evolcore 0.0.17 → 0.0.19

package/dist/cli/daemon-commands.js

@@ -64,6 +64,23 @@ async function probeDaemon(socketPath, timeoutMs = 1000) {
         return null;
     return response;
 }
+/** Ask the daemon to run its own graceful shutdown lifecycle. */
+export async function requestDaemonShutdown(socketPath, timeoutMs = 3_000, reason = 'cli', expectedPids) {
+    const daemon = await probeDaemon(socketPath, Math.min(timeoutMs, 1_000));
+    if (!daemon || (expectedPids && !expectedPids.has(daemon.pid)))
+        return null;
+    const response = await ipcQuery(socketPath, {
+        type: 'shutdown',
+        reason,
+        expectedPid: daemon.pid,
+    }, timeoutMs);
+    if (response?.ok !== true || response.accepted !== true
+        || !Number.isInteger(response.pid) || response.pid <= 0
+        || response.pid !== daemon.pid) {
+        return null;
+    }
+    return response.pid;
+}
 function hasVisibleDaemonPid(status, ping) {
     return status.mains.some(entry => entry.alive && entry.record.pid === ping.pid);
 }
@@ -201,6 +218,33 @@ function formatLocalTime(ms) {
     const d = new Date(ms);
     return `${d.getFullYear()}-${String(d.getMonth() + 1).padStart(2, '0')}-${String(d.getDate()).padStart(2, '0')} ${String(d.getHours()).padStart(2, '0')}:${String(d.getMinutes()).padStart(2, '0')}:${String(d.getSeconds()).padStart(2, '0')}`;
 }
+function formatRunningDuration(ms) {
+    const totalSeconds = Math.max(0, Math.floor(ms / 1000));
+    const seconds = totalSeconds % 60;
+    const totalMinutes = Math.floor(totalSeconds / 60);
+    if (totalMinutes === 0)
+        return `${seconds}秒`;
+    const minutes = totalMinutes % 60;
+    const totalHours = Math.floor(totalMinutes / 60);
+    if (totalHours === 0)
+        return `${minutes}分${seconds}秒`;
+    const hours = totalHours % 24;
+    const days = Math.floor(totalHours / 24);
+    if (days === 0)
+        return `${hours}小时${minutes}分${seconds}秒`;
+    return `${days}天${hours}小时${minutes}分${seconds}秒`;
+}
+function resolveRunningDuration(pid, uptime) {
+    if (typeof uptime === 'number' && Number.isFinite(uptime) && uptime >= 0) {
+        return formatRunningDuration(uptime);
+    }
+    const processStartedAt = getProcessStartTime(pid);
+    if (processStartedAt !== null) {
+        return formatRunningDuration(Date.now() - processStartedAt);
+    }
+    const instance = scanInstances().mains.find(entry => entry.alive && entry.record.pid === pid);
+    return instance ? formatRunningDuration(Date.now() - instance.record.startedAt) : '未知';
+}
 function printStartupInfo(opts = {}) {
     const pkgRoot = getPackageRoot();
     const isNpmInstall = pkgRoot.includes('node_modules');
@@ -256,7 +300,7 @@ export async function cmdStart(opts = {}) {
     const existingDaemon = await probeDaemon(p.socket);
     if (existingDaemon) {
         console.log(`  EvolCore is already running (PID: ${existingDaemon.pid}, IPC reachable)`);
-        console.log('  已在运行；部署/脚本可直接复用当前实例');
+        console.log(`  已在运行；已运行时长: ${resolveRunningDuration(existingDaemon.pid, existingDaemon.uptime)}；部署/脚本可直接复用当前实例`);
         return;
     }
     ensureDataDirs();
@@ -356,7 +400,7 @@ export async function cmdStart(opts = {}) {
                 console.log(`    ${symbol} ${aid} — 最后活动 ${ago} (${info.event})`);
             }
         }
-        console.log('  已在运行；部署/脚本可继续轮询 IPC ready，或直接复用当前实例');
+        console.log(`  已在运行；已运行时长: ${formatRunningDuration(Date.now() - first.record.startedAt)}；部署/脚本可继续轮询 IPC ready，或直接复用当前实例`);
         console.log('  使用 ec restart 重启，或 ec stop 先停止');
         return;
     }
@@ -562,10 +606,11 @@ export async function cmdStart(opts = {}) {
     };
     setTimeout(checkReady, 1000);
 }
-async function stopPid(pid) {
+async function stopPid(pid, gracefulRequested = false) {
     console.log(`🛑 Stopping EvolCore (PID: ${pid})...`);
-    platform.killProcess(pid);
-    if (await platform.waitForProcessExit(pid, 10_000)) {
+    if (!gracefulRequested)
+        platform.killProcess(pid);
+    if (await platform.waitForProcessExit(pid, gracefulRequested ? 30_000 : 10_000)) {
         console.log('✓ EvolCore stopped');
         return true;
     }
@@ -608,7 +653,10 @@ export async function cmdStop() {
     if (runtimeOrphans.length > 0) {
         console.log(`⚠ 检测到未登记的 EvolCore 进程，将一并停止: ${runtimeOrphans.map(orphan => orphan.pid).join(', ')}`);
     }
-    const stopped = await Promise.all([...pids].map(pid => stopPid(pid)));
+    const gracefulPid = ping && pids.has(ping.pid)
+        ? await requestDaemonShutdown(p.socket, 3_000, 'ec stop', pids)
+        : null;
+    const stopped = await Promise.all([...pids].map(pid => stopPid(pid, pid === gracefulPid)));
     if (stopped.some(result => !result)) {
         process.exitCode = 1;
         return;
@@ -675,7 +723,12 @@ export async function cmdRestart(opts = {}) {
         if (aliveMains.length > 1) {
             console.log(`⚠ 检测到 ${aliveMains.length} 个 main 实例，将一并停止: ${aliveMains.map(m => m.record.pid).join(', ')}`);
         }
-        const stopped = await Promise.all(aliveMains.map(m => stopPid(m.record.pid)));
+        const mainPids = new Set(aliveMains.map(entry => entry.record.pid));
+        const currentPing = await probeDaemon(socketPath);
+        const gracefulPid = currentPing && mainPids.has(currentPing.pid)
+            ? await requestDaemonShutdown(socketPath, 3_000, 'ec restart', mainPids)
+            : null;
+        const stopped = await Promise.all(aliveMains.map(m => stopPid(m.record.pid, m.record.pid === gracefulPid)));
         if (stopped.some(result => !result)) {
             console.error('❌ Restart aborted because an existing EvolCore process could not be stopped');
             process.exitCode = 1;
@@ -703,7 +756,12 @@ export async function cmdRestart(opts = {}) {
         const runtimeOrphans = findOrphanProcesses().filter(o => isRuntimeOrphan(o));
         if (runtimeOrphans.length > 0) {
             console.log(`⚠ 检测到未登记的 EvolCore 进程，将一并停止: ${runtimeOrphans.map(o => o.pid).join(', ')}`);
-            const stopped = await Promise.all(runtimeOrphans.map(o => stopPid(o.pid)));
+            const orphanPids = new Set(runtimeOrphans.map(orphan => orphan.pid));
+            const currentPing = await probeDaemon(socketPath);
+            const gracefulPid = currentPing && orphanPids.has(currentPing.pid)
+                ? await requestDaemonShutdown(socketPath, 3_000, 'ec restart', orphanPids)
+                : null;
+            const stopped = await Promise.all(runtimeOrphans.map(o => stopPid(o.pid, o.pid === gracefulPid)));
             if (stopped.some(result => !result)) {
                 console.error('❌ Restart aborted because an unregistered EvolCore process could not be stopped');
                 process.exitCode = 1;
@@ -1359,7 +1417,7 @@ export function cmdLogs(args) {
 // ==================== Watch ====================
 let watchUseColor = false;
 const WATCH_BRACKET_TS_RE = /^\[(\d{4}-\d{2}-\d{2}[T ]\d{2}:\d{2}:\d{2}(?:\.\d+)?Z?)\]/;
-const WATCH_JSON_TS_RE = /"ts"\s*:\s*"(\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:\.\d+)?Z?)"/;
+const WATCH_JSON_TS_RE = /"(?:ts|timestamp|startedAt|firedAt|finishedAt)"\s*:\s*(?:"(\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:\.\d+)?Z?)"|(\d+(?:\.\d+)?))/;
 function parseWatchTs(s) {
     const m = s.match(/^(\d{4})-(\d{2})-(\d{2})[T ](\d{2}):(\d{2}):(\d{2})(?:\.(\d+))?(Z)?$/);
     if (!m)
@@ -1371,10 +1429,21 @@ function parseWatchTs(s) {
     return new Date(+y, +mo - 1, +d, +h, +mi, +se, msNum).getTime();
 }
 function extractWatchTs(line) {
-    const m = line.match(WATCH_BRACKET_TS_RE) || line.match(WATCH_JSON_TS_RE);
-    if (!m)
+    const bracket = line.match(WATCH_BRACKET_TS_RE);
+    if (bracket) {
+        const t = parseWatchTs(bracket[1]);
+        return isNaN(t) ? null : t;
+    }
+    const json = line.match(WATCH_JSON_TS_RE);
+    if (!json)
         return null;
-    const t = parseWatchTs(m[1]);
+    if (json[2] !== undefined) {
+        const numeric = Number(json[2]);
+        if (!Number.isFinite(numeric) || numeric <= 0)
+            return null;
+        return numeric < 100_000_000_000 ? numeric * 1000 : numeric;
+    }
+    const t = parseWatchTs(json[1]);
     return isNaN(t) ? null : t;
 }
 function toLocalTimeStr(epoch) {
@@ -1791,8 +1860,7 @@ function cmdWatch(filterTypes) {
         const all = fs.readdirSync(p.logs).filter(f => f.endsWith('.log')).map(f => path.join(p.logs, f));
         return filterLogFiles(all, filterTypes);
     };
-    // Strip rotation suffix (e.g., "daemon-20260518-21" → "daemon")
-    const shortName = (f) => path.basename(f, '.log').replace(/-\d{8}-\d{2}$/, '');
+    const shortName = shortLogNameLocal;
     // 计算最长文件名用于对齐
     let maxNameLen = 0;
     const updateMaxName = () => {

package/dist/cli/init.js

@@ -82,11 +82,11 @@ function ecagentUnavailableReason() {
 function buildDefaults(chosen, available, projectsDefaultPath) {
     const baseagents = {};
     for (const b of available) {
-        // ecagent is bundled but opt-in; do not declare it merely because it is available.
-        if (b === 'ecagent' && chosen !== 'ecagent')
-            continue;
         baseagents[b] = {};
     }
+    // ecagent is bundled with EvolCore, so declare it even when the caller
+    // supplies a reduced availability list (for example, a test probe).
+    baseagents.ecagent ??= {};
     return {
         $schema_version: 1,
         active_baseagent: chosen,
@@ -125,9 +125,12 @@ function applyExplicitAutostart(enabled, runtimeRoot) {
         console.log(`❌ ${autostartPlatformLabel() || '登录自启'}配置失败: ${result.error || '未知错误'}`);
     }
     else {
+        const backend = enabled && result.backend ? `（方式：${result.backend}）` : '';
         console.log(enabled
-            ? `✓ 已启用 ${autostartPlatformLabel() || '登录'}自启`
+            ? `✓ 已启用 ${autostartPlatformLabel() || '登录'}自启${backend}`
             : `✓ 已禁用 ${autostartPlatformLabel() || '登录'}自启`);
+        if (result.warning)
+            console.log(`⚠ ${result.warning}`);
     }
     return result.ok;
 }
@@ -508,9 +511,12 @@ export async function initTail(options = {}) {
             console.log(`  ❌ ${autostartPlatformLabel() || '登录自启'}配置失败: ${result.error || '未知错误'}`);
             return false;
         }
+        const backend = enabled && result.backend ? `（方式：${result.backend}）` : '';
         console.log(enabled
-            ? `  ✓ 已启用 ${autostartPlatformLabel() || '登录'}自启`
+            ? `  ✓ 已启用 ${autostartPlatformLabel() || '登录'}自启${backend}`
             : `  ✓ 已禁用 ${autostartPlatformLabel() || '登录'}自启`);
+        if (result.warning)
+            console.log(`  ⚠ ${result.warning}`);
         return true;
     }
     async function handleOwnersPrompt(rl) {
@@ -827,11 +833,19 @@ export async function cmdInitNonInteractive(opts, dependencies = {}) {
     catch (e) {
         fail('IO_ERROR', `failed to write daemon.json: ${e?.message || e}`, EXIT_RUNTIME, format);
     }
+    let autostartBackend;
+    let autostartWarning;
     if (opts.autoStart !== undefined) {
         const autostart = configureAutostart(opts.autoStart, p.root);
         if (!autostart.ok) {
             fail('AUTOSTART_CONFIG_FAILED', autostart.error || 'failed to configure login autostart', EXIT_RUNTIME, format);
         }
+        if (opts.autoStart === true && autostart.backend) {
+            // Keep the selected Windows backend visible to automation callers as
+            // well as in data/autostart-state.json.
+            autostartBackend = autostart.backend;
+        }
+        autostartWarning = autostart.warning;
     }
     // ── 10. 输出 init.result ──
     const result = {
@@ -845,6 +859,8 @@ export async function cmdInitNonInteractive(opts, dependencies = {}) {
         projectsDefaultPath: projectsDefaultPath ?? null,
         defaultsPath: p.defaultsConfig,
         daemonConfigPath: p.daemonConfig,
+        ...(autostartBackend ? { autoStartBackend: autostartBackend } : {}),
+        ...(autostartWarning ? { autoStartWarning: autostartWarning } : {}),
         ...(forced ? { forced: true, previousOwners } : {}),
     };
     emitResult(result, format);

package/dist/cli/restart-monitor.js

@@ -14,6 +14,7 @@ import { WEB_PACKAGE_NAME } from '../product.js';
 import { shouldSuppressRealRestart } from '../utils/restart-safety.js';
 import { rotateStdoutLog } from '../utils/log-writer.js';
 import { inspectDataMigrationRequirement } from '../core/data-migration.js';
+import { requestDaemonShutdown } from './daemon-commands.js';
 const execFileAsync = promisify(execFile);
 // 清理 Claude Code 环境变量，防止 SDK 认为是嵌套会话
 function cleanEnv() {
@@ -105,11 +106,14 @@ export async function cmdRestartMonitor() {
     if (runtimeOrphans.length > 0) {
         const pids = runtimeOrphans.map(o => o.pid).join(', ');
         log(`Stopping unregistered EvolCore process(es): ${pids}`);
+        const orphanPids = new Set(runtimeOrphans.map(orphan => orphan.pid));
+        const ping = await requestDaemonShutdown(p.socket, 3_000, 'restart-monitor orphan cleanup', orphanPids);
         for (const orphan of runtimeOrphans) {
-            platform.killProcess(orphan.pid, false);
+            if (orphan.pid !== ping)
+                platform.killProcess(orphan.pid, false);
         }
         const exited = await Promise.all(runtimeOrphans.map(async (orphan) => {
-            if (await platform.waitForProcessExit(orphan.pid, 10_000))
+            if (await platform.waitForProcessExit(orphan.pid, orphan.pid === ping ? 30_000 : 10_000))
                 return true;
             platform.killProcess(orphan.pid, true);
             return platform.waitForProcessExit(orphan.pid, 5_000);
@@ -130,12 +134,15 @@ export async function cmdRestartMonitor() {
     if (aliveMains.length > 0) {
         const oldPids = aliveMains.map(m => m.record.pid);
         log(`Monitoring ${oldPids.length} main process(es): ${oldPids.join(', ')}`);
-        // 先并行 SIGTERM 通知所有活 main
+        const gracefulPid = await requestDaemonShutdown(p.socket, 3_000, 'restart-monitor', new Set(oldPids));
+        // 没有收到 IPC shutdown 确认的进程才走信号兜底
         for (const pid of oldPids) {
-            try {
-                platform.killProcess(pid, false);
+            if (pid !== gracefulPid) {
+                try {
+                    platform.killProcess(pid, false);
+                }
+                catch { }
             }
-            catch { }
         }
         const exited = await Promise.all(oldPids.map(async (oldPid) => {
             if (await platform.waitForProcessExit(oldPid, 30_000)) {

package/dist/cli/watch-logs.js

@@ -1,8 +1,8 @@
 import path from 'path';
-/** 去掉轮转后缀（"daemon-20260518-21.log" → "daemon"；"ts-sdk-2026-05-27.log" → "ts-sdk"）。入参可为文件名或绝对路径。 */
+/** 去掉轮转后缀（按小时、按日及旧版带连字符日期）。入参可为文件名或绝对路径。 */
 export function shortLogName(file) {
     return path.basename(file, '.log')
-        .replace(/-\d{8}-\d{2}$/, '') // -YYYYMMDD-HH（按小时轮转）
+        .replace(/-\d{8}(?:-\d{2})?$/, '') // -YYYYMMDD[-HH]（按日/小时轮转）
         .replace(/-\d{4}-\d{2}-\d{2}$/, ''); // -YYYY-MM-DD（按日轮转，如 ts-sdk）
 }
 /** 从 .log 文件名列表推导去重、字母序的类型列表。 */

package/dist/config/builtin-roles.js

@@ -3,11 +3,15 @@ import { expectedRoleRank } from './role-ranks.js';
 export { expectedRoleRank, ROLE_RANKS } from './role-ranks.js';
 export const BUILTIN_USER_ROLES = ['member', 'visitor'];
 export const MANAGEMENT_ROLES = ['owner', 'admin'];
+export const DAEMON_OWNER_ROLE = 'daemon-owner';
 export function isManagementRole(role) {
     return role === 'owner' || role === 'admin';
 }
+export function isDaemonOwnerRole(role) {
+    return role === DAEMON_OWNER_ROLE;
+}
 export function isReservedRoleName(role) {
-    return isManagementRole(role);
+    return isManagementRole(role) || isDaemonOwnerRole(role);
 }
 /** Built-in user policy data comes exclusively from kits/templates/roles. */
 export function getBuiltinRolesConfig() {

package/dist/config/role-ranks.js

@@ -1,4 +1,6 @@
 export const ROLE_RANKS = Object.freeze({
+    /** Process-plane rank for display/audit only; it is never relation-assignable. */
+    'daemon-owner': 1000,
     owner: 900,
     admin: 700,
     custom: 500,
@@ -6,6 +8,8 @@ export const ROLE_RANKS = Object.freeze({
     visitor: 100,
 });
 export function expectedRoleRank(role) {
+    if (role === 'daemon-owner')
+        return ROLE_RANKS['daemon-owner'];
     if (role === 'owner')
         return ROLE_RANKS.owner;
     if (role === 'admin')

package/dist/core/audit/event-key.js

@@ -0,0 +1,29 @@
+import crypto from 'node:crypto';
+function compactPart(value) {
+    const text = String(value ?? '').trim();
+    return text || undefined;
+}
+function stableDigest(parts) {
+    const material = parts.map(part => compactPart(part) ?? '-').join('\u0000');
+    return crypto.createHash('sha256').update(material).digest('hex').slice(0, 20);
+}
+/** Stable across source/mirror records for one tool-call lifecycle. */
+export function buildToolLifecycleEventKey(input) {
+    return `tool:${stableDigest([
+        input.sessionId ?? 'unknown',
+        input.callId ?? input.correlationId ?? input.requestId ?? 'unknown',
+    ])}`;
+}
+/** Stable across repeated projections of one authorization decision. */
+export function buildAuthorizationEventKey(input) {
+    const lifecycleId = input.callId ?? input.correlationId ?? input.requestId;
+    if (lifecycleId) {
+        return `${buildToolLifecycleEventKey({
+            sessionId: input.sessionId,
+            callId: input.callId,
+            correlationId: input.correlationId,
+            requestId: input.requestId,
+        })}:authorization:${stableDigest([input.operation])}`;
+    }
+    return `authorization:${stableDigest([input.sessionId ?? 'unknown', input.operation])}`;
+}

package/dist/core/audit/log-integrity.js

@@ -77,6 +77,10 @@ export function inspectStructuredLogs(logDir, options = {}) {
 }
 function structuredRecordKey(value) {
     const nested = nestedRecord(value);
+    const eventKey = firstDefined(value, nested, ['eventKey', 'event_key']);
+    const eventPhase = firstDefined(value, nested, ['eventPhase', 'event_phase']);
+    if (eventKey)
+        return `${String(eventKey)}${eventPhase ? `:${String(eventPhase)}` : ''}`;
     const correlation = firstDefined(value, nested, [
         'correlationId', 'correlation_id', 'callId', 'call_id', 'toolUseId', 'tool_use_id',
         'requestId', 'request_id', 'msgId', 'operationId',
@@ -96,17 +100,23 @@ function isCorrelatableRecord(value) {
 }
 function stableHash(value) {
     const nested = nestedRecord(value);
+    const eventKey = firstDefined(value, nested, ['eventKey', 'event_key']);
     const canonical = {
+        eventKey,
+        eventPhase: firstDefined(value, nested, ['eventPhase', 'event_phase']),
         type: canonicalEventType(value),
         toolName: firstDefined(value, nested, ['toolName', 'tool', 'name']),
-        callId: firstDefined(value, nested, ['callId', 'call_id', 'toolUseId', 'tool_use_id']),
-        correlationId: firstDefined(value, nested, ['correlationId', 'correlation_id']),
-        requestId: firstDefined(value, nested, ['requestId', 'request_id']),
+        callId: eventKey ? undefined : firstDefined(value, nested, ['callId', 'call_id', 'toolUseId', 'tool_use_id']),
+        correlationId: eventKey ? undefined : firstDefined(value, nested, ['correlationId', 'correlation_id']),
+        requestId: eventKey ? undefined : firstDefined(value, nested, ['requestId', 'request_id']),
         sessionId: firstDefined(value, nested, ['sessionId', 'session_id']),
         agentAid: firstDefined(value, nested, ['agentAid', 'agent_aid', 'selfAid']),
         permissionMode: firstDefined(value, nested, ['permissionMode', 'permission_mode']),
         isError: firstDefined(value, nested, ['isError', 'is_error']) ?? (value.ok === false || nested?.ok === false ? true : undefined),
         errorCode: firstDefined(value, nested, ['errorCode', 'error_code']),
+        decision: firstDefined(value, nested, ['decision']),
+        executed: firstDefined(value, nested, ['executed']),
+        executionState: firstDefined(value, nested, ['executionState', 'execution_state']),
         input: firstDefined(value, nested, ['input']),
         result: firstDefined(value, nested, ['result', 'content']),
         error: firstDefined(value, nested, ['error', 'errorMessage']),

package/dist/core/auth/auth-gateway.js

@@ -5,20 +5,8 @@ import { authorizeCommand, authorizeResolvedConfigCommand } from './operation-au
 import { auditCommandAuthorization } from './authorization-audit.js';
 import { hasTrustedPrincipal } from './authenticated-actor.js';
 import { resolveRuntimePermissionMode } from '../role/runtime-policy.js';
-const CROSS_AGENT_READ_OPERATIONS = new Set([
-    'trigger.list',
-    'trigger.show',
-    'trigger.history',
-]);
 export function isCrossAgentTriggerOperationAllowed(input) {
-    if (input.control || input.taskAgentAid === input.targetAgentAid)
-        return true;
-    if (!input.taskAgentAid || !input.targetManagement)
-        return false;
-    return CROSS_AGENT_READ_OPERATIONS.has(input.operation);
-}
-export function isCrossAgentTriggerReadOperation(operation) {
-    return CROSS_AGENT_READ_OPERATIONS.has(operation);
+    return input.control || input.daemonOwner === true || input.taskAgentAid === input.targetAgentAid;
 }
 export function buildAuthSubject(input) {
     const chatType = input.chatType === 'group' ? 'group' : 'private';
@@ -34,12 +22,14 @@ export function buildAuthSubject(input) {
         peerType: input.peerType,
     });
     const processOwners = input.processOwners ?? [];
-    const isDaemonOwner = isProcessOwner({
+    const isDaemonService = input.trustedProcessRole === 'daemon-service';
+    const isDaemonOwner = !isDaemonService && isProcessOwner({
         actor: roleDetail.actor,
         processOwners,
     });
     const suppliedRole = input.identity?.role && input.identity.role !== 'none' ? input.identity.role : undefined;
-    const role = suppliedRole ?? (isDaemonOwner ? 'owner' : roleDetail.effectiveRole ?? 'none');
+    const role = suppliedRole ?? roleDetail.effectiveRole ?? 'none';
+    const processRole = isDaemonService ? 'daemon-service' : isDaemonOwner ? 'daemon-owner' : 'none';
     return {
         selfAid: input.selfAid,
         actorId,
@@ -52,11 +42,13 @@ export function buildAuthSubject(input) {
         conversationId,
         peerKey: input.channelType && conversationId ? formatPeerKey(input.channelType, conversationId) : undefined,
         role,
-        roleSource: isDaemonOwner && !roleDetail.effectiveRole ? 'fallback' : roleDetail.source,
+        relationRole: role,
+        processRole,
+        roleSource: roleDetail.source,
         identity: input.identity ?? roleToSessionIdentity(role === 'none' ? null : role),
         isDaemonOwner,
         fromControlChannel: !!input.fromControlChannel,
-        allowAccess: isDaemonOwner || (suppliedRole
+        allowAccess: processRole !== 'none' || (suppliedRole
             ? checkRoleAccess(suppliedRole, input.selfAid)
             : roleDetail.allowAccess && checkRoleAccess(role, input.selfAid)),
         permissionMode: input.permissionMode
@@ -104,6 +96,7 @@ export function authorizeOperation(params) {
         selfAid: params.subject.selfAid,
         peerKey: params.subject.peerKey,
         role: params.subject.role,
+        processRole: params.subject.processRole,
         isDaemonOwner: params.subject.isDaemonOwner,
         fromControlChannel: params.subject.fromControlChannel,
         allowExplicitRelationTarget: params.allowExplicitRelationTarget,
@@ -183,10 +176,13 @@ function auditDecision(params, decision) {
         peerKey: params.subject.peerKey,
         channel: params.subject.channel,
         channelId: params.subject.channelId,
-        role: params.subject.role,
+        role: decision.allow ? decision.role : params.subject.role,
+        processRole: params.subject.processRole,
         isDaemonOwner: params.subject.isDaemonOwner,
         fromControlChannel: params.subject.fromControlChannel,
         decision: decision.allow ? 'allow' : 'deny',
+        executed: false,
+        executionState: decision.allow ? 'authorized' : 'blocked',
         code: decision.allow ? undefined : decision.code,
         reason: decision.allow ? undefined : decision.reason,
         matchedRule: decision.matchedRule,