comisai 1.0.44 → 1.0.46

package/node_modules/@comis/core/dist/domain/rpc-error-classification.js

@@ -0,0 +1,62 @@
+// SPDX-License-Identifier: Apache-2.0
+/**
+ * Single source of truth for classifying a TYPED RPC refusal.
+ *
+ * ## Why this lives in `@comis/core`
+ * An RPC error is classified + logged at **two** layers: the daemon's
+ * `classifyRpcError` (`packages/daemon/src/api/rpc-dispatch.ts`) AND the
+ * `@comis/gateway` method-router trace wrapper (`classifyRpcMethodError`). The
+ * gateway is a lower-level library and **cannot `instanceof`** the daemon
+ * (`PreconditionError`/`ValidationError`/`AuthorizationError`), `@comis/agent`
+ * (`SandboxDowngradeError`), or local (`RequiredToolsUnreachableError`) error classes —
+ * the dependency direction forbids it.
+ *
+ * If each layer hard-coded its own typed→kind mapping they would drift: one
+ * layer logging an intentional policy/security refusal as `internal`/ERROR(50)
+ * while the other logs `precondition`/warn means a `logscan --level 50,60`
+ * operator health sweep flags a fail-closed
+ * refusal as an ERROR. Both layers therefore
+ * delegate here, keyed off the stable {@link Error.name} — the lowest-common-denominator
+ * signal available WITHOUT a cross-package import. **Add a new typed refusal in ONE
+ * place: {@link TYPED_RPC_ERROR_BY_NAME}.**
+ *
+ * ## Scope
+ * This recognizes the TYPED refusals only. Each caller keeps its OWN fallback for an
+ * UNRECOGNIZED error (the daemon defaults to `internal`/`error`; the gateway applies its
+ * message-substring heuristics then `internal`/`error`) — those fallbacks legitimately
+ * differ per layer and are deliberately NOT unified here.
+ *
+ * A typed refusal is an EXPECTED caller-side / policy / security outcome, never an
+ * internal handler fault, so its `level` is always `"warn"` and its `errorKind` is
+ * never `"internal"`.
+ *
+ * @module
+ */
+// Keyed by `Error.name` (a `Map` — not object indexing — to keep the key set closed and
+// avoid the `detect-object-injection` sink on the `.get(name)` lookup). The name strings
+// are the CONTRACT with the error classes (each sets `this.name`); keep this map in sync
+// when a class is renamed or a new typed refusal is introduced. The hints here are the
+// single per-class hint text — the daemon and gateway layers both delegate here, so the
+// same refusal produces byte-identical hints (including the knob-naming hints) at both layers.
+const TYPED_RPC_ERROR_BY_NAME = new Map([
+    // Caller precondition failures (incl. gated-off policy refusals).
+    ["PreconditionError", { errorKind: "precondition", hint: "Caller precondition not met; check resource state before retry", level: "warn" }],
+    // Fail-closed SECURITY refusal (the sub-agent sandbox no-downgrade gate).
+    ["SandboxDowngradeError", { errorKind: "precondition", hint: "Child sandbox posture is less confined than its spawner; align the child's skills sandbox config or set security.agentToAgent.sandboxNoDowngrade:false to allow", level: "warn" }],
+    // Caller-side validation failures.
+    ["ValidationError", { errorKind: "validation", hint: "Check parameter types and values against the schema", level: "warn" }],
+    ["RequiredToolsUnreachableError", { errorKind: "validation", hint: "Adjust required_tools and/or tool_groups per the per-tool hints in the error message", level: "warn" }],
+    // Expected authorization refusal (wrong-trust control-plane call).
+    ["AuthorizationError", { errorKind: "auth", hint: "Caller lacks admin trust for this control-plane method; use an admin-scoped token or the documented operator route (e.g. `comis explain` assembles obs reports offline)", level: "warn" }],
+]);
+/**
+ * Classify a TYPED RPC refusal by its {@link Error.name}, or return `null` when the
+ * error is NOT a recognized typed refusal (the caller then applies its own fallback).
+ *
+ * Pure + dependency-free: no I/O, no error-class imports (keyed off the `.name` string),
+ * deterministic for a given input.
+ */
+export function classifyTypedRpcError(err) {
+    const name = err instanceof Error ? err.name : "";
+    return TYPED_RPC_ERROR_BY_NAME.get(name) ?? null;
+}

package/node_modules/@comis/core/dist/domain/session-key.js

@@ -74,7 +74,7 @@ export function parseFormattedSessionKey(formatted) {
     // any peer/guild/thread markers, so we greedily join consecutive parts into
     // channelId until we hit a known marker or run out. This makes the format
     // round-trip-safe when channelId has colons; for simple channelIds (no
-    // colons) the behaviour is identical to the old one-index-takes-all path.
+    // colons) the greedy join consumes exactly one part.
     let idx = 2;
     const channelIdParts = [];
     while (idx < parts.length &&

package/node_modules/@comis/core/dist/domain/sub-agent-tool-denylist.js

@@ -30,6 +30,7 @@ export const SUB_AGENT_TOOL_DENYLIST = new Set([
     "memory_manage", // memory purge is destructive
     "heartbeat_manage", // heartbeat config -> config persistence -> potential SIGUSR2
     "mcp_manage", // mcp connect/disconnect/reconnect -> MCP server config persistence (persistToConfig)
+    "mcp_login", // mcp.oauth_login -> control-plane credential flow; never delegatable / never on the cap surface
 ]);
 /**
  * Minimal copy of TOOL_PROFILES from @comis/skills/tool-policy.ts.

package/node_modules/@comis/core/dist/domain/subagent-context-config.js

@@ -40,7 +40,7 @@ export const SubagentContextConfigSchema = z.strictObject({
     resultTagPrefix: z.string().min(1).max(100).default("Subagent Result"),
     /** Maximum tokens for parent context summary (when includeParentHistory = "summary") */
     parentSummaryMaxTokens: z.number().int().min(100).max(10_000).default(1_000),
-    /** Maximum queued spawns per caller before true backpressure rejection. 0 disables queuing (preserves old throw behavior). */
+    /** Maximum queued spawns per caller before true backpressure rejection. 0 disables queuing (an over-cap spawn throws immediately instead of waiting). */
     maxQueuedPerAgent: z.number().int().min(0).max(50).default(10),
     /** How long a queued spawn waits before failing with timeout (ms). */
     queueTimeoutMs: z.number().int().min(1000).max(600_000).default(120_000),

package/node_modules/@comis/core/dist/domain/subagent-context-types.d.ts

@@ -72,7 +72,7 @@ export interface SpawnPacket {
      *  Child agents restore these into their DiscoveryTracker so previously-discovered
      *  tools are immediately available without re-discovery. */
     discoveredDeferredTools?: string[];
-    /** Inherited conversation language (DET-02 tag); auto-populated from parent. */
+    /** Inherited conversation language tag; auto-populated from parent. */
     language?: string;
     /** Cached prompt state from parent for prefix sharing.
      *  When present and model/provider match, sub-agent reuses parent's frozen
@@ -89,7 +89,7 @@ export interface SpawnPacket {
         model: string;
         provider: string;
         cacheRetention: string | undefined;
-        /** 2.1: Timestamp (ms since epoch) when the parent last confirmed a cache write.
+        /** Timestamp (ms since epoch) when the parent last confirmed a cache write.
          *  Used by the TTL expiry guard in sub-agents to disable skipCacheWrite when
          *  the shared prefix cache has likely expired. */
         cacheWriteTimestamp?: number;
@@ -132,8 +132,8 @@ export interface SubAgentSpawnPreparedEvent {
 }
 /**
  * Emitted when a spawn request is denied. The per-caller gates emit
- * `depth_exceeded`/`children_exceeded`/`queue_full`/`queue_timeout`; the Phase-213
- * tree-wide spawn ceiling (CEIL-01, `boundedAutonomy.tryAcquireSpawn`) emits the
+ * `depth_exceeded`/`children_exceeded`/`queue_full`/`queue_timeout`; the
+ * tree-wide spawn ceiling (`boundedAutonomy.tryAcquireSpawn`) emits the
  * `ceiling_*` reasons so an observer can distinguish a tree-wide bound (the whole
  * spawn tree, keyed on `rootRunId`) from a single caller's depth/fan-out gate.
  */

package/node_modules/@comis/core/dist/event-bus/events-agent.d.ts

@@ -12,7 +12,7 @@ import type { ScriptClass } from "../text/script-classes.js";
 import type { GenerationPass } from "../text/generation-quality.js";
 import type { AuditKind } from "../security/audit.js";
 /**
- * SPEND-05 (Phase 177-01): the closed scope enum that rides the
+ * The closed scope enum that rides the
  * `observability:spend_*` wire (mirrors how {@link AuditKind} rides
  * `audit:event`). The daemon-wide spend accumulator (`@comis/agent`
  * `budget/spend-accumulator.ts`) and the abort wiring import it so the scope of a
@@ -80,10 +80,10 @@ export interface AgentEvents {
         /** Human-readable activity label for exec commands. */
         description?: string;
         /** Action-discriminator for action-keyed tools (e.g. mcp_manage action="set").
-         *  Drives typed activity labels. Sanitised/derived at the emit site (§16.1). */
+         *  Drives typed activity labels. Sanitised/derived at the emit site. */
         action?: string;
         /** Sanitised tool params for activity rendering. MUST be redacted via
-         *  redactValue() at the emit site before emit (§10.1) — the type carries
+         *  redactValue() at the emit site before emit — the type carries
          *  no redaction guarantee; the emit-site redaction + CI grep gate enforce it. */
         params?: Record<string, unknown>;
     };
@@ -93,15 +93,22 @@ export interface AgentEvents {
         durationMs: number;
         success: boolean;
         timestamp: number;
-        /** Correlates start↔end for a stable activityId (§16.11). */
+        /** Correlates start↔end for a stable activityId. */
         toolCallId: string;
         userId?: string;
         traceId?: string;
         agentId?: string;
         sessionKey?: string;
         /** Sanitised tool params for activity rendering. MUST be redacted via
-         *  redactValue() at the emit site before emit (§10.1). */
+         *  redactValue() at the emit site before emit. */
         params?: Record<string, unknown>;
+        /** On FAILURE only: the bounded+redacted argument shape (redactValue then
+         *  sanitizeToolArgs — secrets/PII/paths masked, each value capped, large
+         *  values → "[N chars]"). Forwarded to the tool.result trajectory record
+         *  and explain's failures[] so "what did the failed call attempt?" is
+         *  answerable in one `comis explain` — no raw conversation-store dive.
+         *  Omitted on success (the input is only load-bearing on a failure). */
+        argsPreview?: Record<string, unknown>;
         /** Truncated error message when success=false (max 1500 chars). */
         errorMessage?: string;
         /** Error classification (closed ErrorKind union). "timeout" for
@@ -115,26 +122,26 @@ export interface AgentEvents {
         fullChars?: number;
         /** Character count after truncation. Only present when truncated=true. */
         returnedChars?: number;
-        /** Which of the 4 sources classified this failure (P1/D1). */
+        /** Which of the 4 sources classified this failure. */
         classifiedFailureBy?: "sdk_iserror" | "exit_code" | "failure_detector" | "mcp_classifier";
         /** False ONLY when the SDK/transport itself errored; true for content/exit/detector failures. */
         transportOk?: boolean;
         /** HTTP status for web tools (result.status). */
         httpStatus?: number;
-        /** The detector rule that matched (P2/D2). */
+        /** The detector rule that matched. */
         matchedRule?: string;
-        /** The token that matched, e.g. a status code (P2/D2). */
+        /** The token that matched, e.g. a status code. */
         matchedToken?: string;
-        /** Size in bytes of the full serialized result (D4) — never the body. */
+        /** Size in bytes of the full serialized result — never the body. */
         resultBytes?: number;
-        /** 12-hex digest of the full result payload (D4) — never the body. */
+        /** 12-hex digest of the full result payload — never the body. */
         resultDigest?: string;
-        /** F-OBS-2 (30uc-20260624): CONTENT-FREE grounding summary for web_search /
+        /** CONTENT-FREE grounding summary for web_search /
          *  web_fetch — the number of results returned (1 for a single fetch). Lets a
          *  "grounded in fetched results" predicate be verified from the trajectory
          *  without a DEBUG daemon-log grep. Never titles/snippets/bodies. */
         resultCount?: number;
-        /** F-OBS-2: the source HOSTS the web result came from (e.g. ["example.com"]) —
+        /** The source HOSTS the web result came from (e.g. ["example.com"]) —
          *  hosts ONLY, never full URLs with paths/queries, never bodies. */
         domains?: string[];
     };
@@ -153,9 +160,9 @@ export interface AgentEvents {
     };
     /**
      * Circuit breaker opened for a tool (tool-level total OR error-pattern
-     * threshold crossed). D3 — fired by the bridge exactly at the counter
+     * threshold crossed). Fired by the bridge exactly at the counter
      * crossing (`recordResult` returns the verdict; the breaker stays
-     * emitter-free). Phase 153's `obs.explain` renders a breakerTimeline from
+     * emitter-free). `obs.explain` renders a breakerTimeline from
      * these; the payload carries the breaker's already-normalized `errorTag`
      * (extractErrorTag — first-80-char normalized), NEVER raw error text (§2.7).
      */
@@ -172,7 +179,7 @@ export interface AgentEvents {
     };
     /**
      * Circuit breaker reset for a tool (a success that recovered a non-zero
-     * failure counter). D3. Lifecycle `reset()` does NOT emit this (A2).
+     * failure counter). Lifecycle `reset()` does NOT emit this.
      */
     "tool:breaker_reset": {
         toolName: string;
@@ -183,18 +190,18 @@ export interface AgentEvents {
     };
     /**
      * Tool result offloaded to disk (exceeded the inline threshold or the hard
-     * cap). D7 — emitted by the executor's microcompaction offload callback
-     * (the guard stays emitter-free, T-151-07). Phase 153's `obs.explain`
+     * cap). Emitted by the executor's microcompaction offload callback
+     * (the guard stays emitter-free). `obs.explain`
      * renders `IncidentReport.offloads[]` from these. The payload carries a
      * count (`originalChars`) and a WORKSPACE-RELATIVE pointer — never the
-     * offloaded result body and never the absolute host path (§2.7 / T-151-05/06).
+     * offloaded result body and never the absolute host path (§2.7).
      */
     "tool:result_offloaded": {
         toolName: string;
         toolCallId: string;
         /** Character count of the original (pre-offload) result. */
         originalChars: number;
-        /** Workspace-relative path (sessionDir-relative): `tool-results/<toolCallId>.json`. Phase 153 drill-down target. */
+        /** Workspace-relative path (sessionDir-relative): `tool-results/<toolCallId>.json`. `obs.explain` drill-down target. */
         diskPathRel: string;
         timestamp: number;
     };
@@ -235,9 +242,9 @@ export interface AgentEvents {
         agentId: string;
         tenantId: string;
         actionType: string;
-        /** Event family (AUDIT-03 / E4) — the closed {@link AuditKind} union rides the wire to Plan 03's sink (which derives kind from actionType only as a fallback). Optional for un-migrated emits; all 6 in-repo sites set it. */
+        /** Event family — the closed {@link AuditKind} union rides the wire to the audit sink (which derives kind from actionType only as a fallback). Optional on the wire; all 6 in-repo emit sites set it. */
         kind?: AuditKind;
-        /** Risk class — loosely typed here; AuditEventSchema's closed read|mutate|destructive is the source of truth. The bogus "security"/"write"/"neutral" strings moved to `kind` and are no longer sent. */
+        /** Risk class — loosely typed here; AuditEventSchema's closed read|mutate|destructive is the source of truth. Event-family strings ("security"/"write"/"neutral") belong on `kind`, never here. */
         classification?: string;
         outcome: "success" | "failure" | "denied";
         metadata?: Record<string, unknown>;
@@ -308,19 +315,19 @@ export interface AgentEvents {
          */
         pendingCacheInvestmentUsd: number;
         /** SDK per-turn stop signal (e.g. "stop"|"length"|"tool_use"|"refusal").
-         *  Current at the per-turn emit (m.lastStopReason captured at :1231 same case). D8. */
+         *  Current at the per-turn emit (m.lastStopReason is captured in the same executor case). */
         stopReason?: string;
         /** Execution-level finish disposition (e.g. "stop"|"loop_detected"|"budget_exceeded").
-         *  Best-effort at the per-turn emit — m.finishReason settles LATER than turn_end
-         *  (set at :1005/:1018/:1625/:1672/:2113); treat as init-default "stop" until Phase 152
-         *  flight-recorder surfaces effectiveFinishReason. D8. */
+         *  Best-effort at the per-turn emit — m.finishReason settles LATER than turn_end,
+         *  so treat this as the init-default "stop"; the flight-recorder's
+         *  effectiveFinishReason is the settled value. */
         finishReason?: string;
         /**
-         * COST-01: the DISTINCT tool names that fired during this turn (content-free
+         * The DISTINCT tool names that fired during this turn (content-free
          * ids only — never args/output). OMITTED when no tool fired (absence = the
          * byte-identical no-tool payload, not an empty array). Persisted on the
          * `tool_tag` column. The per-tool token/$ attribution a consumer derives from
-         * this is best-effort/labeled (N3): an even split across these tools that
+         * this is best-effort/labeled: an even split across these tools that
          * conserves the turn total — exact per-tool accounting is out of scope.
          */
         toolTag?: string[];
@@ -365,7 +372,7 @@ export interface AgentEvents {
         /** Effort/thinking value at time of break. */
         effortValue?: string;
     };
-    /** SPEND-05 (Phase 177-01): spend approaching a ceiling (fired at
+    /** Spend approaching a ceiling (fired at
      *  `warnAtFraction`, default 0.8, BEFORE the kill-switch trips). Content-free
      *  (§2.7): dollar amounts as NUMBERS, scope as the closed {@link SpendScopeKind}
      *  enum, ids only — NEVER a message/prompt/query body. */
@@ -378,7 +385,7 @@ export interface AgentEvents {
         capUsd: number;
         fraction: number;
     };
-    /** SPEND-05 (Phase 177-01): a spend ceiling was exceeded — the dollars
+    /** A spend ceiling was exceeded — the dollars
      *  kill-switch tripped for this scope. Content-free (§2.7): `estUsd` is the
      *  reservation that breached; amounts are NUMBERS, scope is a closed enum, ids
      *  only — NEVER a message/prompt/query body. */
@@ -391,8 +398,8 @@ export interface AgentEvents {
         capUsd: number;
         estUsd: number;
     };
-    /** SPEND-05 (Phase 177-01): a remote model burned tokens with UNKNOWN pricing
-     *  (fail-loud, not fail-open — the ffe11736 danger). Content-free (§2.7):
+    /** A remote model burned tokens with UNKNOWN pricing
+     *  (fail-loud, not fail-open — unpriced spend must surface, never silently read as $0). Content-free (§2.7):
      *  provider/model are config ids/enums (a model id is a config value, NOT user
      *  content) + turn ids — NEVER a message/prompt/query body. */
     "observability:spend_unpriceable": {
@@ -421,11 +428,11 @@ export interface AgentEvents {
         action: "warn" | "reinforce" | "terminate";
     };
     /**
-     * SSRF-AUDIT (hermes-usecases obs-loop 2026-06-25): an outbound URL was BLOCKED by
+     * An outbound URL was BLOCKED by
      * the SSRF guard (`validateUrl`). A forensics signal so `comis security audit-log`
      * records an agent/injected-instruction attempt to reach a cloud-metadata IP /
-     * RFC1918 / loopback / non-http target — previously such blocks were SILENT (no
-     * audit row), unlike the destructive-command floor (`command:blocked`).
+     * RFC1918 / loopback / non-http target — without this event such blocks would be
+     * SILENT (no audit row), unlike the destructive-command floor (`command:blocked`).
      * CONTENT-FREE BY CONSTRUCTION: `origin` is the URL's `origin` (scheme+host+port)
      * ONLY — `new URL().origin` strips the path, query, fragment AND userinfo, so no
      * secret-bearing query string or embedded `user:pass@` credential can ride it.
@@ -443,7 +450,7 @@ export interface AgentEvents {
     };
     /**
      * Critic isolation: canary token detected in the critic's verdict output
-     * (prompt-extraction attempt). 100% capture per AI-SPEC §7 (S2, Phase 154).
+     * (prompt-extraction attempt). Every detection emits — 100% capture.
      */
     "critic.isolation.canary_leak": {
         timestamp: number;
@@ -455,7 +462,7 @@ export interface AgentEvents {
     };
     /**
      * Critic isolation: implied tool call detected in the critic's verdict
-     * (scope-widening attempt). 100% capture per AI-SPEC §7 (S2, Phase 154).
+     * (scope-widening attempt). Every detection emits — 100% capture.
      */
     "critic.isolation.implied_tool_call": {
         timestamp: number;
@@ -485,14 +492,14 @@ export interface AgentEvents {
     };
     /**
      * Fail-closed sub-agent spawn refusal: the child's resolved sandbox posture
-     * was LESS confined than its spawner's on ≥1 dimension (SANDBOX-02/03). Fires
+     * was LESS confined than its spawner's on ≥1 dimension. Fires
      * at the spawn chokepoint BEFORE any run/session is created.
      *
-     * §2.7 / D-EVENT: enum-tuple payload ONLY — both postures as closed-union
+     * §2.7: enum-tuple payload ONLY — both postures as closed-union
      * LABELS + the violated dimension labels + the two agent ids + a timestamp.
      * NEVER the underlying paths/hosts/uid-numbers/credential values that would
      * leak the operator's sandbox topology. Pino auto-redaction is a net, not a
-     * license (T-172-01f).
+     * license.
      */
     "security:sandbox_downgrade_refused": {
         timestamp: number;
@@ -660,8 +667,8 @@ export interface AgentEvents {
         timestamp: number;
     };
     /**
-     * OUTCOME-08: a finished trajectory's resolved net task-outcome (WS1). Emitted daemon-side after
-     * `OutcomeSignalPort.resolve`, `learningOutcome.enabled`-gated (default OFF), bridged for `comis explain` (OBS-02). Counts/ids/closed-enums ONLY — no bodies/alpha (SEC-01 §7); adding one is a compile error.
+     * A finished trajectory's resolved net task-outcome. Emitted daemon-side after
+     * `OutcomeSignalPort.resolve`, `learningOutcome.enabled`-gated (default OFF), bridged for `comis explain`. Counts/ids/closed-enums ONLY — no bodies/free text (§2.7); adding one is a compile error.
      */
     "learning:outcome_observed": {
         agentId: string;
@@ -674,11 +681,11 @@ export interface AgentEvents {
         timestamp: number;
     };
     /**
-     * FORGET-06 (v2.26 WS4): the lifecycle sweep demoted (`learning:memory_demoted`) /
+     * The lifecycle sweep demoted (`learning:memory_demoted`) /
      * SOFT-evicted (`learning:memory_evicted`, set `evicted_at`, never DELETE) N memories
      * this run. Emitted DAEMON-SIDE (the lifecycle store has no bus) from the real sweep
-     * report `demoted`/`evicted` counts. Counts ONLY — never an id-list or body (§2.7 /
-     * SEC-01). Bridged for `comis explain` (OBS-02).
+     * report `demoted`/`evicted` counts. Counts ONLY — never an id-list or body (§2.7).
+     * Bridged for `comis explain`.
      */
     "learning:memory_demoted": {
         agentId: string;
@@ -691,12 +698,12 @@ export interface AgentEvents {
         timestamp: number;
     };
     /**
-     * OBS-2b (reflect-obs-20260627): the once-per-run lifecycle/forget sweep SUMMARY — the parity
+     * The once-per-run lifecycle/forget sweep SUMMARY — the parity
      * event for the forget half of learning (reflection has `reflect:funnel`; the forget sweep had
      * only the per-category demoted/evicted counts above, invisible to `cron.runs`/fleet/`explain`).
      * Carries the run breakdown so `cron.runs jobName "Memory lifecycle"` answers "what did the sweep
      * do" (scanned/evicted/demoted) in one call instead of a `db.mjs` `evicted_at` poll, and the fleet
-     * lens rolls a `memory_lifecycle` finding. Counts ONLY — never an id-list/body (§2.7 / SEC-01).
+     * lens rolls a `memory_lifecycle` finding. Counts ONLY — never an id-list/body (§2.7).
      */
     "learning:lifecycle_swept": {
         agentId: string;
@@ -707,13 +714,13 @@ export interface AgentEvents {
         timestamp: number;
     };
     /**
-     * OBS-4b (reflect-obs-20260627): N memories accrued a CORROBORATED failure (failure_count++) this
+     * N memories accrued a CORROBORATED failure (failure_count++) this
      * resolve — the eviction-causation PRECURSOR. Eviction needs `failure_count >= failureEvictionFloor`,
-     * but the accrual itself was previously invisible (only the DB column changed over time + a DEBUG
-     * line), so "why did/didn't this memory evict" had no event trail (you had to SEED failure_count to
-     * test eviction). This event makes the corroborated-failure accrual diagnosable from `comis explain`
+     * and without this event the accrual would be invisible (only the DB column changing over time + a
+     * DEBUG line), leaving "why did/didn't this memory evict" with no event trail. This event makes the
+     * corroborated-failure accrual diagnosable from `comis explain`
      * (bridged) so the path toward eviction is reconstructable. Count ONLY — never a memory id-list/body
-     * (§2.7 / SEC-01); the accrual is already FORGET-03 corroboration-gated (≥2 independent sessions).
+     * (§2.7); the accrual is already corroboration-gated (≥2 independent sessions).
      */
     "learning:memory_failure_attributed": {
         agentId: string;
@@ -721,11 +728,11 @@ export interface AgentEvents {
         timestamp: number;
     };
     /**
-     * GENQ-01: a memory-generation pass produced output whose quality diverged from its
-     * source (the F-ML1 class — a weak local model silently translating non-Latin source
+     * A memory-generation pass produced output whose quality diverged from its
+     * source (the failure class where a weak local model silently translates non-Latin source
      * memories into Latin output; the generalization of `context:summary_language_mismatch`
      * to the consolidation/reasoning/user-representation passes). VISIBILITY ONLY, never
-     * gated (I8). Emitted only on an issue (`languageMismatch || emptyOutput ||
+     * gated. Emitted only on an issue (`languageMismatch || emptyOutput ||
      * formatViolation`). Bridged to `memory.generation_quality` + persisted as a
      * `health_signal`. Closed `GenerationPass` + `ScriptClass` enums + booleans + ids ONLY
      * — NEVER the source or generated body (§2.7); the classifier reads text locally.

package/node_modules/@comis/core/dist/event-bus/events-channel.d.ts

@@ -22,15 +22,15 @@ export interface ChannelEvents {
         timestamp: number;
     };
     /**
-     * REACT-01 (Verified Learning WS1): an inbound reaction-add captured on a
+     * An inbound reaction-add captured on a
      * Discord/Slack/Telegram message. Emitted by the orchestrator channel-manager
-     * via the optional adapter.onReaction fanout; the daemon (Plan 04, setup-
+     * via the optional adapter.onReaction fanout; the daemon (setup-
      * learning) subscribes and observes a `reaction`-source outcome IFF the
-     * messageId maps to an agent-authored outbound trajectory (REACT-02 fail-
+     * messageId maps to an agent-authored outbound trajectory (fail-
      * closed). The reactorId/emoji are UNTRUSTED inbound — no trust is asserted
      * here. Counts/ids/emoji ONLY — never message bodies or sender display names
-     * (SEC-01 §7); the emoji is matched against a CLOSED reactionMap downstream
-     * (Plan 04) and never flows into a prompt.
+     * (§2.7); the emoji is matched against a CLOSED reactionMap downstream
+     * and never flows into a prompt.
      */
     "channel:reaction_received": {
         messageId: string;
@@ -276,7 +276,11 @@ export interface ChannelEvents {
         strategy?: "all-or-abort" | "best-effort";
         timestamp: number;
     };
-    /** Emitted when delivery is aborted (e.g., via AbortSignal). */
+    /** Emitted when delivery is aborted (e.g., via AbortSignal). Also emitted by
+     *  the orchestrator delivery stage when an already-aborted execution signal
+     *  made the block pacer skip EVERY block without reaching deliverToChannel —
+     *  the trajectory otherwise records nothing for a turn whose reply was never
+     *  sent (`chunksDelivered: 0`, `reason` = the abort reason). */
     "delivery:aborted": {
         channelId: string;
         channelType: string;
@@ -287,6 +291,33 @@ export interface ChannelEvents {
         origin: string;
         timestamp: number;
     };
+    /**
+     * The per-turn activity coordinator dispatched `renderer.finalize` — the
+     * decision that paints the activity surface's TERMINAL state (the kept
+     * "❌ {errorKind}" pill, the deleted scaffold, the silent no-op). Content-free:
+     * a closed outcome kind + the closed ErrorKind + a fixed named-constant
+     * `reason` + the strategy name. `reclassified` marks the failed-event
+     * reclassify (a success outcome flipped to failure because a tool step
+     * failed mid-turn) so a stale-looking pill label is explainable from the
+     * trajectory alone instead of coordinator source-reading.
+     */
+    "activity:turn_finalized": {
+        sessionKey: string;
+        agentId: string;
+        channelType: string;
+        /** The renderer strategy that painted the surface (EditPlace / AppendOnly / …). */
+        strategy: string;
+        /** The EFFECTIVE outcome kind dispatched to the renderer. */
+        outcome: "success" | "success_with_recovered_failures" | "failure" | "silent" | "aborted";
+        errorKind?: string;
+        /** The fixed one-line human reason for a resource abort, when present. */
+        reason?: string;
+        /** True when a non-failure outcome was flipped to failure by an observed failed event. */
+        reclassified: boolean;
+        /** How many observed events had status "failed" during the turn. */
+        failedEventCount: number;
+        timestamp: number;
+    };
     /** Outbound chunk persisted in delivery queue before send attempt. */
     "delivery:enqueued": {
         entryId: string;
@@ -305,7 +336,7 @@ export interface ChannelEvents {
         timestamp: number;
     };
     /**
-     * REACT-04 / WR-01 (Verified Learning, Phase 206-05): a minted agent-reply
+     * A minted agent-reply
      * messageId was bound to its trajectory scope on the PRIMARY inbound-reply
      * (direct-ack) path — the positive proof that the reaction->trajectory
      * binding fired. Emitted right after `recordOutboundMessage` in the
@@ -315,7 +346,7 @@ export interface ChannelEvents {
      * not a never-bound), and its absence means the bind never fired. Shares the
      * `messageId` with the `delivery:acked` event emitted on the same chunk, so
      * the attribution is reconstructable from the event trail. COUNTS/IDS/closed-
-     * scalars ONLY — never a message body or a secret (§2.7 / SEC-01); the
+     * scalars ONLY — never a message body or a secret (§2.7); the
      * `agentId` is the REAL agent partition (never the tenantId).
      */
     "delivery:reply_bound": {
@@ -370,6 +401,36 @@ export interface ChannelEvents {
         responseTimeMs: number;
         timestamp: number;
     };
+    /**
+     * A webhook channel has received no inbound activity for longer than its
+     * configured missed-inbound threshold. Raised by the daemon liveness timer
+     * (independent of the stale-reap-exempt health monitor). Content-free —
+     * labels, counts, and timestamps only, never message bodies.
+     */
+    "channel:inbound_silent": {
+        channelType: string;
+        lastInboundAt: number | null;
+        silentForMs: number;
+        thresholdMs: number;
+        timestamp: number;
+    };
+    /**
+     * An inbound activity was REJECTED at a channel gateway ingress auth gate
+     * (a missing bearer pre-gate, or a signed-token validation failure) before
+     * any body parse or adapter dispatch. Raised by the ingress through an
+     * injected content-free hook so a forged / expired / wrong-audience /
+     * missing-token FLOOD against the public messaging endpoint is COUNTABLE by
+     * the fleet lens instead of living only in a raw WARN. Content-free by
+     * construction: the closed `reason` class + the channel label ONLY — never
+     * the bearer token, the Authorization header, or the request body (§2.7 and
+     * the opaque-401 contract: the forged material is counted without being
+     * echoed). Daemon-global — no agentId/sessionKey.
+     */
+    "channel:ingress_auth_rejected": {
+        channelType: string;
+        reason: "missing_bearer" | "invalid_token";
+        timestamp: number;
+    };
     /** Delivery cancelled by a before_delivery hook. */
     "delivery:hook_cancelled": {
         channelId: string;

package/node_modules/@comis/core/dist/event-bus/events-infra.d.ts

@@ -16,7 +16,7 @@ export interface InfraEvents {
          * Short, renderer-safe approval id (12-char base62) minted by the
          * approval gate. REQUIRED on the event so renderer prompts and the
          * `/approve <id>` / `/deny <id>` slash commands share the same id, and
-         * the full `requestId` never reaches renderers (§4.2, §6.4.1).
+         * the full `requestId` never reaches renderers.
          *
          * Build coupling: the SOLE emit site that mints + supplies `shortId`
          * lives in `approval/approval-gate.ts` — this schema only declares the
@@ -33,7 +33,7 @@ export interface InfraEvents {
         timeoutMs: number;
         /** Distributed trace id when the request is created inside a request
          *  context. Optional — `restorePending()` preserves `shortId` but may
-         *  omit `traceId` after a graceful restart (§4.2). */
+         *  omit `traceId` after a graceful restart. */
         traceId?: string;
         /** Channel type of the originating request (e.g., "telegram", "discord"). Used by the activity-renderer approval path. */
         channelType?: string;
@@ -137,7 +137,7 @@ export interface InfraEvents {
          * Carried on the payload so the Verified Learning correction writer
          * (setup-learning-reactions.ts) can record the prior completed trajectory for
          * a single-agent turn WITHOUT reading ALS (the emit runs outside the
-         * executor's runWithContext scope — CR-02).
+         * executor's runWithContext scope).
          */
         traceId?: string;
         receivedAt: number;
@@ -242,9 +242,9 @@ export interface InfraEvents {
         result: string;
         success: boolean;
         /** Absent for deliveryTarget-less system_event jobs (the memory-cron
-         *  __SENTINEL__ class — live finding 2026-06-11: their WORK rides this
-         *  event and must fire even with nothing to deliver). The delivery
-         *  listener already guards via `deliveryTarget?.channelType`. */
+         *  __SENTINEL__ class): their WORK rides this event, so it must fire
+         *  even with nothing to deliver. The delivery listener already guards
+         *  via `deliveryTarget?.channelType`. */
         deliveryTarget?: {
             channelId: string;
             userId: string;
@@ -283,6 +283,29 @@ export interface InfraEvents {
             error?: string;
         }) => void;
     };
+    /** Scheduler: pre-run wake-gate fired — content-free savings/health signal.
+     *  Counts/enums/ids ONLY (jobId, agentId, wake, durationMs, toolCalls,
+     *  estTurnsSaved) — NEVER the gathered payload, the script source, a prompt,
+     *  or a secret. Emitted per gated fire (skip AND wake). */
+    "scheduler:wake_gate": {
+        jobId: string;
+        agentId: string;
+        /** false = the model turn was skipped; true = the gate woke the model. */
+        wake: boolean;
+        /** Gate run wall-clock (the runner's now()-delta span, fail-open included). */
+        durationMs: number;
+        /** Count of allow-decision cap-calls the gate made this fire (0 if none/unknown). */
+        toolCalls: number;
+        /** Derived heuristic: model turns avoided (1 on skip, 0 on wake). */
+        estTurnsSaved: number;
+        /** true = a FAIL-OPEN wake the runner caught (jailed run rejected —
+         *  timeout/overflow/non-zero-exit/spawn-error/unavailable-jail — or the lease
+         *  mint threw), not a clean decision. Distinguishes a broken gate (fails open
+         *  every fire — saves nothing, costs its cap-calls) from a healthy monitor that
+         *  legitimately always wakes; both otherwise read `wake:true, skipRate 0`. */
+        failedOpen: boolean;
+        timestamp: number;
+    };
     /** Scheduler: heartbeat check performed */
     "scheduler:heartbeat_check": {
         checksRun: number;