comisai 1.0.45 → 1.0.46

package/node_modules/@comis/agent/dist/memory/outcome-judge-seam.d.ts

@@ -1,22 +1,22 @@
 /**
- * The daemon-injected OPTIONAL, cost-gated outcome-judge seam (OUTCOME-04).
+ * The daemon-injected OPTIONAL, cost-gated outcome-judge seam.
  *
  * {@link createOutcomeJudgeSeam} wraps a cheap resolved model into a
- * `judge(trajectoryContent)` seam — the FALLBACK outcome source for v2.26
- * Verified Learning (WS1). When NO deterministic tool/pipeline signal exists for
- * a finished trajectory AND the per-agent judge is enabled, the daemon (Plan 04)
+ * `judge(trajectoryContent)` seam — the FALLBACK outcome source for
+ * verified learning. When NO deterministic tool/pipeline signal exists for
+ * a finished trajectory AND the per-agent judge is enabled, the daemon
  * runs ONE cheap-model pass over the trajectory and gets back a
  * `success/failure/unknown` verdict + a confidence. The verdict is fed to
  * `OutcomeSignalPort.observe()` as a `source: "judge"` observation; the
- * deterministic tool/pipeline sources ALWAYS outrank it via the Plan 02 fusion
+ * deterministic tool/pipeline sources ALWAYS outrank it via the fusion
  * precedence — this seam can never overturn a deterministic result.
  *
- * Built but DORMANT: the judge ships `enabled:false` by default (design D6), so
+ * Built but DORMANT: the judge ships `enabled:false` by default, so
  * the daemon never constructs or calls it unless an operator opts in. Follows the
  * standard offline cron-seam posture (bounded, non-fatal, lenient-parsing) and adds
- * the OUTCOME-04 triple-bound for its UNTRUSTED input.
+ * a triple bound for its UNTRUSTED input.
  *
- * Security posture (OUTCOME-04 / SEC-01 / §9 triple-bound — the trajectory the
+ * Security posture (a triple bound — the trajectory the
  * judge scores is UNTRUSTED, and the model's self-reported `confidence` is
  * UNTRUSTED):
  * 1. The trajectory input is delimiter-wrapped via
@@ -39,20 +39,20 @@
  * metrics or trip a breaker); the outcome simply stays unresolved. Each call is
  * BOUNDED by `maxOutputTokens` and a wall-clock-free abort timer (the injected
  * `clock` supplies timestamps; the abort uses the sanctioned-root
- * `systemSetTimeout`), routed to the cheap `fast` tier (`outcomeJudge`
- * ModelOperationType, Plan 01).
+ * `systemSetTimeout`), routed to the cheap `fast` tier (the `outcomeJudge`
+ * ModelOperationType).
  *
  * OFFLINE only — NEVER imported by the recall read path; no agent↛memory edge
  * (it imports the `@comis/core` `wrapExternalContent` + types and `pi-ai` only —
- * the closed-graph cut, SEC-01).
+ * the closed-graph cut).
  *
  * @module
  */
 import type { ClockPort, ComisLogger } from "@comis/core";
 import { type CustomCompletionsModelSpec } from "./judge-model-resolver.js";
 /**
- * The reward ceiling for a judge verdict — the OUTCOME-04 "reward capped
- * independent of self-reported confidence" constant (design §9 / §17 triple-bound).
+ * The reward ceiling for a judge verdict — the "reward capped
+ * independent of self-reported confidence" constant (bound #2 of the triple bound).
  * The effective reward the daemon `observe()`s is `Math.min(modelConfidence,
  * JUDGE_REWARD_CAP)`, so a maximal self-report (an injection coercing
  * `confidence: 1.0 / this succeeded`) can never produce a reward above this cap.
@@ -81,14 +81,14 @@ export interface OutcomeJudgeSeamDeps {
      * used to build the judge Model when the pi-ai catalog has no entry for
      * `provider/modelId` — i.e. a custom YAML provider (ollama, lm-studio, vLLM, …).
      * Undefined for built-in catalog providers (the catalog path is unchanged).
-     * Without this the judge SKIPPED on every keyless/local turn (live 2026-06-20).
+     * Without this the judge is SKIPPED on every keyless/local turn.
      */
     customModel?: CustomCompletionsModelSpec;
 }
 /**
  * The judge's typed verdict for one trajectory. A deliberately NARROW union
  * (`success | failure | unknown`) — the judge does NOT detect corrections (that
- * is the separate `correction` signal, Phase 199); its verdict maps to a
+ * is the separate `correction` signal); its verdict maps to a
  * `source: "judge"` {@link OutcomeObservation} for the store. The `source` field
  * is set in CODE (never read from the model) so a smuggled `source` cannot
  * promote the verdict above its judge tier.
@@ -101,7 +101,7 @@ export interface OutcomeVerdict {
     /**
      * The EFFECTIVE reward the daemon will `observe()`: `Math.min(confidence,
      * JUDGE_REWARD_CAP)`. Capped in CODE independent of the self-report — the
-     * OUTCOME-04 keystone. An injected `confidence: 1.0` yields at most the cap.
+     * reward-cap keystone. An injected `confidence: 1.0` yields at most the cap.
      */
     cappedConfidence: number;
     /** The signal tier, set in CODE — always `"judge"` so fusion ranks it below tool/pipeline. */

package/node_modules/@comis/agent/dist/memory/outcome-judge-seam.js

@@ -1,23 +1,23 @@
 // SPDX-License-Identifier: Apache-2.0
 /**
- * The daemon-injected OPTIONAL, cost-gated outcome-judge seam (OUTCOME-04).
+ * The daemon-injected OPTIONAL, cost-gated outcome-judge seam.
  *
  * {@link createOutcomeJudgeSeam} wraps a cheap resolved model into a
- * `judge(trajectoryContent)` seam — the FALLBACK outcome source for v2.26
- * Verified Learning (WS1). When NO deterministic tool/pipeline signal exists for
- * a finished trajectory AND the per-agent judge is enabled, the daemon (Plan 04)
+ * `judge(trajectoryContent)` seam — the FALLBACK outcome source for
+ * verified learning. When NO deterministic tool/pipeline signal exists for
+ * a finished trajectory AND the per-agent judge is enabled, the daemon
  * runs ONE cheap-model pass over the trajectory and gets back a
  * `success/failure/unknown` verdict + a confidence. The verdict is fed to
  * `OutcomeSignalPort.observe()` as a `source: "judge"` observation; the
- * deterministic tool/pipeline sources ALWAYS outrank it via the Plan 02 fusion
+ * deterministic tool/pipeline sources ALWAYS outrank it via the fusion
  * precedence — this seam can never overturn a deterministic result.
  *
- * Built but DORMANT: the judge ships `enabled:false` by default (design D6), so
+ * Built but DORMANT: the judge ships `enabled:false` by default, so
  * the daemon never constructs or calls it unless an operator opts in. Follows the
  * standard offline cron-seam posture (bounded, non-fatal, lenient-parsing) and adds
- * the OUTCOME-04 triple-bound for its UNTRUSTED input.
+ * a triple bound for its UNTRUSTED input.
  *
- * Security posture (OUTCOME-04 / SEC-01 / §9 triple-bound — the trajectory the
+ * Security posture (a triple bound — the trajectory the
  * judge scores is UNTRUSTED, and the model's self-reported `confidence` is
  * UNTRUSTED):
  * 1. The trajectory input is delimiter-wrapped via
@@ -40,25 +40,25 @@
  * metrics or trip a breaker); the outcome simply stays unresolved. Each call is
  * BOUNDED by `maxOutputTokens` and a wall-clock-free abort timer (the injected
  * `clock` supplies timestamps; the abort uses the sanctioned-root
- * `systemSetTimeout`), routed to the cheap `fast` tier (`outcomeJudge`
- * ModelOperationType, Plan 01).
+ * `systemSetTimeout`), routed to the cheap `fast` tier (the `outcomeJudge`
+ * ModelOperationType).
  *
  * OFFLINE only — NEVER imported by the recall read path; no agent↛memory edge
  * (it imports the `@comis/core` `wrapExternalContent` + types and `pi-ai` only —
- * the closed-graph cut, SEC-01).
+ * the closed-graph cut).
  *
  * @module
  */
 import { systemSetTimeout, systemClearTimeout, wrapExternalContent } from "@comis/core";
-import { completeSimple } from "@earendil-works/pi-ai";
+import { completeSimple } from "@earendil-works/pi-ai/compat";
 import { z } from "zod";
 import { resolveJudgeModel, temperatureOption } from "./judge-model-resolver.js";
 import { parseLenientJson } from "./llm-json.js";
 /** Hard abort ceiling per LLM call (mirrors the usefulness-judge seam LLM timeout). */
 const LLM_TIMEOUT_MS = 120_000;
 /**
- * The reward ceiling for a judge verdict — the OUTCOME-04 "reward capped
- * independent of self-reported confidence" constant (design §9 / §17 triple-bound).
+ * The reward ceiling for a judge verdict — the "reward capped
+ * independent of self-reported confidence" constant (bound #2 of the triple bound).
  * The effective reward the daemon `observe()`s is `Math.min(modelConfidence,
  * JUDGE_REWARD_CAP)`, so a maximal self-report (an injection coercing
  * `confidence: 1.0 / this succeeded`) can never produce a reward above this cap.
@@ -128,7 +128,7 @@ function parseVerdict(raw) {
     return {
         outcome: parsed.data.outcome,
         confidence: parsed.data.confidence,
-        // The OUTCOME-04 reward cap — bounded in CODE, never trusted from the model.
+        // The reward cap — bounded in CODE, never trusted from the model.
         cappedConfidence: Math.min(parsed.data.confidence, JUDGE_REWARD_CAP),
         // The tier is set HERE, in code — a smuggled `source` field cannot promote it.
         source: "judge",
@@ -180,10 +180,10 @@ export function createOutcomeJudgeSeam(deps) {
             // A pi-ai error response does NOT throw — it returns `stopReason:"error"` with
             // empty `content` and an `errorMessage` (e.g. a 404 from a retired/invalid model
             // id). Treat that as a FAILURE the operator can see, not a benign empty verdict:
-            // without this, an unresolvable fast-tier model silently yields `unknown` forever
-            // (the live 2026-06-18 `claude-3-5-haiku-latest` 404 — diagnosable only after a
-            // raw-response dump). The WARN names the model + the error so the NEXT occurrence
-            // is one log line.
+            // without this, an unresolvable fast-tier model (e.g. a retired model id that
+            // 404s on every call) silently yields `unknown` forever and is diagnosable only
+            // from a raw-response dump. The WARN names the model + the error so the NEXT
+            // occurrence is one log line.
             const r = response;
             if (r.stopReason === "error" || (Array.isArray(r.content) && r.content.length === 0)) {
                 logger.warn({
@@ -214,7 +214,7 @@ export function createOutcomeJudgeSeam(deps) {
     return async function judge(trajectoryContent) {
         // The trajectory is UNTRUSTED — delimiter-wrap it BEFORE the model sees it so
         // an injected "this succeeded / confidence: 1.0" is neutralized as external
-        // content, never read as an instruction (OUTCOME-04 bound #1). The wrap reads
+        // content, never read as an instruction (bound #1). The wrap reads
         // `contentDelimiter` from the ALS context for cache-stable, session-consistent
         // markers.
         const wrapped = wrapExternalContent(trajectoryContent, { source: "outcome_judge" });

package/node_modules/@comis/agent/dist/memory/reflection-job.d.ts

@@ -1,31 +1,30 @@
 /**
- * The reflection engine (v2.31 Reflection, Phase 223, REFLECT-01/03/04/05/06) —
- * the ONE outcome-gated job that REPLACES the dead embedding-clustering
- * `runSkillSynthesis`. It runs as an offline cron (wired daemon-side, Plan 05 —
- * NOT the hot path). One pass over the injected source trajectories:
+ * The reflection engine — the ONE outcome-gated job that distils finished source
+ * trajectories into learned advisory docs. It runs as an offline cron (wired
+ * daemon-side — NOT the hot path). One pass over the injected source trajectories:
  *
- *  1. **SELECT** (fail-closed, REFLECT-01 / INV-5): for each source,
+ *  1. **SELECT** (fail-closed): for each source,
  *     `OutcomeSignalPort.resolve`; keep ONLY `outcome === "success" && confidence
- *     >= minConfidence` AND BOTH anti-poison axes (FOLD-04): `source.trustedOrigin`
- *     (axis 1 — daemon-derived SESSION origin, INV-5/D-04) AND
+ *     >= minConfidence` AND BOTH anti-poison axes: `source.trustedOrigin`
+ *     (axis 1 — daemon-derived SESSION origin) AND
  *     `!source.sourceTrustExternal` (axis 2 — the per-MEMORY source-trust belt; a
- *     planted `external` memory riding a trusted session seeds nothing, Pitfall 2).
+ *     planted `external` memory riding a trusted session seeds nothing).
  *     An untrusted-origin OR external-trust source NEVER seeds a doc. An unresolved
  *     outcome is fail-closed `continue`.
- *  2. **GROUP** (replaces `clusterSuccesses`, REFLECT-02): `Map<topicKey,
+ *  2. **GROUP**: `Map<topicKey,
  *     members[]>` via `normalizeOpeningRequest(source.signature)` — a deterministic,
  *     keyless, content-light token-SET hash (NO embeddings). An empty topicKey
  *     (`""`, ungroupable) is skipped.
- *  3. **GATE** (anti-domination, REFLECT-03 / INV-2): `distinctSenderCardinality(
+ *  3. **GATE** (anti-domination): `distinctSenderCardinality(
  *     members) >= 2` — N repeats of one `(sessionId, sender)` count as 1, so an
  *     attacker cannot corroborate a doc by repeating one success. Bounded by
  *     `maxDocsPerRun`.
- *  4. **REFLECT** (REFLECT-04): `store.get(docName)` → its `structuredBody`. New
+ *  4. **REFLECT**: `store.get(docName)` → its `structuredBody`. New
  *     (no prior AST) → reflect a FRESH section list, `renderStructuredBody`.
  *     Exists → reflect delta-ops, `applyDeltaOps(prior, ops)` (untargeted sections
- *     byte-identical — Hindsight's drift-killer), `renderStructuredBody`. ONE cheap
- *     LLM call per topic via the injected adapter.
- *  5. **GUARD + ADMIT** (REFLECT-05/06): an empty/failed reflection → record
+ *     stay byte-identical, so a refresh cannot drift text it did not target),
+ *     `renderStructuredBody`. ONE cheap LLM call per topic via the injected adapter.
+ *  5. **GUARD + ADMIT**: an empty/failed reflection → record
  *     `empty_reflection`, SKIP `store.admit` (the guard lives HERE — the store
  *     upsert overwrites `body` unconditionally on conflict, so the prior doc only
  *     survives if we skip the call). Else `validateLearnedDocBody({name,body,
@@ -34,16 +33,16 @@
  *     proofCount: LOW_PROOF_COUNT, ... })` — at `trust=learned`/`state=candidate`
  *     (store-forced) and idempotent on the deterministic id.
  *
- * Kind-generic-READY: the engine populates only `kind:"skill"` in 223, but the
- * SELECT/GROUP/REFLECT seams are kind-agnostic so Phase 225 adds profile/topic by
- * varying select/group/prompt, not by adding a new engine.
+ * Kind-generic: the SELECT/GROUP/REFLECT seams are kind-agnostic, so the
+ * profile/topic doc families ride the SAME engine by varying select/group/prompt,
+ * not by adding a new engine.
  *
  * Closed graph: this job consumes `@comis/core` PORT TYPES + the static
  * `validateLearnedDocBody` keystone + the pure `applyDeltaOps`/`renderStructuredBody`
  * (agent→core is ALLOWED) + the injected source/store/adapter/clock. It imports NO
  * `@comis/memory` / `@comis/skills` value (the agent↛memory / agent↛skills build
  * cut). It emits NO `learning:skill_*` bus event — the daemon emits the counts
- * after the job returns (Plan 05).
+ * after the job returns.
  *
  * @module
  */
@@ -52,12 +51,12 @@ import type { LearningScope, MentalModelStorePort, OutcomeSignalPort, ReflectAdm
 import type { ReflectionAdapter } from "./llm-reflection-adapter.js";
 /**
  * One finished source trajectory the job selects + groups over. The daemon
- * (Plan 05) builds these from the LCD-merged review source and injects them.
+ * builds these from the LCD-merged review source and injects them.
  * `text` is the flattened transcript the reflect adapter wraps; `signature` is the
  * envelope-stripped user-role text the topicKey is computed from; `sender` is the
  * message author the anti-domination cardinality counts on. `trustedOrigin` is
  * derived DAEMON-SIDE (the daemon has the session/sender-trust context — the
- * `ResolvedOutcome` does NOT carry it; Research A2) — the job FILTERS on it, it
+ * `ResolvedOutcome` does NOT carry it) — the job FILTERS on it, it
  * does NOT compute trust itself.
  */
 export interface ReflectionSourceTrajectory {
@@ -72,24 +71,36 @@ export interface ReflectionSourceTrajectory {
     /** The envelope-stripped user-role text → `normalizeOpeningRequest` (the topicKey). */
     signature: string;
     /**
-     * FOLD-04 ANTI-POISON AXIS 1 (the 223 session-origin belt). INV-5/D-04: false ⇒
+     * ANTI-POISON AXIS 1 (the session-origin belt). false ⇒
      * this success NEVER seeds a doc (daemon-derived SESSION/sender origin trust). A
      * per-TRAJECTORY boolean — NOT a per-memory trust level.
      */
     trustedOrigin: boolean;
     /**
-     * FOLD-04 ANTI-POISON AXIS 2 (Phase 225, the per-MEMORY source-trust belt —
-     * GAP-3, the OLD user-rep layer-1 firewall, memory-user-representation-job.ts:322
-     * `s.trustLevel !== "external"`). true ⇒ this source carries an `external`-trust
+     * ANTI-POISON AXIS 2 (the per-MEMORY source-trust belt, mirroring the
+     * `trustLevel !== "external"` firewall the memory pipeline applies to source
+     * memories). true ⇒ this source carries an `external`-trust
      * memory and NEVER seeds a doc, even riding a `trustedOrigin:true` session
-     * (Pitfall 2: a planted external memory can ride a trusted session — the two axes
-     * are DISTINCT and must BOTH pass). The daemon (Plan 04) sets it from the
+     * (a planted external memory can ride a trusted session — the two axes
+     * are DISTINCT and must BOTH pass). The daemon sets it from the
      * per-memory `trustLevel === "external"`; for kind:skill the daemon sets it false
      * (skill sources are outcome trajectories, not source memories).
      */
     sourceTrustExternal: boolean;
+    /**
+     * Content-free procedure descriptor for the turn — `key` groups (self-sufficient:
+     * a custom groupKey BYPASSES the Jaccard signature-merge, so only byte-identical keys
+     * collide), `sequence` is the ordered call-site sequence + counts (repeats preserved,
+     * NOT sorted/deduped) which feeds the reflect input. NAMES only — no args/bodies/secrets.
+     * Absent when the turn ran no cap-mapped tool call sites. Orthogonal to the two trust
+     * axes above — it never weakens them.
+     */
+    procedureDescriptor?: {
+        key: string;
+        sequence: readonly string[];
+    };
 }
-/** The config slice the job reads (a structural subset; Phase 226 collapses to learning.reflect). */
+/** The config slice the job reads (a structural subset of the learning reflect config). */
 export interface RunReflectionConfig {
     enabled: boolean;
     minConfidence: number;
@@ -110,21 +121,30 @@ export interface RunReflectionDeps {
     /** The (tenant, agent) isolation boundary every read/write rebinds to. */
     scope: LearningScope;
     /**
-     * The doc family this run reflects (Phase 225 FOLD — the I7 kind-parameter).
+     * The doc family this run reflects (the kind-parameter).
      * Threaded onto the admitted doc's `kind` and into the doc-name prefix
      * (`<kind>-<topicKey>`) so the engine is ONE engine across skill/profile/topic.
-     * Omitted ⇒ `"skill"` (a skill run is byte-identical to the 223 behavior).
+     * Omitted ⇒ `"skill"` (the default skill behavior).
      */
     kind?: "skill" | "profile" | "topic";
     /**
-     * The per-kind GROUP key (Phase 225 FOLD). Maps a source to its corroboration
+     * The per-kind GROUP key. Maps a source to its corroboration
      * group: kind:skill keys on the normalized opening-request signature (the
      * default), kind:profile groups by user (one doc per user), kind:topic groups
      * its surprisal/observation clusters. Omitted ⇒ `normalizeOpeningRequest(
-     * t.signature)` (byte-identical for kind:skill). An empty key (`""`) is
+     * t.signature)` (identical for kind:skill). An empty key (`""`) is
      * ungroupable and skipped (never corroborates — a singleton).
      */
     groupKey?: (t: ReflectionSourceTrajectory) => string;
+    /**
+     * PROCEDURE run only — gates BOTH the descriptor-into-input thread (the ordered
+     * tool-sequence section appended to the reflect input) AND the DETERMINISTIC
+     * `required_tools`/`params_schema` bind at admit. Set ONLY on the 4th (procedure)
+     * reflectKinds entry. Gate on THIS flag, NOT on "descriptor present" —
+     * the user-intent skill run also reads descriptor-carrying sources, and mis-binding
+     * its `required_tools` would mis-classify it as a learnable procedure.
+     */
+    populateProcedureMetadata?: boolean;
     config: RunReflectionConfig;
     /** The LCD-merged source history the daemon injects (with the daemon-derived trustedOrigin). */
     sourceTrajectories: ReflectionSourceTrajectory[];
@@ -135,18 +155,18 @@ export interface RunReflectionDeps {
     /**
      * The mental-model store (injected from @comis/memory). `get` reads the prior doc
      * for delta-ops; `admit` is the idempotent candidate write (a NEW doc, or a skill
-     * doc — byte-identical with 223). `supersede` (Phase 225 FOLD-01) is the bi-temporal
+     * doc). `supersede` is the bi-temporal
      * history-append a profile/topic CORRECTION of an EXISTING doc routes through (the
      * prior body is preserved in `history`, never overwritten). Optional with a
-     * skill-default posture: omitted ⇒ no doc supersedes (every kind admits, the 223
-     * behavior); kind:skill NEVER supersedes even when wired.
+     * skill-default posture: omitted ⇒ no doc supersedes (every kind admits);
+     * kind:skill NEVER supersedes even when wired.
      */
     mentalModelStore: Pick<MentalModelStorePort, "get" | "admit"> & Partial<Pick<MentalModelStorePort, "supersede">>;
     /** Wall-clock reads — durations + the admit timestamp. NEVER a wall-clock global. */
     clock: {
         now: () => number;
     };
-    /** Counts/ids-only event bus (the daemon emits the learning:skill_* events, Plan 05). */
+    /** Counts/ids-only event bus (the daemon emits the learning:skill_* events). */
     eventBus: {
         emit(event: string, payload: unknown): void;
     };
@@ -155,9 +175,9 @@ export interface RunReflectionDeps {
 /**
  * The ACUTE reason a reflection run admitted nothing (or did) — a closed,
  * content-free enum so "why didn't a doc get learned?" is ONE readable field on
- * the funnel (the RC-4 diagnosability the synthesis-job established).
+ * the funnel.
  *
- * IN-02: the canonical definition moved to `@comis/core` (events-learning.ts) so
+ * The canonical definition lives in `@comis/core` (events-learning.ts) so
  * the `reflect:funnel.admissionOutcome` event payload is typed to the SAME closed
  * union (core cannot import @comis/agent — the agent→core direction only). This
  * job's `classifyReflectOutcome` produces it; the daemon emit assigns it onto the
@@ -169,16 +189,15 @@ export interface RunReflectionDeps {
  * - `uncorroborated`       — topics grouped but `maxTopicCardinality < 2` (the
  *                            anti-domination gate: needs ≥2 distinct (session,sender)).
  * - `empty_reflection`     — a corroborated topic reflected empty/failed (the
- *                            REFLECT-05 guard skipped the admit; the prior doc survives).
+ *                            empty-content guard skipped the admit; the prior doc survives).
  * - `rejected_validation`  — a reflected body failed `validateLearnedDocBody`
  *                            (a poison/secret body rejected before durable storage).
- * - `rejected_name_length` — a reflected doc's NAME exceeded `MAX_DOC_NAME_LENGTH`
- *                            (the 225 WR-01 gap: previously mis-reported as
- *                            `rejected_validation`). Reported as its own reason so an
+ * - `rejected_name_length` — a reflected doc's NAME exceeded `MAX_DOC_NAME_LENGTH`.
+ *                            Reported as its own reason so an
  *                            operator distinguishes a name-length over-cap from a poison
  *                            verdict (counts-only — never the offending name).
  * - `untrusted_origin`     — every selected success was dropped at SELECT for an
- *                            untrusted origin / external-trust source (D5 salvage): the
+ *                            untrusted origin / external-trust source: the
  *                            specific "nothing trusted survived" reason, out-ranking the
  *                            generic `no_successes`.
  * - `admitted`             — ≥1 doc admitted.
@@ -213,13 +232,13 @@ export interface RunReflectionResult {
      */
     emptyReflections: number;
     /**
-     * Phase 226 (D5 salvage): how many `success` sources were dropped at SELECT for an
-     * untrusted origin (FOLD-04 axis 1) or external-trust source (axis 2). Counts only.
+     * How many `success` sources were dropped at SELECT for an
+     * untrusted origin (axis 1) or external-trust source (axis 2). Counts only.
      * Lets the daemon emit `untrusted_origin` when this is the acute reason nothing seeded.
      */
     untrustedDrops: number;
     /**
-     * Phase 226 (the 225 WR-01 gap): how many corroborated topics had their reflected doc
+     * How many corroborated topics had their reflected doc
      * rejected for a NAME-length over-cap (distinct from a poison `rejected_validation`).
      * Counts only — never the offending name.
      */
@@ -247,11 +266,20 @@ export declare function classifyReflectOutcome(f: {
     maxTopicCardinality: number;
     admitted: number;
     emptyReflections: number;
-    /** Phase 226: success sources dropped at SELECT for untrusted origin / external-trust. */
+    /** Success sources dropped at SELECT for untrusted origin / external-trust. */
     untrustedDrops?: number;
-    /** Phase 226: corroborated topics rejected for a doc-name over-cap (the 225 WR-01 gap). */
+    /** Corroborated topics rejected for a doc-name over-cap. */
     nameLengthRejections?: number;
 }): ReflectAdmissionOutcome;
+/**
+ * The DETERMINISTIC required-tools footprint for a procedure doc: the dedupe+sorted
+ * union of the members' content-free ordered descriptor sequences (the SET of tool
+ * NAMES the procedure touches). NEVER LLM-authored — bound at admit from the AUDITED
+ * descriptor so an advisory doc carries no learned-code envelope (INV-4). The ORDER +
+ * counts live on the groupKey + the reflect input, NOT here (required_tools is a SET).
+ * Clock-/order-independent: the sort makes it byte-stable across calls.
+ */
+export declare function deriveRequiredTools(members: ReflectionSourceTrajectory[]): string[];
 /**
  * Run one reflection pass for a single agent. Non-fatal posture: a single topic's
  * resolve/reflect/admit fault is logged + skipped (the run returns `ok` with the