comisai 1.0.45 → 1.0.46

package/node_modules/@comis/gateway/dist/channel-ingress/msteams-ingress.d.ts

@@ -0,0 +1,74 @@
+import { Hono } from "hono";
+import type { Result } from "@comis/shared";
+import { type ComisLogger } from "@comis/core";
+/**
+ * The closed rejection class passed to the content-free auth-reject hook.
+ * `missing_bearer` — the request carried no bearer token (the cheap pre-gate);
+ * `invalid_token` — a bearer token was present but failed signed-token
+ * validation (forged / unsigned / expired / wrong-audience). The class is the
+ * ONLY thing the hook ever receives — never the token, header, or body.
+ */
+export type MsTeamsIngressAuthRejectReason = "missing_bearer" | "invalid_token";
+/**
+ * Dependencies for the Microsoft Teams inbound ingress.
+ *
+ * The factory is framework-agnostic over these injected closures: it holds
+ * no channel-adapter or JWT-library imports, so the gateway gains no
+ * dependency on the channels package. The composition root binds the
+ * concrete validator (with the expected audience already closed over) and
+ * the adapter's inbound driver.
+ */
+export interface MsTeamsIngressDeps {
+    /**
+     * Validates the inbound `Authorization` header (a signed activity token).
+     * The caller has already bound the expected audience. Resolves `ok` when
+     * the token verifies, `err` otherwise — the handler rejects with 401 and
+     * never surfaces the error detail to the caller.
+     */
+    readonly validateActivityJwt: (authHeader: string | undefined) => Promise<Result<void, Error>>;
+    /**
+     * Hands the validated activities to the adapter's inbound pipeline. The
+     * body is treated as opaque here and cast to the concrete activity type at
+     * the adapter boundary.
+     */
+    readonly handleWebhookEvents: (activities: unknown[]) => void;
+    /**
+     * Optional content-free hook fired on every auth-gate rejection (before any
+     * body parse or adapter dispatch), carrying ONLY the closed rejection class.
+     * The composition root binds it to a daemon eventBus emit so an ingress
+     * forged/expired/wrong-audience/missing-token FLOOD is COUNTABLE by the fleet
+     * lens instead of living only in a raw WARN. A no-op when absent — the gate
+     * and its opaque 401 are unchanged either way; the hook NEVER receives the
+     * token, the Authorization header, or the request body.
+     */
+    readonly onAuthRejected?: (reason: MsTeamsIngressAuthRejectReason) => void;
+    readonly logger: ComisLogger;
+}
+/**
+ * Create the Hono sub-application that receives Microsoft Teams activities.
+ *
+ * The daemon mounts it at `/channels/msteams`, so the effective public route
+ * is `POST /channels/msteams/api/messages`. Every request is untrusted until
+ * the injected validator passes:
+ *
+ * 1. Cheap Bearer-presence pre-gate — a request with no bearer token is
+ *    rejected 401 before any validation or body work (avoids expensive work
+ *    on unauthenticated floods).
+ * 2. Full token validation via `validateActivityJwt` — a forged / unsigned /
+ *    wrong-audience token is rejected 401 with the body left unparsed and the
+ *    adapter never invoked.
+ * 3. Parse guard — a malformed JSON body is rejected 4xx.
+ * 4. Ack — the handler dispatches the activities to `handleWebhookEvents`
+ *    defensively (a throwing dispatch is contained so it neither blocks the
+ *    ack nor surfaces internal detail), then acks by activity type. A message
+ *    activity is fire-and-forget: it gets a prompt bare 202. A card-action
+ *    invoke is request/response: it gets a synchronous 200
+ *    AdaptiveCardInvokeResponse — a content-free message-type value that
+ *    clears the client's button spinner — while its resolution and
+ *    edit-in-place happen out-of-band on the same dispatched activity.
+ *
+ * All responses are opaque: every error carries a fixed message, and the
+ * InvokeResponse value is empty — neither the validator's nor the dispatch's
+ * internal error text is ever surfaced to the caller.
+ */
+export declare function createMsTeamsIngress(deps: MsTeamsIngressDeps): Hono;

package/node_modules/@comis/gateway/dist/channel-ingress/msteams-ingress.js

@@ -0,0 +1,122 @@
+// SPDX-License-Identifier: Apache-2.0
+import { Hono } from "hono";
+import { systemNowMs } from "@comis/core";
+/** Pipeline-stage tag for this boundary's structured logs. */
+const INGRESS_STEP = "msteams-ingress";
+/** Authorization scheme the inbound activity must carry. */
+const BEARER_PREFIX = "Bearer ";
+/**
+ * Create the Hono sub-application that receives Microsoft Teams activities.
+ *
+ * The daemon mounts it at `/channels/msteams`, so the effective public route
+ * is `POST /channels/msteams/api/messages`. Every request is untrusted until
+ * the injected validator passes:
+ *
+ * 1. Cheap Bearer-presence pre-gate — a request with no bearer token is
+ *    rejected 401 before any validation or body work (avoids expensive work
+ *    on unauthenticated floods).
+ * 2. Full token validation via `validateActivityJwt` — a forged / unsigned /
+ *    wrong-audience token is rejected 401 with the body left unparsed and the
+ *    adapter never invoked.
+ * 3. Parse guard — a malformed JSON body is rejected 4xx.
+ * 4. Ack — the handler dispatches the activities to `handleWebhookEvents`
+ *    defensively (a throwing dispatch is contained so it neither blocks the
+ *    ack nor surfaces internal detail), then acks by activity type. A message
+ *    activity is fire-and-forget: it gets a prompt bare 202. A card-action
+ *    invoke is request/response: it gets a synchronous 200
+ *    AdaptiveCardInvokeResponse — a content-free message-type value that
+ *    clears the client's button spinner — while its resolution and
+ *    edit-in-place happen out-of-band on the same dispatched activity.
+ *
+ * All responses are opaque: every error carries a fixed message, and the
+ * InvokeResponse value is empty — neither the validator's nor the dispatch's
+ * internal error text is ever surfaced to the caller.
+ */
+export function createMsTeamsIngress(deps) {
+    const { validateActivityJwt, handleWebhookEvents, onAuthRejected, logger } = deps;
+    const app = new Hono();
+    app.post("/api/messages", async (c) => {
+        const startedAt = systemNowMs();
+        // (1) Bearer-presence pre-gate — reject before any validation or body read.
+        const authHeader = c.req.header("authorization") ?? c.req.header("Authorization");
+        if (authHeader === undefined || !authHeader.startsWith(BEARER_PREFIX)) {
+            logger.warn({
+                step: INGRESS_STEP,
+                hint: "Reject inbound activity without a bearer token",
+                errorKind: "auth",
+            }, "Rejected inbound activity: missing bearer token");
+            // Fleet-visible, content-free: the class only — never the (absent) token.
+            onAuthRejected?.("missing_bearer");
+            return c.json({ error: "unauthorized" }, 401);
+        }
+        // (2) Full token validation — no body is processed on failure, and the
+        // validator's error detail is never surfaced to the caller.
+        logger.debug({ step: INGRESS_STEP }, "Validating inbound activity token");
+        const verdict = await validateActivityJwt(authHeader);
+        if (!verdict.ok) {
+            logger.warn({
+                step: INGRESS_STEP,
+                hint: "Reject unverified inbound activity",
+                errorKind: "auth",
+            }, "Rejected inbound activity: token validation failed");
+            // Fleet-visible, content-free: the class only — never the forged token.
+            onAuthRejected?.("invalid_token");
+            return c.json({ error: "unauthorized" }, 401);
+        }
+        // (3) Parse guard — the body is opaque and only touched after validation.
+        let body;
+        try {
+            body = await c.req.json();
+        }
+        catch {
+            logger.warn({
+                step: INGRESS_STEP,
+                hint: "Send a JSON activity body",
+                errorKind: "validation",
+            }, "Rejected inbound activity: malformed JSON body");
+            return c.json({ error: "invalid body" }, 400);
+        }
+        // A single-activity POST is normalized to the array the adapter expects.
+        const activities = Array.isArray(body) ? body : [body];
+        // (4) Fast ack. Dispatch defensively so a downstream failure neither
+        // blocks the ack nor leaks internal detail through the public endpoint.
+        logger.debug({ step: INGRESS_STEP, activityCount: activities.length }, "Dispatching inbound activities");
+        try {
+            handleWebhookEvents(activities);
+        }
+        catch (dispatchErr) {
+            logger.error({
+                step: INGRESS_STEP,
+                err: dispatchErr,
+                hint: "Inspect the channel inbound pipeline",
+                errorKind: "internal",
+            }, "Inbound activity dispatch failed");
+        }
+        const durationMs = systemNowMs() - startedAt;
+        // The dispatch above already ran for every activity; only the terminal ack
+        // branches on type. A card-action invoke is request/response and requires a
+        // synchronous AdaptiveCardInvokeResponse; a message activity keeps the bare
+        // 202 fast-ack. The InvokeResponse is returned only when the POST is that
+        // LONE invoke: Bot Framework delivers one activity per POST, so a
+        // multi-activity batch is contract-impossible — if one arrives, it falls to
+        // the bare 202 rather than mis-acking a co-batched message with the invoke's
+        // request/response value.
+        const soleActivity = activities.length === 1 ? activities[0] : undefined;
+        const isInvoke = typeof soleActivity === "object" &&
+            soleActivity !== null &&
+            soleActivity.type === "invoke";
+        if (isInvoke) {
+            logger.info({ step: INGRESS_STEP, durationMs }, "Inbound invoke acknowledged");
+            // The InvokeResponse value is content-free: it only clears the button
+            // spinner and carries no internal detail. Resolution is out-of-band.
+            return c.json({
+                statusCode: 200,
+                type: "application/vnd.microsoft.activity.message",
+                value: "",
+            }, 200);
+        }
+        logger.info({ step: INGRESS_STEP, durationMs }, "Inbound activity accepted");
+        return c.body(null, 202);
+    });
+    return app;
+}

package/node_modules/@comis/gateway/dist/index.d.ts

@@ -12,6 +12,8 @@ export type { RpcAdapterDeps } from "./rpc/rpc-adapters.js";
 export { WsConnectionManager } from "./rpc/ws-handler.js";
 export { createMappedWebhookEndpoint } from "./webhook/webhook-endpoint.js";
 export { getPresetMappings } from "./webhook/webhook-presets.js";
+export { createMsTeamsIngress } from "./channel-ingress/msteams-ingress.js";
+export type { MsTeamsIngressDeps } from "./channel-ingress/msteams-ingress.js";
 export { createOAuthCallbackRoute, insertPendingFlow, PENDING_FLOW_TIMEOUT_MS, } from "./oauth/oauth-callback-route.js";
 export type { OAuthCallbackDeps, PendingFlow, } from "./oauth/oauth-callback-route.js";
 export { createMediaRoutes } from "./web/index.js";

package/node_modules/@comis/gateway/dist/index.js

@@ -23,6 +23,9 @@ export { WsConnectionManager } from "./rpc/ws-handler.js";
 // Webhook
 export { createMappedWebhookEndpoint } from "./webhook/webhook-endpoint.js";
 export { getPresetMappings } from "./webhook/webhook-presets.js";
+// Channel ingress -- Microsoft Teams inbound activities (mounted per-channel
+// by the daemon; framework-agnostic over injected validator + adapter driver)
+export { createMsTeamsIngress } from "./channel-ingress/msteams-ingress.js";
 // OAuth callback route exports
 export { createOAuthCallbackRoute, insertPendingFlow, PENDING_FLOW_TIMEOUT_MS, } from "./oauth/oauth-callback-route.js";
 // Web -- media routes

package/node_modules/@comis/gateway/dist/openai/openai-types.d.ts

@@ -2,19 +2,18 @@
  * OpenAI-compatible type definitions for /v1/chat/completions.
  *
  * Provides Zod schemas for request validation and TypeScript interfaces
- * for response construction. Used by openai-completions.ts and consumed
- * by plans 68-02 and 68-05.
+ * for response construction. Used by openai-completions.ts.
  *
  * @module
  */
 import { z } from "zod";
 /**
  * A single block in the OpenAI multimodal `content` array. Standard OpenAI
- * shape: a `text` block or an `image_url` block. V1-NO-VISION (30uc-20260624):
- * accepting the array form lets a standard multimodal request PARSE (instead of
- * the confusing "expected string, received array" schema 400); the handler
- * flattens text blocks and returns a NAMED unsupported-vision error for
- * image_url blocks (vision input is not yet wired through /v1).
+ * shape: a `text` block or an `image_url` block. Accepting the array form lets
+ * a standard multimodal request PARSE (instead of the confusing "expected
+ * string, received array" schema 400); the handler flattens text blocks and
+ * returns a NAMED unsupported-vision error for image_url blocks (vision input
+ * is not yet wired through /v1).
  */
 export declare const ContentBlockSchema: z.ZodUnion<readonly [z.ZodObject<{
     type: z.ZodLiteral<"text">;
@@ -27,7 +26,7 @@ export declare const ContentBlockSchema: z.ZodUnion<readonly [z.ZodObject<{
     }, z.core.$strip>;
 }, z.core.$strict>]>;
 /** Schema for a single message in the chat completions request. `content` is a
- *  plain string OR the OpenAI multimodal content-block array (V1-NO-VISION). */
+ *  plain string OR the OpenAI multimodal content-block array. */
 export declare const ChatMessageSchema: z.ZodObject<{
     role: z.ZodEnum<{
         user: "user";

package/node_modules/@comis/gateway/dist/openai/openai-types.js

@@ -3,8 +3,7 @@
  * OpenAI-compatible type definitions for /v1/chat/completions.
  *
  * Provides Zod schemas for request validation and TypeScript interfaces
- * for response construction. Used by openai-completions.ts and consumed
- * by plans 68-02 and 68-05.
+ * for response construction. Used by openai-completions.ts.
  *
  * @module
  */
@@ -14,11 +13,11 @@ import { z } from "zod";
 // ---------------------------------------------------------------------------
 /**
  * A single block in the OpenAI multimodal `content` array. Standard OpenAI
- * shape: a `text` block or an `image_url` block. V1-NO-VISION (30uc-20260624):
- * accepting the array form lets a standard multimodal request PARSE (instead of
- * the confusing "expected string, received array" schema 400); the handler
- * flattens text blocks and returns a NAMED unsupported-vision error for
- * image_url blocks (vision input is not yet wired through /v1).
+ * shape: a `text` block or an `image_url` block. Accepting the array form lets
+ * a standard multimodal request PARSE (instead of the confusing "expected
+ * string, received array" schema 400); the handler flattens text blocks and
+ * returns a NAMED unsupported-vision error for image_url blocks (vision input
+ * is not yet wired through /v1).
  */
 export const ContentBlockSchema = z.union([
     z.strictObject({ type: z.literal("text"), text: z.string() }),
@@ -28,7 +27,7 @@ export const ContentBlockSchema = z.union([
     }),
 ]);
 /** Schema for a single message in the chat completions request. `content` is a
- *  plain string OR the OpenAI multimodal content-block array (V1-NO-VISION). */
+ *  plain string OR the OpenAI multimodal content-block array. */
 export const ChatMessageSchema = z.strictObject({
     role: z.enum(["system", "user", "assistant"]),
     content: z.union([z.string(), z.array(ContentBlockSchema)]),

package/node_modules/@comis/gateway/dist/rpc/method-router.js

@@ -45,14 +45,13 @@ export function createDynamicMethodRouter(initialMethods, logger) {
      * Classify an RPC method error for structured logging.
      */
     function classifyRpcMethodError(err) {
-        // OBS-RPC-REFUSAL-CLASS (orchestration-excellence-20260701): typed policy/security/
-        // validation refusals → non-internal (warn) via the SINGLE source of truth in
-        // `@comis/core`, which the daemon's `classifyRpcError` (rpc-dispatch.ts) ALSO delegates
-        // to. They reach this outer trace wrapper with their `Error.name` intact; this package
-        // cannot `instanceof` the daemon/@comis/agent error classes (dependency direction), and
-        // `classifyTypedRpcError` keys off that name — so the two log layers cannot drift (the
-        // drift is exactly what let this layer keep logging refusals as internal/ERROR after the
-        // dispatch layer was fixed). A refusal must NOT log error(50) — a health sweep counts it.
+        // Typed policy/security/validation refusals → non-internal (warn) via the
+        // SINGLE source of truth in `@comis/core`, which the daemon's `classifyRpcError`
+        // (rpc-dispatch.ts) ALSO delegates to. They reach this outer trace wrapper with
+        // their `Error.name` intact; this package cannot `instanceof` the daemon/@comis/agent
+        // error classes (dependency direction), and `classifyTypedRpcError` keys off that
+        // name — so the two log layers cannot drift and log the same refusal at different
+        // levels. A refusal must NOT log error(50) — a health sweep counts it.
         const typed = classifyTypedRpcError(err);
         if (typed)
             return { errorKind: typed.errorKind, hint: typed.hint };
@@ -106,7 +105,12 @@ export function createDynamicMethodRouter(initialMethods, logger) {
                 const logFn = classified.errorKind === "internal" ? logger.error.bind(logger) : logger.warn.bind(logger);
                 logFn({
                     method: name,
-                    err,
+                    // An expected classified refusal (non-internal → warn) logs its
+                    // MESSAGE only: the Error object serializes with its full stack,
+                    // and a routine operator flow (the CLI probing an admin-gated obs
+                    // method before its offline fallback) then reads as a fault.
+                    // Stack traces are DEBUG-only; internal errors keep the full err.
+                    err: classified.errorKind === "internal" ? err : (err instanceof Error ? err.message : String(err)),
                     durationMs,
                     clientId: context.clientId,
                     hint: classified.hint,

package/node_modules/@comis/gateway/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@comis/gateway",
   "private": true,
-  "version": "1.0.45",
+  "version": "1.0.46",
   "author": "Moshe Anconina",
   "license": "Apache-2.0",
   "description": "HTTP, JSON-RPC, and WebSocket gateway for Comis",

package/node_modules/@comis/infra/dist/credential-broker/lease-manager.d.ts

@@ -1,5 +1,5 @@
 import { type ClockPort, type AgentCapability } from "@comis/core";
-/** Input to mint a new lease (LEASE-01). */
+/** Input to mint a new lease. */
 export interface MintLeaseInput {
     agentId: string;
     caps: readonly AgentCapability[];
@@ -35,8 +35,8 @@ export interface LeaseManager {
      *
      * AUDIENCE (RFC 8707): for every method the required cap is derived from
      * `HANDLER_CAPABILITY_MAP[requestedMethod]`, EXCEPT the `tool.invoke` dispatch
-     * (Phase 212) — `tool.invoke` is not in that map; its audience is the INNER
-     * tool's cap from `TOOL_CAPABILITY_MAP[innerTool]` (Pitfall 2). So a lease
+     * — `tool.invoke` is not in that map; its audience is the INNER
+     * tool's cap from `TOOL_CAPABILITY_MAP[innerTool]`. So a lease
      * scoped to `orch:read` is in-audience at `tool.invoke({tool:"memory_search"})`
      * (orch:read) and OUT of audience at `tool.invoke({tool:"web_fetch"})`
      * (orch:web) — a captured lease cannot dispatch a tool whose cap it lacks.
@@ -56,17 +56,17 @@ export interface LeaseManager {
         revoked: number;
     };
     /**
-     * Cascade-revoke a lease and every descendant reachable via `parentLeaseId`
-     * (REVOKE-02). Reaches grandchildren: revoking a parent revokes its children
-     * AND their children. Built on the at-mint `parentLeaseId`→children adjacency
-     * (the reverse of `parentLeaseId` does not exist otherwise — Pitfall 5). A
-     * `visited` set guards re-entry; leaseIds never re-mint, so the tree is
-     * acyclic and the guard is cheap insurance. The control-plane authority the
-     * admin `lease.revoke`/`run.kill` RPC (Phase 213) drives.
+     * Cascade-revoke a lease and every descendant reachable via `parentLeaseId`.
+     * Reaches grandchildren: revoking a parent revokes its children AND their
+     * children. Built on the at-mint `parentLeaseId`→children adjacency (the
+     * reverse of `parentLeaseId` does not exist otherwise). A `visited` set guards
+     * re-entry; leaseIds never re-mint, so the tree is acyclic and the guard is
+     * cheap insurance. The control-plane authority the admin `lease.revoke` /
+     * `run.kill` RPC drives.
      */
     cascadeRevoke(leaseId: string, visited?: Set<string>): void;
     /**
-     * Revoke EVERY lease of a root-run (REVOKE-01), cascading each to its
+     * Revoke EVERY lease of a root-run, cascading each to its
      * descendants. Scans on `rootRunId` and `cascadeRevoke`s each match through
      * ONE shared `visited` set, so the returned `revoked` is the distinct number
      * of leases flipped (a parent + its already-cascaded child are not

package/node_modules/@comis/infra/dist/credential-broker/lease-manager.js

@@ -1,7 +1,7 @@
 // SPDX-License-Identifier: Apache-2.0
 /**
  * LeaseManager — the run-scoped, multi-use, revocable, audience-bound
- * capability lease (LEASE-01 / LEASE-02 / LEASE-03; v8 §4.2).
+ * capability lease.
  *
  * A `SessionManager` variant: same factory shape, same length-guarded
  * timing-safe `tokenEquals`, same lazy-TTL reaper — but the lease is the
@@ -18,15 +18,16 @@
  *     `HANDLER_CAPABILITY_MAP[method]` and rejects if the lease does not hold
  *     it — a captured lease replayed at a foreign method is denied. Deriving
  *     the audience from the shipped map (not a bespoke audience claim) means
- *     caps and audience cannot drift. The one exception is the Phase-212
+ *     caps and audience cannot drift. The one exception is the
  *     `tool.invoke` dispatch: it is not in `HANDLER_CAPABILITY_MAP`, so its
  *     audience is the INNER tool's cap from `TOOL_CAPABILITY_MAP[innerTool]`
- *     (Pitfall 2) — still derived from a shipped table, so a lease scoped to
+ *     — still derived from a shipped table, so a lease scoped to
  *     `orch:read` cannot `tool.invoke` a `web_fetch` (orch:web).
  *
- * In-memory only (a `Map`, like SessionManager) — M1 does NOT persist in-flight
- * run state (that is M2). The operator-facing revoke RPC + cascade are Phase
- * 213; this module ships the `revoked` field + the revocation-respecting paths.
+ * In-memory only (a `Map`, like SessionManager) — in-flight run state is not
+ * persisted across restarts. The operator-facing revoke RPC + cascade live in
+ * the daemon; this module ships the `revoked` field + the revocation-respecting
+ * paths.
  *
  * SECURITY: bearer minted via `generateStrongToken()` (CSPRNG, never
  * `Math.random`); stored as a Buffer for `timingSafeEqual`; the length-guard in
@@ -36,7 +37,7 @@
  */
 import { timingSafeEqual, randomUUID } from "node:crypto";
 import { generateStrongToken, HANDLER_CAPABILITY_MAP, TOOL_CAPABILITY_MAP, SELF_SCOPED_AGENT_READS, } from "@comis/core";
-// O(1) membership for the self-scoped-read audience exception (CLI-01/02). The
+// O(1) membership for the self-scoped-read audience exception. The
 // const is the single auditable source in @comis/core; building the Set once at
 // module load keeps the per-validate check small.
 const SELF_SCOPED_AGENT_READ_SET = new Set(SELF_SCOPED_AGENT_READS);
@@ -54,9 +55,9 @@ function tokenEquals(candidate, stored) {
 export function createLeaseManager(deps) {
     const { clock, defaultTtlMs = 15 * 60 * 1000 } = deps;
     const leases = new Map();
-    // parentLeaseId → child leaseIds, built at MINT (Pitfall 5). cascadeRevoke
-    // reads this reverse index to reach a lease's children/grandchildren; deriving
-    // it at revoke time is impossible because parentLeaseId has no reverse index.
+    // parentLeaseId → child leaseIds, built at MINT. cascadeRevoke reads this
+    // reverse index to reach a lease's children/grandchildren; deriving it at
+    // revoke time is impossible because parentLeaseId has no reverse index.
     const childrenByParent = new Map();
     /**
      * Cascade-revoke `leaseId` and every descendant via the at-mint adjacency.
@@ -77,7 +78,7 @@ export function createLeaseManager(deps) {
      * Per-lease revoke: flag the entry (do NOT delete) so validate denies it.
      * Returns 1 when an entry existed (now revoked), 0 for an UNKNOWN id — so the
      * exposed `revoke` reports an HONEST count to the operator and never a phantom
-     * revoke of an id that was never minted (REVOKE-01 honesty; the live finding).
+     * revoke of an id that was never minted.
      */
     function revokeLease(leaseId) {
         // Keep the entry (do NOT delete) so validate's `revoked` check denies it;
@@ -112,9 +113,9 @@ export function createLeaseManager(deps) {
                 maxExpiresAtMs,
                 revoked: false,
             });
-            // Build the parent→children adjacency at MINT (Pitfall 5) so a later
-            // cascadeRevoke can reach this lease from its parent. Deriving the reverse
-            // of parentLeaseId at revoke time is impossible.
+            // Build the parent→children adjacency at MINT so a later cascadeRevoke can
+            // reach this lease from its parent. Deriving the reverse of parentLeaseId
+            // at revoke time is impossible.
             if (input.parentLeaseId !== undefined) {
                 const siblings = childrenByParent.get(input.parentLeaseId) ?? new Set();
                 siblings.add(leaseId);
@@ -157,7 +158,7 @@ export function createLeaseManager(deps) {
                     rootRunId: entry.rootRunId,
                     ...(entry.parentLeaseId !== undefined ? { parentLeaseId: entry.parentLeaseId } : {}),
                 };
-                // Self-scoped-read audience exception (CLI-01/02; v8 §15 whoami/status).
+                // Self-scoped-read audience exception (whoami/status).
                 // The three ungated, scopes:["rpc"], self-_agentId-scoped reads in
                 // SELF_SCOPED_AGENT_READS (capabilities.introspect / session.status /
                 // session.list) are in-audience for ANY valid lease — the cap-socket
@@ -177,12 +178,12 @@ export function createLeaseManager(deps) {
                 // be one the lease holds. A non-cap method ("deny-by-origin"/"ungated")
                 // or an unknown method has no orch:* cap → out of audience → deny.
                 //
-                // Pitfall 2 (Phase 212): `tool.invoke` is NOT in HANDLER_CAPABILITY_MAP;
-                // its audience is the INNER tool's cap from TOOL_CAPABILITY_MAP (shape
-                // (b) — derive from the SAME table the dispatch gate reads, so caps and
-                // audience cannot drift). An undefined/unmapped inner tool yields no cap →
-                // denied here, mirroring the dispatch-layer default-deny (defense-in-depth
-                // with requireCapability at the endpoint).
+                // `tool.invoke` is NOT in HANDLER_CAPABILITY_MAP; its audience is the
+                // INNER tool's cap from TOOL_CAPABILITY_MAP — derive from the SAME table
+                // the dispatch gate reads, so caps and audience cannot drift. An
+                // undefined/unmapped inner tool yields no cap → denied here, mirroring
+                // the dispatch-layer default-deny (defense-in-depth with
+                // requireCapability at the endpoint).
                 const requiredCap = requestedMethod === "tool.invoke"
                     ? innerTool === undefined
                         ? undefined
@@ -222,7 +223,7 @@ export function createLeaseManager(deps) {
             // ONE shared `visited` set dedupes across the scan so the count is the
             // distinct number of leases revoked (a parent + its already-cascaded child
             // are not double-counted). An unknown root is a clean 0-revoke no-op — the
-            // daemon RPC handler (Phase 213, Plan 06) is the throw boundary.
+            // daemon RPC handler is the throw boundary.
             const visited = new Set();
             for (const [id, entry] of leases) {
                 if (entry.rootRunId === rootRunId) {

package/node_modules/@comis/infra/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@comis/infra",
   "private": true,
-  "version": "1.0.45",
+  "version": "1.0.46",
   "author": "Moshe Anconina",
   "license": "Apache-2.0",
   "description": "Structured logging infrastructure for Comis",

package/node_modules/@comis/memory/dist/durable-run-row-schema.d.ts

@@ -1,7 +1,6 @@
 /**
- * Zod row schema for the `durable_runs` table — the Phase-216 durable checkpoint
- * store (DUR-01). SSOT for the file-internal `DurableRunDbRow` type in
- * `durable-run-store.ts`.
+ * Zod row schema for the `durable_runs` table — the durable checkpoint store.
+ * SSOT for the file-internal `DurableRunDbRow` type in `durable-run-store.ts`.
  *
  * Lives in its OWN module (NOT `row-schemas.ts`) because that file is at the
  * 800-line cap; this keeps the additive durable-run schema out of it. Same
@@ -13,16 +12,14 @@
  *   - INTEGER/REAL → `z.number()`; the JSON columns are TEXT → `z.string()` at
  *     the row layer (the store parses them to arrays at the domain boundary).
  *
- * SECURITY (T-216-05, mirrors video_jobs T-189-02): the column set is the
- * attenuated `caps` + routing/lifecycle + the outward counter ONLY — NO
- * key/token/secret/bearer column. The lease bearer is re-minted on resume and is
- * NEVER persisted here.
+ * SECURITY: the column set is the attenuated `caps` + routing/lifecycle + the
+ * outward counter ONLY — NO key/token/secret/bearer column. The lease bearer is
+ * re-minted on resume and is NEVER persisted here.
  *
- * NEW-1/LOW-1: `outward_step` (DDL DEFAULT -1) is the SOLE counter column. There
- * is NO coarse per-step index column — that marker was dropped as dead state.
- * `DurableRunRecord.stepIndex` maps onto `outward_step` in the store's
- * rowToRecord (the -1 seed surfaces as stepIndex -1 for a never-sent run, which
- * the domain schema permits via `.min(-1)`, NEW-5).
+ * `outward_step` (DDL DEFAULT -1) is the SOLE counter column. There is NO coarse
+ * per-step index column. `DurableRunRecord.stepIndex` maps onto `outward_step`
+ * in the store's rowToRecord (the -1 seed surfaces as stepIndex -1 for a
+ * never-sent run, which the domain schema permits via `.min(-1)`).
  *
  * @module
  */
@@ -45,5 +42,7 @@ export declare const DurableRunDbRowSchema: z.ZodObject<{
     last_heartbeat_at: z.ZodNumber;
     created_at_ms: z.ZodNumber;
     updated_at_ms: z.ZodNumber;
+    script_ref: z.ZodNullable<z.ZodString>;
+    checkpoint_ref: z.ZodNullable<z.ZodString>;
 }, z.core.$strict>;
 export type DurableRunDbRow = z.infer<typeof DurableRunDbRowSchema>;

package/node_modules/@comis/memory/dist/durable-run-row-schema.js

@@ -1,8 +1,7 @@
 // SPDX-License-Identifier: Apache-2.0
 /**
- * Zod row schema for the `durable_runs` table — the Phase-216 durable checkpoint
- * store (DUR-01). SSOT for the file-internal `DurableRunDbRow` type in
- * `durable-run-store.ts`.
+ * Zod row schema for the `durable_runs` table — the durable checkpoint store.
+ * SSOT for the file-internal `DurableRunDbRow` type in `durable-run-store.ts`.
  *
  * Lives in its OWN module (NOT `row-schemas.ts`) because that file is at the
  * 800-line cap; this keeps the additive durable-run schema out of it. Same
@@ -14,16 +13,14 @@
  *   - INTEGER/REAL → `z.number()`; the JSON columns are TEXT → `z.string()` at
  *     the row layer (the store parses them to arrays at the domain boundary).
  *
- * SECURITY (T-216-05, mirrors video_jobs T-189-02): the column set is the
- * attenuated `caps` + routing/lifecycle + the outward counter ONLY — NO
- * key/token/secret/bearer column. The lease bearer is re-minted on resume and is
- * NEVER persisted here.
+ * SECURITY: the column set is the attenuated `caps` + routing/lifecycle + the
+ * outward counter ONLY — NO key/token/secret/bearer column. The lease bearer is
+ * re-minted on resume and is NEVER persisted here.
  *
- * NEW-1/LOW-1: `outward_step` (DDL DEFAULT -1) is the SOLE counter column. There
- * is NO coarse per-step index column — that marker was dropped as dead state.
- * `DurableRunRecord.stepIndex` maps onto `outward_step` in the store's
- * rowToRecord (the -1 seed surfaces as stepIndex -1 for a never-sent run, which
- * the domain schema permits via `.min(-1)`, NEW-5).
+ * `outward_step` (DDL DEFAULT -1) is the SOLE counter column. There is NO coarse
+ * per-step index column. `DurableRunRecord.stepIndex` maps onto `outward_step`
+ * in the store's rowToRecord (the -1 seed surfaces as stepIndex -1 for a
+ * never-sent run, which the domain schema permits via `.min(-1)`).
  *
  * @module
  */
@@ -42,16 +39,22 @@ export const DurableRunDbRowSchema = z.strictObject({
     lease_ids: z.string(),
     budget_consumed: z.number(),
     cron_origin: z.string().nullable(),
-    // NEW-1/LOW-1: the SOLE outward-send counter (DDL DEFAULT -1). Owned only by
+    // The SOLE outward-send counter (DDL DEFAULT -1). Owned only by
     // allocateOutwardStep; maps to DurableRunRecord.stepIndex in rowToRecord. There
     // is NO coarse per-step index column — strictObject rejects one if the DDL adds it.
     outward_step: z.number(),
     // 'running' | 'orphaned' | 'completed' | 'revoked' — the SQL CHECK constraint
-    // belt-and-suspenders the closed Zod union (Plan-01 DurableRunStatusSchema).
+    // belt-and-suspenders the closed Zod union (DurableRunStatusSchema).
     status: z.string(),
     // Nullable; set by markOrphaned/invalidateForRevoke, NULL on a healthy row.
     orphan_reason: z.string().nullable(),
     last_heartbeat_at: z.number(),
     created_at_ms: z.number(),
     updated_at_ms: z.number(),
+    // Additive resumable-orchestrate columns (both nullable — SQLite NULL on every
+    // prior row + on a non-orchestrate/never-checkpointed run). Content-free: a
+    // workspace-relative script path + a ResultRef id, no bytes/bearer. The store
+    // maps `?? undefined` onto the optional domain fields at the boundary.
+    script_ref: z.string().nullable(),
+    checkpoint_ref: z.string().nullable(),
 });