comisai 1.0.45 → 1.0.46

package/node_modules/@comis/daemon/dist/api/session-handlers/session-helpers.d.ts

@@ -55,7 +55,7 @@ export declare function loadJsonlSession(filePath: string): {
     updatedAt: number;
 } | undefined;
 /**
- * COMPACT-STORE-MISS (30uc-20260624): load a session's transcript from EITHER
+ * Load a session's transcript from EITHER
  * store, keyed by the canonical formatted key. Live channel conversations are
  * persisted ONLY as file JSONL by the pi session manager
  * (`workspace/sessions/<tenant>/<channel>/<userId>~peer~<peerId>.jsonl`), never

package/node_modules/@comis/daemon/dist/api/session-handlers/session-helpers.js

@@ -36,7 +36,7 @@ export const IS_DEV = systemGetEnv("NODE_ENV") !== "production";
  * observability artifacts (`<file>.jsonl.trajectory.jsonl`). Both scanners
  * must share this predicate: counting trajectory EVENTS as session messages
  * re-surfaced a deleted session in session.list as
- * `default:<name>.jsonl.trajectory` (live C7 finding, 2026-06-12).
+ * `default:<name>.jsonl.trajectory` (observed live).
  */
 function isLiveTranscriptFile(file) {
     return file.endsWith(".jsonl") && !file.endsWith(".trajectory.jsonl");
@@ -151,8 +151,8 @@ export function scanWorkspaceSessions(workspaceDir) {
                     // file `111~peer~111.jsonl` produced the hybrid `tenant:111~peer~111:channel`
                     // that parseFormattedSessionKey + `explain`/`mirror` reject — "no trajectory
                     // found" on a session whose stored key is `tenant:111:channel:peer:111`
-                    // (UX-1 added channelDir but missed the peer encoding; live 2026-06-21 rig
-                    // Phase-0). Fall back to the legacy splice only when the path is unparseable.
+                    // (an earlier fix added channelDir but missed the peer encoding).
+                    // Fall back to the legacy splice only when the path is unparseable.
                     const parsedKey = pathToSessionKey(filePath, sessionsRoot);
                     const sessionKey = parsedKey
                         ? formatSessionKey(parsedKey)
@@ -220,7 +220,7 @@ export function loadJsonlSession(filePath) {
     }
 }
 /**
- * COMPACT-STORE-MISS (30uc-20260624): load a session's transcript from EITHER
+ * Load a session's transcript from EITHER
  * store, keyed by the canonical formatted key. Live channel conversations are
  * persisted ONLY as file JSONL by the pi session manager
  * (`workspace/sessions/<tenant>/<channel>/<userId>~peer~<peerId>.jsonl`), never

package/node_modules/@comis/daemon/dist/api/session-handlers/session-list.d.ts

@@ -17,8 +17,8 @@ import { type SessionHandlerDeps } from "./session-helpers.js";
  *
  * Shared so search mode can NEVER again drift from list mode: search previously did
  * `listDetailed()` ALONE and was blind to JSONL-only sessions, so `session.search`
- * returned 0 hits for content `session.history`/`session.list` could see (live
- * 2026-06-20: the chat-API session is JSONL-only — the SQLite `sessions` table was
+ * returned 0 hits for content `session.history`/`session.list` could see (observed
+ * live: the chat-API session is JSONL-only — the SQLite `sessions` table was
  * empty — so every search returned empty).
  */
 export declare function enumerateListableSessions(deps: SessionHandlerDeps, tenantId: string | undefined): ReturnType<SessionHandlerDeps["sessionStore"]["listDetailed"]>;

package/node_modules/@comis/daemon/dist/api/session-handlers/session-list.js

@@ -19,8 +19,8 @@ import { IS_DEV, scanJsonlSessions, scanWorkspaceSessions, loadJsonlSession, } f
  *
  * Shared so search mode can NEVER again drift from list mode: search previously did
  * `listDetailed()` ALONE and was blind to JSONL-only sessions, so `session.search`
- * returned 0 hits for content `session.history`/`session.list` could see (live
- * 2026-06-20: the chat-API session is JSONL-only — the SQLite `sessions` table was
+ * returned 0 hits for content `session.history`/`session.list` could see (observed
+ * live: the chat-API session is JSONL-only — the SQLite `sessions` table was
  * empty — so every search returned empty).
  */
 export function enumerateListableSessions(deps, tenantId) {
@@ -54,7 +54,7 @@ export function bindSessionListHandlers(deps) {
             // kind="all" + sinceMinutes=undefined). Internal-field reads BEFORE strip.
             const callerMetadata = rawParams._callerMetadata;
             const callerSessionKey = rawParams._callerSessionKey;
-            // CR-03: the tool.invoke rpc route injects `_agentId = lease.agentId`; its
+            // The tool.invoke rpc route injects `_agentId = lease.agentId`; its
             // PRESENCE is the unforgeable agent-origin signal (inbound _agentId is
             // stripped from external callers at the gateway). Admin/operator/CLI calls
             // arrive with NO _agentId and keep full enumeration.
@@ -88,12 +88,12 @@ export function bindSessionListHandlers(deps) {
                     }
                 });
             }
-            // AgentId self-scope (CR-03): an agent-origin caller may enumerate ONLY
+            // AgentId self-scope: an agent-origin caller may enumerate ONLY
             // its own sessions. Mirror session.search's `_agentId` filter exactly
             // (the predicate `parseFormattedSessionKey(s.sessionKey)?.agentId ===
             // callerAgentId`) so a jailed orch:read script cannot harvest the
             // directory of every agent's/user's sessions (the keys that would turn
-            // the CR-02 single-session read into a turnkey cross-tenant exfiltration,
+            // a single-session read into a turnkey cross-tenant exfiltration,
             // plus a userId/channelId enumeration leak in its own right). Fail CLOSED
             // (filter to the caller's own) — composes with the sub-agent narrowing
             // below. When `callerAgentId` is undefined (admin / operator / CLI) the
@@ -181,8 +181,8 @@ export function bindSessionListHandlers(deps) {
             // is a contiguous substring. The tool advertises "keywords"; a literal
             // indexOf on the joined query silently returned 0 for multi-keyword
             // queries whose terms were separated in the text (e.g. "axolotl Quark"
-            // vs "...axolotl named Quark") — a silent-empty footgun (live finding
-            // 2026-06-12). A single-token query degenerates to the prior substring
+            // vs "...axolotl named Quark") — a silent-empty footgun observed
+            // live. A single-token query degenerates to the prior substring
             // behavior, so existing phrase/keyword callers are unaffected.
             // Strip surrounding double-quotes per token: the tool-side FTS5
             // sanitizer wraps dotted/hyphenated terms (e.g. "chat-send", "v1.0")
@@ -200,7 +200,7 @@ export function bindSessionListHandlers(deps) {
                 // the OpenAI-compat chat session + any pi-agent-session-manager session is
                 // JSONL-only (the primary store's loadByFormattedKey returns null for it), so
                 // without this fallback session.search SKIPPED every such session → 0 hits for
-                // content session.history could read (live 2026-06-20). The enumerated entry
+                // content session.history could read (observed live). The enumerated entry
                 // carries the JSONL path from scanWorkspaceSessions.
                 if (!data && session.metadata?._workspaceJsonlPath) {
                     data = loadJsonlSession(session.metadata._workspaceJsonlPath);

package/node_modules/@comis/daemon/dist/api/session-handlers/session-mutate.js

@@ -46,7 +46,7 @@ export function bindSessionMutateHandlers(deps) {
             return result;
         },
         [SessionSpawnContract.method]: async (rawParams) => {
-            // CAP-03/05 (v8 §3.7): the capability gate lives HERE because the agent
+            // The capability gate lives HERE because the agent
             // loop reaches handlers without passing checkScope (the in-process
             // bypass). Read the injected _capabilities from raw params BEFORE the
             // strip; throws CapabilityDeniedError when orch:spawn is not held.
@@ -114,8 +114,8 @@ export function bindSessionMutateHandlers(deps) {
             // null ("full") → pass ReadonlySet<never> sentinel so gate still checks denylist;
             // non-null → pass the computed set for membership checks.
             const reachableToolNames = reachableToolNamesSet !== null ? reachableToolNamesSet : undefined;
-            // Phase 213 CR-01: establish the tree-stable rootRunId (+ parentLeaseId)
-            // BEFORE the spawn so the tree-wide ceiling (CEIL-01), killByRootRun, and
+            // Establish the tree-stable rootRunId (+ parentLeaseId)
+            // BEFORE the spawn so the tree-wide spawn ceiling, killByRootRun, and
             // the per-root budget all key on ONE id per spawn tree. Two cases:
             //   - DESCENDANT: this spawn was initiated by a running sub-agent calling
             //     sessions_spawn. The dispatcher injected THAT sub-agent's session key
@@ -123,8 +123,7 @@ export function bindSessionMutateHandlers(deps) {
             //     `run.sessionKey`. Inherit that run's rootRunId AND its parentLeaseId
             //     (the lease that authorized the parent) so the whole subtree shares
             //     one root — without this every descendant minted a fresh root and the
-            //     fork-bomb escaped the ceiling (RESEARCH Pitfall 1, the silent
-            //     under-count).
+            //     fork-bomb escaped the ceiling (a silent under-count).
             //   - TOP-LEVEL: an operator/channel turn with no parent run. Reuse the
             //     session's stable synthetic root via resolveRootRunId so the ceiling
             //     and the budget meter agree on the same tree id.
@@ -143,7 +142,7 @@ export function bindSessionMutateHandlers(deps) {
                 agentId: spawnAgentId,
                 callerSessionKey,
                 callerAgentId: callerAgentIdInternal,
-                // CEIL-01/REVOKE-03: propagate the resolved tree root + the authorizing
+                // Propagate the resolved tree root + the authorizing
                 // lease so the ceiling/kill/budget see one tree (omit when absent).
                 ...(resolvedRootRunId !== undefined ? { rootRunId: resolvedRootRunId } : {}),
                 ...(inheritedParentLeaseId !== undefined ? { parentLeaseId: inheritedParentLeaseId } : {}),
@@ -162,10 +161,10 @@ export function bindSessionMutateHandlers(deps) {
                 requiredTools,
                 includeParentHistory,
                 reachableToolNames,
-                // GEN-03: ride the parent's resolved reply language into child session
+                // Ride the parent's resolved reply language into child session
                 // metadata (same channel as objective/toolGroups); read off the live ALS.
                 resolvedLanguage: tryGetContext()?.resolvedLanguage,
-                // WT-01: thread the `worktree?` request from the RPC param so the runner
+                // Thread the `worktree?` request from the RPC param so the runner
                 // persists it onto the child session metadata; executeSubAgent then runs
                 // the child in an isolated git worktree (auto-clean-if-unchanged). Omit
                 // when absent so the no-worktree spawn stays byte-identical.
@@ -194,7 +193,7 @@ export function bindSessionMutateHandlers(deps) {
             return baseAsyncResponse;
         },
         [SessionCompactContract.method]: async (rawParams) => {
-            // COMPACT-KEY (30uc-20260624): self-resolve the CALLER's own session. An
+            // Self-resolve the CALLER's own session. An
             // agent should NOT have to construct/guess its own formatted key (it guessed
             // ":telegram:" where the real key uses ":peer:"). Read the dispatcher-injected
             // `_callerSessionKey` BEFORE the strip (the same internal field session.send
@@ -210,7 +209,7 @@ export function bindSessionMutateHandlers(deps) {
             const userParams = stripInternalFields(rawParams);
             const params = SessionCompactContract.request.parse(userParams);
             const instructions = params.instructions;
-            // COMPACT-STORE-MISS (30uc-20260624): read from EITHER store — a live channel
+            // Read from EITHER store — a live channel
             // chat is file-JSONL-only (the SQLite sessions table is empty for it), so a
             // SQLite-only read threw "Session not found" for the active session.
             const data = loadSessionAnyStore(deps, sessionKey);

package/node_modules/@comis/daemon/dist/api/session-handlers/session-read.js

@@ -55,7 +55,7 @@ export function bindSessionReadHandlers(deps) {
             // The session-not-found error message preserves the user-friendly hint
             // including the list of available keys — that path runs AFTER the
             // parse since session_key must be present to do the lookup.
-            // Internal-field read BEFORE strip (caller-scoping — CR-02). The
+            // Internal-field read BEFORE strip (caller-scoping). The
             // tool.invoke rpc route injects `_agentId = lease.agentId`; its PRESENCE
             // is the unforgeable agent-origin signal (inbound _agentId is stripped
             // from external callers at the gateway). Admin/operator/CLI calls arrive
@@ -66,7 +66,7 @@ export function bindSessionReadHandlers(deps) {
             const sessionKey = params.session_key;
             const offset = params.offset ?? 0;
             const limit = params.limit ?? 20;
-            // CR-02 self-scope: an agent-origin caller may read ONLY its own
+            // Agent self-scope: an agent-origin caller may read ONLY its own
             // session. Mirror session.search's `_agentId` filter exactly
             // (session-list.ts:163-168) — the session belongs to the caller iff
             // `parseFormattedSessionKey(sessionKey)?.agentId === callerAgentId`.

package/node_modules/@comis/daemon/dist/api/shared/assert-not-agent-origin.js

@@ -4,7 +4,7 @@
 // gateway/method-router converts it to a JSON-RPC error response (mirrors the
 // existing `_trustLevel === "admin"` admin-gate throws in *-handlers.ts).
 /**
- * ORIGIN-01 deny-by-origin guard (v8 §3.1 / §22.3 floor item 1).
+ * Deny-by-origin guard for admin-scoped control-plane methods.
  *
  * The confused-deputy mitigation for the control plane: the in-process agent
  * loop dispatches straight through `createRpcDispatch` (bypassing
@@ -12,7 +12,7 @@
  * call may reach an admin-scoped method (`secrets.*`/`tokens.*`/`config.*`/
  * `agents.*`/`mcp.*`/…).
  *
- * **Trust-tiered (30uc-20260624 decision):** an agent turn operating on behalf
+ * **Trust-tiered:** an agent turn operating on behalf
  * of an **admin-trust** user INHERITS that user's control-plane privileges — so
  * an admin-trust agent origin is ALLOWED through to the admin handler (which
  * re-checks `_trustLevel === "admin"`, defense-in-depth). A **non-admin** agent
@@ -23,10 +23,10 @@
  * (resolved per-message in `execution-pipeline`, default `"user"`).
  *
  * Soundness of the two signals:
- *   - `_agentId` — Plan 03 strips inbound `INTERNAL_FIELD_NAMES` (incl. `_agentId`)
- *     from external WS/REST callers before dispatch, so its *presence* here is an
- *     unforgeable agent-origin signal; the sole legitimate injector is
- *     `createAgentRpcCall` (ORIGIN-03).
+ *   - `_agentId` — the gateway strips inbound `INTERNAL_FIELD_NAMES` (incl.
+ *     `_agentId`) from external WS/REST callers before dispatch, so its *presence*
+ *     here is an unforgeable agent-origin signal; the sole legitimate injector is
+ *     `createAgentRpcCall`.
  *   - `_trustLevel` — ALSO in `INTERNAL_FIELD_NAMES` (external-stripped) AND
  *     re-injected by `createAgentRpcCall` from the framework ALS trust
  *     (post-spread, so a tool- or agent-supplied value cannot override the

package/node_modules/@comis/daemon/dist/api/shared/builtin-provider-guard.js

@@ -1,26 +1,4 @@
-// SPDX-License-Identifier: Apache-2.0
-/**
- * Built-in provider redundancy guard for providers.create.
- *
- * Rejects providers_manage create attempts that would shadow pi-ai's
- * dynamic catalog with a redundant custom entry. A built-in provider
- * (one in pi-ai's getProviders()) already has its full model list
- * available via the catalog -- custom entries are only legitimate for
- * proxies (different baseUrl) or non-SDK providers. Without this guard,
- * an LLM agent that creates a catalog-shadowing entry with a stale or
- * invented model id sets up downstream 404 / "model not found" failures
- * (production: 2026-05-01 08:53-08:54 trace).
- *
- * Generic by construction: rejection message uses ${providerId} +
- * ${apiKeyName} interpolation only -- no per-provider hardcoded names
- * in the source template (catalog-agnostic). Pinned by source-grep
- * regression test in builtin-provider-guard.test.ts.
- *
- * Mirrors credential-resolver.ts shape.
- *
- * @module
- */
-import { getProviders, getModels } from "@earendil-works/pi-ai";
+import { getProviders, getModels } from "@earendil-works/pi-ai/compat";
 /**
  * Check whether a providers.create call would land a redundant custom
  * entry that shadows pi-ai's dynamic catalog. Returns ok=true when the

package/node_modules/@comis/daemon/dist/api/shared/credential-resolver.js

@@ -1,38 +1,4 @@
-// SPDX-License-Identifier: Apache-2.0
-/**
- * Pre-write credential validator for agent provider/model patches.
- *
- * When a patch sets agents.<id>.provider, verify the API key is resolvable
- * from one of the sources pi-coding-agent will consult at runtime. Reject
- * fail-loud with an actionable error if no source resolves.
- *
- * Resolution chain (matches pi-coding-agent runtime semantics):
- *   1. KEYLESS_PROVIDER_TYPES.has(entry.type) — ollama / lm-studio
- *   2. providers.entries.<provider>.apiKeyName → secretManager.has(...)
- *   3. Comis OAuth profiles — agent.oauthProfiles[provider] resolved against an
- *      injected oauthProfileLoader (the OAuthCredentialStorePort handle held by
- *      the daemon, adapted to a synchronous has-check at the call site).
- *   4. Secret-store canonical key — for the DEFAULT_PROVIDER_KEYS providers
- *      (anthropic/openai/google/groq/mistral), secretManager.has(canonicalKey).
- *      This mirrors the runtime: createAuthStorageAdapter hydrates exactly these
- *      providers into AuthStorage via secretManager.get(canonicalKey), so a bare
- *      `provider: anthropic` agent (no providers.entries block) works in
- *      `security.storage: encrypted` mode where the key is NOT in process.env.
- *   5. pi-ai's getEnvApiKey(provider) — canonical env vars (incl. ANTHROPIC_OAUTH_TOKEN
- *      and AWS/ADC special-cases). Does NOT cover comis-managed OAuth profiles in
- *      ~/.comis/auth-profiles.json (e.g. openai-codex).
- *
- * Note on synchronous loader facade: `OAuthCredentialStorePort.has`
- * is async (returns Promise<Result<boolean, Error>>). To avoid an async cascade
- * through every call site, this resolver remains SYNCHRONOUS and accepts a
- * sync facade (`oauthProfileLoader: { has(profileId: string): boolean }`).
- * The async port `has()` call MUST be performed at the daemon edge
- * (config-handlers / agent-handlers) and adapted into the closure. This keeps
- * the port-side validator I/O-free (Hexagonal: validator does no I/O).
- *
- * @module
- */
-import { getEnvApiKey, getProviders, getModels } from "@earendil-works/pi-ai";
+import { getEnvApiKey, getProviders, getModels } from "@earendil-works/pi-ai/compat";
 import { KEYLESS_PROVIDER_TYPES } from "@comis/core";
 import { DEFAULT_PROVIDER_KEYS } from "@comis/agent";
 export function resolveProviderCredential(targetProvider, deps) {

package/node_modules/@comis/daemon/dist/api/shared/emit-capability-audit.d.ts

@@ -1,4 +1,4 @@
-import type { EventMap } from "@comis/core";
+import type { AgentCapability, EventMap } from "@comis/core";
 /**
  * The minimal structural deps the emitter reads. `ApiDispatchDeps` /
  * `CapabilityEndpointDeps` (whose `container.eventBus` is the full
@@ -30,22 +30,41 @@ export interface CapabilityAuditRecord {
     readonly runId?: string;
     /**
      * The tree-stable root (the real lease's rootRunId, or the synthetic in-process
-     * root). Optional (WR-02): a gated decision with no resolvable root is still a
+     * root). Optional: a gated decision with no resolvable root is still a
      * durable security fact and emits `audit:event`; only the `capability:audited`
      * TREE producer (which needs a placeable root) is suppressed when this is absent.
      */
     readonly rootRunId?: string;
-    /** The real lease id (socket). ABSENT in-process — NEVER fabricated (G1). */
+    /** The real lease id (socket). ABSENT in-process — NEVER fabricated. */
     readonly leaseId?: string;
     /** The parent lease id (socket, when present) — the spawn-tree parent edge. */
     readonly parentLeaseId?: string;
     /** The authorization outcome — a closed string-literal union (AGENTS §2.8). */
     readonly decision: "allow" | "deny";
 }
+/**
+ * The closed capability→action-class map for the durable audit trail's
+ * `classification` (the `read|mutate|destructive` enum on `AuditEventSchema`).
+ * Read-class caps (they observe) → `"read"`; mutate-class caps (they change
+ * state or send outward) → `"mutate"`. Typed `Record<AgentCapability, ...>` so a
+ * new `AGENT_CAPABILITIES` member is a COMPILE-VISIBLE gap here — never a silent
+ * miss. There is no `"destructive"` entry: the allow path attributes read/mutate;
+ * a DENY is the only `"destructive"` emitter (a denied call is the signal).
+ */
+export declare const CAPABILITY_ACTION_CLASS: Record<AgentCapability, "read" | "mutate">;
+/**
+ * Classify a capability into the audit `classification` enum — a PURE lookup (no
+ * I/O, no throw; the `attenuateCaps` pure discipline). Returns the `read`/`mutate`
+ * action class for a known {@link import("@comis/core").AgentCapability}, or
+ * `undefined` for ANY OTHER string (the in-process dispatch path may pass a
+ * non-`orch:` cap) — an honest unknown that OMITS the field rather than
+ * mislabeling it (e.g. tagging a mutate as read).
+ */
+export declare function classifyCapabilityAction(capability: string): "read" | "mutate" | undefined;
 /**
  * Emit the per-cap audit for a gated call's authorization decision — BOTH the
- * durable `audit:event` (AUDIT-02) and the `capability:audited` trajectory
- * record (TREE). Pure emitter: emits, never throws.
+ * durable `audit:event` and the `capability:audited` trajectory
+ * record. Pure emitter: emits, never throws.
  *
  * @param deps - structural deps carrying `container.eventBus` + tenant config.
  * @param record - the content-free per-cap fact. Optional fields

package/node_modules/@comis/daemon/dist/api/shared/emit-capability-audit.js

@@ -1,28 +1,34 @@
 // SPDX-License-Identifier: Apache-2.0
 /**
- * AUDIT-01 / AUDIT-02 / TREE (v2.29 Phase 215 Plan 01) — the per-capability
- * audit emitter at the gate chokepoints.
+ * The per-capability audit emitter at the gate chokepoints.
  *
  * For every capability-gated call (an ALLOWED *and* a DENIED one), this emits
  * the authorization decision at the SINGLE chokepoint as TWO bus events:
  *
- *   1. `audit:event` — the DURABLE trail (AUDIT-02). Rides the shipped
+ *   1. `audit:event` — the DURABLE trail. Rides the shipped
  *      `wireAuditSink` → `obs_audit_events` + `0600 security-audit.jsonl` +
  *      `.audit()` log, reconstructable offline (no gateway). The per-cap tuple
  *      rides the content-free `metadata` free-map (sanitized at the sink).
- *   2. `capability:audited` — the TREE record (the spawn-tree's per-node
- *      producer Plan 03 folds). A typed, content-free event on the trajectory.
+ *   2. `capability:audited` — the TREE record (folded by the spawn-tree's
+ *      per-node producer). A typed, content-free event on the trajectory.
  *
  * One chokepoint emits BOTH (see `rpc-dispatch.ts` in-process +
  * `setup-capability-endpoint.ts` socket). This module is a PURE emitter — it
  * emits, never throws (no `@allow-throw`); the throwing gate is the caller's
  * `requireCapability` / `assertNotAgentOrigin`.
  *
- * CONTENT-FREE (T-215-01 / Pitfall 5): the record carries ids + caps + tool
+ * CONTENT-FREE: the record carries ids + caps + tool
  * NAME + method + decision ONLY — NEVER the `tool.invoke` args, a message body,
  * a file path, or a secret name. There is deliberately no args/body parameter.
  *
- * Chokepoint asymmetry (G1): the in-process path has NO lease, so `leaseId` /
+ * CLASSIFICATION: the durable `audit:event.classification` is a member of the
+ * closed `AuditEventSchema` enum (`read | mutate | destructive`) or is OMITTED —
+ * never an out-of-enum sentinel (the sink coerces any such value to null,
+ * dropping the action class). A DENY is `destructive`; an ALLOW derives a
+ * `read`/`mutate` from the capability via {@link classifyCapabilityAction} and
+ * omits the field for an unrecognized cap (honest unknown, never a mislabel).
+ *
+ * Chokepoint asymmetry: the in-process path has NO lease, so `leaseId` /
  * `parentLeaseId` / `tool` are honestly ABSENT (omitted) and `rootRunId` is the
  * synthetic `root-session-<key>`. The socket path passes the full real tuple.
  * NEVER fabricate a `lease-<synthetic>` for the in-process record.
@@ -30,10 +36,45 @@
  * @module
  */
 import { systemNowMs } from "@comis/core";
+/**
+ * The closed capability→action-class map for the durable audit trail's
+ * `classification` (the `read|mutate|destructive` enum on `AuditEventSchema`).
+ * Read-class caps (they observe) → `"read"`; mutate-class caps (they change
+ * state or send outward) → `"mutate"`. Typed `Record<AgentCapability, ...>` so a
+ * new `AGENT_CAPABILITIES` member is a COMPILE-VISIBLE gap here — never a silent
+ * miss. There is no `"destructive"` entry: the allow path attributes read/mutate;
+ * a DENY is the only `"destructive"` emitter (a denied call is the signal).
+ */
+export const CAPABILITY_ACTION_CLASS = {
+    "orch:read": "read",
+    "orch:web": "read",
+    "orch:analyze": "read",
+    "orch:browse": "read",
+    // MCP calls observe the connected server — a read-class action. (A deny is
+    // always emitted as `destructive`, so this class is the ALLOW-path attribution.)
+    "orch:mcp": "read",
+    "orch:write": "mutate",
+    "orch:message": "mutate",
+    "orch:spawn": "mutate",
+    "orch:graph": "mutate",
+    "orch:cron": "mutate",
+    "orch:skill": "mutate",
+};
+/**
+ * Classify a capability into the audit `classification` enum — a PURE lookup (no
+ * I/O, no throw; the `attenuateCaps` pure discipline). Returns the `read`/`mutate`
+ * action class for a known {@link import("@comis/core").AgentCapability}, or
+ * `undefined` for ANY OTHER string (the in-process dispatch path may pass a
+ * non-`orch:` cap) — an honest unknown that OMITS the field rather than
+ * mislabeling it (e.g. tagging a mutate as read).
+ */
+export function classifyCapabilityAction(capability) {
+    return CAPABILITY_ACTION_CLASS[capability];
+}
 /**
  * Emit the per-cap audit for a gated call's authorization decision — BOTH the
- * durable `audit:event` (AUDIT-02) and the `capability:audited` trajectory
- * record (TREE). Pure emitter: emits, never throws.
+ * durable `audit:event` and the `capability:audited` trajectory
+ * record. Pure emitter: emits, never throws.
  *
  * @param deps - structural deps carrying `container.eventBus` + tenant config.
  * @param record - the content-free per-cap fact. Optional fields
@@ -44,8 +85,16 @@ export function emitCapabilityAudit(deps, record) {
     const isDeny = record.decision === "deny";
     const timestamp = systemNowMs();
     const tenantId = deps.container.config.tenantId ?? "default";
-    // 1. The durable AUDIT-02 trail — ALWAYS emitted for a gated decision (WR-02:
-    //    the security trail is NOT coupled to tree-root resolution). The per-cap
+    // The action class for the durable trail: a DENY is the destructive-intent
+    // signal; an ALLOW derives a read|mutate from the capability's mutation
+    // semantics and is OMITTED for an unrecognized cap (an honest unknown — never
+    // an out-of-enum sentinel the sink would drop to null). Mirrors the
+    // conditional-carry of `createAuditEvent`.
+    const classification = isDeny
+        ? "destructive"
+        : classifyCapabilityAction(record.capability);
+    // 1. The durable audit trail — ALWAYS emitted for a gated decision (the
+    //    security trail is NOT coupled to tree-root resolution). The per-cap
     //    tuple rides the content-free `metadata` free-map; optional ids (incl.
     //    rootRunId) are present only when known (honest absence in-process).
     deps.container.eventBus.emit("audit:event", {
@@ -55,7 +104,7 @@ export function emitCapabilityAudit(deps, record) {
         actionType: record.method,
         kind: isDeny ? "capability_denied" : "audit",
         outcome: isDeny ? "denied" : "success",
-        classification: isDeny ? "destructive" : "neutral",
+        ...(classification !== undefined ? { classification } : {}),
         metadata: {
             capability: record.capability,
             method: record.method,
@@ -69,7 +118,7 @@ export function emitCapabilityAudit(deps, record) {
         },
     });
     // 2. The TREE record (the spawn-tree's per-node producer) — emitted ONLY with a
-    //    resolvable root (WR-02): a node with no root is unplaceable in the tree,
+    //    resolvable root: a node with no root is unplaceable in the tree,
     //    and `capability:audited.rootRunId` is a required string. The translator
     //    (translate-orchestration-payload.ts) strips the envelope; this carries the
     //    typed content-free tuple.

package/node_modules/@comis/daemon/dist/api/shared/persist-to-config.d.ts

@@ -57,7 +57,7 @@ export declare function _pendingConfigMutations(): number;
  * Run `fn` inside a config-mutation fence so any SIGUSR2 restart that a
  * config-mutating tool schedules MID-`fn` is deferred until `fn` settles.
  *
- * RESTART-01 (live VPS 2026-06-20): a config-mutating agent tool
+ * Without the fence, a config-mutating agent tool
  * (heartbeat_manage / config.patch / agents_manage / …) called inside a
  * SYNCHRONOUS chat/responses-API turn triggered a debounced SIGUSR2 that
  * restarted the daemon UNDER the in-flight HTTP request → the request died

package/node_modules/@comis/daemon/dist/api/shared/persist-to-config.js

@@ -178,7 +178,7 @@ export function _pendingConfigMutations() {
  * Run `fn` inside a config-mutation fence so any SIGUSR2 restart that a
  * config-mutating tool schedules MID-`fn` is deferred until `fn` settles.
  *
- * RESTART-01 (live VPS 2026-06-20): a config-mutating agent tool
+ * Without the fence, a config-mutating agent tool
  * (heartbeat_manage / config.patch / agents_manage / …) called inside a
  * SYNCHRONOUS chat/responses-API turn triggered a debounced SIGUSR2 that
  * restarted the daemon UNDER the in-flight HTTP request → the request died

package/node_modules/@comis/daemon/dist/api/skill-handlers.js

@@ -133,7 +133,7 @@ export function createSkillHandlers(deps) {
             return result;
         },
         [SkillsUploadContract.method]: async (rawParams) => {
-            // CAP-03/05 (v8 §3.7): in-process capability gate — the agent loop skips
+            // In-process capability gate — the agent loop skips
             // checkScope, so orch:skill is enforced here, reading the injected
             // _capabilities from raw params BEFORE the strip.
             requireCapability(rawParams._capabilities, "orch:skill");
@@ -271,7 +271,7 @@ export function createSkillHandlers(deps) {
             return result;
         },
         [SkillsImportContract.method]: async (rawParams) => {
-            // CAP-03/05 (v8 §3.7): in-process capability gate (see skills.upload).
+            // In-process capability gate (see skills.upload).
             requireCapability(rawParams._capabilities, "orch:skill");
             const callingAgentId = resolveCallingAgentId(rawParams);
             const userParams = stripInternalFields(rawParams);
@@ -400,7 +400,7 @@ export function createSkillHandlers(deps) {
             return result;
         },
         [SkillsDeleteContract.method]: async (rawParams) => {
-            // CAP-03/05 (v8 §3.7): in-process capability gate (see skills.upload).
+            // In-process capability gate (see skills.upload).
             requireCapability(rawParams._capabilities, "orch:skill");
             const callingAgentId = resolveCallingAgentId(rawParams);
             const userParams = stripInternalFields(rawParams);
@@ -471,7 +471,7 @@ export function createSkillHandlers(deps) {
             return result;
         },
         [SkillsCreateContract.method]: async (rawParams) => {
-            // CAP-03/05 (v8 §3.7): in-process capability gate (see skills.upload).
+            // In-process capability gate (see skills.upload).
             requireCapability(rawParams._capabilities, "orch:skill");
             const callingAgentId = resolveCallingAgentId(rawParams);
             const userParams = stripInternalFields(rawParams);
@@ -571,7 +571,7 @@ export function createSkillHandlers(deps) {
             return result;
         },
         [SkillsUpdateContract.method]: async (rawParams) => {
-            // CAP-03/05 (v8 §3.7): in-process capability gate (see skills.upload).
+            // In-process capability gate (see skills.upload).
             requireCapability(rawParams._capabilities, "orch:skill");
             const callingAgentId = resolveCallingAgentId(rawParams);
             const userParams = stripInternalFields(rawParams);

package/node_modules/@comis/daemon/dist/api/ssrf-image-fetch.js

@@ -3,7 +3,7 @@
 // caller's `@allow-throw` boundary (image-handlers / media-handlers) and
 // converted to a JSON-RPC error response by rpc-dispatch.ts.
 /**
- * Shared DNS-pinned, SSRF-safe image byte fetch (CR-01).
+ * Shared DNS-pinned, SSRF-safe image byte fetch.
  *
  * Closes the DNS-rebinding time-of-check/time-of-use (TOCTOU) SSRF gap that a
  * bare `fetch(url, { redirect: "error" })` leaves open: `validateUrl` resolves

package/node_modules/@comis/daemon/dist/api/subagent-handlers.d.ts

@@ -5,8 +5,8 @@
  *   subagent.list, subagent.kill, subagent.steer
  *
  * List returns filtered runs from SubAgentRunner. Kill marks a running
- * run as failed. Steer is flag-gated on security.agentToAgent.steerInject
- * (STEER-01): OFF (default) → kill+respawn with a new task (status "steered");
+ * run as failed. Steer is flag-gated on security.agentToAgent.steerInject:
+ * OFF (default) → kill+respawn with a new task (status "steered");
  * ON → inject the message into the running child's live session at its next
  * step boundary (no kill/respawn, same runId, status "steered_inject").
  * Rate-limited at 2s per target (shared across both branches).

package/node_modules/@comis/daemon/dist/api/subagent-handlers.js

@@ -7,8 +7,8 @@
  *   subagent.list, subagent.kill, subagent.steer
  *
  * List returns filtered runs from SubAgentRunner. Kill marks a running
- * run as failed. Steer is flag-gated on security.agentToAgent.steerInject
- * (STEER-01): OFF (default) → kill+respawn with a new task (status "steered");
+ * run as failed. Steer is flag-gated on security.agentToAgent.steerInject:
+ * OFF (default) → kill+respawn with a new task (status "steered");
  * ON → inject the message into the running child's live session at its next
  * step boundary (no kill/respawn, same runId, status "steered_inject").
  * Rate-limited at 2s per target (shared across both branches).
@@ -92,16 +92,16 @@ export function createSubagentHandlers(deps) {
                     steerTimestamps.delete(key);
                 }
             }
-            // STEER-01: flag-gated branch. Flag ON → inject into the live child (no
+            // Flag-gated branch. Flag ON → inject into the live child (no
             // kill, no respawn — transcript + progress preserved, same runId). Flag
-            // OFF (default) → the historical kill+respawn, BYTE-IDENTICAL. The 2s
+            // OFF (default) → kill+respawn. The 2s
             // rate-limit above is shared by both branches.
             if (deps.securityConfig.agentToAgent?.steerInject) {
                 const run = deps.subAgentRunner.getRunStatus(target);
                 if (!run) {
                     throw new Error(`Unknown run ID: ${target}`);
                 }
-                // WR-02: mirror killRun's status guard (sub-agent-runner.ts:1910-1912).
+                // Mirror killRun's status guard (sub-agent-runner.ts:1910-1912).
                 // getRunStatus returns a run for ANY status still inside the retention
                 // window; a steer aimed at a completed/failed/queued run has no live
                 // handle, so fail fast with an actionable status-named error instead of
@@ -111,7 +111,7 @@ export function createSubagentHandlers(deps) {
                 }
                 const steerResult = await deps.subAgentRunner.steerRun(target, message);
                 if (!steerResult.steered) {
-                    // WR-03 (§2.7): the inject-failure branch is a path an operator must
+                    // The inject-failure branch is a path an operator must
                     // diagnose. Log a WARN with an actionable hint + errorKind before the
                     // throw (which the @allow-throw dispatcher converts to a JSON-RPC
                     // error) — never the steer message body. The success branch already
@@ -150,10 +150,10 @@ export function createSubagentHandlers(deps) {
                 throw new Error(`Run details not found after kill: ${target}`);
             }
             // Respawn with new task — reads internal fields directly off rawParams.
-            // Phase 213 CR-01: the respawn must stay in the KILLED run's spawn tree, so
+            // The respawn must stay in the KILLED run's spawn tree, so
             // inherit its rootRunId (+ the authorizing parentLeaseId). Without this the
-            // steer-respawn minted a fresh root → a later run.kill {rootRunId} of the
-            // original tree would miss the steered continuation (a survivor — REVOKE-03).
+            // steer-respawn would mint a fresh root → a later run.kill {rootRunId} of the
+            // original tree would miss the steered continuation (a surviving orphan).
             const newRunId = deps.subAgentRunner.spawn({
                 task: message,
                 agentId: run.agentId,