENTS §2.2). Algorithm:
- *  1. base = the §3.8 profile entry for `cfg.profile ?? "standard"` (the
+ *  1. base = the profile entry for `cfg.profile ?? "standard"` (the
  *     `unattended`/`max` entries are already CLAMPED to `standard`'s caps).
  *  2. start from the profile's base caps; if `cfg.capabilities` is given,
  *     use it as the base instead (explicit override).
@@ -295,7 +307,7 @@ export interface ResolvedAutonomy {
  *     (`web`→`orch:web`, …), deduped.
  *  4. apply explicit scalar overrides (any defined field wins — progressive
  *     disclosure).
- *  5. attach the `autoApprovable` bit per cap (the §22.3 floor caps are
+ *  5. attach the `autoApprovable` bit per cap (the structural-floor caps are
  *     always-escalate, even when opted in).
  *
  * @param cfg the per-agent autonomy block (omitted → `standard`, zero-config).