comisai 1.0.45 → 1.0.46

package/node_modules/@comis/daemon/dist/wiring/setup-capability-endpoint-boot.js

@@ -1,9 +1,8 @@
 // SPDX-License-Identifier: Apache-2.0
 /**
  * `constructCapabilityLayer` — the daemon-wide capability-lease construction +
- * ACTIVATION (Phase 211 ENDPOINT-01/03 → Phase 212 Plan 05 dormancy activation),
- * extracted from `daemon.ts`'s boot WITHOUT adding a net line to daemon.ts
- * (line-cap ≤ 3000, arch invariant — the daemon-side wiring all lives here).
+ * ACTIVATION, extracted from `daemon.ts`'s boot WITHOUT adding a net line to
+ * daemon.ts (line-cap ≤ 3000, arch invariant — the daemon-side wiring all lives here).
  *
  * Mirrors the credential broker's conditional construction (gated on
  * `executor.broker`): construct ONE daemon-wide `LeaseManager` + the loopback
@@ -12,12 +11,11 @@
  * (so deny-by-origin + requireCapability + the unknown-method `!handler` throw
  * all fire automatically).
  *
- * Phase 212 (the dormancy activation — Gap 3) flips the layer from constructed-
- * but-DORMANT to ACTIVE, all inside this helper so daemon.ts only KEEPS the
- * returned handle:
- *   1. The daemon-side `tool.invoke` executor (`createToolInvokeExecutor`, Plan
- *      02) is constructed HERE from the injected shipped cores (read/grep/find/
- *      ls/jq + web_search) + the agent workspace resolver + the Plan-03 ResultRef
+ * Activation flips the layer from constructed-but-DORMANT to ACTIVE, all inside
+ * this helper so daemon.ts only KEEPS the returned handle:
+ *   1. The daemon-side `tool.invoke` executor (`createToolInvokeExecutor`) is
+ *      constructed HERE from the injected shipped cores (read/grep/find/ls/jq +
+ *      web_search) + the agent workspace resolver + the ResultRef
  *      `materialize` writer, and injected into `createCapabilityEndpoint` via its
  *      deps — MIRRORING how the `LeaseManager` is constructed-and-injected. NOT a
  *      mutable setter on the handle: construction-time injection keeps the lease-
@@ -27,27 +25,27 @@
  *      socket; the lease is per-spawn) — the boot log now reports `active: true`.
  * The returned handle's `endpoint.stopSocket` is threaded into `setupShutdown`
  * (mirrors the broker teardown). The bwrap per-jail bind is the orchestrate
- * runner's (Plan 04) — this helper owns the daemon-wide socket lifecycle.
+ * runner's — this helper owns the daemon-wide socket lifecycle.
  *
  * @module
  */
-import { resolveAutonomy, safePath, createOutputGuard, formatSessionKey, } from "@comis/core";
+import { resolveAutonomy, permitsMcpTool, safePath, createOutputGuard, formatSessionKey, } from "@comis/core";
 import { createLeaseManager } from "@comis/infra";
 import { createBoundedAutonomy } from "../autonomy/bounded-autonomy.js";
-// Phase 217-05 (UNATT/BREAK/EVICT): the never-hang control plane the dispatch
-// chokepoint reads — the per-rootRunId denial breaker (BREAK-01/02), the evicted-
-// rootRunId set (EVICT-01/03), and the content-free escalate NotifyFn (UNATT-03).
+// The never-hang control plane the dispatch chokepoint reads — the per-rootRunId
+// denial breaker, the evicted-rootRunId set, and the content-free escalate NotifyFn.
 // All three are constructed here (alongside BoundedAutonomy) and held on the cap
 // handle so daemon.ts threads them onto the dispatch deps.
 import { createDenialBreaker } from "../autonomy/denial-breaker.js";
 import { createEvictRegistry } from "../autonomy/evict-registry.js";
 import { namespacePreflight } from "@comis/skills";
-import { createOrchestrateExecutorCores, createResultRefStore, } from "@comis/skills/tools";
-import { createCapabilityEndpoint } from "./setup-capability-endpoint.js";
+import { createOrchestrateExecutorCores, createResultRefStore, CHECKPOINT_TTL_MS, } from "@comis/skills/tools";
+import { readFileSync } from "node:fs";
+import { createCapabilityEndpoint, createReplayRecorder, } from "./setup-capability-endpoint.js";
 import { createToolInvokeExecutor } from "./setup-tool-invoke-executor.js";
 /**
- * Build the `resolveRootRunId(sessionKey) → rootRunId` resolver (Phase 213-08,
- * BUDGET-01/02) over a late-bound budget holder + a session→rootRunId index. The
+ * Build the `resolveRootRunId(sessionKey) → rootRunId` resolver over a late-bound
+ * budget holder + a session→rootRunId index. The
  * resolver is a STABLE closure created EARLY (before setupAgents/setupSchedulers,
  * which hold it) and reads `holder.current` at call time — by the time a turn runs,
  * the cap layer has populated it.
@@ -56,7 +54,7 @@ import { createToolInvokeExecutor } from "./setup-tool-invoke-executor.js";
  * mint a SYNTHETIC per-session root `root-session-<formattedKey>` and `registerRoot`
  * it on first use (via the holder). The synthetic fallback is what bounds a
  * TOP-LEVEL (non-spawned) self-spawning loop — the budget's token/wall-clock limbs
- * then key on a stable id for ANY run, not only orchestrate children (criterion #2).
+ * then key on a stable id for ANY run, not only orchestrate children.
  * A synthetic root has no real lease, so a synthetic leaseId is recorded (the
  * correlation index is content-free; the meter only needs the wall-clock anchor).
  * Idempotent: the same session resolves to the SAME id on every call.
@@ -93,10 +91,10 @@ function buildWebSearchConfig(keys) {
     };
 }
 /**
- * Construct the daemon-side `tool.invoke` executor (Plan 02) from the shipped
- * cores + the workspace resolver + the ResultRef store (Plan 05). Returns
+ * Construct the daemon-side `tool.invoke` executor from the shipped
+ * cores + the workspace resolver + the ResultRef store. Returns
  * `undefined` when the activation inputs (skillsLogger + workspaceDirs +
- * defaultWorkspaceDir) are not all supplied (the 211 boot-gate unit tests) — the
+ * defaultWorkspaceDir) are not all supplied (the boot-gate unit tests) — the
  * endpoint then has NO executor and an executor-route call throws a clear wiring
  * error (never a silent no-op).
  *
@@ -104,9 +102,9 @@ function buildWebSearchConfig(keys) {
  * call to the store's `(payload, toolName, ctx)`: the lease's `agentId` resolves
  * the offloading agent's workspace, so an over-threshold daemon-side return
  * (e.g. a large `web_fetch`) is written to THAT agent's `results/` and the jailed
- * script slices it in-jail via `jq`/`read` over the ref (REF-01/02). A per-call
+ * script slices it in-jail via `jq`/`read` over the ref. A per-call
  * `runId` scopes the on-disk basename; the orchestrate runner's `gcRun`/
- * `cleanupRun` reaps the agent's `results/` on its run end (REF-03).
+ * `cleanupRun` reaps the agent's `results/` on its run end.
  */
 function buildToolInvokeExecutor(deps, resultRefStore, boundedAutonomy) {
     const { skillsLogger, workspaceDirs, defaultWorkspaceDir, daemonLogger } = deps;
@@ -114,8 +112,8 @@ function buildToolInvokeExecutor(deps, resultRefStore, boundedAutonomy) {
         return undefined;
     const now = deps.clock.now;
     const resolveWorkspace = (agentId) => workspaceDirs.get(agentId) ?? defaultWorkspaceDir;
-    // The shipped read/grep/find/ls/jq + web_search cores (skills) — the real cores
-    // Plan 02 left injected. Built ONCE (the web-search cache is factory-shared).
+    // The shipped read/grep/find/ls/jq + web_search cores (skills).
+    // Built ONCE (the web-search cache is factory-shared).
     const cores = createOrchestrateExecutorCores({
         logger: skillsLogger,
         webSearchConfig: buildWebSearchConfig(deps.webSearchKeys),
@@ -124,10 +122,10 @@ function buildToolInvokeExecutor(deps, resultRefStore, boundedAutonomy) {
         resolveWorkspace,
         fileExecutors: cores.fileExecutors,
         webSearch: cores.webSearch,
-        // Phase 213 (BUDGET-03): the real per-root meter for the FLAT web $ charge.
+        // The real per-root meter for the FLAT web $ charge.
         // The cost-bearing web pair (web_fetch/web_search) charges against the tree
         // root's budget — estUsd:0 here (the executor does not price the fetch; the
-        // limb that bites is the bridge's per-LLM-call reserve in Plan 08), but the
+        // limb that bites is the bridge's per-LLM-call reserve), but the
         // call IS metered (the meter increments / the wall-clock + token limbs still
         // gate it). A lease with no rootRunId (older/test wiring) skips the charge.
         budgetHook: (_estimate, lease) => {
@@ -136,7 +134,7 @@ function buildToolInvokeExecutor(deps, resultRefStore, boundedAutonomy) {
             boundedAutonomy.reserveBudget(lease.rootRunId, "_web", "_web", 0, 0);
         },
         // Over-threshold returns offload to the OFFLOADING agent's workspace
-        // results/ (REF-01) — the lease (threaded by the executor) gives the agentId.
+        // results/ — the lease (threaded by the executor) gives the agentId.
         materialize: async (payload, toolName, lease) => {
             const workspacePath = resolveWorkspace(lease.agentId);
             const runId = `tinvoke-${now().toString(36)}`;
@@ -150,14 +148,134 @@ function buildToolInvokeExecutor(deps, resultRefStore, boundedAutonomy) {
             // anything that is not a ResultRef.
             return result !== undefined && "ref" in result ? result : undefined;
         },
+        // The daemon-wide MCP manager (threaded from CapabilityLayerDeps via the
+        // daemon.ts caller) — the executor's `case "mcp"` dispatches through its
+        // `callTool` on the daemon's network (the jail stays `--unshare-net`).
+        mcpClientManager: deps.mcpClientManager,
+        // The layer-2 inbound MCP allowlist (232-02 `permitsMcpTool`), resolved PER
+        // agentId from THAT agent's `autonomy.mcp` block (not a global — D3 per-agent).
+        // Prototype-safe lookup: `agentId` crosses from the lease, so iterate own
+        // entries rather than indexing the Record with it. Absent autonomy/mcp ⇒
+        // `permitsMcpTool` never runs ⇒ deny by absence (the surface stays dark).
+        mcpAllowlist: {
+            permits: (agentId, server, tool) => {
+                const agentCfg = Object.entries(deps.agents).find(([id]) => id === agentId)?.[1];
+                const mcpCfg = agentCfg?.autonomy?.mcp;
+                return mcpCfg !== undefined && permitsMcpTool(mcpCfg, server, tool);
+            },
+        },
+        // The default-OFF write SURFACE gate (NG2): `orch:write` is a FLOOR cap (held
+        // by every standard/unattended/max agent), but the typed write surface must be
+        // an explicit opt-in. Resolved PER agentId from THAT agent's
+        // `autonomy.write === true` (prototype-safe own-entry lookup, mirroring
+        // mcpAllowlist). Absent/false ⇒ the executor denies the write dispatch even
+        // though the lease holds orch:write — restoring the read-only-by-default surface.
+        writeSurfaceEnabled: (agentId) => {
+            const agentCfg = Object.entries(deps.agents).find(([id]) => id === agentId)?.[1];
+            return agentCfg?.autonomy?.write === true;
+        },
+        // The default-OFF RESUME surface gate (RESUME-01/04, T-233-04): checkpoint/
+        // resume reuse the orch:write/orch:read FLOOR caps, so the cap is NOT the gate —
+        // this predicate is (default-off `autonomy.durability.orchestrateResume`).
+        // Resolved PER agentId from THAT agent's nested durability toggle
+        // (prototype-safe own-entry lookup, EXACTLY mirroring writeSurfaceEnabled).
+        // Absent/false ⇒ the executor denies BOTH arms even though the lease holds the
+        // floor cap — deny-by-absence, fail-closed.
+        orchestrateResumeEnabled: (agentId) => {
+            const agentCfg = Object.entries(deps.agents).find(([id]) => id === agentId)?.[1];
+            return agentCfg?.autonomy?.durability?.orchestrateResume === true;
+        },
+        // The durable-run store — checkpoint stamps checkpointRef onto the run's row
+        // (COALESCE-preserve; the store's upsertCheckpoint never writes outward_step) and
+        // resume reads the last checkpointRef back. Absent ⇒ checkpoint/resume degrade.
+        ...(deps.durableRuns ? { durableRuns: deps.durableRuns } : {}),
+        // The checkpoint materialize bridge (RESUME-05): a distinguished, LONGER-TTL
+        // (CHECKPOINT_TTL_MS) kind:json ResultRef, keyed on lease.rootRunId so resume
+        // finds it after a restart. The SAME per-file (8 MiB) + per-run aggregate caps
+        // apply (the store enforces them regardless of TTL). A non-ResultRef return
+        // (over-cap refuse / failed write) surfaces as undefined ⇒ the executor refuses
+        // the checkpoint content-free.
+        materializeCheckpoint: async (stateJson, lease) => {
+            const workspacePath = resolveWorkspace(lease.agentId);
+            const runId = lease.rootRunId ?? `checkpoint-${now().toString(36)}`;
+            const result = await resultRefStore.materialize(stateJson, "orchestrate_checkpoint", {
+                workspacePath,
+                runId,
+                nowMs: now(),
+                ttlMs: CHECKPOINT_TTL_MS,
+            });
+            return result !== undefined && "ref" in result ? result : undefined;
+        },
+        // Load a checkpoint blob back for resume — a workspace-confined read of the
+        // recorded ResultRef.ref. safePath refuses any escape; a missing/absent file
+        // (expired / GC'd) degrades to undefined ⇒ resume returns null (never a throw).
+        loadCheckpoint: async (ref, lease) => {
+            const workspacePath = resolveWorkspace(lease.agentId);
+            try {
+                const abs = safePath(workspacePath, ref);
+                // eslint-disable-next-line security/detect-non-literal-fs-filename -- safePath-confined to the agent's workspace; ref is a store-minted results/ path
+                return readFileSync(abs, "utf8");
+            }
+            catch {
+                return undefined;
+            }
+        },
+        logger: daemonLogger,
+    });
+}
+/**
+ * Build the content-free replay recorder over the SAME workspace resolver +
+ * ResultRef store the tool-invoke executor uses. The recorder is the SOLE writer
+ * of `<workspace>/results/replay.jsonl`; injected into the endpoint it appends one
+ * content-free `{seq, method, paramsDigest} → pointer` line per SUCCESSFUL cap
+ * dispatch (INV-5), so a later deterministic replay has recorded results to serve
+ * back. Returns `undefined` when the workspace inputs are absent (the boot-gate
+ * unit tests) — the endpoint then records nothing (byte-identical to a run without
+ * the resume surface). Recording is ALSO gated per-run on
+ * `autonomy.durability.orchestrateResume` (default-off), so a wired-but-disabled
+ * agent still records nothing.
+ */
+function buildReplayRecorder(deps, resultRefStore) {
+    const { workspaceDirs, defaultWorkspaceDir, daemonLogger } = deps;
+    if (!workspaceDirs || defaultWorkspaceDir === undefined)
+        return undefined;
+    const now = deps.clock.now;
+    const resolveWorkspace = (agentId) => workspaceDirs.get(agentId) ?? defaultWorkspaceDir;
+    return createReplayRecorder({
+        // Default-OFF per-run gate: record ONLY when orchestrateResume is on for the
+        // lease's agent (prototype-safe own-entry lookup, EXACTLY mirroring the
+        // executor's orchestrateResumeEnabled predicate). Absent/false ⇒ a full no-op.
+        isEnabled: (agentId) => {
+            const agentCfg = Object.entries(deps.agents).find(([id]) => id === agentId)?.[1];
+            return agentCfg?.autonomy?.durability?.orchestrateResume === true;
+        },
+        // The SAME resolver the tool-invoke executor uses — the recorded pointer files +
+        // replay.jsonl live under the offloading agent's jailed workspace results/ dir.
+        resolveWorkspace,
+        // Bind each recorded result to the ResultRef store under a fixed tool name so the
+        // bytes live in the jailed results/ under the same caps/TTL/GC. A ResultRef maps
+        // to its pointer; an over-cap { error } / undefined passes through (honest-degrade).
+        materialize: async (payload, ctx) => {
+            const result = await resultRefStore.materialize(payload, "orchestrate_replay", {
+                workspacePath: ctx.workspacePath,
+                runId: ctx.runId,
+                nowMs: ctx.nowMs,
+                ...(ctx.ttlMs !== undefined ? { ttlMs: ctx.ttlMs } : {}),
+            });
+            return result !== undefined && "ref" in result ? { ref: result.ref } : result;
+        },
+        nowMs: now,
+        // A checkpoint-length TTL so a resumable run stays replayable (mirrors the
+        // checkpoint materialize's TTL).
+        ttlMs: CHECKPOINT_TTL_MS,
         logger: daemonLogger,
     });
 }
 /**
  * Construct the daemon-wide capability layer (gated on an autonomy-bearing
  * profile, mirroring how the broker is gated on `executor.broker`), ACTIVATE it
- * (inject the executor + start the 0600 socket — Phase 212 Gap 3), AND run the
- * JAIL-03 host namespace preflight once at boot. The cap handle is `undefined`
+ * (inject the executor + start the 0600 socket), AND run the
+ * host namespace preflight once at boot. The cap handle is `undefined`
  * when no agent is autonomy-bearing (so the lease layer + cap.sock are absent);
  * the preflight runs unconditionally (it is a host capability check).
  *
@@ -168,7 +286,7 @@ export async function constructCapabilityLayer(deps) {
     const { agents, rpcCall, clock, dataDir, daemonLogger } = deps;
     const preflight = namespacePreflight();
     const { namespacePreflightOk } = preflight;
-    // Phase 213-08 (BUDGET-01/02): the rootRunId resolver over the late-bound holder
+    // The rootRunId resolver over the late-bound holder
     // + the session→rootRunId index. Built whenever a holder is supplied (daemon.ts
     // shares the SAME holder + index it threads into setupAgents early) — the resolver
     // is a stable closure that reads `holder.current` at call time.
@@ -186,16 +304,16 @@ export async function constructCapabilityLayer(deps) {
     if (!autonomyBearingConfig) {
         return { capEndpointHandle: undefined, capEndpointStop: undefined, namespacePreflightOk };
     }
-    // Phase 213-08 (RATE-02): use the daemon-supplied LeaseManager when provided
+    // Use the daemon-supplied LeaseManager when provided
     // (built EARLY in daemon.ts so setupSchedulers' cron-fire mint shares the SAME
-    // instance — schedulers run before this layer), else construct one here (the 211
+    // instance — schedulers run before this layer), else construct one here (the
     // boot-gate path / older callers). ONE daemon-wide LeaseManager either way.
     const leaseManagerDeps = { clock };
     const leaseManager = deps.leaseManager ?? createLeaseManager(leaseManagerDeps);
-    // Phase 213: construct the daemon-wide BoundedAutonomy service alongside the
+    // Construct the daemon-wide BoundedAutonomy service alongside the
     // LeaseManager (the construct-and-inject precedent). The cronJobCount provider
     // (daemon.ts binds it to the per-agent CronScheduler.getJobs().length) is the
-    // RATE-02 count source the cap endpoint reaches through `cronCount`.
+    // count source the cap endpoint reaches through `cronCount`.
     const boundedAutonomy = createBoundedAutonomy({
         clock,
         timers: deps.timers,
@@ -203,29 +321,50 @@ export async function constructCapabilityLayer(deps) {
         config: autonomyBearingConfig,
         ...(deps.cronJobCount ? { cronJobCount: deps.cronJobCount } : {}),
         logger: daemonLogger,
+        // The pre-trip budget signal: 80% of any per-root limb → the fleet lens
+        // (health_signal row via the persistence wiring) BEFORE the abort wedges
+        // the session. Counts + closed labels only. Absent container (boot-gate
+        // unit tests) ⇒ no emit — the meter still enforces.
+        ...(deps.container !== undefined
+            ? {
+                onLimbWarning: (w) => 
+                // The container's structural type narrows emit to the audit
+                // events; the budget warning rides the SAME full TypedEventBus the
+                // daemon passes (AppContainer.eventBus) — widen at this one seam.
+                deps.container.eventBus.emit("autonomy:budget_warning", {
+                    rootRunId: w.rootRunId,
+                    limb: w.limb,
+                    spent: w.spent,
+                    cap: w.cap,
+                    unit: w.unit,
+                    fraction: w.cap > 0 ? Math.min(1, w.spent / w.cap) : 1,
+                    timestamp: clock.now(),
+                }),
+            }
+            : {}),
     });
-    // Phase 217-05 (BREAK-01/02): the daemon-wide denial breaker, keyed per
+    // The daemon-wide denial breaker, keyed per
     // rootRunId. denialBreakerN is sourced from the resolved autonomy-bearing config
-    // (LOW-1 — NOT a non-existent `agents[defaultAgentId]` lookup; this file has no
+    // (NOT a non-existent `agents[defaultAgentId]` lookup; this file has no
     // defaultAgentId local). A single daemon-wide breaker is acceptable: it keys
     // per-rootRunId, mirroring the single daemon-wide LeaseManager + BoundedAutonomy.
     const denialBreaker = createDenialBreaker({
         denialBreakerN: autonomyBearingConfig.denialBreakerN,
         logger: daemonLogger,
     });
-    // Phase 217-05 (EVICT-01/03): the daemon-wide evicted-rootRunId set. The SAME
+    // The daemon-wide evicted-rootRunId set. The SAME
     // instance is read by the chokepoint (isEvicted → demote to "default") and
     // written by the autonomy.evict admin handler (mark) — wired via the dispatch
-    // deps spread (activating Plan 04's conditionally-registered handler).
+    // deps spread, activating the conditionally-registered evict handler.
     const evictRegistry = createEvictRegistry({ logger: daemonLogger });
-    // Phase 217-05 (UNATT-03): the content-free escalate NotifyFn. A synchronous
+    // The content-free escalate NotifyFn. A synchronous
     // WARN (ids/enums/hint only, NEVER a message body) — mirrors the durable-resume
     // notify (setup-durable-resume.ts). The chokepoint fires it fire-and-forget (the
     // deny still re-throws immediately so the run never hangs). No ApprovalGate is in
     // scope at this boot seam, so the WARN + the deny's existing audit emit together
-    // meet UNATT-03's out-of-band + auditable bar.
+    // meet the out-of-band + auditable bar.
     const escalate = (opts) => daemonLogger.warn({ kind: opts.kind, rootRunId: opts.rootRunId, hint: opts.hint, errorKind: "internal" }, `Autonomy escalation: ${opts.reason}`);
-    // Phase 213-08 (BUDGET-01/02): POPULATE the late-bound budget holder with the
+    // POPULATE the late-bound budget holder with the
     // narrow budget port now that the service exists — the seam the bridge reads
     // (the bridge + schedulers were built BEFORE this layer; they hold the holder
     // and read `current` at fire time). reserveBudget/registerRoot are bound to the
@@ -234,7 +373,7 @@ export async function constructCapabilityLayer(deps) {
         deps.boundedAutonomyHolder.current = {
             reserveBudget: (rootRunId, provider, model, estUsd, estTokens) => boundedAutonomy.reserveBudget(rootRunId, provider, model, estUsd, estTokens),
             registerRoot: (rootRunId, leaseId, parentLeaseId) => boundedAutonomy.registerRoot(rootRunId, leaseId, parentLeaseId),
-            // KEYING-01: the bridge calls this once per turn to re-anchor an interactive
+            // The bridge calls this once per turn to re-anchor an interactive
             // session root's wall-clock + token limbs (a session root acquires no spawn
             // slot, so it would otherwise accumulate across the whole conversation and
             // falsely abort turns after wallClockMs). A no-op when a live spawn shares the
@@ -242,15 +381,15 @@ export async function constructCapabilityLayer(deps) {
             evictRootIfIdle: (rootRunId) => boundedAutonomy.evictRootIfIdle(rootRunId),
         };
     }
-    // The daemon-wide OutputGuard the mint registers each bearer in (Pitfall 1 —
-    // ENDPOINT-03). setup-tools reads it off the handle for the CapabilityMintDeps.
+    // The daemon-wide OutputGuard the mint registers each bearer in (Pitfall 1).
+    // setup-tools reads it off the handle for the CapabilityMintDeps.
     const outputGuard = createOutputGuard();
-    // The Plan-03 ResultRef store the executor offloads over-threshold returns to.
+    // The ResultRef store the executor offloads over-threshold returns to.
     const resultRefStore = createResultRefStore({ logger: deps.skillsLogger ?? daemonLogger });
     // The cap socket path lives under the data dir, mirroring broker.sock's
     // ephemeral lifecycle. The orchestrate runner binds it per jail; the daemon-
     // wide endpoint listens on it once (activated below).
-    // Phase 212 Gap 3: ACTIVATE the cap layer. A cap-socket setup failure (an
+    // ACTIVATE the cap layer. A cap-socket setup failure (an
     // unusable dataDir, or the unix socket cannot bind) must NOT crash the daemon
     // boot — autonomy is an add-on, so it degrades HONESTLY (no cap layer + a loud
     // WARN; the absent handle downshifts the surface) while the daemon keeps serving
@@ -262,11 +401,16 @@ export async function constructCapabilityLayer(deps) {
         // (NOT a mutable setter on a security boundary). The bounded-autonomy service
         // backs the executor's real budgetHook (the flat web charge).
         const toolInvokeExecutor = buildToolInvokeExecutor(deps, resultRefStore, boundedAutonomy);
-        // Thread the daemon logger so the socket boundary is observable (WR-02): a
+        // Step 1b: build the content-free replay recorder over the SAME workspace
+        // resolver + ResultRef store, and inject it below — the SOLE writer of
+        // results/replay.jsonl. Without this, recordReplay short-circuits on every
+        // dispatch and a later deterministic replay diverges on the first cap call.
+        const replayRecorder = buildReplayRecorder(deps, resultRefStore);
+        // Thread the daemon logger so the socket boundary is observable: a
         // post-listen server error and per-connection errors are logged with the
         // canonical err/errorKind/hint rather than silently swallowed. The
         // boundedAutonomy service drives the endpoint's rate-limit + cron self-ownership
-        // (RATE-01/02) and the resolved autonomy config supplies cronSelfMax.
+        // and the resolved autonomy config supplies cronSelfMax.
         const endpoint = createCapabilityEndpoint({
             leaseManager,
             rpcCall,
@@ -274,20 +418,23 @@ export async function constructCapabilityLayer(deps) {
             toolInvokeExecutor,
             boundedAutonomy,
             autonomyConfig: autonomyBearingConfig,
-            // AUDIT-01 (215): the socket per-cap audit's bus + tenant scope. Absent in
-            // the 211 boot-gate tests ⇒ socket audit is a no-op (honest degrade).
+            // The socket per-cap audit's bus + tenant scope. Absent in
+            // the boot-gate tests ⇒ socket audit is a no-op (honest degrade).
             ...(deps.container ? { container: deps.container } : {}),
-            // Phase 216 (HIGH-1): the durable store — the jail leg allocates a monotonic
+            // The durable store — the jail leg allocates a monotonic
             // _outwardStepIndex for an outward message method. Absent ⇒ pass-through.
             ...(deps.durableRuns ? { durableRuns: deps.durableRuns } : {}),
+            // The content-free replay recorder (REPLAY-01). Absent (boot-gate tests /
+            // no workspace) ⇒ recordReplay is a no-op, byte-identical to today.
+            ...(replayRecorder ? { replayRecorder } : {}),
         });
-        // Step 2: ACTIVATE — start the daemon-wide 0600 socket ONCE. 211 left this
-        // DORMANT (no startSocket; active:false). Now the cap surface is LIVE: a jailed
-        // orchestrate child reaches the endpoint over the bound socket.
+        // Step 2: ACTIVATE — start the daemon-wide 0600 socket ONCE. Construction
+        // leaves it DORMANT (no startSocket; active:false). Now the cap surface is LIVE:
+        // a jailed orchestrate child reaches the endpoint over the bound socket.
         await endpoint.startSocket(capSocketPath);
         daemonLogger.info({ submodule: "capability-endpoint", capSocketPath, active: true }, "Capability lease layer ACTIVE (0600 socket listening; executor wired; lease minted per spawn)");
         return {
-            // Phase 217-05: the never-hang control plane (denialBreaker/evictRegistry/
+            // The never-hang control plane (denialBreaker/evictRegistry/
             // escalate) rides the handle so daemon.ts threads it onto the dispatch deps.
             capEndpointHandle: {
                 leaseManager,
@@ -300,7 +447,7 @@ export async function constructCapabilityLayer(deps) {
                 escalate,
             },
             // The cap-socket teardown ALSO tears down the bounded-autonomy rate-limiter
-            // timers (clean shutdown — RATE-01's TTL-evict timers).
+            // timers (clean shutdown — the TTL-evict timers).
             capEndpointStop: async () => {
                 await endpoint.stopSocket();
                 boundedAutonomy.destroy();

package/node_modules/@comis/daemon/dist/wiring/setup-capability-endpoint.d.ts

@@ -1,9 +1,9 @@
 /**
  * `createCapabilityEndpoint` — the loopback capability endpoint that
- * authenticates the jailed script surface (ENDPOINT-01 / ENDPOINT-02; v8 §4.2).
+ * authenticates the jailed script surface.
  * A NEAR-CLONE of the in-process `createAgentRpcCall`: validate the bearer
- * (timing-safe, not-expired, not-revoked, audience-bound — 211-01) → STRIP the
- * attacker-controlled wire `_X` fields (ORIGIN-02) → inject `_capabilities` (from
+ * (timing-safe, not-expired, not-revoked, audience-bound) → STRIP the
+ * attacker-controlled wire `_X` fields → inject `_capabilities` (from
  * the VALIDATED LEASE, not `resolveAutonomy`) + `_agentId` → dispatch through the
  * SAME `createRpcDispatch` sink. Unlike the in-process path it MUST strip before
  * injecting (the params are RAW WIRE BYTES, not typed tool args).
@@ -17,19 +17,19 @@
  * order is load-bearing: a forged inbound `_X` is dropped first, so the injected
  * lease values are the ONLY ones the sink sees (the endpoint adds no new INTERNAL_FIELD_NAME).
  *
- * Phase 212 adds the `tool.invoke` ONE-ROUTE dispatch (`handleToolInvoke`): gates in
- * v8 §6.2 order — cap-map allow-list (unmapped → CapabilityDeniedError) → denylist →
- * deny-by-origin → requireCapability → route. The route split (Gap 1): `{kind:"rpc"}`
+ * The `tool.invoke` ONE-ROUTE dispatch (`handleToolInvoke`) gates in a fixed
+ * order — cap-map allow-list (unmapped → CapabilityDeniedError) → denylist →
+ * deny-by-origin → requireCapability → route. The route split: `{kind:"rpc"}`
  * tools strip-then-inject to the SAME sink; `{kind:"executor"}` tools route to the
  * injected `toolInvokeExecutor`. The lease audience binds tool.invoke to
- * TOOL_CAPABILITY_MAP[innerTool] (Pitfall 2) — a captured lease cannot dispatch a
- * tool whose cap it lacks. Phase 216 (HIGH-1): an OUTWARD message method gets a
+ * TOOL_CAPABILITY_MAP[innerTool] — a captured lease cannot dispatch a
+ * tool whose cap it lacks. An OUTWARD message method gets a
  * monotonic `_outwardStepIndex` allocated here (the exactly-once ledger key).
  *
  * @module
  */
 import { type ResolvedAutonomy, type DurableRunPort } from "@comis/core";
-import type { LeaseManager, ComisLogger } from "@comis/infra";
+import type { LeaseManager, LeaseInfo, ComisLogger } from "@comis/infra";
 import type { RpcCall } from "@comis/skills/platform-tools";
 import type { ExecuteToolInvoke } from "./setup-tool-invoke-executor.js";
 import type { BoundedAutonomy } from "../autonomy/bounded-autonomy.js";
@@ -51,7 +51,7 @@ import { type EmitCapabilityAuditDeps } from "../api/shared/emit-capability-audi
 export declare const DENYLISTED_RPC_METHODS: Readonly<Record<string, string>>;
 /** Deps for {@link createCapabilityEndpoint}. */
 export interface CapabilityEndpointDeps {
-    /** The daemon-wide LeaseManager (211-01) — validates the bearer per call. */
+    /** The daemon-wide LeaseManager — validates the bearer per call. */
     leaseManager: LeaseManager;
     /**
      * The single RPC dispatch sink (createRpcDispatch). Injecting `_agentId`
@@ -60,38 +60,38 @@ export interface CapabilityEndpointDeps {
      */
     rpcCall: RpcCall;
     /**
-     * The daemon logger for socket-boundary observability (WR-02 / §2.7). A cap
+     * The daemon logger for socket-boundary observability. A cap
      * socket is a boundary crossing, so a post-listen server error and a
      * per-connection error must be reconstructable from logs (with `err` +
      * `errorKind` + `hint`) rather than silently swallowed. Optional so the
      * deny-matrix unit tests can construct the endpoint without a logger; when
-     * absent the handlers degrade to a no-op (the pre-WR-02 behavior).
+     * absent the handlers degrade to a no-op (no boundary logging).
      */
     logger?: ComisLogger;
     /**
      * The daemon-side executor for the `{kind:"executor"}` tools of `tool.invoke`
-     * (read/grep/find/ls/jq + web_search/web_fetch — Gap 1, Phase 212). Constructed
-     * + injected in Plan 05's wiring. Optional so the rpc-route + deny-matrix unit
+     * (read/grep/find/ls/jq + web_search/web_fetch). Constructed
+     * + injected by the daemon wiring. Optional so the rpc-route + deny-matrix unit
      * tests can construct the endpoint without it; a `tool.invoke` whose route is
      * `{kind:"executor"}` requires it (a clear throw when absent — never a silent
      * no-op, since that would drop a legitimately-authorized call).
      */
     toolInvokeExecutor?: ExecuteToolInvoke;
     /**
-     * The daemon-wide bounded-autonomy service (Phase 213). `handleCapCall`
-     * consults it for the per-root + per-socket rate limit (RATE-01) and the cron
-     * self-ownership cap via `cronCount` (RATE-02). Optional so the deny-matrix unit
+     * The daemon-wide bounded-autonomy service. `handleCapCall`
+     * consults it for the per-root + per-socket rate limit and the cron
+     * self-ownership cap via `cronCount`. Optional so the deny-matrix unit
      * tests can construct the endpoint without it (the rate-limit + cron-cap limbs
      * are then inert — the endpoint still validates + strips + dispatches).
      */
     boundedAutonomy?: BoundedAutonomy;
     /**
-     * The resolved autonomy posture (Phase 213) — the `cronSelfMax` source the cron
+     * The resolved autonomy posture — the `cronSelfMax` source the cron
      * self-ownership cap reads. Optional alongside {@link boundedAutonomy}.
      */
     autonomyConfig?: ResolvedAutonomy;
     /**
-     * AUDIT-01 (Phase 215): the structural deps the per-cap audit emitter reads —
+     * The structural deps the per-cap audit emitter reads —
      * `container.eventBus` (for the audit:event + capability:audited emits) +
      * `container.config.tenantId` (the audit tenant scope). The daemon passes the
      * same `AppContainer` the dispatch sink already holds (the endpoint dispatches
@@ -102,12 +102,22 @@ export interface CapabilityEndpointDeps {
      * unaffected). NEVER fabricate when absent — degrade to no-audit, not a fake.
      */
     container?: EmitCapabilityAuditDeps["container"];
-    /** Phase 216 (HIGH-1): the durable-run store — the SOLE source of the monotonic
+    /** The durable-run store — the SOLE source of the monotonic
      *  `_outwardStepIndex` (allocateOutwardStep). For an OUTWARD message method the
      *  endpoint allocates a UNIQUE per-root index + injects it beside `_agentId` so the
-     *  Plan-05 wrap reads distinct `(rootRunId, stepIndex)` per send. Optional; absent ⇒
-     *  no index injected → the wrap is a pass-through (byte-identical pre-216). */
+     *  outward-send wrap reads distinct `(rootRunId, stepIndex)` per send. Optional; absent ⇒
+     *  no index injected → the wrap is a pass-through (no exactly-once ledger). */
     durableRuns?: DurableRunPort;
+    /**
+     * The content-free replay recorder (REPLAY-01). After a SUCCESSFUL dispatch the
+     * chokepoint hands it `(lease, method, wireParams, result)` → it appends ONE
+     * `{seq, method, paramsDigest} → pointer` line to the run's `results/replay.jsonl`
+     * (digests + pointers ONLY — INV-5). Optional + default-OFF: absent ⇒ NOTHING is
+     * recorded (the deny-matrix tests + every run without orchestrateResume are
+     * byte-identical to today); the recorder is ALSO gated per-run. Never alters the
+     * dispatch it observes.
+     */
+    replayRecorder?: ReplayRecorder;
 }
 /** The capability endpoint handle: the dispatch fn + the 0600 socket lifecycle. */
 export interface CapabilityEndpoint {
@@ -121,6 +131,63 @@ export interface CapabilityEndpoint {
     /** Stop the socket server and unlink the socket file. Idempotent. */
     stopSocket(): Promise<void>;
 }
+/**
+ * The content-free params digest BOTH the recorder and the separate replay socket
+ * key on: the platform sha256 (never hand-rolled — V6) over the CANONICAL
+ * (sorted-key) serialization of the params. Exported so `orchestrate-replay-socket.ts`
+ * digests the re-spawned script's params IDENTICALLY — the in-order match is only
+ * sound if both sides hash the same bytes. Keyed on the ORIGINAL wire params (what
+ * the jailed script sent), never the stripped/injected ones.
+ */
+export declare function replayParamsDigest(params: Record<string, unknown>): string;
+/**
+ * The minimal materialize seam the recorder writes each result through — a
+ * structural subset of `ResultRefStore.materialize` bound to a fixed tool name.
+ * Returns the pointer (`ResultRef.ref`), a content-free `{error}` on over-cap refuse,
+ * or `undefined` on a failed write. The boot layer binds it to the real result-ref
+ * store, so recorded bytes live in the jailed `results/` under the same caps/TTL/GC.
+ */
+export type ReplayResultMaterialize = (payload: string, ctx: {
+    workspacePath: string;
+    runId: string;
+    nowMs: number;
+    ttlMs?: number;
+}) => Promise<{
+    ref: string;
+} | {
+    error: string;
+} | undefined>;
+/** Deps for {@link createReplayRecorder}. */
+export interface ReplayRecorderDeps {
+    /** Default-OFF per-run gate: record ONLY when `autonomy.durability.orchestrateResume`
+     *  is on for the lease's agent (the plan-02 predicate). Absent/false ⇒ a full no-op. */
+    isEnabled: (agentId: string) => boolean;
+    /** Resolve the agent's jailed workspace — where `results/replay.jsonl` + the pointer
+     *  files live (the SAME resolver the tool-invoke executor + checkpoint use). */
+    resolveWorkspace: (agentId: string) => string;
+    /** Materialize each recorded result to a workspace-confined pointer (the ResultRef
+     *  contained-write) — never inline the body, even for small results (A3). */
+    materialize: ReplayResultMaterialize;
+    /** Injected wall clock (§2.8) — no ambient-clock read. */
+    nowMs: () => number;
+    /** TTL (ms) for the recorded-result pointer files; absent ⇒ the store default. The
+     *  boot layer passes a checkpoint-length TTL so a resumable run stays replayable. */
+    ttlMs?: number;
+    /** Boundary logger — a materialize/append failure WARNs with the canonical fields. */
+    logger?: ComisLogger;
+}
+/** Records each side-effecting cap-socket call to a content-free `replay.jsonl`. */
+export interface ReplayRecorder {
+    /** Append ONE content-free `{seq, method, paramsDigest} → pointer` line for a
+     *  SUCCESSFUL dispatch. A no-op when recording is off for the run. Best-effort: a
+     *  materialize refuse / append failure WARNs and returns — recording MUST NEVER
+     *  break the live dispatch it observes. */
+    record(lease: LeaseInfo, method: string, params: Record<string, unknown>, result: unknown): Promise<void>;
+}
+/** Build the content-free replay recorder over the injected gate + workspace resolver
+ *  + materialize seam. Keeps a monotonic per-`rootRunId` seq (dispatch order — the
+ *  recorded order the separate replay socket serves back). */
+export declare function createReplayRecorder(deps: ReplayRecorderDeps): ReplayRecorder;
 /**
  * Build the loopback capability endpoint over the daemon-wide LeaseManager and
  * the RPC dispatch sink. See the module doc for the deny-matrix soundness.