comisai 1.0.45 → 1.0.46

package/node_modules/@comis/core/dist/domain/durable-run.js

@@ -1,13 +1,13 @@
 // SPDX-License-Identifier: Apache-2.0
 /**
  * DurableRunRecord: the Zod-validated checkpoint a long-running agent run
- * persists so a daemon restart can resume it (Phase 216, DUR-01/DUR-02/DUR-03).
+ * persists so a daemon restart can resume it.
  *
  * The record is read back on resume and decides what the rehydrated run may do,
- * so the schema is the trust boundary (T-216-01): `caps` is the closed
+ * so the schema is the trust boundary: `caps` is the closed
  * AgentCapability union (a tampered cap string cannot rehydrate), `status` is a
  * closed four-state set, and `strictObject` rejects any column the store DDL
- * adds without a matching field — so the schema and the SQLite table (Plan 02)
+ * adds without a matching field — so the schema and the SQLite table
  * move in lockstep, exactly like `video-job-row-schema.ts`.
  *
  * `caps` reuses the single AGENT_CAPABILITIES tuple from
@@ -24,18 +24,18 @@ import { AGENT_CAPABILITIES } from "../security/capability.js";
  * The closed AgentCapability union as a Zod schema, built from the single
  * AGENT_CAPABILITIES tuple (SSOT in security/capability.ts). A persisted cap
  * outside this set fails `parseDurableRunRecord` — a tampered/foreign cap
- * string can never rehydrate into a resumed run's authority (T-216-01).
+ * string can never rehydrate into a resumed run's authority.
  */
 export const AgentCapabilitySchema = z.enum(AGENT_CAPABILITIES);
 /**
  * The closed run-status set. `running` rows are the boot-resume scan
- * (`listResumable`); `revoked` is the DUR-03 terminal state a `invalidateForRevoke`
+ * (`listResumable`); `revoked` is the terminal state a `invalidateForRevoke`
  * write flips a record to so resume can never re-mint a revoked run.
  */
 export const DurableRunStatusSchema = z.enum(["running", "orphaned", "completed", "revoked"]);
 /**
  * A single spawn-tree node for a DAG/graph run — the `snapshotToSpawnTree`
- * shape (Plan 11). `status` is a free string here (the graph engine owns the
+ * shape. `status` is a free string here (the graph engine owns the
  * node-status vocabulary); `runId` is present once the node has been minted.
  */
 const SpawnTreeNodeSchema = z.strictObject({
@@ -48,10 +48,10 @@ const SpawnTreeNodeSchema = z.strictObject({
  * `caps`/`status` unions make a tampered or column-drifted row unrepresentable.
  */
 export const DurableRunRecordSchema = z.strictObject({
-    /** The root run id — the idempotency key the store upserts on (DUR-01). */
+    /** The root run id — the idempotency key the store upserts on. */
     rootRunId: z.string(),
     /**
-     * The spawn-tree union and the LOW-2 DAG-vs-flat discriminator:
+     * The spawn-tree union and the DAG-vs-flat discriminator:
      *   - a FLAT run's spawn tree is `string[]` of leaseId/sessionKey node ids;
      *   - a DAG/graph run's is `{nodeId,status,runId?}[]`.
      * Both shapes MUST parse so a DAG checkpoint passes `parseDurableRunRecord`.
@@ -59,7 +59,7 @@ export const DurableRunRecordSchema = z.strictObject({
      * `status` ⇒ DAG (resumeGraph).
      */
     spawnTree: z.union([z.array(z.string()), z.array(SpawnTreeNodeSchema)]),
-    /** The caps the resumed run may hold — the closed AgentCapability union (T-216-01). */
+    /** The caps the resumed run may hold — the closed AgentCapability union. */
     caps: z.array(AgentCapabilitySchema),
     /** The leases held by this run; rehydrated on resume. */
     leaseIds: z.array(z.string()),
@@ -68,18 +68,34 @@ export const DurableRunRecordSchema = z.strictObject({
     /** The cron job id this run was launched from, or null for a user-originated run. */
     cronOrigin: z.string().nullable(),
     /**
-     * The outward-send counter (HIGH-1 / ONCE-02) — maps to the dedicated
-     * `outward_step` DB column (Plan 02). `-1` is the 'no outward send yet'
+     * The outward-send counter — maps to the dedicated
+     * `outward_step` DB column. `-1` is the 'no outward send yet'
      * sentinel: the counter seeds at -1 so the first `allocateOutwardStep` yields
-     * 0. It MUST parse (`.min(-1)`, NEW-5) or a checkpointed-but-not-yet-sent run
+     * 0. It MUST parse (`.min(-1)`) or a checkpointed-but-not-yet-sent run
      * is falsely rejected by `parseDurableRunRecord` and orphaned on restart,
-     * breaking DUR-02.
+     * making the run unresumable.
      */
     stepIndex: z.number().int().min(-1),
     /** The run lifecycle state — the closed running/orphaned/completed/revoked set. */
     status: DurableRunStatusSchema,
-    /** The last keep-alive heartbeat write (HB-01), epoch ms. */
+    /** The last keep-alive heartbeat write, epoch ms. */
     lastHeartbeatAt: z.number(),
+    /**
+     * The pinned script path RELATIVE to the run workspace (`<runId>.<language>`)
+     * for a RE-RUNNABLE orchestrate row. Its presence is the orchestrate-kind
+     * discriminator the boot sweep routes on. Content-free: a path, NOT the script
+     * bytes (INV-5). Optional/nullable so EVERY existing row (which has neither
+     * this nor `checkpointRef`) still parses — the closed-union resume gate is
+     * unweakened.
+     */
+    scriptRef: z.string().nullable().optional(),
+    /**
+     * The `ResultRef.ref` id of the last checkpoint blob (a distinguished
+     * `kind:"json"` ResultRef). Content-free: an id pointer, NOT the checkpoint
+     * body (INV-5) — the bytes live in the capped/TTL'd `results/` store.
+     * Optional/nullable for the same reason as `scriptRef`.
+     */
+    checkpointRef: z.string().nullable().optional(),
 });
 /**
  * Parse unknown input into a DurableRunRecord, returning Result<T, ZodError>.

package/node_modules/@comis/core/dist/domain/execution-graph.js

@@ -46,17 +46,16 @@ export const NodeTypeIdSchema = z.enum([
     "map-reduce",
 ]);
 /**
- * Required-config shape hint per built-in node type (OR-01, v2.19).
+ * Required-config shape hint per built-in node type.
  *
  * Surfaced in the both-or-neither validation error so a weak model that
  * declares a typed driver (e.g. `typeId:"debate"`) but forgets its
- * `typeConfig` is told EXACTLY what config to add — instead of the old
+ * `typeConfig` is told EXACTLY what config to add — instead of a
  * generic "omit both for a regular single-agent node" steer, which silently
- * demoted the user's debate/vote/etc. to a plain agent and destroyed intent
- * (the live bull_bear_debate attempt-1 failure). These are descriptive hints,
+ * demotes the user's debate/vote/etc. to a plain agent and destroys intent
+ * (an observed live failure). These are descriptive hints,
  * not the authoritative driver schemas (those live in the orchestrator and are
  * validated at the RPC layer); `?` marks an optional field.
- * See design/small-model-orchestration-fidelity.md §4.
  */
 const TYPE_CONFIG_HINTS = {
     agent: `{ "agent": "agent-id" }`,
@@ -98,7 +97,7 @@ export const GraphNodeSchema = z.strictObject({
     timeoutMs: z.number().int().positive().optional(),
     /** Maximum agentic steps for the sub-agent */
     maxSteps: z.number().int().positive().optional(),
-    /** Per-spawn token budget for this node's sub-agent. Becomes the child's BudgetGuard per-execution cap; a breach fails THIS node honoring on_failure (BUDGET-01/02). */
+    /** Per-spawn token budget for this node's sub-agent. Becomes the child's BudgetGuard per-execution cap; a breach fails THIS node honoring on_failure. */
     tokenBudget: z.number().int().positive().optional(),
     /** Barrier mode for fan-in nodes: all (default), majority (>50%), best-effort (any completed) */
     barrierMode: z.enum(["all", "majority", "best-effort"]).default("all"),
@@ -113,7 +112,7 @@ export const GraphNodeSchema = z.strictObject({
     /** Type-specific configuration -- validated against the driver's configSchema at the RPC layer */
     typeConfig: z.record(z.string(), z.unknown()).optional(),
 }).superRefine((n, ctx) => {
-    // both-or-neither (OR-01). When violated, emit a TYPE-AWARE message that steers
+    // typeId/typeConfig are both-or-neither. When violated, emit a TYPE-AWARE message that steers
     // the model toward the correct self-correction instead of a generic both-or-neither
     // string that mis-advises demotion (see TYPE_CONFIG_HINTS above).
     const hasTypeId = n.typeId !== undefined;

package/node_modules/@comis/core/dist/domain/index.js

@@ -27,5 +27,5 @@ export { SUB_AGENT_TOOL_DENYLIST, SUB_AGENT_TOOL_PROFILES, SUB_AGENT_TOOL_GROUPS
 // RPC typed-refusal classification — the single source of truth the daemon
 // rpc-dispatch classifier AND the @comis/gateway method-router classifier both
 // delegate to, so intentional policy/security refusals classify consistently
-// (warn, never internal/ERROR) at every log layer (OBS-RPC-REFUSAL-CLASS).
+// (warn, never internal/ERROR) at every log layer.
 export { classifyTypedRpcError } from "./rpc-error-classification.js";

package/node_modules/@comis/core/dist/domain/memory-entry.d.ts

@@ -109,15 +109,15 @@ export type MemorySource = z.infer<typeof MemorySourceSchema>;
  * One entity mention emitted by extraction. The extraction job EMITS these
  * (carrying the source memory's inherited trust + source provenance); a later
  * pass persists and resolves them. Minimal shape — just the mention name
- * (design §4.2's entity table is `canonical_name`-only, so there is
+ * (the entity table is `canonical_name`-only, so there is
  * intentionally no `type` field).
  */
-/** LENIENT (live finding 2026-06-11): the extraction LLM naturally emits
- *  `{ name, type: "person" }`; a strictObject rejected the element, which
- *  failed the memory, which failed the WHOLE extraction envelope — a single
- *  typed entity discarded every fact in the batch. Unknown keys are
+/** LENIENT: the extraction LLM naturally emits
+ *  `{ name, type: "person" }`; a strictObject would reject the element, which
+ *  would fail the memory, which would fail the WHOLE extraction envelope — a
+ *  single typed entity discarding every fact in the batch. Unknown keys are
  *  stripped; `name` stays required + non-empty (there is still no `type`
- *  field in the domain — design §4.2 canonical_name-only). */
+ *  field in the domain — the entity table is canonical_name-only). */
 export declare const ExtractedEntitySchema: z.ZodObject<{
     name: z.ZodString;
 }, z.core.$strip>;
@@ -129,7 +129,7 @@ export type ExtractedEntity = z.infer<typeof ExtractedEntitySchema>;
  * converted to absolute in-prompt); the job resolves it to epoch ms
  * post-parse before storing it on {@link MemoryEntrySchema}'s `occurredAt`.
  *
- * LENIENT (`z.object`): unknown keys are stripped, not rejected (Pitfall 5).
+ * LENIENT (`z.object`): unknown keys are stripped, not rejected.
  */
 export declare const StructuredMemorySchema: z.ZodObject<{
     content: z.ZodString;
@@ -176,7 +176,7 @@ export declare const MemoryExtractionResultSchema: z.ZodObject<{
 }, z.core.$strip>;
 export type MemoryExtractionResult = z.infer<typeof MemoryExtractionResultSchema>;
 /**
- * MemoryEntity (design §4.3) — the resolved entity persisted into the
+ * MemoryEntity — the resolved entity persisted into the
  * `memory_entities` table by the entity-resolution pass. Defined here so that
  * pass can import it; the extraction job does NOT persist it (entities are
  * emit-only at extraction time).

package/node_modules/@comis/core/dist/domain/memory-entry.js

@@ -39,7 +39,7 @@ export const MemoryEntrySchema = z.strictObject({
     createdAt: z.number().int().positive(),
     /** Event time in epoch ms; distinct from createdAt (record time). Absent when the event time is unknown. */
     occurredAt: z.number().int().positive().optional(),
-    /** Evidence count. NULL/absent = raw memory; >=1 = observation. Design §4.3. */
+    /** Evidence count. NULL/absent = raw memory; >=1 = observation. */
     proofCount: z.number().int().positive().optional(),
     /** Contributing source memory ids. */
     sourceIds: z.array(z.guid()).optional(),
@@ -66,22 +66,22 @@ export const MemoryEntrySchema = z.strictObject({
      */
     memoryType: z.enum(["working", "episodic", "semantic", "procedural"]).optional(),
     /**
-     * Reasoning-observation kind. Absent/NULL = "merge" (the default for all
-     * rows predating this field; the @comis/memory adapter applies the
-     * `?? "merge"` fallback on read). Additive `.optional()` — an omitting write
+     * Reasoning-observation kind. Absent/NULL = "merge" (the @comis/memory
+     * adapter applies the `?? "merge"` fallback on read). Additive
+     * `.optional()` — an omitting write
      * is unaffected; the enum is enforced HERE + the lenient LLM parser,
-     * NOT a SQLite CHECK (the occurred_at/proof_count ALTER-ADD-COLUMN no-CHECK
-     * precedent — a post-hoc enum CHECK is unreliable across existing rows).
-     * "generalization" is the GENERAL-01 (v2.26 Phase 203) higher-order synthesis
+     * NOT a SQLite CHECK (an enum CHECK added to an already-populated column
+     * is unreliable across pre-existing rows).
+     * "generalization" is the higher-order synthesis
      * kind — a `semantic` memory abstracting a cross-context cluster ("user prefers
-     * X in general"), written by `runMemoryConsolidation` (Plan 03) with
+     * X in general"), written by `runMemoryConsolidation` with
      * `proofCount = |cluster|` and `sourceIds` retained. The enum stays CLOSED
-     * (widened, not `z.string()`); the SQLite `observation_kind` column remains
-     * unchecked nullable TEXT, so this is a pure domain-layer widen with NO migration.
+     * (never `z.string()`); the SQLite `observation_kind` column is
+     * unchecked nullable TEXT, so the closed set is enforced purely at the domain layer.
      */
     observationKind: z.enum(["merge", "deductive", "inductive", "generalization"]).optional(),
     /**
-     * Inductive pattern class (Honcho-derived). Only set when
+     * Inductive pattern class. Only set when
      * observationKind="inductive". Additive `.optional()` closed enum.
      */
     patternType: z.enum(["preference", "behavior", "personality", "tendency", "correlation"]).optional(),
@@ -106,7 +106,7 @@ export function parseMemoryEntry(raw) {
 // strings with zod-validated structured memories `{ content, entities[], occurredAt }`.
 // These schemas are the validation boundary the job parses LLM output against.
 //
-// STRICT vs LENIENT (design §6.1 / RESEARCH Pitfall 5):
+// STRICT vs LENIENT:
 //   - LLM-OUTPUT schemas (StructuredMemorySchema, MemoryExtractionResultSchema) are
 //     LENIENT `z.object` so a benign extra LLM key (e.g. `confidence`) is STRIPPED,
 //     not rejected — a valid memory must not be discarded over an unrequested field.
@@ -117,15 +117,15 @@ export function parseMemoryEntry(raw) {
  * One entity mention emitted by extraction. The extraction job EMITS these
  * (carrying the source memory's inherited trust + source provenance); a later
  * pass persists and resolves them. Minimal shape — just the mention name
- * (design §4.2's entity table is `canonical_name`-only, so there is
+ * (the entity table is `canonical_name`-only, so there is
  * intentionally no `type` field).
  */
-/** LENIENT (live finding 2026-06-11): the extraction LLM naturally emits
- *  `{ name, type: "person" }`; a strictObject rejected the element, which
- *  failed the memory, which failed the WHOLE extraction envelope — a single
- *  typed entity discarded every fact in the batch. Unknown keys are
+/** LENIENT: the extraction LLM naturally emits
+ *  `{ name, type: "person" }`; a strictObject would reject the element, which
+ *  would fail the memory, which would fail the WHOLE extraction envelope — a
+ *  single typed entity discarding every fact in the batch. Unknown keys are
  *  stripped; `name` stays required + non-empty (there is still no `type`
- *  field in the domain — design §4.2 canonical_name-only). */
+ *  field in the domain — the entity table is canonical_name-only). */
 export const ExtractedEntitySchema = z.object({
     name: z.string().min(1),
 });
@@ -136,16 +136,16 @@ export const ExtractedEntitySchema = z.object({
  * converted to absolute in-prompt); the job resolves it to epoch ms
  * post-parse before storing it on {@link MemoryEntrySchema}'s `occurredAt`.
  *
- * LENIENT (`z.object`): unknown keys are stripped, not rejected (Pitfall 5).
+ * LENIENT (`z.object`): unknown keys are stripped, not rejected.
  */
 export const StructuredMemorySchema = z.object({
     content: z.string().min(1),
     occurredAt: z.string().optional(),
-    // Accept BOTH entity shapes (live finding 2026-06-11): the extraction LLM
+    // Accept BOTH entity shapes: the extraction LLM
     // naturally emits plain strings ("entities": ["user", "Biscuit"]) — the
-    // shape the prompt's prose implied — while the domain wants { name }.
+    // shape the prompt's prose implies — while the domain wants { name }.
     // Strings normalize to { name }; objects pass through the lenient schema.
-    // Every memory in every live batch failed on this field before the union.
+    // Without the union, a batch using the string shape fails on this field.
     entities: z
         .array(z.union([
         z.string().min(1).transform((name) => ({ name })),
@@ -156,18 +156,18 @@ export const StructuredMemorySchema = z.object({
     /**
      * Causal cause→effect relations emitted by extraction. The
      * fact stated in `content` is the CAUSE; each entry's `effect` is a consequence
-     * stated as a concise fact (A2 — the cause is the memory's own content, so the
+     * stated as a concise fact (the cause is the memory's own content, so the
      * just-stored memory id is the resolved edge source). ADDITIVE: `.default([])`
      * — an extraction that omits it is unaffected, and the LENIENT `z.object`
      * envelope (above) still STRIPS a benign extra key rather than rejecting it.
-     * The per-cause object is `z.strictObject` with a typed `effect: string.min(1)`
-     * so garbage is still rejected (an empty/non-string/extra-key entry fails) —
+     * The per-cause object keeps a typed `effect: string.min(1)`
+     * so garbage is still rejected (an empty or non-string `effect` fails) —
      * injection-safe: untrusted conversation content cannot forge a malformed edge.
      * The edge links MEMORY ids; the `effect` text is resolved to a stored memory
      * id by the @comis/memory adapter (scoped FTS top-1) on the agent-side write.
      */
-    // LENIENT per-cause object (live finding 2026-06-11 — same class as the
-    // entity fix above): extra keys stripped, `effect` still required +
+    // LENIENT per-cause object (the same lenient contract as `entities`
+    // above): extra keys stripped, `effect` still required +
     // non-empty so garbage is rejected without discarding the batch.
     causes: z.array(z.object({ effect: z.string().min(1) })).default([]),
 });
@@ -179,7 +179,7 @@ export const MemoryExtractionResultSchema = z.object({
     memories: z.array(StructuredMemorySchema),
 });
 /**
- * MemoryEntity (design §4.3) — the resolved entity persisted into the
+ * MemoryEntity — the resolved entity persisted into the
  * `memory_entities` table by the entity-resolution pass. Defined here so that
  * pass can import it; the extraction job does NOT persist it (entities are
  * emit-only at extraction time).

package/node_modules/@comis/core/dist/domain/memory-export-envelope.d.ts

@@ -55,7 +55,7 @@ export type MemoryExportEntry = z.infer<typeof MemoryExportEntrySchema>;
  * Parse an unknown JSON value as a memory export envelope.
  * Fail-closed: any schemaVersion other than "comis-memory-export-v1" returns err().
  * No multi-version reader — z.literal enforces the single accepted version.
- * IN-01: cross-validates entryCount against entries.length — a mismatch is a
+ * Cross-validates entryCount against entries.length — a mismatch is a
  * data-integrity signal (crafted envelope) and is rejected rather than silently accepted.
  */
 export declare function parseMemoryExportEnvelope(raw: unknown): Result<MemoryExportEnvelope, z.ZodError | Error>;

package/node_modules/@comis/core/dist/domain/memory-export-envelope.js

@@ -38,7 +38,7 @@ export const MemoryExportEnvelopeSchema = z.strictObject({
  * Parse an unknown JSON value as a memory export envelope.
  * Fail-closed: any schemaVersion other than "comis-memory-export-v1" returns err().
  * No multi-version reader — z.literal enforces the single accepted version.
- * IN-01: cross-validates entryCount against entries.length — a mismatch is a
+ * Cross-validates entryCount against entries.length — a mismatch is a
  * data-integrity signal (crafted envelope) and is rejected rather than silently accepted.
  */
 export function parseMemoryExportEnvelope(raw) {

package/node_modules/@comis/core/dist/domain/msteams-conversation-reference.d.ts

@@ -0,0 +1,68 @@
+/**
+ * ConversationReference: the routing tuple a proactive send resolves from a
+ * conversation id.
+ *
+ * A reply rides the inbound activity's own `serviceUrl`/tenant; a PROACTIVE send
+ * (cron, heartbeat, an unsolicited notice) has no inbound activity, so it must
+ * recover `{serviceUrl, tenantId, threadId}` from a durable store keyed by the
+ * conversation id. This record is what that store (behind
+ * {@link MsTeamsConversationStorePort}) round-trips.
+ *
+ * Content-free: routing fields ONLY — there is deliberately no credential field
+ * and no message-content field. A persisted `serviceUrl` stays untrusted at read;
+ * the send path re-validates it against the host allowlist before use.
+ *
+ * SECURITY: the tampering control that is actually ENGAGED on the store path is the
+ * ROW schema (`MsTeamsConversationRowSchema`, also a `z.strictObject`) that the
+ * memory store's row mapper applies when a reference is read back — it rejects a
+ * smuggled column and degrades a corrupt row to `err`. The `z.strictObject` here
+ * is the same shape guard for any caller that validates an untrusted reference
+ * through {@link parseConversationReference}, but it is interface-first: no
+ * production caller invokes it yet (the inbound capture builds a fixed-shape
+ * literal from typed extractions), so treat it as available validation rather than
+ * the live guard.
+ */
+import { type Result } from "@comis/shared";
+import { z } from "zod";
+/**
+ * The routing tuple a proactive send resolves from a conversation id. `updatedAt`
+ * is the wall-clock (ms) the reference was last captured; it drives the store's TTL
+ * prune + cap eviction.
+ */
+export interface ConversationReference {
+    /** The platform conversation id — the lookup key (hashed to the store's PK). */
+    readonly conversationId: string;
+    /** The per-conversation service base URL a send POSTs to. */
+    readonly serviceUrl: string;
+    /** The AAD tenant the conversation belongs to — required so a channel-originated proactive send authorizes. */
+    readonly tenantId: string;
+    /** The thread root (channel/group threads only); absent for a 1:1 or unthreaded chat. */
+    readonly threadId?: string;
+    /** Wall-clock (ms) of the last capture — drives TTL prune + cap eviction. */
+    readonly updatedAt: number;
+}
+/**
+ * The `z.strictObject` schema for {@link ConversationReference}. `strictObject`
+ * REJECTS a smuggled field (e.g. a `trustLevel`/`source` promotion claim) for any
+ * caller that validates through it. Ids are `z.string().min(1)` (an empty routing
+ * id is never valid); `threadId` is optional; `updatedAt` is a number (ms). The
+ * live tampering control on the store path is the memory store's row schema
+ * (`MsTeamsConversationRowSchema`); this domain schema is interface-first — see the
+ * module note above.
+ */
+export declare const ConversationReferenceSchema: z.ZodObject<{
+    conversationId: z.ZodString;
+    serviceUrl: z.ZodString;
+    tenantId: z.ZodString;
+    threadId: z.ZodOptional<z.ZodString>;
+    updatedAt: z.ZodNumber;
+}, z.core.$strict>;
+/**
+ * Parse unknown input into a {@link ConversationReference}, returning
+ * `Result<T, ZodError>` (never throws). The `z.strictObject` rejects any smuggled
+ * field, so a caller cannot promote trust or route through an unexpected column.
+ * Interface-first: exported for callers that need to validate an untrusted
+ * reference, but no production path invokes it yet (the store's read-side row
+ * mapper is the engaged guard).
+ */
+export declare function parseConversationReference(raw: unknown): Result<ConversationReference, z.ZodError>;

package/node_modules/@comis/core/dist/domain/msteams-conversation-reference.js

@@ -0,0 +1,58 @@
+// SPDX-License-Identifier: Apache-2.0
+/**
+ * ConversationReference: the routing tuple a proactive send resolves from a
+ * conversation id.
+ *
+ * A reply rides the inbound activity's own `serviceUrl`/tenant; a PROACTIVE send
+ * (cron, heartbeat, an unsolicited notice) has no inbound activity, so it must
+ * recover `{serviceUrl, tenantId, threadId}` from a durable store keyed by the
+ * conversation id. This record is what that store (behind
+ * {@link MsTeamsConversationStorePort}) round-trips.
+ *
+ * Content-free: routing fields ONLY — there is deliberately no credential field
+ * and no message-content field. A persisted `serviceUrl` stays untrusted at read;
+ * the send path re-validates it against the host allowlist before use.
+ *
+ * SECURITY: the tampering control that is actually ENGAGED on the store path is the
+ * ROW schema (`MsTeamsConversationRowSchema`, also a `z.strictObject`) that the
+ * memory store's row mapper applies when a reference is read back — it rejects a
+ * smuggled column and degrades a corrupt row to `err`. The `z.strictObject` here
+ * is the same shape guard for any caller that validates an untrusted reference
+ * through {@link parseConversationReference}, but it is interface-first: no
+ * production caller invokes it yet (the inbound capture builds a fixed-shape
+ * literal from typed extractions), so treat it as available validation rather than
+ * the live guard.
+ */
+import { ok, err } from "@comis/shared";
+import { z } from "zod";
+/**
+ * The `z.strictObject` schema for {@link ConversationReference}. `strictObject`
+ * REJECTS a smuggled field (e.g. a `trustLevel`/`source` promotion claim) for any
+ * caller that validates through it. Ids are `z.string().min(1)` (an empty routing
+ * id is never valid); `threadId` is optional; `updatedAt` is a number (ms). The
+ * live tampering control on the store path is the memory store's row schema
+ * (`MsTeamsConversationRowSchema`); this domain schema is interface-first — see the
+ * module note above.
+ */
+export const ConversationReferenceSchema = z.strictObject({
+    conversationId: z.string().min(1),
+    serviceUrl: z.string().min(1),
+    tenantId: z.string().min(1),
+    threadId: z.string().min(1).optional(),
+    updatedAt: z.number(),
+});
+/**
+ * Parse unknown input into a {@link ConversationReference}, returning
+ * `Result<T, ZodError>` (never throws). The `z.strictObject` rejects any smuggled
+ * field, so a caller cannot promote trust or route through an unexpected column.
+ * Interface-first: exported for callers that need to validate an untrusted
+ * reference, but no production path invokes it yet (the store's read-side row
+ * mapper is the engaged guard).
+ */
+export function parseConversationReference(raw) {
+    const result = ConversationReferenceSchema.safeParse(raw);
+    if (result.success) {
+        return ok(result.data);
+    }
+    return err(result.error);
+}

package/node_modules/@comis/core/dist/domain/normalized-message.d.ts

@@ -88,8 +88,8 @@ export declare function parseMessage(raw: unknown): Result<NormalizedMessage, z.
  *
  * Returns the `metadata.traceId` string when it is present and is a string;
  * returns `undefined` otherwise. The defensive `typeof v === "string"` check
- * guards against messages that were not parsed through the new schema (e.g.
- * messages constructed before the schema change shipped, or from external sources).
+ * guards against messages that never passed through the schema validator
+ * (e.g. persisted messages or ones constructed from external sources).
  *
  * Usage (orchestrator wrap site):
  * ```typescript

package/node_modules/@comis/core/dist/domain/normalized-message.js

@@ -78,8 +78,8 @@ export function parseMessage(raw) {
  *
  * Returns the `metadata.traceId` string when it is present and is a string;
  * returns `undefined` otherwise. The defensive `typeof v === "string"` check
- * guards against messages that were not parsed through the new schema (e.g.
- * messages constructed before the schema change shipped, or from external sources).
+ * guards against messages that never passed through the schema validator
+ * (e.g. persisted messages or ones constructed from external sources).
  *
  * Usage (orchestrator wrap site):
  * ```typescript

package/node_modules/@comis/core/dist/domain/normalized-reaction.d.ts

@@ -1,8 +1,7 @@
 import { type Result } from "@comis/shared";
 import { z } from "zod";
 /**
- * NormalizedReaction: Channel-agnostic representation of an inbound reaction
- * (Verified Learning WS1, REACT-01).
+ * NormalizedReaction: Channel-agnostic representation of an inbound reaction.
  *
  * The reaction-capable adapters (Discord/Slack/Telegram) convert their native
  * reaction-add event into this shape before it reaches core logic — the sibling
@@ -11,10 +10,10 @@ import { z } from "zod";
  *
  * UNTRUSTED inbound data: this type carries NO trust/authority field — only the
  * platform ids, the emoji, and the channel. Trust is resolved downstream from
- * config (Phase 199 daemon wiring), never asserted by the reaction. A reaction
+ * config (the daemon wiring), never asserted by the reaction. A reaction
  * can only WEIGHT learning, never write content or raise trust.
  *
- * SECURITY (V5): `z.strictObject` is load-bearing — it rejects smuggled fields
+ * SECURITY: `z.strictObject` is load-bearing — it rejects smuggled fields
  * (e.g. a `trustLevel`/`source` promotion claim) at {@link parseReaction}.
  */
 export declare const NormalizedReactionSchema: z.ZodObject<{
@@ -29,7 +28,7 @@ export type NormalizedReaction = z.infer<typeof NormalizedReactionSchema>;
  * Parse unknown input into a NormalizedReaction, returning Result<T, ZodError>.
  *
  * The input is untrusted platform data — `z.strictObject` rejects any field the
- * reactor smuggled in (V5), and the ids are `z.string().min(1)` (platform ids
+ * reactor smuggled in, and the ids are `z.string().min(1)` (platform ids
  * are not UUIDs, but an empty id is never valid).
  */
 export declare function parseReaction(raw: unknown): Result<NormalizedReaction, z.ZodError>;

package/node_modules/@comis/core/dist/domain/normalized-reaction.js

@@ -2,8 +2,7 @@
 import { ok, err } from "@comis/shared";
 import { z } from "zod";
 /**
- * NormalizedReaction: Channel-agnostic representation of an inbound reaction
- * (Verified Learning WS1, REACT-01).
+ * NormalizedReaction: Channel-agnostic representation of an inbound reaction.
  *
  * The reaction-capable adapters (Discord/Slack/Telegram) convert their native
  * reaction-add event into this shape before it reaches core logic — the sibling
@@ -12,10 +11,10 @@ import { z } from "zod";
  *
  * UNTRUSTED inbound data: this type carries NO trust/authority field — only the
  * platform ids, the emoji, and the channel. Trust is resolved downstream from
- * config (Phase 199 daemon wiring), never asserted by the reaction. A reaction
+ * config (the daemon wiring), never asserted by the reaction. A reaction
  * can only WEIGHT learning, never write content or raise trust.
  *
- * SECURITY (V5): `z.strictObject` is load-bearing — it rejects smuggled fields
+ * SECURITY: `z.strictObject` is load-bearing — it rejects smuggled fields
  * (e.g. a `trustLevel`/`source` promotion claim) at {@link parseReaction}.
  */
 export const NormalizedReactionSchema = z.strictObject({
@@ -34,7 +33,7 @@ export const NormalizedReactionSchema = z.strictObject({
  * Parse unknown input into a NormalizedReaction, returning Result<T, ZodError>.
  *
  * The input is untrusted platform data — `z.strictObject` rejects any field the
- * reactor smuggled in (V5), and the ids are `z.string().min(1)` (platform ids
+ * reactor smuggled in, and the ids are `z.string().min(1)` (platform ids
  * are not UUIDs, but an empty id is never valid).
  */
 export function parseReaction(raw) {

package/node_modules/@comis/core/dist/domain/provider-capabilities.d.ts

@@ -5,8 +5,7 @@
  * These describe provider-level quirks that apply to ALL models served by
  * a provider (as opposed to ModelCompatConfig which is per-model).
  *
- * NOTE: Comis starts with 4 fields that address known provider-specific
- * issues. Additional fields (e.g., payloadNormalization, thinkingSignature)
+ * NOTE: Additional fields (e.g., payloadNormalization, thinkingSignature)
  * can be added as needed without breaking existing configs because Zod
  * defaults handle missing fields.
  *

package/node_modules/@comis/core/dist/domain/provider-capabilities.js

@@ -6,8 +6,7 @@
  * These describe provider-level quirks that apply to ALL models served by
  * a provider (as opposed to ModelCompatConfig which is per-model).
  *
- * NOTE: Comis starts with 4 fields that address known provider-specific
- * issues. Additional fields (e.g., payloadNormalization, thinkingSignature)
+ * NOTE: Additional fields (e.g., payloadNormalization, thinkingSignature)
  * can be added as needed without breaking existing configs because Zod
  * defaults handle missing fields.
  *

package/node_modules/@comis/core/dist/domain/rpc-error-classification.d.ts

@@ -1,5 +1,5 @@
 /**
- * Single source of truth for classifying a TYPED RPC refusal (OBS-RPC-REFUSAL-CLASS).
+ * Single source of truth for classifying a TYPED RPC refusal.
  *
  * ## Why this lives in `@comis/core`
  * An RPC error is classified + logged at **two** layers: the daemon's
@@ -10,11 +10,11 @@
  * (`SandboxDowngradeError`), or local (`RequiredToolsUnreachableError`) error classes —
  * the dependency direction forbids it.
  *
- * Before this module each layer hard-coded its own typed→kind mapping and they
- * **drifted**: the gateway layer kept logging intentional policy/security refusals as
- * `internal`/ERROR(50) long after the dispatch layer was fixed to `precondition`/warn,
- * so a `logscan --level 50,60` operator health sweep STILL flagged a fail-closed
- * refusal as an ERROR (found live, orchestration-excellence-20260701). Both layers now
+ * If each layer hard-coded its own typed→kind mapping they would drift: one
+ * layer logging an intentional policy/security refusal as `internal`/ERROR(50)
+ * while the other logs `precondition`/warn means a `logscan --level 50,60`
+ * operator health sweep flags a fail-closed
+ * refusal as an ERROR. Both layers therefore
  * delegate here, keyed off the stable {@link Error.name} — the lowest-common-denominator
  * signal available WITHOUT a cross-package import. **Add a new typed refusal in ONE
  * place: {@link TYPED_RPC_ERROR_BY_NAME}.**