comisai 1.0.45 → 1.0.46

package/node_modules/@comis/core/dist/config/schema-agent/schema-agent-autonomy-bounds.js

@@ -1,17 +1,17 @@
 // SPDX-License-Identifier: Apache-2.0
 /**
- * Agent config — Autonomy BOUNDS sub-blocks (213-03).
+ * Agent config — Autonomy BOUNDS sub-blocks.
  *
  * The four NESTED `z.strictObject` bounding blocks the daemon-side
- * `BoundedAutonomy` service (Plans 04/05/06/07) reads, split out of
+ * `BoundedAutonomy` service reads, split out of
  * `schema-agent-autonomy.ts` to keep that leaf under the schema-agent
- * file-size cap. They follow the `message`/`lease` nested-block precedent
- * (RESEARCH §D — A2): a `z.strictObject` per limb group, every field
+ * file-size cap. They follow the `message`/`lease` nested-block precedent:
+ * a `z.strictObject` per limb group, every field
  * `.default()`-ed, `strictObject` as the typo guard (fails-closed).
  *
  * `schema-agent-autonomy.ts` wires each into `AutonomyConfigSchema`,
  * derives `STANDARD_GUARDS` defaults from these schemas (`.parse({})`), and
- * the resolver merges the nested + the prior-flat fields per-field.
+ * the resolver merges the nested + the flat alias fields per-field.
  *
  * Pure schema leaf — imports only `zod`. No `process.env` / `Date.now` /
  * `path.join` (AGENTS §2.2).
@@ -20,35 +20,34 @@
  */
 import { z } from "zod";
 /**
- * Per-root-run BUDGET ceiling (§8.7, BUDGET-01/02). The nested
+ * Per-root-run BUDGET ceiling. The nested
  * `autonomy.budget.{ aggregateUsd, tokens, wallClockMs }` sub-block bounds the
  * WHOLE spawn tree keyed on its `rootRunId` (the daemon-side BoundedAutonomy
- * meter, Plans 04/06 reads it). Three independent limbs so a runaway loop trips
+ * meter reads it). Three independent limbs so a runaway loop trips
  * a bound regardless of pricing knowledge:
  *  - `aggregateUsd` — the priced $-ceiling (the flat `aggregateBudgetUsd` is its
  *    alias; the resolver folds both into this one field).
  *  - `tokens` — the token ceiling, which STILL bites on an unknown-priced ($0)
- *    subscription/Codex model that the $-limb counts as free (the ffe11736
- *    BUDGET-02 case).
+ *    subscription model that the $-limb counts as free.
  *  - `wallClockMs` — the wall-clock ceiling, a backstop on a stuck/looping tree
  *    that burns neither $ nor tokens fast.
  * Every limb is `.positive()` so a profile can never resolve an absent/zero
  * (fails-open) bound. The defaults are sized well above a single legit turn but
- * below a self-spawning storm (a §22.3 floor that is ON in every profile).
+ * below a self-spawning storm (a floor that is ON in every profile).
  */
 export const AutonomyBudgetConfigSchema = z.strictObject({
     /** Priced per-root $ ceiling (the flat `aggregateBudgetUsd` is its alias). */
     aggregateUsd: z.number().positive().default(2.0),
-    /** Per-root token ceiling — bites even on an unknown-priced ($0) model (BUDGET-02). */
+    /** Per-root token ceiling — bites even on an unknown-priced ($0) model. */
     tokens: z.number().int().positive().default(2_000_000),
     /** Per-root wall-clock ceiling in ms — backstop on a stuck/looping tree (30 min). */
     wallClockMs: z.number().int().positive().default(1_800_000),
 });
 /**
- * Per-root / per-socket call-RATE ceiling (RATE-01). The nested
+ * Per-root / per-socket call-RATE ceiling. The nested
  * `autonomy.rate.{ perRootCallsPerSec, perSocketCallsPerSec, connectionChurnPerMin }`
  * sub-block bounds a `for(;;) spawn()` / cron-storm call rate without tripping a
- * legitimate burst (the daemon-side call-rate-limiter, Plan 06, reads it):
+ * legitimate burst (the daemon-side call-rate-limiter reads it):
  *  - `perRootCallsPerSec` — calls/sec across the whole spawn tree (per `rootRunId`).
  *  - `perSocketCallsPerSec` — calls/sec on a single orchestration socket.
  *  - `connectionChurnPerMin` — new-connection churn/min (a reconnect-storm cap).
@@ -64,51 +63,51 @@ export const AutonomyRateConfigSchema = z.strictObject({
     connectionChurnPerMin: z.number().int().positive().default(60),
 });
 /**
- * The tree-wide SPAWN ceiling shape (CEIL-01). The nested
+ * The tree-wide SPAWN ceiling shape. The nested
  * `autonomy.spawn.{ maxConcurrentSelfAgents, maxSpawnDepth, maxChildrenPerAgent }`
- * sub-block is the ONE resolved source the per-root semaphore (Plan 04) reads:
+ * sub-block is the ONE resolved source the per-root semaphore reads:
  *  - `maxConcurrentSelfAgents` — concurrent self-agents tree-wide (the flat
  *    field is its alias; the resolver folds both here).
  *  - `maxSpawnDepth` (3) — delegation-tree depth cap.
  *  - `maxChildrenPerAgent` (5) — per-caller fan-out cap.
- * `maxSpawnDepth`/`maxChildrenPerAgent` previously defaulted only inside
- * `subagentContext` (sub-agent-runner `?? 3`/`?? 5`); surfacing them here +
- * into `ResolvedAutonomy` gives the semaphore a single resolved read. Every
+ * Surfacing `maxSpawnDepth`/`maxChildrenPerAgent` here + into
+ * `ResolvedAutonomy` gives the semaphore a single resolved read instead of the
+ * `subagentContext` fallbacks (sub-agent-runner `?? 3`/`?? 5`). Every
  * limb `.positive()`.
  */
 export const AutonomySpawnConfigSchema = z.strictObject({
     /** Concurrent self-agents tree-wide (the flat `maxConcurrentSelfAgents` is its alias). */
     maxConcurrentSelfAgents: z.number().int().positive().default(4),
-    /** Delegation-tree depth cap (v8 CEIL-01). */
+    /** Delegation-tree depth cap. */
     maxSpawnDepth: z.number().int().positive().default(3),
-    /** Per-caller fan-out cap (v8 CEIL-01). */
+    /** Per-caller fan-out cap. */
     maxChildrenPerAgent: z.number().int().positive().default(5),
 });
 /**
- * OUTWARD-send governance beyond the per-hour quota (QUOTA-01/02). The nested
+ * OUTWARD-send governance beyond the per-hour quota. The nested
  * `autonomy.outward.{ originOnly, perTargetGrants, volumeCap }` sub-block bounds
- * the genuinely-outward `orch:message` subset (the outward-quota meter, Plan 05,
+ * the genuinely-outward `orch:message` subset (the outward-quota meter
  * reads it; `message.channels`/`maxPerHour` stay for the channel/hour quota):
  *  - `originOnly` (true) — by default only the agent's OWN origin channel is an
  *    auto-allowable target; a NEW target needs an explicit grant.
- *  - `perTargetGrants` — the §8.4 explicit per-target grant list (empty default);
+ *  - `perTargetGrants` — the explicit per-target grant list (empty default);
  *    a send to a non-origin target is denied unless its id is here.
  *  - `volumeCap` — a per-send volume bound (chars / recipient-weighted units; the
- *    Plan-05 meter defines the unit) so a mass-recipient / high-volume send trips
- *    a gate even when reversible. `.positive()`.
- * NB: `orch:browse` stays OFF (the `ALWAYS_ESCALATE_CAPABILITIES` member,
- * QUOTA-02) — no tool maps to it in M1, so no config knob is needed here.
+ *    outward-quota meter defines the unit) so a mass-recipient / high-volume send
+ *    trips a gate even when reversible. `.positive()`.
+ * NB: `orch:browse` stays OFF (an `ALWAYS_ESCALATE_CAPABILITIES` member) —
+ * no tool maps to it, so no config knob is needed here.
  */
 export const AutonomyOutwardConfigSchema = z.strictObject({
     /** Only the agent's own origin channel is auto-allowable by default. */
     originOnly: z.boolean().default(true),
-    /** The §8.4 explicit per-target grant list (a non-origin target needs an entry). */
+    /** The explicit per-target grant list (a non-origin target needs an entry). */
     perTargetGrants: z.array(z.string()).default([]),
-    /** Per-send volume bound (chars / recipient-weighted; the Plan-05 meter defines the unit). */
+    /** Per-send volume bound (chars / recipient-weighted; the outward-quota meter defines the unit). */
     volumeCap: z.number().int().positive().default(4000),
 });
 /**
- * The §3.8 `standard` BOUNDS defaults — ON under every autonomy-bearing profile.
+ * The `standard` BOUNDS defaults — ON under every autonomy-bearing profile.
  * Derived from the schemas (`.parse({})`) so the profile table (`STANDARD_GUARDS`
  * in `schema-agent-autonomy.ts`) and the Zod `.default()`s never drift.
  */
@@ -120,12 +119,12 @@ export const STANDARD_AUTONOMY_BOUNDS = {
 };
 /**
  * Merge the nested BOUNDS blocks per-field against the profile `base` (the
- * `cfg?.lease?.leaseMaxTtlMin ?? base.leaseMaxTtlMin` model, RESEARCH §D). Each
+ * `cfg?.lease?.leaseMaxTtlMin ?? base.leaseMaxTtlMin` model). Each
  * limb reads the explicit nested field first, then — for the two aliased limbs —
- * the prior-flat field (`aggregateBudgetUsd` → `budget.aggregateUsd`;
+ * the flat field (`aggregateBudgetUsd` → `budget.aggregateUsd`;
  * `maxConcurrentSelfAgents` → `spawn.maxConcurrentSelfAgents`), then the profile
  * default. The flat and nested representations resolve to ONE value (a live
- * alias, not a deprecated migration path — no compatibility shim). PURE.
+ * alias, not a compatibility shim). PURE.
  */
 export function resolveAutonomyBounds(cfg, base) {
     return {

package/node_modules/@comis/core/dist/config/schema-agent/schema-agent-autonomy-degrade.d.ts

@@ -1,15 +1,15 @@
 /**
- * Agent config — Autonomy honest-degrade path (PROFILE-03).
+ * Agent config — Autonomy honest-degrade path.
  *
- * Split out of `schema-agent-autonomy.ts` (which keeps the PROFILE-01
- * named-profile resolver) to hold the SEPARATE PROFILE-03 concern: when a host
+ * Split out of `schema-agent-autonomy.ts` (which keeps the
+ * named-profile resolver) to hold the SEPARATE concern: when a host
  * precondition for the jail fails, downshift the resolved posture to `assistant`
  * and SURFACE a structured signal — never a silent unjailed fallback.
  *
- * 210/211 SEAM (RESEARCH Pitfall 5 / A4): the downshift is driven by a
+ * SEAM: the downshift is driven by a
  * preflight-RESULT INPUT (a boolean the caller passes in), NEVER a live
- * bubblewrap / `unshare` probe. The probe that PRODUCES that boolean is Phase
- * 211 (JAIL-03). Keeping the trigger an input keeps `degradeAutonomy` PURE
+ * bubblewrap / `unshare` probe. The probe that PRODUCES that boolean is
+ * daemon-side. Keeping the trigger an input keeps `degradeAutonomy` PURE
  * (AGENTS §2.2) and independently testable — this leaf imports nothing from the
  * daemon's sandbox-provider layer.
  *
@@ -20,19 +20,19 @@
  * @module
  */
 import { type AutonomyProfileName, type ResolvedAutonomy } from "./schema-agent-autonomy.js";
-/** The host preconditions a jail-bearing posture depends on (210: the namespace preflight; 211 adds the probe that fills it). */
+/** The host preconditions a jail-bearing posture depends on (filled by the daemon-side namespace preflight probe). */
 export interface AutonomyPreflightResult {
     /**
      * Whether the unprivileged-user-namespace (`unshare --user`/`--net`)
      * preflight passed. `false` means the jail cannot be built, so an
      * autonomy-bearing posture would run UNJAILED — which we refuse, downshifting
-     * to `assistant` instead. In Phase 210 this is supplied by the caller (the
-     * default at boot is `true`); the actual probe lands in Phase 211.
+     * to `assistant` instead. Supplied by the caller (the default at boot is
+     * `true`); the actual probe is daemon-side.
      */
     readonly namespacePreflightOk: boolean;
 }
 /**
- * The structured signal a downshift surfaces (PROFILE-03). Carried out of
+ * The structured signal a downshift surfaces. Carried out of
  * {@link degradeAutonomy} so the daemon can emit a WARN + a `doctor` finding —
  * the operator is TOLD, never silently dropped to a safer posture. The
  * `errorKind` is the closed-union `"precondition"` (an unmet host guard), and
@@ -41,7 +41,7 @@ export interface AutonomyPreflightResult {
 export interface AutonomyDownshift {
     /** The profile that was selected before the precondition failed. */
     readonly downshiftedFrom: AutonomyProfileName;
-    /** Always `assistant` in M1 — the zero-surface safe floor. */
+    /** Always `assistant` — the zero-surface safe floor. */
     readonly downshiftedTo: "assistant";
     /** Machine-readable reason (the failed precondition). */
     readonly reason: "namespace_preflight_failed";
@@ -51,19 +51,19 @@ export interface AutonomyDownshift {
     readonly errorKind: "precondition";
 }
 /**
- * Honest legible degrade (PROFILE-03). Given a fully-resolved posture and the
+ * Honest legible degrade. Given a fully-resolved posture and the
  * host preflight RESULT, downshift to `assistant` (enabled false, zero caps) and
  * SURFACE a structured {@link AutonomyDownshift} when the namespace preflight
  * failed — never a silent enabled-but-unjailed fallback.
  *
  * PURE — a function of `(resolved, preflight)` only (no env/clock/fs, AGENTS
- * §2.2). The preflight boolean is an INPUT; the probe that produces it is Phase
- * 211 (JAIL-03 / RESEARCH Pitfall 5). The downshift is a no-op (no signal) when
+ * §2.2). The preflight boolean is an INPUT; the probe that produces it is
+ * daemon-side. The downshift is a no-op (no signal) when
  * the preflight passed OR the posture is already `assistant` (nothing to take
  * away — idempotent).
  *
  * @param resolved the posture from {@link resolveAutonomy}.
- * @param preflight the host preconditions (210: caller-supplied; 211: probed).
+ * @param preflight the host preconditions (caller-supplied; probed daemon-side).
  * @returns the (possibly-downshifted) posture + an optional surfaced signal.
  */
 export declare function degradeAutonomy(resolved: ResolvedAutonomy, preflight: AutonomyPreflightResult): {

package/node_modules/@comis/core/dist/config/schema-agent/schema-agent-autonomy-degrade.js

@@ -1,16 +1,16 @@
 // SPDX-License-Identifier: Apache-2.0
 /**
- * Agent config — Autonomy honest-degrade path (PROFILE-03).
+ * Agent config — Autonomy honest-degrade path.
  *
- * Split out of `schema-agent-autonomy.ts` (which keeps the PROFILE-01
- * named-profile resolver) to hold the SEPARATE PROFILE-03 concern: when a host
+ * Split out of `schema-agent-autonomy.ts` (which keeps the
+ * named-profile resolver) to hold the SEPARATE concern: when a host
  * precondition for the jail fails, downshift the resolved posture to `assistant`
  * and SURFACE a structured signal — never a silent unjailed fallback.
  *
- * 210/211 SEAM (RESEARCH Pitfall 5 / A4): the downshift is driven by a
+ * SEAM: the downshift is driven by a
  * preflight-RESULT INPUT (a boolean the caller passes in), NEVER a live
- * bubblewrap / `unshare` probe. The probe that PRODUCES that boolean is Phase
- * 211 (JAIL-03). Keeping the trigger an input keeps `degradeAutonomy` PURE
+ * bubblewrap / `unshare` probe. The probe that PRODUCES that boolean is
+ * daemon-side. Keeping the trigger an input keeps `degradeAutonomy` PURE
  * (AGENTS §2.2) and independently testable — this leaf imports nothing from the
  * daemon's sandbox-provider layer.
  *
@@ -24,19 +24,19 @@ import { AutonomyConfigSchema, resolveAutonomy, } from "./schema-agent-autonomy.
 /** The actionable remediation surfaced on a namespace-preflight downshift. */
 const NAMESPACE_PREFLIGHT_DOWNSHIFT_HINT = "Autonomy needs an unprivileged user namespace to build the jail, and the namespace preflight failed — downshifted to the 'assistant' profile (no orchestration surfaces). Enable unprivileged user namespaces (e.g. sysctl kernel.unprivileged_userns_clone=1 / kernel.apparmor_restrict_unprivileged_userns=0) and restart, or set autonomy.profile: assistant to silence this. See docs/agents/autonomy.";
 /**
- * Honest legible degrade (PROFILE-03). Given a fully-resolved posture and the
+ * Honest legible degrade. Given a fully-resolved posture and the
  * host preflight RESULT, downshift to `assistant` (enabled false, zero caps) and
  * SURFACE a structured {@link AutonomyDownshift} when the namespace preflight
  * failed — never a silent enabled-but-unjailed fallback.
  *
  * PURE — a function of `(resolved, preflight)` only (no env/clock/fs, AGENTS
- * §2.2). The preflight boolean is an INPUT; the probe that produces it is Phase
- * 211 (JAIL-03 / RESEARCH Pitfall 5). The downshift is a no-op (no signal) when
+ * §2.2). The preflight boolean is an INPUT; the probe that produces it is
+ * daemon-side. The downshift is a no-op (no signal) when
  * the preflight passed OR the posture is already `assistant` (nothing to take
  * away — idempotent).
  *
  * @param resolved the posture from {@link resolveAutonomy}.
- * @param preflight the host preconditions (210: caller-supplied; 211: probed).
+ * @param preflight the host preconditions (caller-supplied; probed daemon-side).
  * @returns the (possibly-downshifted) posture + an optional surfaced signal.
  */
 export function degradeAutonomy(resolved, preflight) {
@@ -49,8 +49,7 @@ export function degradeAutonomy(resolved, preflight) {
     // floor and SAY SO. Resolve the canonical `assistant` shape so the downshifted
     // posture is byte-identical to a selected `assistant` (enabled false, 0 caps).
     // Parse through the schema first so the `AutonomyConfig` is fully-defaulted
-    // (the resolver's param is the OUTPUT type — `message` is required), matching
-    // the Plan-02 m1Notice/`tsc`-vs-vitest typing precedent.
+    // (the resolver's param is the OUTPUT type — `message` is required).
     const downshifted = resolveAutonomy(AutonomyConfigSchema.parse({ profile: "assistant" }));
     const downshift = {
         downshiftedFrom: resolved.profile,

package/node_modules/@comis/core/dist/config/schema-agent/schema-agent-autonomy-durability.d.ts

@@ -1,13 +1,13 @@
 /**
- * Agent config — Autonomy DURABILITY sub-block (Phase 216 — DUR-01..04 / HB-01).
+ * Agent config — Autonomy DURABILITY sub-block.
  *
  * The nested `z.strictObject` block that gates the daemon-side durable-run +
- * resume engine (Plans 02-07). It follows the `message`/`lease`/`budget`/`rate`/
- * `spawn`/`outward` nested-block precedent (RESEARCH §D — A2): a `z.strictObject`
+ * resume engine. It follows the `message`/`lease`/`budget`/`rate`/
+ * `spawn`/`outward` nested-block precedent: a `z.strictObject`
  * with every field `.default()`-ed and `strictObject` as the typo guard
  * (fails-closed).
  *
- * GATING (RESEARCH primary recommendation): `enabled` defaults to FALSE. The
+ * GATING: `enabled` defaults to FALSE. The
  * daemon constructs the durable stores + resume engine + watchdog ONLY when this
  * is true AND an autonomy-bearing agent is configured — so a default install is
  * byte-identical (no new timer, no boot recovery work), mirroring the
@@ -24,11 +24,11 @@
  */
 import { z } from "zod";
 /**
- * Durable-run + resume-engine posture (Phase 216). When `enabled`, the daemon
- * persists a per-root checkpoint as the spawn tree advances (DUR-01), emits a
- * keep-alive heartbeat on a timer (HB-01), and on boot (after channels) re-mints
- * from the persisted attenuated caps + reconciles crashed-mid-send rows
- * (DUR-02/04 + ONCE-03). A daemon-wide watchdog interval sweeps lapsed
+ * Durable-run + resume-engine posture. When `enabled`, the daemon
+ * persists a per-root checkpoint as the spawn tree advances, emits a
+ * keep-alive heartbeat on a timer, and on boot (after channels) re-mints
+ * from the persisted attenuated caps + reconciles crashed-mid-send rows.
+ * A daemon-wide watchdog interval sweeps lapsed
  * heartbeats. Every field `.default()`-ed; `strictObject` rejects a typo'd key.
  */
 export declare const DurabilityConfigSchema: z.ZodObject<{
@@ -36,5 +36,6 @@ export declare const DurabilityConfigSchema: z.ZodObject<{
     staleHeartbeatMs: z.ZodDefault<z.ZodNumber>;
     keepAliveMs: z.ZodDefault<z.ZodNumber>;
     recoveryBudgetMs: z.ZodDefault<z.ZodNumber>;
+    orchestrateResume: z.ZodDefault<z.ZodBoolean>;
 }, z.core.$strict>;
 export type DurabilityConfig = z.infer<typeof DurabilityConfigSchema>;

package/node_modules/@comis/core/dist/config/schema-agent/schema-agent-autonomy-durability.js

@@ -1,14 +1,14 @@
 // SPDX-License-Identifier: Apache-2.0
 /**
- * Agent config — Autonomy DURABILITY sub-block (Phase 216 — DUR-01..04 / HB-01).
+ * Agent config — Autonomy DURABILITY sub-block.
  *
  * The nested `z.strictObject` block that gates the daemon-side durable-run +
- * resume engine (Plans 02-07). It follows the `message`/`lease`/`budget`/`rate`/
- * `spawn`/`outward` nested-block precedent (RESEARCH §D — A2): a `z.strictObject`
+ * resume engine. It follows the `message`/`lease`/`budget`/`rate`/
+ * `spawn`/`outward` nested-block precedent: a `z.strictObject`
  * with every field `.default()`-ed and `strictObject` as the typo guard
  * (fails-closed).
  *
- * GATING (RESEARCH primary recommendation): `enabled` defaults to FALSE. The
+ * GATING: `enabled` defaults to FALSE. The
  * daemon constructs the durable stores + resume engine + watchdog ONLY when this
  * is true AND an autonomy-bearing agent is configured — so a default install is
  * byte-identical (no new timer, no boot recovery work), mirroring the
@@ -25,11 +25,11 @@
  */
 import { z } from "zod";
 /**
- * Durable-run + resume-engine posture (Phase 216). When `enabled`, the daemon
- * persists a per-root checkpoint as the spawn tree advances (DUR-01), emits a
- * keep-alive heartbeat on a timer (HB-01), and on boot (after channels) re-mints
- * from the persisted attenuated caps + reconciles crashed-mid-send rows
- * (DUR-02/04 + ONCE-03). A daemon-wide watchdog interval sweeps lapsed
+ * Durable-run + resume-engine posture. When `enabled`, the daemon
+ * persists a per-root checkpoint as the spawn tree advances, emits a
+ * keep-alive heartbeat on a timer, and on boot (after channels) re-mints
+ * from the persisted attenuated caps + reconciles crashed-mid-send rows.
+ * A daemon-wide watchdog interval sweeps lapsed
  * heartbeats. Every field `.default()`-ed; `strictObject` rejects a typo'd key.
  */
 export const DurabilityConfigSchema = z.strictObject({
@@ -42,25 +42,37 @@ export const DurabilityConfigSchema = z.strictObject({
     enabled: z.boolean().default(false),
     /**
      * The lapsed-heartbeat threshold (ms) — a `running` run whose last heartbeat is
-     * older than this is treated as crashed and orphan-swept by the watchdog
-     * (DUR-04). Default 120s = 4x `keepAliveMs` (the Pitfall-4 conservative ratio:
+     * older than this is treated as crashed and orphan-swept by the watchdog.
+     * Default 120s = 4x `keepAliveMs` (a deliberately conservative ratio:
      * a transiently-slow run that misses a keep-alive or two must NOT be falsely
-     * failed and its work duplicated — the `ANNOUNCE_PARENT_TIMEOUT_MS` "30s was
-     * too tight" lesson). The watchdog interval also fires at this cadence.
+     * failed and its work duplicated). The watchdog interval also fires at this
+     * cadence.
      */
     staleHeartbeatMs: z.number().int().positive().default(120_000),
     /**
      * The keep-alive write cadence (ms) — how often a live durable run stamps
-     * `lastHeartbeatAt` (HB-01), INDEPENDENT of step/spawn completion so a
+     * `lastHeartbeatAt`, INDEPENDENT of step/spawn completion so a
      * long-running child never looks stale. Default 30s (4x below
      * `staleHeartbeatMs`).
      */
     keepAliveMs: z.number().int().positive().default(30_000),
     /**
-     * The wall-clock recovery budget (ms) for one boot/watchdog pass (HB-02). A
+     * The wall-clock recovery budget (ms) for one boot/watchdog pass. A
      * backlog larger than the budget is partially recovered and the remainder
      * DEFERRED (status stays `running`, so the next boot/tick picks them up) — no
      * thundering herd on a large crash backlog. Default 30s.
      */
     recoveryBudgetMs: z.number().int().positive().default(30_000),
+    /**
+     * The single gate every resumable-orchestrate behavior nests under
+     * (default FALSE). Off ⇒ an `orchestrate` run that times out is SIGKILL'd +
+     * rejected as today (no resumable durable row written, no checkpoint
+     * survival). On ⇒ a durable-registered `orchestrate` timeout records a
+     * resumable `{scriptRef, checkpointRef}` row so `orchestrate({resumeRunId})`
+     * can re-spawn the PINNED original script and `resume()` yields the last
+     * checkpoint. Nested INSIDE this block (not a flat toggle) so it inherits the
+     * durability posture's deny-by-absence: an omitted block resolves it to
+     * false, and the per-agent surface predicate fails closed on absent config.
+     */
+    orchestrateResume: z.boolean().default(false),
 });

package/node_modules/@comis/core/dist/config/schema-agent/schema-agent-autonomy-escalate.d.ts

@@ -1,8 +1,8 @@
 /**
- * Agent config — the §22.3 always-escalate structural floor (the
+ * Agent config — the always-escalate structural floor (the
  * `autoApprovable:false` cap-literals + the per-cap predicate).
  *
- * Split from `schema-agent-autonomy.ts` (218-01 file-size cap discipline): the
+ * Split from `schema-agent-autonomy.ts` (file-size cap discipline): the
  * always-escalate cap set and the pure `capIsAutoApprovable` predicate the
  * resolver attaches to each resolved cap are a self-contained unit the main
  * autonomy leaf imports. One-directional dependency (escalate → consumed by
@@ -17,22 +17,22 @@
 import { type AgentCapability } from "../../security/capability.js";
 /**
  * The structural-floor caps that are `autoApprovable:false` in EVERY profile
- * forever (v8 §22.3): outward + irreversible. They are escalate-not-auto — no
+ * forever: outward + irreversible. They are escalate-not-auto — no
  * mode, trust-graduation, or LLM-judge may ever auto-decide them. A profile that
  * opts one IN (e.g. an explicit `browse: true`) still resolves it with
  * `autoApprovable:false`.
  *
  * `orch:browse` (the browser) is the always-escalate cap-LITERAL member.
- * `orch:message` is deliberately NOT here: per §22.3 the floor item is
+ * `orch:message` is deliberately NOT here: the floor item is
  * "orch:message to a NON-ORIGIN channel", and that target scoping rides the
- * `message.channels` config (`["origin"]` default + the §8.4 per-target grant),
+ * `message.channels` config (`["origin"]` default + the per-target grant),
  * NOT the cap literal. The cap-literal `orch:message` is auto-approvable to the
- * agent's OWN origin channel under quota (the §3.8 capable default), so it
+ * agent's OWN origin channel under quota (the capable default), so it
  * resolves `autoApprovable:true` while the non-origin send is gated by the
  * message config — modeling it as an always-escalate cap-literal would
- * incorrectly forbid even origin sends. `report:issue` is a Phase-215 deputy cap
- * outside this milestone's `orch:*` vocabulary.
+ * incorrectly forbid even origin sends. `report:issue` is a deputy cap
+ * outside the `orch:*` vocabulary.
  */
 export declare const ALWAYS_ESCALATE_CAPABILITIES: readonly ["orch:browse"];
-/** Is this resolved cap auto-allowable? `false` for the §22.3 always-escalate floor. */
+/** Is this resolved cap auto-allowable? `false` for the always-escalate floor. */
 export declare function capIsAutoApprovable(cap: AgentCapability): boolean;

package/node_modules/@comis/core/dist/config/schema-agent/schema-agent-autonomy-escalate.js

@@ -1,24 +1,24 @@
 /**
  * The structural-floor caps that are `autoApprovable:false` in EVERY profile
- * forever (v8 §22.3): outward + irreversible. They are escalate-not-auto — no
+ * forever: outward + irreversible. They are escalate-not-auto — no
  * mode, trust-graduation, or LLM-judge may ever auto-decide them. A profile that
  * opts one IN (e.g. an explicit `browse: true`) still resolves it with
  * `autoApprovable:false`.
  *
  * `orch:browse` (the browser) is the always-escalate cap-LITERAL member.
- * `orch:message` is deliberately NOT here: per §22.3 the floor item is
+ * `orch:message` is deliberately NOT here: the floor item is
  * "orch:message to a NON-ORIGIN channel", and that target scoping rides the
- * `message.channels` config (`["origin"]` default + the §8.4 per-target grant),
+ * `message.channels` config (`["origin"]` default + the per-target grant),
  * NOT the cap literal. The cap-literal `orch:message` is auto-approvable to the
- * agent's OWN origin channel under quota (the §3.8 capable default), so it
+ * agent's OWN origin channel under quota (the capable default), so it
  * resolves `autoApprovable:true` while the non-origin send is gated by the
  * message config — modeling it as an always-escalate cap-literal would
- * incorrectly forbid even origin sends. `report:issue` is a Phase-215 deputy cap
- * outside this milestone's `orch:*` vocabulary.
+ * incorrectly forbid even origin sends. `report:issue` is a deputy cap
+ * outside the `orch:*` vocabulary.
  */
 export const ALWAYS_ESCALATE_CAPABILITIES = ["orch:browse"];
 const ALWAYS_ESCALATE_SET = new Set(ALWAYS_ESCALATE_CAPABILITIES);
-/** Is this resolved cap auto-allowable? `false` for the §22.3 always-escalate floor. */
+/** Is this resolved cap auto-allowable? `false` for the always-escalate floor. */
 export function capIsAutoApprovable(cap) {
     return !ALWAYS_ESCALATE_SET.has(cap);
 }

package/node_modules/@comis/core/dist/config/schema-agent/schema-agent-autonomy-mcp.d.ts

@@ -0,0 +1,67 @@
+/**
+ * Agent config — Autonomy MCP inbound-allowlist sub-block.
+ *
+ * The nested `z.strictObject` leaf that governs which connected-MCP-server
+ * tools an autonomy-bearing agent may call from the jailed SDK. It is the
+ * SECOND default-deny layer: the `orch:mcp` capability grant (the surface gate)
+ * is layer one; even holding `orch:mcp`, a `{server,tool}` pair absent from
+ * `allow` — or on a server without an explicit inbound classification — is
+ * denied here.
+ *
+ * Follows the `durability`/`message` nested-block precedent: a `z.strictObject`
+ * with every field `.default()`-ed and `strictObject` as the typo guard
+ * (fails-closed). `enabled` defaults FALSE and `allow` defaults `{}`, so a
+ * fully-omitted block resolves to a dark surface — no tool reachable.
+ *
+ * The 3-tier inbound classification MIRRORS THE SHAPE of the per-tool export
+ * policy (`"safe" | "permission-gated" | absent ⇒ deny`) but is a SEPARATE
+ * inbound field — the outbound export policy is NOT the inbound gate.
+ *
+ * `permitsMcpTool` is the PURE predicate the daemon-side executor calls per
+ * invocation: it answers "is this `{server,tool}` listed AND classified
+ * reachable?" — deny by absence at every step (unlisted server, unlisted tool,
+ * or an absent classification all return false). Prototype-safe: an untrusted
+ * server name never resolves an inherited object.
+ *
+ * Pure schema leaf — imports only `zod`. No `process.env` / `Date.now` /
+ * `path.join`.
+ *
+ * @module
+ */
+import { z } from "zod";
+/**
+ * The inbound MCP allowlist posture. `enabled` is the surface gate (paired with
+ * the `orch:mcp` capability grant); `allow` maps a connected server name to the
+ * explicit set of tool names reachable on it plus a required inbound
+ * classification. An absent classification is treated as unreachable (the
+ * default-deny safety net) — it is NOT an accepted inbound tier.
+ */
+export declare const AutonomyMcpConfigSchema: z.ZodObject<{
+    enabled: z.ZodDefault<z.ZodBoolean>;
+    allow: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodObject<{
+        tools: z.ZodDefault<z.ZodArray<z.ZodString>>;
+        classification: z.ZodOptional<z.ZodEnum<{
+            safe: "safe";
+            "permission-gated": "permission-gated";
+        }>>;
+    }, z.core.$strict>>>;
+}, z.core.$strict>;
+/** The resolved inbound-MCP-allowlist posture. */
+export type AutonomyMcpConfig = z.infer<typeof AutonomyMcpConfigSchema>;
+/**
+ * Pure inbound-allowlist predicate — the layer-two default-deny gate the
+ * daemon-side MCP executor calls per invocation. Returns `true` ONLY when the
+ * server is listed in `allow`, the tool is in that server's explicit `tools`
+ * list, AND the server carries an inbound classification of `"safe"` or
+ * `"permission-gated"`. Every other case — an unlisted server, an unlisted
+ * tool, or an absent classification — returns `false` (deny by absence).
+ *
+ * A `"permission-gated"` server is PERMITTED here; the approval-gate firing is
+ * the executor's concern — this predicate only answers "listed & classified".
+ *
+ * Iterates own entries (never indexes `allow` with the untrusted `server`), so
+ * an adversarial `"__proto__"`/`"constructor"` name resolves nothing.
+ *
+ * PURE — a function of its arguments only (no env/clock/fs).
+ */
+export declare function permitsMcpTool(cfg: AutonomyMcpConfig, server: string, tool: string): boolean;