comisai 1.0.45 → 1.0.46

package/node_modules/@comis/daemon/dist/observability/build-config-posture-record.d.ts

@@ -1,8 +1,8 @@
 /**
- * I3 — record a config-posture SNAPSHOT at boot.
+ * Record a config-posture SNAPSHOT at boot.
  *
  * Captures the three log-file-only security-posture FINDINGS as a single
- * point-in-time `obs_diagnostics` row at startup, so the fleet lens (Phase 161)
+ * point-in-time `obs_diagnostics` row at startup, so the fleet lens
  * can query a daemon's posture without grepping `daemon.log`:
  *   - `tlsOff`               — the gateway is running without TLS (recomputed
  *                              from `gateway.{tls, allowInsecureHttp}` at the
@@ -26,9 +26,9 @@
  *
  * This is a boot-time SNAPSHOT — a direct `insertDiagnostic`, NOT an event. An
  * event would imply recurrence/streaming and go stale; a once-per-boot record
- * is the correct point-in-time model (RESEARCH Pitfall 4). Because the snapshot
+ * is the correct point-in-time model. Because the snapshot
  * is recorded once per boot regardless of WARN frequency, the recurrence gate
- * does not gate I3 away.
+ * does not gate this snapshot away.
  *
  * `details` carries ONLY booleans + counts + closed stranded labels — no secret
  * values, no cert paths, no canary secrets, no free text. The stranded findings
@@ -41,18 +41,18 @@ import type { ClockPort } from "@comis/core";
 import type { ObservabilityStore } from "@comis/memory";
 import type { StrandedFinding } from "../wiring/setup-storage-mismatch-warn.js";
 /**
- * RESOLVE-01: count configured agents whose NATIVE provider family disagrees with
- * their model id's family (the `ffe11736` chimera). Conservative — gateway/custom
+ * Count configured agents whose NATIVE provider family disagrees with
+ * their model id's family (the provider/model chimera). Conservative — gateway/custom
  * providers + an unknown model family never flag (see `isProviderModelChimera`).
  * Lives here (not inline in daemon.ts) to keep daemon.ts under its 3000-line cap.
- * Count only — the caller persists the COUNT, never agent ids/model names (I3).
+ * Count only — the caller persists the COUNT, never agent ids/model names.
  */
 export declare function countChimericModels(agents: Readonly<Record<string, {
     provider?: string;
     model?: string;
 }>>): number;
 /**
- * OBS-7 (openclaw-usecases 2026-06-25): is the gateway bound to a LOOPBACK address?
+ * Is the gateway bound to a LOOPBACK address?
  *
  * A loopback-bound gateway has no off-host network exposure, so running it WITHOUT
  * TLS is benign — it matches the `gateway-exposure` security check, which flags only
@@ -67,15 +67,15 @@ export declare function countChimericModels(agents: Readonly<Record<string, {
  */
 export declare function isLoopbackHost(host: string | undefined): boolean;
 /**
- * SPEND-05: count configured agents burning tokens on remote-unknown-priced models
+ * Count configured agents burning tokens on remote-unknown-priced models
  * — those whose configured `provider`+`model` resolves to the `"unknown"` pricing
- * state (a NATIVE single-family provider with NO catalog rate — the `ffe11736`
+ * state (a NATIVE single-family provider with NO catalog rate — the
  * fail-open where `resolveModelPricing` silently returns $0, masking a phantom cost
  * as free). A `"free"` local/gateway provider (honest $0) and a `"priced"` agent are
  * NOT counted — so a local-first deployment is never false-flagged. Consumes the
  * shipped 3-state {@link resolvePricingState} directly, NEVER a catalog-presence
  * boolean. Lives here (not inline in daemon.ts) to keep daemon.ts under its 3000-line
- * cap. Count only — the caller persists the COUNT, never agent ids/model names (I3).
+ * cap. Count only — the caller persists the COUNT, never agent ids/model names.
  */
 export declare function countPricingGaps(agents: Readonly<Record<string, {
     provider?: string;
@@ -97,15 +97,15 @@ export interface ConfigPostureInputs {
      */
     canaryFallbackActive: boolean;
     /**
-     * KNOB-03 (Phase 176): providers whose Ollama-served window < configured at
+     * Providers whose Ollama-served window < configured at
      * this boot — a COUNT, never provider names (the no-free-text contract).
-     * Derived in daemon.ts from the SAME comparison results the KNOB-01 boot
+     * Derived in daemon.ts from the SAME comparison results the served-window boot
      * WARN used (one comparison, two surfaces — no drift).
      */
     servedBelowConfiguredCount: number;
     /**
-     * RESOLVE-01 (observability-excellence): number of configured agents whose
-     * NATIVE provider family disagrees with their model id's family (the `ffe11736`
+     * Number of configured agents whose
+     * NATIVE provider family disagrees with their model id's family (the provider/model
      * chimera — e.g. `provider: anthropic` + a qwen model → phantom profile). A
      * COUNT, never agent ids or model names (the no-free-text contract). Computed in
      * daemon.ts via `isProviderModelChimera` over the configured agents at boot.
@@ -113,19 +113,19 @@ export interface ConfigPostureInputs {
      */
     chimericModelCount?: number;
     /**
-     * SPEND-05 (observability-excellence): number of configured agents burning tokens
+     * Number of configured agents burning tokens
      * on remote-unknown-priced models (`resolvePricingState == "unknown"` — a NATIVE
-     * provider with no catalog rate, the `ffe11736` fail-open where spend is silently
+     * provider with no catalog rate, the fail-open where spend is silently
      * under-counted as $0). A COUNT, never agent ids or model names (the no-free-text
      * contract). Computed in daemon.ts via `countPricingGaps` over the configured
      * agents at boot. Optional (defaults to 0 in the record).
      */
     pricingGapCount?: number;
     /**
-     * RELAX-SURFACE (30uc-20260624, Track-M): `true` when the operator set
+     * `true` when the operator set
      * `security.agentToAgent.sandboxNoDowngrade: false` — a RELAXED security default
-     * (a spawned child may run with a weaker sandbox posture than its parent). The
-     * Track-M relaxation-surfacing rule wants a relaxed default surfaced at boot, not
+     * (a spawned child may run with a weaker sandbox posture than its parent). A
+     * relaxed security default should be surfaced at boot, not
      * silent. A boolean, never config bodies. Optional (defaults to `false`).
      */
     sandboxNoDowngradeDisabled?: boolean;
@@ -134,8 +134,8 @@ export interface ConfigPostureInputs {
  * Write a one-shot `config_posture` row to `obs_diagnostics` at boot.
  *
  * No-ops when `obsStore` is `undefined` (observability persistence disabled) —
- * the `?.` is mandatory so a disabled-persistence boot cannot crash shutdown
- * (Pitfall 5). Severity is `"warning"` when ANY posture issue is present
+ * the `?.` is mandatory so a disabled-persistence boot cannot crash shutdown.
+ * Severity is `"warning"` when ANY posture issue is present
  * (`tlsOff` OR a stranded finding OR `canaryFallbackActive` OR
  * `servedBelowConfiguredCount > 0`), else `"info"`. The timestamp comes from
  * the injected `ClockPort` — never `Date.now()` (globals gate).

package/node_modules/@comis/daemon/dist/observability/build-config-posture-record.js

@@ -1,16 +1,16 @@
 import { isProviderModelChimera, resolvePricingState } from "@comis/core";
 /**
- * RESOLVE-01: count configured agents whose NATIVE provider family disagrees with
- * their model id's family (the `ffe11736` chimera). Conservative — gateway/custom
+ * Count configured agents whose NATIVE provider family disagrees with
+ * their model id's family (the provider/model chimera). Conservative — gateway/custom
  * providers + an unknown model family never flag (see `isProviderModelChimera`).
  * Lives here (not inline in daemon.ts) to keep daemon.ts under its 3000-line cap.
- * Count only — the caller persists the COUNT, never agent ids/model names (I3).
+ * Count only — the caller persists the COUNT, never agent ids/model names.
  */
 export function countChimericModels(agents) {
     return Object.values(agents).filter((a) => typeof a.provider === "string" && typeof a.model === "string" && isProviderModelChimera(a.provider, a.model)).length;
 }
 /**
- * OBS-7 (openclaw-usecases 2026-06-25): is the gateway bound to a LOOPBACK address?
+ * Is the gateway bound to a LOOPBACK address?
  *
  * A loopback-bound gateway has no off-host network exposure, so running it WITHOUT
  * TLS is benign — it matches the `gateway-exposure` security check, which flags only
@@ -30,15 +30,15 @@ export function isLoopbackHost(host) {
     return h === "127.0.0.1" || h === "::1" || h === "localhost" || h.startsWith("127.");
 }
 /**
- * SPEND-05: count configured agents burning tokens on remote-unknown-priced models
+ * Count configured agents burning tokens on remote-unknown-priced models
  * — those whose configured `provider`+`model` resolves to the `"unknown"` pricing
- * state (a NATIVE single-family provider with NO catalog rate — the `ffe11736`
+ * state (a NATIVE single-family provider with NO catalog rate — the
  * fail-open where `resolveModelPricing` silently returns $0, masking a phantom cost
  * as free). A `"free"` local/gateway provider (honest $0) and a `"priced"` agent are
  * NOT counted — so a local-first deployment is never false-flagged. Consumes the
  * shipped 3-state {@link resolvePricingState} directly, NEVER a catalog-presence
  * boolean. Lives here (not inline in daemon.ts) to keep daemon.ts under its 3000-line
- * cap. Count only — the caller persists the COUNT, never agent ids/model names (I3).
+ * cap. Count only — the caller persists the COUNT, never agent ids/model names.
  */
 export function countPricingGaps(agents) {
     return Object.values(agents).filter((a) => typeof a.provider === "string" &&
@@ -49,8 +49,8 @@ export function countPricingGaps(agents) {
  * Write a one-shot `config_posture` row to `obs_diagnostics` at boot.
  *
  * No-ops when `obsStore` is `undefined` (observability persistence disabled) —
- * the `?.` is mandatory so a disabled-persistence boot cannot crash shutdown
- * (Pitfall 5). Severity is `"warning"` when ANY posture issue is present
+ * the `?.` is mandatory so a disabled-persistence boot cannot crash shutdown.
+ * Severity is `"warning"` when ANY posture issue is present
  * (`tlsOff` OR a stranded finding OR `canaryFallbackActive` OR
  * `servedBelowConfiguredCount > 0`), else `"info"`. The timestamp comes from
  * the injected `ClockPort` — never `Date.now()` (globals gate).
@@ -77,13 +77,13 @@ export function buildConfigPostureRecord(obsStore, inputs, clock) {
             stranded: inputs.strandedFindings,
             canaryFallbackActive: inputs.canaryFallbackActive,
             servedBelowConfiguredCount: inputs.servedBelowConfiguredCount,
-            // RESOLVE-01: agents booted with a NATIVE provider + a foreign model family
-            // (the ffe11736 chimera). A COUNT, never agent ids/model names (no free text).
+            // Agents booted with a NATIVE provider + a foreign model family
+            // (the provider/model chimera). A COUNT, never agent ids/model names (no free text).
             chimericModelCount,
-            // SPEND-05: agents burning tokens on remote-unknown-priced models
+            // Agents burning tokens on remote-unknown-priced models
             // (resolvePricingState == "unknown"). A COUNT, never agent ids/model names.
             pricingGapCount,
-            // RELAX-SURFACE: the no-downgrade sandbox invariant is DISABLED (relaxed
+            // The no-downgrade sandbox invariant is DISABLED (relaxed
             // default surfaced at boot, not silent). A boolean, never config bodies.
             sandboxNoDowngradeDisabled,
         }),

package/node_modules/@comis/daemon/dist/observability/delivery-queue-logger.d.ts

@@ -10,8 +10,8 @@
  *   confirmed), queue_drained (startup drain complete).
  * - WARN for degraded states: nack (transient failure, will retry) and fail
  *   (permanent failure). WARN events include hint and errorKind as required.
- * - DEBUG for the reply->trajectory binding breadcrumb (delivery:reply_bound,
- *   WR-01): a high-frequency per-reply positive signal, kept at DEBUG so it does
+ * - DEBUG for the reply->trajectory binding breadcrumb (delivery:reply_bound):
+ *   a high-frequency per-reply positive signal, kept at DEBUG so it does
  *   not flood INFO, but present so a reaction map-miss is one-call diagnosable
  *   (the bind fired vs never fired) from the log trail alongside the bus event.
  * @module

package/node_modules/@comis/daemon/dist/observability/delivery-queue-logger.js

@@ -11,8 +11,8 @@
  *   confirmed), queue_drained (startup drain complete).
  * - WARN for degraded states: nack (transient failure, will retry) and fail
  *   (permanent failure). WARN events include hint and errorKind as required.
- * - DEBUG for the reply->trajectory binding breadcrumb (delivery:reply_bound,
- *   WR-01): a high-frequency per-reply positive signal, kept at DEBUG so it does
+ * - DEBUG for the reply->trajectory binding breadcrumb (delivery:reply_bound):
+ *   a high-frequency per-reply positive signal, kept at DEBUG so it does
  *   not flood INFO, but present so a reaction map-miss is one-call diagnosable
  *   (the bind fired vs never fired) from the log trail alongside the bus event.
  * @module
@@ -101,7 +101,7 @@ export function setupDeliveryQueueLogging(deps) {
         }, "Delivery aborted");
     });
     // 8. Reply bound: the agent-reply messageId was bound to its trajectory scope
-    // on the primary inbound-reply path (WR-01). DEBUG, not INFO — this is a
+    // on the primary inbound-reply path. DEBUG, not INFO — this is a
     // per-reply positive signal that would flood INFO, but the breadcrumb is
     // load-bearing for diagnosing a reaction map-miss (a `delivery:reply_bound`
     // for the messageId means the bind fired → a later miss is an eviction; its

package/node_modules/@comis/daemon/dist/observability/obs-audit-sink.d.ts

@@ -1,10 +1,10 @@
 /**
- * AUDIT-01/02/04 — the durable security-audit sink (row-builders + the buffer +
+ * The durable security-audit sink (row-builders + the buffer +
  * the per-event subscribers + the three sinks per event).
  *
  * Every audit-source event maps to an {@link AuditEventRow}. The `audit:event`
  * `metadata` free-map (the ONE escape hatch) is routed through
- * `sanitizeForPersistence` before it lands in `refs` (AUDIT-04). The other
+ * `sanitizeForPersistence` before it lands in `refs`. The other
  * events are structurally content-free (the truncated prefixes / closed labels)
  * but STILL re-apply the scrub uniformly — one chokepoint, defense-in-depth.
  *
@@ -13,10 +13,10 @@
  * stream under the shared `observability.logRotation`), and a `.audit()` (level
  * 35) log line. Tenant-less events resolve `(tenant, agent, traceId)` from the
  * AsyncLocalStorage trace context when present, else persist `tenant_id=''`
- * (system-scoped) — NEVER dropped (decision #2).
+ * (system-scoped) — NEVER dropped.
  *
  * Extracted from `obs-persistence-wiring.ts` to keep that file under the
- * 800-line cap (the Plan-01/02 row-shapes extraction precedent).
+ * 800-line cap (the row-shapes extraction precedent).
  *
  * @module
  */
@@ -27,8 +27,8 @@ import type { ComisLogger } from "@comis/infra";
  * Rotation fallback for the security-audit.jsonl stream when an older caller
  * omits `logRotation`. Aligned to `LogRotationConfigSchema`'s defaults
  * (`packages/core/src/config/schema-observability.ts` — 50 MB / 5 files) so the
- * two can't drift (the AUDIT-01/L1 review found the prior 10 MB literal here
- * disagreed with the 50 MB schema default). NOT imported from the schema to
+ * two can't drift (a mismatched literal here would silently disagree with the
+ * 50 MB schema default). NOT imported from the schema to
  * avoid a daemon→core schema-coupling for two scalars; the doc-comment + this
  * note are the binding.
  */
@@ -49,17 +49,28 @@ export interface AuditRowSink {
  * audit / auth-mutation → "info". Mirrors `kindIsSecuritySignal` but kept local
  * (a string label, not a boolean) so the row carries an operator-readable
  * severity without importing the exhaustiveness guard into the wiring layer.
+ *
+ * `secret_access` is outcome-aware: a routine READ resolution — a successful
+ * get or an expected-absent probe (boot resolves optional provider keys, the
+ * canary reads its env seed per inbound message) — is the audit TRAIL, not an
+ * alert; at "warning" a healthy boot wrote ~10 warning rows and inflated every
+ * severity-filtered sweep. Secret MUTATIONS (classification mutate/destructive)
+ * and non-routine outcomes (denied/error/unknown) stay "warning" —
+ * fail-toward-visibility.
  */
-export declare function kindToSeverity(kind: string): string;
+export declare function kindToSeverity(kind: string, opts?: {
+    outcome?: string | null;
+    classification?: string | null;
+}): string;
 /**
- * Derive an `AuditKind` from an `actionType` when an un-migrated emit omits
- * `payload.kind` (defense-in-depth fallback — Plan 02's WIRE SHAPE: read
- * `payload.kind` when present, derive from `actionType` only as a fallback).
+ * Derive an `AuditKind` from an `actionType` when an emit omits
+ * `payload.kind` (defense-in-depth fallback — the wire shape reads
+ * `payload.kind` when present, deriving from `actionType` only as a fallback).
  * Unknown actionTypes fall back to the generic `audit` family.
  */
 export declare function deriveKindFromActionType(actionType: string): AuditKind;
 /**
- * Build a content-free AuditEventRow from an `audit:event` payload (AUDIT-01/04).
+ * Build a content-free AuditEventRow from an `audit:event` payload.
  * The `metadata` free-map is routed through `sanitizeForPersistence` (keys +
  * scalar counts/ids/digests only) and packed into `refs` — NEVER the raw
  * metadata. `kind` comes from the wire shape (`payload.kind`) or is derived from
@@ -88,7 +99,7 @@ export interface BuildAuditRowArgs {
  * content-free at the emit site — but is STILL routed through
  * `sanitizeForPersistence` uniformly (one chokepoint). `(tenant, agent,
  * traceId)` are resolved by the caller from the trace context (else the `''`
- * system-scope sentinel; the event is NEVER dropped — decision #2).
+ * system-scope sentinel; the event is NEVER dropped).
  */
 export declare function buildAuditRow(args: BuildAuditRowArgs): AuditEventRow;
 /** Dependencies for {@link wireAuditSink}. */

package/node_modules/@comis/daemon/dist/observability/obs-audit-sink.js

@@ -1,11 +1,11 @@
 // SPDX-License-Identifier: Apache-2.0
 /**
- * AUDIT-01/02/04 — the durable security-audit sink (row-builders + the buffer +
+ * The durable security-audit sink (row-builders + the buffer +
  * the per-event subscribers + the three sinks per event).
  *
  * Every audit-source event maps to an {@link AuditEventRow}. The `audit:event`
  * `metadata` free-map (the ONE escape hatch) is routed through
- * `sanitizeForPersistence` before it lands in `refs` (AUDIT-04). The other
+ * `sanitizeForPersistence` before it lands in `refs`. The other
  * events are structurally content-free (the truncated prefixes / closed labels)
  * but STILL re-apply the scrub uniformly — one chokepoint, defense-in-depth.
  *
@@ -14,10 +14,10 @@
  * stream under the shared `observability.logRotation`), and a `.audit()` (level
  * 35) log line. Tenant-less events resolve `(tenant, agent, traceId)` from the
  * AsyncLocalStorage trace context when present, else persist `tenant_id=''`
- * (system-scoped) — NEVER dropped (decision #2).
+ * (system-scoped) — NEVER dropped.
  *
  * Extracted from `obs-persistence-wiring.ts` to keep that file under the
- * 800-line cap (the Plan-01/02 row-shapes extraction precedent).
+ * 800-line cap (the row-shapes extraction precedent).
  *
  * @module
  */
@@ -29,8 +29,8 @@ import { sanitizeForPersistence, getDefaultConfigAuditConfinedBase } from "@comi
  * Rotation fallback for the security-audit.jsonl stream when an older caller
  * omits `logRotation`. Aligned to `LogRotationConfigSchema`'s defaults
  * (`packages/core/src/config/schema-observability.ts` — 50 MB / 5 files) so the
- * two can't drift (the AUDIT-01/L1 review found the prior 10 MB literal here
- * disagreed with the 50 MB schema default). NOT imported from the schema to
+ * two can't drift (a mismatched literal here would silently disagree with the
+ * 50 MB schema default). NOT imported from the schema to
  * avoid a daemon→core schema-coupling for two scalars; the doc-comment + this
  * note are the binding.
  */
@@ -43,7 +43,7 @@ export const AUDIT_JSONL_DEFAULT_MAX_FILES = 5;
  * body) — NOT a closed label/count/id — so they routinely carry inline secrets
  * a no-prefix value (a 32-hex key, a DB password, `mysql -p<pass>`) that
  * neither the credential-KEYED-field drop nor the prefixed/keyworded pattern
- * redactor catches (the AUDIT-04 / H1+H2 review leak). Content-free-by-
+ * redactor catches. Content-free-by-
  * construction: {@link digestFreeFormContentKeys} replaces each with a
  * non-reversible `<key>Sha256` (first 12 hex) + `<key>Length` BEFORE the row is
  * built, so the raw value can never reach the durable row/JSONL even if a
@@ -85,35 +85,48 @@ function digestFreeFormContentKeys(map) {
  * audit / auth-mutation → "info". Mirrors `kindIsSecuritySignal` but kept local
  * (a string label, not a boolean) so the row carries an operator-readable
  * severity without importing the exhaustiveness guard into the wiring layer.
+ *
+ * `secret_access` is outcome-aware: a routine READ resolution — a successful
+ * get or an expected-absent probe (boot resolves optional provider keys, the
+ * canary reads its env seed per inbound message) — is the audit TRAIL, not an
+ * alert; at "warning" a healthy boot wrote ~10 warning rows and inflated every
+ * severity-filtered sweep. Secret MUTATIONS (classification mutate/destructive)
+ * and non-routine outcomes (denied/error/unknown) stay "warning" —
+ * fail-toward-visibility.
  */
-export function kindToSeverity(kind) {
+export function kindToSeverity(kind, opts) {
     switch (kind) {
         case "audit":
         case "auth_mutation":
             return "info";
+        case "secret_access": {
+            const mutation = opts?.classification === "mutate" || opts?.classification === "destructive";
+            const routineRead = opts?.outcome === "success" || opts?.outcome === "not_found";
+            return !mutation && routineRead ? "info" : "warning";
+        }
         default:
-            // Every security-signal kind (secret_access/injection_*/canary_leak/
+            // Every other security-signal kind (injection_*/canary_leak/
             // implied_tool_call/command_blocked/hook_blocked/sandbox_downgrade_refused)
             // and any unknown kind → warning (fail-toward-visibility).
             return "warning";
     }
 }
 /**
- * Derive an `AuditKind` from an `actionType` when an un-migrated emit omits
- * `payload.kind` (defense-in-depth fallback — Plan 02's WIRE SHAPE: read
- * `payload.kind` when present, derive from `actionType` only as a fallback).
+ * Derive an `AuditKind` from an `actionType` when an emit omits
+ * `payload.kind` (defense-in-depth fallback — the wire shape reads
+ * `payload.kind` when present, deriving from `actionType` only as a fallback).
  * Unknown actionTypes fall back to the generic `audit` family.
  */
 export function deriveKindFromActionType(actionType) {
     switch (actionType) {
-        // AUDIT-04 / M1: secret MUTATIONS (set/delete/rotate) are a security signal
-        // too — alongside the secret READ (get). Before the mutation arms they
-        // emitted `classification:"destructive"` with no `kind`, falling through to
+        // Secret MUTATIONS (set/delete/rotate) are a security signal
+        // too — alongside the secret READ (get). Without an explicit `kind` these
+        // would emit `classification:"destructive"` and fall through to
         // the generic `audit` family (severity:"info") — invisible to a
         // kind/severity-filtered audit query. Map them all to the `secret_access`
         // security-signal kind (severity:"warning") so they surface in the
-        // security-audit grep. (The emit sites ALSO set `kind` explicitly now; this
-        // is the defense-in-depth fallback for any un-migrated/future emit.)
+        // security-audit grep. (The emit sites ALSO set `kind` explicitly; this
+        // is the defense-in-depth fallback for any future emit that omits it.)
         case "secrets.get":
         case "secrets.set":
         case "secrets.delete":
@@ -132,7 +145,7 @@ export function deriveKindFromActionType(actionType) {
     }
 }
 /**
- * Build a content-free AuditEventRow from an `audit:event` payload (AUDIT-01/04).
+ * Build a content-free AuditEventRow from an `audit:event` payload.
  * The `metadata` free-map is routed through `sanitizeForPersistence` (keys +
  * scalar counts/ids/digests only) and packed into `refs` — NEVER the raw
  * metadata. `kind` comes from the wire shape (`payload.kind`) or is derived from
@@ -148,9 +161,9 @@ export function auditEventToRow(payload, resolvedTenant, resolvedAgent, resolved
         payload.classification === "destructive"
         ? payload.classification
         : null;
-    // AUDIT-04: content-free-by-construction at the sink. First DIGEST any
+    // Content-free-by-construction at the sink. First DIGEST any
     // free-form-content key (`value`/`commandPrefix` — arbitrary content that the
-    // pattern redactor misses for no-prefix secrets, the H1/H2 review leak), then
+    // pattern redactor misses for no-prefix secrets), then
     // scrub the remaining free-map. A planted value cannot survive either step.
     const scrubbed = payload.metadata !== undefined
         ? sanitizeForPersistence(digestFreeFormContentKeys(payload.metadata))
@@ -165,7 +178,7 @@ export function auditEventToRow(payload, resolvedTenant, resolvedAgent, resolved
         action: payload.actionType,
         actor: resolvedAgent ?? "system",
         outcome: payload.outcome,
-        severity: kindToSeverity(kind),
+        severity: kindToSeverity(kind, { outcome: payload.outcome, classification }),
         traceId: resolvedTraceId ?? null,
         refs: scrubbed !== undefined ? JSON.stringify(scrubbed) : null,
     };
@@ -177,7 +190,7 @@ export function auditEventToRow(payload, resolvedTenant, resolvedAgent, resolved
  * content-free at the emit site — but is STILL routed through
  * `sanitizeForPersistence` uniformly (one chokepoint). `(tenant, agent,
  * traceId)` are resolved by the caller from the trace context (else the `''`
- * system-scope sentinel; the event is NEVER dropped — decision #2).
+ * system-scope sentinel; the event is NEVER dropped).
  */
 export function buildAuditRow(args) {
     // Same content-free-by-construction chokepoint as auditEventToRow: DIGEST any
@@ -194,7 +207,7 @@ export function buildAuditRow(args) {
         action: args.action,
         actor: args.actor,
         outcome: args.outcome,
-        severity: kindToSeverity(args.kind),
+        severity: kindToSeverity(args.kind, { outcome: args.outcome, classification: null }),
         traceId: args.traceId ?? null,
         refs: JSON.stringify(scrubbed),
     };
@@ -220,11 +233,11 @@ export function wireAuditSink(deps) {
     const rotateAtBytes = logRotation?.maxSizeBytes ?? AUDIT_JSONL_DEFAULT_MAX_SIZE_BYTES;
     const keepRotated = logRotation?.maxFiles ?? AUDIT_JSONL_DEFAULT_MAX_FILES;
     /**
-     * The three audit sinks per event (AUDIT-01/02/03): the SQLite buffer, the
+     * The three audit sinks per event: the SQLite buffer, the
      * 0600 security-audit.jsonl line, and the `.audit()` (level 35) log. The row
      * is ALREADY scrubbed (the metadata free-map was routed through
      * `sanitizeForPersistence` in the row-builder). The JSONL append is try/caught
-     * (AGENTS §2.7 / T-176-11): a sink failure logs ERROR with hint+errorKind and
+     * (AGENTS §2.7): a sink failure logs ERROR with hint+errorKind and
      * NEVER throws past the subscriber — the SQLite half still drains, and a
      * tenant-less event is persisted system-scoped, never dropped.
      */
@@ -250,7 +263,7 @@ export function wireAuditSink(deps) {
                 }, "audit-jsonl-append-failed");
             }
         }
-        // AUDIT-03: the now-activated dormant level-35 audit line (scrubbed row).
+        // The level-35 audit line (scrubbed row).
         // `.audit()` is a CUSTOM Pino level registered ONLY by the @comis/infra
         // logger factory — `logger?.audit?.(...)` (method optional-chain, not just
         // the null-guard `logger?.`) so a logger BUILT WITHOUT that factory (a test
@@ -258,7 +271,7 @@ export function wireAuditSink(deps) {
         // rather than crashing the audit subscriber with `audit is not a function`.
         // The DURABLE audit (the obs_audit_events row + security-audit.jsonl above)
         // already fired, so the audit trail stays intact; production uses the infra
-        // logger (has `.audit()`) → behavior is byte-identical (the line still fires).
+        // logger (has `.audit()`) → the line still fires.
         logger?.audit?.({ kind: row.kind, outcome: row.outcome, agentId: row.agentId, traceId: row.traceId, refs: row.refs }, row.kind);
     }
     // audit:event carries its own tenantId/agentId; fall back to the trace ctx /
@@ -299,10 +312,10 @@ export function wireAuditSink(deps) {
             refs: { source: payload.source, riskLevel: payload.riskLevel, patternCount: payload.patterns.length },
         }));
     });
-    // security:ssrf_blocked (SSRF-AUDIT, hermes-usecases 2026-06-25) — the blocked URL's
+    // security:ssrf_blocked — the blocked URL's
     // ORIGIN (scheme+host+port; secret-free by construction — `new URL().origin` drops the
     // path/query/fragment/userinfo) + the closed reason enum. Mirrors command:blocked; gives
-    // `comis security audit-log` the SSRF-attempt trail an SSRF block previously left no row for.
+    // `comis security audit-log` an SSRF-attempt trail for each SSRF block.
     eventBus.on("security:ssrf_blocked", (payload) => {
         const ctx = tryGetContext();
         persistAuditRow(buildAuditRow({
@@ -383,7 +396,7 @@ export function wireAuditSink(deps) {
             refs: { pattern: payload.pattern },
         }));
     });
-    // command:blocked — AUDIT-04 / H2: the `commandPrefix` is the first-200-of
+    // command:blocked — the `commandPrefix` is the first-200-of
     // the COMMAND BODY (content) and routinely carries inline secrets
     // (`mysql -p<pass>`, `psql postgres://user:pw@host`). Do NOT persist it in the
     // durable row/JSONL; emit a content-free `commandSha256` (12 hex) +

package/node_modules/@comis/daemon/dist/observability/obs-autonomy-rows.d.ts

@@ -1,20 +1,19 @@
 /**
- * FLEET-03 (v2.30 Phase 220-01) autonomy/durable-run lifecycle row-builders.
+ * Autonomy/durable-run lifecycle row-builders.
  *
  * The four typed durable/autonomy events — orphaned / resumed / revoked / killed —
- * mapped to content-free `health_signal` diagnostic rows (the GENQ-01 / ORCH-OBS
- * clone: a new `signal:` label rides the EXISTING `obs_diagnostics`
- * `health_signal` category, NO migration). Extracted into this sibling module —
- * mirroring `obs-orchestration-rows.ts` — to keep `obs-persistence-wiring.ts`
- * under the 800-line cap (the Plan 01/03 file-size-extraction precedent).
+ * mapped to content-free `health_signal` diagnostic rows (a new `signal:` label
+ * rides the EXISTING `obs_diagnostics` `health_signal` category, NO migration).
+ * Extracted into this sibling module — mirroring `obs-orchestration-rows.ts` —
+ * to keep `obs-persistence-wiring.ts` under the 800-line cap.
  * Re-exported by the wiring file so the public API (and the test imports) stay
  * byte-identical.
  *
- * CONTENT-FREE by construction (T-220-01 / T-220-02): each `details` carries the
+ * CONTENT-FREE by construction: each `details` carries the
  * closed `signal` label + the closed reason ENUM (orphaned) / the integer COUNT
  * (revoked/killed) / the numeric stepIndex (resumed) + the rootRunId (an id)
  * ONLY — NEVER the engine's free-text orphan reason, a lease bearer/selector, or
- * any body (§2.7). The free-text orphan reason stays on the WARN log / notify at
+ * any body (AGENTS.md §2.7). The free-text orphan reason stays on the WARN log / notify at
  * the source (durable-resume-engine.ts); it never reaches the typed event or this
  * row. The report is therefore SAFE to paste into a review.
  *
@@ -36,16 +35,26 @@ export declare function durableOrphanedEventToRow(payload: EventMap["durable:orp
 /**
  * Map a `durable:resumed` event to a `health_signal` diagnostic row. A resumed
  * in-flight run is healthy crash-recovery, not degradation, so severity:"info" —
- * a resume does NOT inflate the fleet degrade count (the A2 / BENIGN_DAG_DEGRADED
- * precedent). `details` carries the numeric stepIndex (the resumed checkpoint
+ * a resume does NOT inflate the fleet degrade count (the same benign-reason
+ * discipline as BENIGN_DAG_DEGRADED_REASONS). `details` carries the numeric stepIndex (the resumed checkpoint
  * position) + the rootRunId ONLY.
  */
 export declare function durableResumedEventToRow(payload: EventMap["durable:resumed"]): DiagnosticRow;
+/**
+ * Map an `autonomy:budget_warning` event to a `health_signal` diagnostic row —
+ * the PRE-TRIP budget signal (a per-root limb crossed 80% of its cap). Fired
+ * once per (root, limb); severity:"warning" so the fleet lens surfaces a
+ * session approaching its autonomy budget BEFORE the abort wedges it (the trip
+ * itself arrived with zero warning, observed live). `details` carries the
+ * closed limb/unit labels + the numeric spent/cap/fraction + the rootRunId
+ * ONLY — never a body.
+ */
+export declare function autonomyBudgetWarningEventToRow(payload: EventMap["autonomy:budget_warning"]): DiagnosticRow;
 /**
  * Map an `autonomy:revoked` event to a `health_signal` diagnostic row. A
  * cooperative lease/tree revoke had no fleet surface (it was INFO-log-only).
  * `details` carries the revoked COUNT + the rootRunId ONLY — NEVER the lease
- * bearer, selector, or any body (T-220-02). severity:"warning" (an operator
+ * bearer, selector, or any body. severity:"warning" (an operator
  * intervention an admin must see in the fleet roll-up).
  */
 export declare function autonomyRevokedEventToRow(payload: EventMap["autonomy:revoked"]): DiagnosticRow;
@@ -53,14 +62,14 @@ export declare function autonomyRevokedEventToRow(payload: EventMap["autonomy:re
  * Map an `autonomy:killed` event to a `health_signal` diagnostic row. A hard
  * kill (run.kill) flips durable status to 'revoked' INDISTINGUISHABLY from a
  * cooperative revoke in the table — so the DISTINCT `autonomy_killed` signal
- * label is the ONLY way the fleet lens separates killed from revoked counts
- * (RESEARCH OQ1). `details` carries the killed COUNT + the rootRunId ONLY.
+ * label is the ONLY way the fleet lens separates killed from revoked counts.
+ * `details` carries the killed COUNT + the rootRunId ONLY.
  * severity:"warning".
  */
 export declare function autonomyKilledEventToRow(payload: EventMap["autonomy:killed"]): DiagnosticRow;
 /**
- * FLEET-02 (Phase 220-05): map an `autonomy:denial_breaker_tripped` event to a
- * `health_signal` diagnostic row. A Phase-217 capability-DENIAL breaker trip
+ * Map an `autonomy:denial_breaker_tripped` event to a
+ * `health_signal` diagnostic row. A capability-DENIAL breaker trip
  * (N consecutive floor-blocks aborted + killed the run tree) had NO fleet surface:
  * the trip is never a session endReason and never a `breakerTripCount`, so the
  * fleet lens's `breakerTrips` read-back (← `breakerTripTotal`, the TOOL-failure