comisai 1.0.45 → 1.0.46

package/node_modules/@comis/skills/dist/tools/builtin/sandbox/detect-provider.d.ts

@@ -14,9 +14,9 @@ export interface DetectLogger {
     warn(obj: Record<string, unknown>, msg: string): void;
 }
 /**
- * Result of the JAIL-03 namespace preflight. The `namespacePreflightOk` field is
+ * Result of the namespace preflight. The `namespacePreflightOk` field is
  * structurally assignable to `@comis/core`'s `AutonomyPreflightResult` — feed
- * this straight into the SHIPPED `degradeAutonomy` (PROFILE-03, Phase 210) with
+ * this straight into `degradeAutonomy` with
  * no adapter. The extra `stderr`/`signal` carry the bwrap error onto the boot
  * signal so an operator sees WHY the jail could not be built without enabling
  * DEBUG (matching the {@link detectSandboxProvider} warn-with-stderr pattern).
@@ -30,8 +30,8 @@ export interface NamespacePreflightResult {
     readonly signal: NodeJS.Signals | null;
 }
 /**
- * JAIL-03 namespace preflight — PRODUCE the `namespacePreflightOk` boolean the
- * SHIPPED `degradeAutonomy` (PROFILE-03) consumes. Extends the boot smoke test
+ * Namespace preflight — PRODUCE the `namespacePreflightOk` boolean that
+ * `degradeAutonomy` consumes. Extends the boot smoke test
  * with `--unshare-net` (the net-new isolation the `orchestrate` jail requires)
  * + the unprivileged-user-namespace availability check.
  *
@@ -41,10 +41,10 @@ export interface NamespacePreflightResult {
  * downshifts any autonomy-bearing posture to `assistant` and SURFACES a WARN +
  * `doctor` finding — never a silent unjailed fallback.
  *
- * 211 ONLY PRODUCES the boolean — it NEVER re-implements the downshift (that is
- * PROFILE-03 in `@comis/core`). The daemon-side wiring that calls this at boot
- * then feeds `degradeAutonomy` per agent (the `emit-autonomy-boot-log` hook
- * already accepts a `namespacePreflightOk` input) lands in 211-06.
+ * This preflight ONLY PRODUCES the boolean — it NEVER re-implements the
+ * downshift (that is `degradeAutonomy` in `@comis/core`). The daemon-side
+ * wiring calls this at boot and feeds `degradeAutonomy` per agent (the
+ * `emit-autonomy-boot-log` hook accepts a `namespacePreflightOk` input).
  *
  * @returns the preflight result (`namespacePreflightOk` + the bwrap stderr/signal).
  */

package/node_modules/@comis/skills/dist/tools/builtin/sandbox/detect-provider.js

@@ -45,7 +45,7 @@ function isContainer() {
  * the given isolation flags + `extraArgs`, returning whether the namespace
  * construction succeeded plus the raw bwrap stderr/signal. The single, DRY probe
  * body shared by {@link bwrapSmokeTest} (the boot-time provider detection) and
- * {@link namespacePreflight} (the JAIL-03 autonomy preflight) — they differ only
+ * {@link namespacePreflight} (the autonomy preflight) — they differ only
  * in the isolation flags passed, so the bind list + spawn options never drift.
  *
  * The base flags `--unshare-user --unshare-pid --proc /proc` are the kernel-
@@ -77,8 +77,8 @@ function bwrapSmokeTest() {
     return bwrapNamespaceProbe([]);
 }
 /**
- * JAIL-03 namespace preflight — PRODUCE the `namespacePreflightOk` boolean the
- * SHIPPED `degradeAutonomy` (PROFILE-03) consumes. Extends the boot smoke test
+ * Namespace preflight — PRODUCE the `namespacePreflightOk` boolean that
+ * `degradeAutonomy` consumes. Extends the boot smoke test
  * with `--unshare-net` (the net-new isolation the `orchestrate` jail requires)
  * + the unprivileged-user-namespace availability check.
  *
@@ -88,10 +88,10 @@ function bwrapSmokeTest() {
  * downshifts any autonomy-bearing posture to `assistant` and SURFACES a WARN +
  * `doctor` finding — never a silent unjailed fallback.
  *
- * 211 ONLY PRODUCES the boolean — it NEVER re-implements the downshift (that is
- * PROFILE-03 in `@comis/core`). The daemon-side wiring that calls this at boot
- * then feeds `degradeAutonomy` per agent (the `emit-autonomy-boot-log` hook
- * already accepts a `namespacePreflightOk` input) lands in 211-06.
+ * This preflight ONLY PRODUCES the boolean — it NEVER re-implements the
+ * downshift (that is `degradeAutonomy` in `@comis/core`). The daemon-side
+ * wiring calls this at boot and feeds `degradeAutonomy` per agent (the
+ * `emit-autonomy-boot-log` hook accepts a `namespacePreflightOk` input).
  *
  * @returns the preflight result (`namespacePreflightOk` + the bwrap stderr/signal).
  */

package/node_modules/@comis/skills/dist/tools/builtin/sandbox/seccomp-profile.d.ts

@@ -1,5 +1,5 @@
 /**
- * Seccomp BPF-blob loader for the bwrap jail (JAIL-01, Phase 211 §4.7).
+ * Seccomp BPF-blob loader for the bwrap jail.
  *
  * bwrap `--seccomp N` takes an open FILE DESCRIPTOR to RAW BPF bytecode — NOT a
  * JSON profile name/path (that is Docker/runc). The blob is a PRECOMPILED data
@@ -12,19 +12,19 @@
  *  - `loadSeccompProfileFd()` opens the blob and returns an INHERITABLE fd (the
  *    bwrap child must inherit it, so FD_CLOEXEC is NOT set) or `null` when the
  *    blob is absent. Absence is a graceful DEGRADE — `buildArgs` omits
- *    `--seccomp` and the other §4.7 controls (`--new-session`,
+ *    `--seccomp` and the other hardening controls (`--new-session`,
  *    `--die-with-parent`, `--unshare-net`, the bind-mount validator) still hold.
  *    The `.linux.test.ts` "blocked syscall" assertion is the proof gate that the
  *    blob actually denies the dangerous surface on the VPS.
  *
- * REQUIRED fd LIFECYCLE (WR-04 — read this before wiring `seccompFd` in 212):
+ * REQUIRED fd LIFECYCLE (read this before wiring `seccompFd` at a call site):
  *
  *   Because the fd is opened WITHOUT `O_CLOEXEC` (so the bwrap child inherits
  *   it), the PARENT (daemon) process keeps its OWN copy of the descriptor open
  *   after fork. That parent copy MUST be closed once the child has been spawned,
  *   or every jailed spawn leaks one descriptor in the daemon — over a
  *   long-running daemon driving many spawns this exhausts the fd table. The
- *   ONLY correct shape at the (future, 212) call site is open → buildArgs →
+ *   ONLY correct shape at a call site is open → buildArgs →
  *   spawn → close-in-`finally`:
  *
  *     const fd = loadSeccompProfileFd();

package/node_modules/@comis/skills/dist/tools/builtin/sandbox/seccomp-profile.js

@@ -1,6 +1,6 @@
 // SPDX-License-Identifier: Apache-2.0
 /**
- * Seccomp BPF-blob loader for the bwrap jail (JAIL-01, Phase 211 §4.7).
+ * Seccomp BPF-blob loader for the bwrap jail.
  *
  * bwrap `--seccomp N` takes an open FILE DESCRIPTOR to RAW BPF bytecode — NOT a
  * JSON profile name/path (that is Docker/runc). The blob is a PRECOMPILED data
@@ -13,19 +13,19 @@
  *  - `loadSeccompProfileFd()` opens the blob and returns an INHERITABLE fd (the
  *    bwrap child must inherit it, so FD_CLOEXEC is NOT set) or `null` when the
  *    blob is absent. Absence is a graceful DEGRADE — `buildArgs` omits
- *    `--seccomp` and the other §4.7 controls (`--new-session`,
+ *    `--seccomp` and the other hardening controls (`--new-session`,
  *    `--die-with-parent`, `--unshare-net`, the bind-mount validator) still hold.
  *    The `.linux.test.ts` "blocked syscall" assertion is the proof gate that the
  *    blob actually denies the dangerous surface on the VPS.
  *
- * REQUIRED fd LIFECYCLE (WR-04 — read this before wiring `seccompFd` in 212):
+ * REQUIRED fd LIFECYCLE (read this before wiring `seccompFd` at a call site):
  *
  *   Because the fd is opened WITHOUT `O_CLOEXEC` (so the bwrap child inherits
  *   it), the PARENT (daemon) process keeps its OWN copy of the descriptor open
  *   after fork. That parent copy MUST be closed once the child has been spawned,
  *   or every jailed spawn leaks one descriptor in the daemon — over a
  *   long-running daemon driving many spawns this exhausts the fd table. The
- *   ONLY correct shape at the (future, 212) call site is open → buildArgs →
+ *   ONLY correct shape at a call site is open → buildArgs →
  *   spawn → close-in-`finally`:
  *
  *     const fd = loadSeccompProfileFd();

package/node_modules/@comis/skills/dist/tools/builtin/sandbox/types.d.ts

@@ -27,9 +27,9 @@ export interface SandboxOptions {
      * "broker-only" = --unshare-net + unix-socket bind for broker-only egress.
      * "none" = --unshare-net with NO socket and NO proxy (kernel-enforced deny-all
      *   egress; the skill-validation jail uses this so a synthesized script cannot
-     *   reach the network to exfiltrate during dynamic validation, T-201-35).
+     *   reach the network to exfiltrate during dynamic validation).
      * "cap-socket" = --unshare-net + unix-socket bind for the capability-lease
-     *   loopback endpoint (Phase 211, ENDPOINT-03). Mirrors broker-only arg-order:
+     *   loopback endpoint. Mirrors broker-only arg-order:
      *   the bound unix socket stays reachable under netns (netns affects IP sockets
      *   only) so the jailed orchestrate child can dial the lease endpoint while all
      *   general IP egress stays cut.
@@ -55,18 +55,18 @@ export interface SandboxOptions {
      */
     secureCredentialHome?: boolean;
     /**
-     * Open file descriptor to a precompiled raw-BPF seccomp blob (JAIL-01).
+     * Open file descriptor to a precompiled raw-BPF seccomp blob.
      * bwrap `--seccomp N` takes an FD to raw BPF bytecode (NOT a JSON profile).
      * The caller/provider resolves this via loadSeccompProfileFd() (so buildArgs
      * stays a PURE arg generator with no live fs probe). When a number, buildArgs
      * emits `--seccomp <fd>`; when undefined/null the blob is absent and buildArgs
-     * OMITS --seccomp (graceful degrade — the other §4.7 controls still apply).
+     * OMITS --seccomp (graceful degrade — the other sandbox controls still apply).
      * Consumed by BwrapProvider.buildArgs(); other providers ignore it.
      */
     seccompFd?: number | null;
     /**
-     * The user HOME against which the JAIL-03 credential-denylist backstop
-     * screens caller-supplied binds (WR-05). `validateBindMount(hostPath, home)`
+     * The user HOME against which the credential-denylist backstop
+     * screens caller-supplied binds. `validateBindMount(hostPath, home)`
      * treats `home` as the trusted base for the `~/.ssh`/`~/.config`/… denylist —
      * so it MUST be an explicit, trusted value, not an ambient read buried inside
      * the otherwise-pure `buildArgs` generator. Resolve it once from trusted
@@ -79,7 +79,7 @@ export interface SandboxOptions {
      */
     home?: string;
     /**
-     * Resolved Node-runtime placement for the jail (JAIL-04 / v8 §4.6).
+     * Resolved Node-runtime placement for the jail.
      * The provider resolves this via resolveJailNode() (probe node on the jail
      * PATH → bind process.execPath → mark unavailable) and passes the result in,
      * so buildArgs stays a pure arg generator (no live fs probe). buildArgs emits
@@ -92,7 +92,7 @@ export interface SandboxOptions {
      */
     jailNode?: JailNodeResolution;
     /**
-     * Resolved comis-agent CLI-binary placement for the jail (CLI-05/06).
+     * Resolved comis-agent CLI-binary placement for the jail.
      * The provider resolves this via resolveJailAgentCli() — hash-verify the
      * comis-built `comis-agent-entry.js` against the committed manifest pin, then
      * bind / unavailable-missing / unavailable-hash-mismatch — and passes the
@@ -101,7 +101,7 @@ export interface SandboxOptions {
      * binary is bound READ-ONLY — a writable binary is a host-RCE vector, and
      * src==dest so COMIS_AGENT_BIN/PATH resolves it in-jail). "unavailable" (a
      * missing OR tampered binary) emits NO bind — the orchestrate-tool then makes
-     * ONLY the CLI surface unavailable with a loud signal (CLI-06), while the
+     * ONLY the CLI surface unavailable with a loud signal, while the
      * orchestrate SCRIPT surface still runs. Unlike jailNode, an unavailable
      * comis-agent binary does NOT refuse the whole jail (the script surface is
      * independent of the CLI surface).
@@ -110,8 +110,8 @@ export interface SandboxOptions {
     jailAgentCli?: JailAgentCliResolution;
 }
 /**
- * The three-mode result of resolveJailNode() (JAIL-04). Exhaustive: there is no
- * "bundled Node" mode — that claim is a spoofing vector (T-211-21).
+ * The three-mode result of resolveJailNode(). Exhaustive: there is no
+ * "bundled Node" mode — that claim is a spoofing vector.
  */
 export type JailNodeResolution = {
     mode: "path";
@@ -123,12 +123,27 @@ export type JailNodeResolution = {
     hint: string;
 };
 /**
- * The two-mode result of resolveJailAgentCli() (CLI-05/06). "bind" only when the
+ * The two-mode result of resolveJailPython(). Unlike JailNodeResolution there
+ * is NO bind mode: the daemon is Node, so there is no daemon-python binary to
+ * RO-bind as a fallback. "path" therefore carries the absolute `pythonBin` to
+ * invoke (a bare `python3` name is not safe to mirror node's `{mode:"path"}` —
+ * it could resolve off the child PATH to an unintended interpreter or exit
+ * 127). "unavailable" is the honest degrade: a missing interpreter is ALWAYS a
+ * LOUD unavailable with an operator hint — never a silent unjailed run.
+ */
+export type JailPythonResolution = {
+    mode: "path";
+    pythonBin: string;
+} | {
+    mode: "unavailable";
+    hint: string;
+};
+/**
+ * The two-mode result of resolveJailAgentCli(). "bind" only when the
  * comis-agent binary EXISTS and its sha256 matches the committed manifest pin;
  * "unavailable" (with a content-free operator hint) when the binary is MISSING
  * or its bytes do NOT match the pin (tamper). There is no silent third state —
- * a missing/tampered binary is always a LOUD unavailable, never a silent bind
- * (T-219-22 tampering / T-219-24 silent-degrade).
+ * a missing/tampered binary is always a LOUD unavailable, never a silent bind.
  */
 export type JailAgentCliResolution = {
     mode: "bind";

package/node_modules/@comis/skills/dist/tools/builtin/sleep-tool.d.ts

@@ -1,5 +1,5 @@
 /**
- * The `sleep` primitive (STREAM-03).
+ * The `sleep` primitive.
  *
  * A builtin AgentTool the model calls to PAUSE between turns. Its whole reason
  * to exist is cost: instead of polling in a token-burning loop ("is the child
@@ -30,7 +30,7 @@ import type { AgentTool } from "@earendil-works/pi-agent-core";
  * Upper bound on a single sleep, in milliseconds. Chosen to match the ~5-minute
  * Anthropic prompt-cache TTL the verify-only cache stack tracks: a sleep longer
  * than the cache window would let the cached prefix expire, defeating the point.
- * A request above this is clamped down to it (T-221-SLEEP-01 mitigation).
+ * A request above this is clamped down to it.
  */
 export declare const MAX_SLEEP_MS = 300000;
 /**
@@ -62,7 +62,7 @@ declare const SleepParams: Type.TObject<{
  *
  * @param deps - Optional dependencies. `timer` defaults to the sanctioned
  *   systemSetTimeout/systemClearTimeout helpers.
- * @returns AgentTool implementing the sleep primitive (STREAM-03).
+ * @returns AgentTool implementing the sleep primitive.
  */
 export declare function createSleepTool(deps?: SleepToolDeps): AgentTool<typeof SleepParams>;
 export {};

package/node_modules/@comis/skills/dist/tools/builtin/sleep-tool.js

@@ -1,6 +1,6 @@
 // SPDX-License-Identifier: Apache-2.0
 /**
- * The `sleep` primitive (STREAM-03).
+ * The `sleep` primitive.
  *
  * A builtin AgentTool the model calls to PAUSE between turns. Its whole reason
  * to exist is cost: instead of polling in a token-burning loop ("is the child
@@ -32,7 +32,7 @@ import { jsonResult } from "../../platform-tools/tool-helpers.js";
  * Upper bound on a single sleep, in milliseconds. Chosen to match the ~5-minute
  * Anthropic prompt-cache TTL the verify-only cache stack tracks: a sleep longer
  * than the cache window would let the cached prefix expire, defeating the point.
- * A request above this is clamped down to it (T-221-SLEEP-01 mitigation).
+ * A request above this is clamped down to it.
  */
 export const MAX_SLEEP_MS = 300_000; // ~5 minutes
 const SleepParams = Type.Object({
@@ -53,7 +53,7 @@ const defaultTimer = {
     clearTimeout: (handle) => systemClearTimeout(handle),
 };
 /**
- * Read a duration param tolerantly (WR-02): a finite number is taken as-is, a
+ * Read a duration param tolerantly: a finite number is taken as-is, a
  * NUMERIC STRING (LLMs commonly emit `{ ms: "1500" }`) is coerced, and anything
  * else — absent, null, non-finite, or an unparseable string (`"abc"`) — returns
  * `undefined` so the caller falls back to the clamped default. NEVER throws (the
@@ -79,7 +79,7 @@ function readMaybeNumber(params, key) {
  * `seconds`. A non-finite / missing / unparseable request defaults to
  * {@link MAX_SLEEP_MS} (the cache-window pace) rather than throwing — a sleep
  * with no usable argument means "defer for the cache TTL". The result is always
- * within `[0, MAX_SLEEP_MS]`. Tolerant of stringly-typed args (WR-02): it reads
+ * within `[0, MAX_SLEEP_MS]`. Tolerant of stringly-typed args: it reads
  * via {@link readMaybeNumber}, NOT the throwing shared helper, so a bad value
  * can never escape `execute()`.
  */
@@ -106,7 +106,7 @@ function resolveClampedMs(params) {
  *
  * @param deps - Optional dependencies. `timer` defaults to the sanctioned
  *   systemSetTimeout/systemClearTimeout helpers.
- * @returns AgentTool implementing the sleep primitive (STREAM-03).
+ * @returns AgentTool implementing the sleep primitive.
  */
 export function createSleepTool(deps = {}) {
     const timer = deps.timer ?? defaultTimer;
@@ -138,7 +138,7 @@ export function createSleepTool(deps = {}) {
                     if (settled)
                         return;
                     settled = true;
-                    timer.clearTimeout(handle); // clear the pending timer → no handle leak (T-221-SLEEP-04)
+                    timer.clearTimeout(handle); // clear the pending timer → no handle leak
                     resolve(true);
                 };
                 const handle = timer.setTimeout(() => {
@@ -148,7 +148,7 @@ export function createSleepTool(deps = {}) {
                     signal?.removeEventListener("abort", onAbort);
                     resolve(false);
                 }, clampedMs);
-                // Never let a pending sleep block graceful daemon shutdown (T-221-SLEEP-01).
+                // Never let a pending sleep block graceful daemon shutdown.
                 handle.unref();
                 signal?.addEventListener("abort", onAbort, { once: true });
             });

package/node_modules/@comis/skills/dist/tools/builtin/terminal-driver/egress-relay-init.d.ts

@@ -1,11 +1,11 @@
 /**
- * egress-relay-init -- the in-jail relay-as-init for `network: listed-hosts`
- * (§3.5). It is NOT imported by any package — it is spawned as a
+ * egress-relay-init -- the in-jail relay-as-init for `network: listed-hosts`.
+ * It is NOT imported by any package — it is spawned as a
  * SUBPROCESS *inside* the bwrap jail, AFTER bwrap's `--` separator, as the jail's
  * userns-root PID-1 init (the `relayArgv` that {@link buildEgressRelayLaunch}
  * points {@link RELAY_INIT_SCRIPT_URL} at). It composes the two net-new dimensions
- * (egress relay + uid drop) into ONE launcher, in the exact order the egress
- * transport spike proved on the VPS (the `g3-relay.mjs` transport):
+ * (egress relay + uid drop) into ONE launcher, in the exact order that keeps the
+ * driven child from ever holding CAP_NET_ADMIN:
  *
  *   1. Bring loopback (`lo`) UP. The jail owns its netns (`--unshare-net`) and the
  *      init runs as userns-root, so it holds CAP_NET_ADMIN over that netns — `ip
@@ -33,7 +33,7 @@
  * Live enforcement is VPS-only (the loopback-up + TCP->unix bridge + uid drop need
  * a real `--unshare-net` userns): the `terminal-scope-matrix.linux.test.ts`
  * egress cell drives a real request through this init (allowlisted -> 200,
- * non-listed -> 403, direct `--noproxy` -> rc=7), mirroring the egress transport spike.
+ * non-listed -> 403, direct `--noproxy` -> rc=7).
  *
  * @module
  */
@@ -43,15 +43,15 @@
  * namespace maps a single uid, so 65534 is unmapped and `setuid(65534)` throws).
  * The relay-init is a bare runtime subprocess with NO `@comis/infra` logger, so the
  * audit is a one-line JSON object written to stderr (the operator-observable signal
- * the orchestrator + the VPS smoke can grep). It deliberately mirrors the §2.7 log
- * shape (`hint`/`errorKind`) so it reads like every other structured failure line.
+ * the orchestrator + the VPS smoke can grep). It deliberately mirrors the canonical
+ * structured-log shape (`hint`/`errorKind`) so it reads like every other failure line.
  */
 export interface RelayInitAudit {
     /** Always `"egress-relay-init"` — the source tag for grep. */
     module: string;
     /** The security posture / next-failure hint (audit prose). */
     hint: string;
-    /** The §2.7 errorKind tag (`"permission"` for the unmapped-drop case). */
+    /** The canonical errorKind tag (`"permission"` for the unmapped-drop case). */
     errorKind: string;
     /** The net-new uid the drop targeted (could not reach). */
     targetUid?: number;
@@ -81,9 +81,8 @@ export interface DropPrivilegesDeps {
  * init attempts the uid drop here. On the root-worker VPS the bwrap user namespace
  * maps a SINGLE uid (host-root → userns-root), so 65534 is NOT a mapped target and
  * `process.setuid(65534)` throws (EPERM/EINVAL via `does_own_process_state`). The
- * egress transport spike PROVED the egress transport working as userns-root with NO uid
- * drop, so we MUST NOT throw: a throw would crash the relay-init PID-1 and kill the
- * whole listed-hosts session. Instead we emit a STRUCTURED audit WARN (the session is
+ * egress transport works as userns-root with NO uid drop, so we MUST NOT throw:
+ * a throw would crash the relay-init PID-1 and kill the whole listed-hosts session. Instead we emit a STRUCTURED audit WARN (the session is
  * running at the jail userns-uid because the drop target isn't mapped) and CONTINUE.
  * The bwrap user+pid+net+fs namespaces + the ~/.comis carve-out + the env-scrub + the
  * egress allowlist still confine the child — running at the namespace's userns-root is
@@ -109,7 +108,7 @@ export declare function dropPrivileges(setuid?: number, setgid?: number, deps?:
  * pointing at the in-jail loopback relay (`http://127.0.0.1:<relayPort>`). The
  * relay-init binds the relay on `relayPort`, so it is the AUTHORITATIVE source of
  * this value — set here, NOT relied upon via bwrap env-forwarding (which does not
- * survive the relay-init→child `spawnSync` boundary, live VPS 2026-06-14). Without
+ * survive the relay-init→child `spawnSync` boundary). Without
  * it a proxy-aware child attempts a DIRECT connect that `--unshare-net` blocks
  * ("could not resolve host"). Both upper- and lower-case forms cover the common
  * clients (curl reads lower; most others honor upper).

package/node_modules/@comis/skills/dist/tools/builtin/terminal-driver/egress-relay-init.js

@@ -1,12 +1,12 @@
 // SPDX-License-Identifier: Apache-2.0
 /**
- * egress-relay-init -- the in-jail relay-as-init for `network: listed-hosts`
- * (§3.5). It is NOT imported by any package — it is spawned as a
+ * egress-relay-init -- the in-jail relay-as-init for `network: listed-hosts`.
+ * It is NOT imported by any package — it is spawned as a
  * SUBPROCESS *inside* the bwrap jail, AFTER bwrap's `--` separator, as the jail's
  * userns-root PID-1 init (the `relayArgv` that {@link buildEgressRelayLaunch}
  * points {@link RELAY_INIT_SCRIPT_URL} at). It composes the two net-new dimensions
- * (egress relay + uid drop) into ONE launcher, in the exact order the egress
- * transport spike proved on the VPS (the `g3-relay.mjs` transport):
+ * (egress relay + uid drop) into ONE launcher, in the exact order that keeps the
+ * driven child from ever holding CAP_NET_ADMIN:
  *
  *   1. Bring loopback (`lo`) UP. The jail owns its netns (`--unshare-net`) and the
  *      init runs as userns-root, so it holds CAP_NET_ADMIN over that netns — `ip
@@ -34,7 +34,7 @@
  * Live enforcement is VPS-only (the loopback-up + TCP->unix bridge + uid drop need
  * a real `--unshare-net` userns): the `terminal-scope-matrix.linux.test.ts`
  * egress cell drives a real request through this init (allowlisted -> 200,
- * non-listed -> 403, direct `--noproxy` -> rc=7), mirroring the egress transport spike.
+ * non-listed -> 403, direct `--noproxy` -> rc=7).
  *
  * @module
  */
@@ -131,9 +131,8 @@ function defaultAudit(record) {
  * init attempts the uid drop here. On the root-worker VPS the bwrap user namespace
  * maps a SINGLE uid (host-root → userns-root), so 65534 is NOT a mapped target and
  * `process.setuid(65534)` throws (EPERM/EINVAL via `does_own_process_state`). The
- * egress transport spike PROVED the egress transport working as userns-root with NO uid
- * drop, so we MUST NOT throw: a throw would crash the relay-init PID-1 and kill the
- * whole listed-hosts session. Instead we emit a STRUCTURED audit WARN (the session is
+ * egress transport works as userns-root with NO uid drop, so we MUST NOT throw:
+ * a throw would crash the relay-init PID-1 and kill the whole listed-hosts session. Instead we emit a STRUCTURED audit WARN (the session is
  * running at the jail userns-uid because the drop target isn't mapped) and CONTINUE.
  * The bwrap user+pid+net+fs namespaces + the ~/.comis carve-out + the env-scrub + the
  * egress allowlist still confine the child — running at the namespace's userns-root is
@@ -198,7 +197,7 @@ function auditDropFailure(audit, err, ids) {
  * pointing at the in-jail loopback relay (`http://127.0.0.1:<relayPort>`). The
  * relay-init binds the relay on `relayPort`, so it is the AUTHORITATIVE source of
  * this value — set here, NOT relied upon via bwrap env-forwarding (which does not
- * survive the relay-init→child `spawnSync` boundary, live VPS 2026-06-14). Without
+ * survive the relay-init→child `spawnSync` boundary). Without
  * it a proxy-aware child attempts a DIRECT connect that `--unshare-net` blocks
  * ("could not resolve host"). Both upper- and lower-case forms cover the common
  * clients (curl reads lower; most others honor upper).
@@ -232,7 +231,7 @@ async function main() {
     bringLoopbackUp();
     await startRelay(args.socketPath, args.port);
     // Privilege drop happens AFTER the privileged netns setup (lo up) + the relay
-    // bind, but BEFORE exec — the child never holds the cap (the spike composition).
+    // bind, but BEFORE exec — the child never holds the cap.
     // Best-effort: on the root-worker VPS the net-new uid is not
     // mapped in the bwrap single-uid userns, so the drop is refused; dropPrivileges
     // logs the audit posture and continues rather than crash the relay-init PID-1.