evolcore 0.0.25 → 0.0.27

package/dist/config/config-operation-service.js

@@ -5,6 +5,10 @@ import { currentVersion, fieldSchemaDefault, isSchemaName, listSchemaNames, list
 import fs from 'fs';
 import path from 'path';
 import { resolvePaths, agentDir, agentRelationConfig } from '../paths.js';
+import { roleMenuQuery, roleMenuUpdate } from '../core/command/role-menu.js';
+import { parsePeerKey, PeerIdentityCache } from '../core/relation/peer-identity.js';
+import { isExplicitGroupId } from '../aun/group/index.js';
+import { isUnsupportedBaseagentConfigField } from './config-field-policy.js';
 export const AUTHENTICATED_CONFIG_ROLE_ENV = 'EVOLCORE_AUTHENTICATED_CONFIG_ROLE';
 export function executeResolvedConfigCommand(command, options = {}) {
     try {
@@ -23,11 +27,150 @@ export function executeResolvedConfigCommand(command, options = {}) {
         return { ok: false, code: 'CONFIG_ERROR', error: error instanceof Error ? error.message : String(error) };
     }
 }
+/**
+ * Execute a config command that may use an asynchronous domain service.
+ * Relation role assignments are intentionally handled here instead of by
+ * mutateConfig(), so Role Menu remains the single write path for validation,
+ * revisions, journaling, and audit.
+ */
+export async function executeResolvedConfigCommandAsync(command, options = {}) {
+    try {
+        if (isRelationRoleCommand(command)) {
+            return await executeRelationRoleCommand(command, options);
+        }
+        return executeResolvedConfigCommand(command, options);
+    }
+    catch (error) {
+        if (error instanceof ConfigError)
+            return { ok: false, code: error.code, error: error.message, ...(error.data !== undefined ? { data: error.data } : {}) };
+        const roleError = error;
+        return {
+            ok: false,
+            code: roleError?.code || 'CONFIG_ERROR',
+            error: roleError?.message || String(error),
+            ...(roleError?.data !== undefined ? { data: roleError.data } : {}),
+        };
+    }
+}
+function isRelationRoleCommand(command) {
+    return command.kind === 'field'
+        && command.field === 'role'
+        && command.configScope === 'relation'
+        && (command.operationId === 'role.relation.read'
+            || command.operationId === 'role.assign'
+            || command.operationId === 'role.revoke');
+}
+async function executeRelationRoleCommand(op, options) {
+    if (!op.self || !op.peerKey) {
+        return { ok: false, code: 'PEER_REQUIRED', error: 'role requires --self <aid> --peer <peer-aid>' };
+    }
+    const target = roleTargetFromPeerKey(op.self, op.peerKey);
+    const context = options.roleContext ?? {
+        self: op.self,
+        actorRole: options.role || 'owner',
+        actorRoleSource: 'local-cli',
+        isDaemonOwner: false,
+        fromControlChannel: false,
+        aunAvailable: true,
+    };
+    if (context.self !== op.self) {
+        return { ok: false, code: 'SCOPE_MISMATCH', error: 'Role target does not match the receiving Agent' };
+    }
+    const targetArgs = { self: op.self, view: 'target', target };
+    const current = await roleMenuQuery(context, targetArgs);
+    const explicitRole = current?.assignment?.explicitRole
+        ?? current?.assignment?.explicitDefaultRole
+        ?? null;
+    const effectiveRole = current?.effectiveRole?.roleId
+        ?? current?.baselineRole?.roleId
+        ?? null;
+    const effectiveRoleSource = current?.effectiveRole?.source
+        ?? current?.baselineRole?.source
+        ?? 'none';
+    const roleDetails = { explicitRole, effectiveRole, effectiveRoleSource };
+    if (op.subcommand === 'get') {
+        return {
+            ok: true,
+            subcommand: 'get',
+            field: op.field,
+            value: explicitRole,
+            scope: op.configScope,
+            roleDetails,
+        };
+    }
+    const nextValue = op.subcommand === 'unset' ? null : op.value;
+    const updated = await roleMenuUpdate(context, {
+        self: op.self,
+        resource: 'assignment',
+        target,
+        expectedPolicyRevision: current.policyRevision,
+        expectedRelationRevision: current.relationRevision,
+    }, JSON.stringify(nextValue));
+    const updatedExplicitRole = updated?.assignment?.explicitRole
+        ?? updated?.assignment?.explicitDefaultRole
+        ?? null;
+    const updatedEffectiveRole = updated?.effectiveRole?.roleId
+        ?? updated?.baselineRole?.roleId
+        ?? null;
+    const updatedEffectiveRoleSource = updated?.effectiveRole?.source
+        ?? updated?.baselineRole?.source
+        ?? 'none';
+    const updatedDetails = {
+        explicitRole: updatedExplicitRole,
+        effectiveRole: updatedEffectiveRole,
+        effectiveRoleSource: updatedEffectiveRoleSource,
+    };
+    if (op.subcommand === 'unset') {
+        return {
+            ok: true,
+            subcommand: 'unset',
+            field: op.field,
+            removed: updated.changed === true,
+            scope: op.configScope,
+            roleDetails: updatedDetails,
+        };
+    }
+    return {
+        ok: true,
+        subcommand: 'set',
+        field: op.field,
+        value: updatedExplicitRole,
+        scope: op.configScope,
+        file: 'relation-config',
+        roleDetails: updatedDetails,
+    };
+}
+function roleTargetFromPeerKey(self, peerKey) {
+    let parsed;
+    try {
+        parsed = parsePeerKey(peerKey);
+    }
+    catch {
+        throw new ConfigError('INVALID_SELECTOR', `Invalid relation peer key: ${peerKey}`);
+    }
+    if (parsed.channelType !== 'aun') {
+        throw new ConfigError('NOT_SUPPORTED', 'Relation role assignments currently support AUN peers only');
+    }
+    const relation = read(ConfigTarget.Relation, { self, peerKey });
+    const identity = PeerIdentityCache.get('aun', parsed.channelId, agentDir(self));
+    const verifiedType = identity?.aid === parsed.channelId && identity.source === 'agentmd' && identity.verifiedAt > 0
+        ? identity.type : undefined;
+    const isGroup = relation?.targetKind ? relation.targetKind === 'group'
+        : verifiedType ? verifiedType === 'group' : isExplicitGroupId(parsed.channelId);
+    return isGroup
+        ? { kind: 'group', groupId: parsed.channelId }
+        : { kind: 'private', peerAid: parsed.channelId };
+}
 export function executeResolvedConfigOperation(op, options = {}) {
     try {
         const missingAgent = selectedAgentError(op);
         if (missingAgent)
             return missingAgent;
+        if (op.configScope === 'agent'
+            && (op.field === 'fullaccess' || op.field.startsWith('fullaccess.'))
+            && op.subcommand !== 'get') {
+            return { ok: false, code: 'FORBIDDEN', error: 'Agent fullaccess can only be configured in ECWeb Agent settings' };
+        }
         if (op.subcommand === 'get')
             return executeGet(op, options);
         if (op.subcommand === 'set')
@@ -222,6 +365,9 @@ function executeSchema(command) {
     };
 }
 function executeGet(op, options) {
+    if (isUnsupportedBaseagentConfigField(op.field)) {
+        return { ok: false, code: 'UNSUPPORTED_FIELD', error: `Config field ${op.field} is not supported by this version` };
+    }
     const selector = selectorFor(op, options);
     if (op.configScope === 'process') {
         const config = read(ConfigTarget.Process, selector) || {};
@@ -298,6 +444,13 @@ function getWithSchemaDefault(op, absent, note) {
     return { ok: true, subcommand: 'get', field: op.field, value: absent, scope: op.configScope, ...nt };
 }
 function executeSet(op, options) {
+    if (op.field === 'role') {
+        return {
+            ok: false,
+            code: 'ROLE_POLICY_MANAGED',
+            error: 'Relation role assignments require the asynchronous role assignment service',
+        };
+    }
     if (!op.route)
         return { ok: false, code: 'UNKNOWN_FIELD', error: `Unknown config field: ${op.field}` };
     const selector = selectorFor(op, options);
@@ -341,6 +494,13 @@ function executeSet(op, options) {
     };
 }
 function executeUnset(op, options) {
+    if (op.field === 'role') {
+        return {
+            ok: false,
+            code: 'ROLE_POLICY_MANAGED',
+            error: 'Relation role assignments require the asynchronous role assignment service',
+        };
+    }
     if (!op.route)
         return { ok: false, code: 'UNKNOWN_FIELD', error: `Unknown config field: ${op.field}` };
     const selector = selectorFor(op, options);

package/dist/config/contact-book-store.js

@@ -2,7 +2,7 @@ import crypto from 'crypto';
 import fs from 'fs';
 import path from 'path';
 import { isValidAid } from '../aun/aid/validation.js';
-import { isExplicitGroupId } from '../aun/group-identity.js';
+import { isExplicitGroupId } from '../aun/group/index.js';
 import { agentConfig, agentContactConfig, agentDir, resolvePaths } from '../paths.js';
 import { atomicReadJson, atomicWrite, atomicWriteJson } from '../utils/atomic-write.js';
 import { fileCache } from '../core/daemon-file-cache.js';

package/dist/config/contact-book.js

@@ -1,6 +1,6 @@
 import { agentContactConfig } from '../paths.js';
 import { isValidAid } from '../aun/aid/validation.js';
-import { isExplicitGroupId } from '../aun/group-identity.js';
+import { isExplicitGroupId } from '../aun/group/index.js';
 import { ConfigTarget, read, validateConfig } from './config-manager.js';
 import { ContactMutationError, contactRevision, mutateContactBookSync } from './contact-book-store.js';
 import { formatContactAlias, normalizeContactChannelKey, parseContactAlias, } from './contact-alias.js';

package/dist/config/contact-operation-service.js

@@ -1,10 +1,12 @@
 import fs from 'fs';
 import { isValidAid } from '../aun/aid/validation.js';
-import { isExplicitGroupId } from '../aun/group-identity.js';
+import { isExplicitGroupId } from '../aun/group/index.js';
 import { agentConfig } from '../paths.js';
 import { getContactSnapshot, resolveContactView } from './contact-book.js';
 import { ContactMutationError } from './contact-book-store.js';
 import { addContact, mutateContactWithOperation } from './contact-request-service.js';
+import { expirePendingContactRequests, reviewContactRequest } from './contact-request-service.js';
+import { listStaticAgentOwners } from './peer-role-resolver.js';
 export function resolveContactCommand(argv) {
     const args = argv[0] === 'contact' ? argv.slice(1) : [...argv];
     const selfAid = String(argValue(args, '--self') || '').trim();
@@ -15,12 +17,41 @@ export function resolveContactCommand(argv) {
     if (extra.length > 0)
         return invalid('INVALID_ARGUMENT', `Unexpected contact arguments: ${extra.join(' ')}`);
     if (command === 'list') {
-        if (subcommand !== undefined || !args.includes('--blocked')) {
-            return invalid('INVALID_ARGUMENT', 'Only ec contact list --blocked is currently supported');
+        if (subcommand !== undefined) {
+            return invalid('INVALID_ARGUMENT', 'contact list does not accept a positional argument');
         }
+        const filter = args.includes('--blocked')
+            ? 'blocked'
+            : args.includes('--pending')
+                ? 'pending'
+                : args.includes('--all') ? 'all' : undefined;
+        if (!filter)
+            return invalid('INVALID_ARGUMENT', 'contact list requires --blocked, --pending, or --all');
         return {
             ok: true,
-            command: { kind: 'list-blocked', operationId: 'contact.read', selfAid, canonicalArgv: canonicalArgv(argv) },
+            command: { kind: 'list-blocked', operationId: 'contact.read', selfAid, filter, canonicalArgv: canonicalArgv(argv) },
+        };
+    }
+    if (command === 'approve' || command === 'reject' || command === 'block-request') {
+        if (!isValidAid(subcommand || '') || isExplicitGroupId(subcommand || '')) {
+            return invalid('INVALID_AID', 'primaryId must be a valid individual AID');
+        }
+        const requestId = String(argValue(args, '--request-id') || '').trim();
+        if (!requestId)
+            return invalid('INVALID_ARGUMENT', `${command} requires --request-id <request-id>`);
+        const expectedContactRevision = argValue(args, '--contact-revision')?.trim() || undefined;
+        return {
+            ok: true,
+            command: {
+                kind: 'review-request',
+                operationId: 'contact.review',
+                selfAid,
+                primaryId: subcommand,
+                requestId,
+                decision: command === 'approve' ? 'approve' : command === 'reject' ? 'reject' : 'block',
+                expectedContactRevision,
+                canonicalArgv: canonicalArgv(argv),
+            },
         };
     }
     if (command === 'block' || command === 'unblock') {
@@ -62,13 +93,63 @@ export async function executeResolvedContactCommand(command, actor = 'local-cli'
     }
     try {
         if (command.kind === 'list-blocked') {
+            await expirePendingContactRequests(command.selfAid);
             const snapshot = getContactSnapshot(command.selfAid);
+            const ids = command.filter === 'blocked'
+                ? [...snapshot.blockedIndex]
+                : [...snapshot.contacts.entries()]
+                    .filter(([, entry]) => command.filter === 'all' || entry.status === 'pending')
+                    .map(([id]) => id);
+            const items = ids.sort().map(id => contactItem(command.selfAid, id));
+            if (command.filter === 'blocked') {
+                return {
+                    ok: true,
+                    operation: 'list-blocked',
+                    selfAid: command.selfAid,
+                    contactRevision: snapshot.contactRevision,
+                    items,
+                };
+            }
             return {
                 ok: true,
-                operation: 'list-blocked',
+                operation: 'list-contacts',
                 selfAid: command.selfAid,
+                filter: command.filter,
                 contactRevision: snapshot.contactRevision,
-                items: [...snapshot.blockedIndex].sort().map(id => resolveContactView(command.selfAid, id)),
+                items,
+            };
+        }
+        if (command.kind === 'review-request') {
+            const expectedContactRevision = command.expectedContactRevision ?? getContactSnapshot(command.selfAid).contactRevision;
+            const reviewerAid = actor === 'local-cli'
+                ? listStaticAgentOwners(command.selfAid)[0]
+                : actor;
+            if (!reviewerAid) {
+                return { ok: false, code: 'NO_OWNER', error: `Agent has no owner: ${command.selfAid}` };
+            }
+            const reviewed = await reviewContactRequest({
+                selfAid: command.selfAid,
+                primaryId: command.primaryId,
+                requestId: command.requestId,
+                expectedContactRevision,
+                approverId: reviewerAid,
+                actorId: reviewerAid,
+                decision: command.decision,
+            });
+            if (reviewed.code !== 'approved' && reviewed.code !== 'rejected' && reviewed.code !== 'blocked') {
+                const code = reviewed.code === 'request-expired' ? 'REQUEST_EXPIRED'
+                    : reviewed.code === 'revision-conflict' ? 'CONFLICT'
+                        : reviewed.code === 'forbidden' ? 'PERMISSION_DENIED' : 'REQUEST_STALE';
+                return { ok: false, code, error: reviewed.code, data: { contactRevision: reviewed.contactRevision } };
+            }
+            return {
+                ok: true,
+                operation: 'review-request',
+                selfAid: command.selfAid,
+                primaryId: command.primaryId,
+                requestId: command.requestId,
+                result: reviewed.code,
+                contactRevision: reviewed.contactRevision,
             };
         }
         if (command.kind === 'set-blocked') {
@@ -129,16 +210,24 @@ function stripOptions(args) {
     const result = [];
     for (let index = 0; index < args.length; index += 1) {
         const arg = args[index];
-        if (arg === '--self' || arg === '--format') {
+        if (arg === '--self' || arg === '--format' || arg === '--request-id' || arg === '--contact-revision') {
             index += 1;
             continue;
         }
-        if (arg === '--blocked')
+        if (arg === '--blocked' || arg === '--pending' || arg === '--all')
             continue;
         result.push(arg);
     }
     return result;
 }
+function contactItem(selfAid, primaryId) {
+    const view = resolveContactView(selfAid, primaryId);
+    const entry = getContactSnapshot(selfAid).contacts.get(primaryId);
+    return {
+        ...view,
+        ...(entry?.pendingRequest ? { pendingRequest: { ...entry.pendingRequest } } : {}),
+    };
+}
 function canonicalArgv(argv) {
     return argv[0] === 'contact' ? [...argv] : ['contact', ...argv];
 }

package/dist/config/peer-role-resolver.js

@@ -10,7 +10,7 @@ import { getRoleDefinition, getRoleRank, normalizeDefaultRole, roleExists } from
 import { getStoredRoleRegistry, roleRegistryExists } from './role-store.js';
 import { resolvePrincipal } from './contact-book.js';
 import { isValidAid } from '../aun/aid/validation.js';
-import { isExplicitGroupId } from '../aun/group-identity.js';
+import { isExplicitGroupId } from '../aun/group/index.js';
 export function isAuthenticated(userId) {
     return isValidAid(String(userId || '').trim());
 }

package/dist/config/resolved-config-op.js

@@ -97,11 +97,15 @@ function resolveFieldCommand(argv, subcommand, options = {}) {
             reason: 'permissionMode is defined by roles; use the role policy editor',
         };
     }
-    if (field === 'role') {
+    if (subcommand !== 'get' && (field === 'initialization' || field.startsWith('initialization.'))) {
+        return { ok: false, code: 'INITIALIZATION_MANAGED', reason: 'initialization is owned by the creation service' };
+    }
+    const isRelationRole = field === 'role';
+    if (isRelationRole && selector.scope !== 'relation') {
         return {
             ok: false,
-            code: 'ROLE_POLICY_MANAGED',
-            reason: 'Relation role assignments are managed through the role assignment service',
+            code: 'RELATION_SELECTOR_REQUIRED',
+            reason: `config ${subcommand} role needs a relation target: --self <aid> --peer <peer-aid>`,
         };
     }
     if (subcommand !== 'get' && (field === 'roles' || field.startsWith('roles.'))) {
@@ -129,12 +133,14 @@ function resolveFieldCommand(argv, subcommand, options = {}) {
             reason: `Config field ${field} does not support object writes`,
         };
     }
-    const commandScope = selector.scope === 'defaults' ? 'process' : selector.scope;
+    const commandScope = isRelationRole ? 'agent' : selector.scope === 'defaults' ? 'process' : selector.scope;
     const isSafe = fieldRule.class === 'safe-scalar' || fieldRule.class === 'safe-readonly-object';
     const isManagementOperation = commandScope === 'process' || !isSafe;
-    const operationId = isManagementOperation
-        ? subcommand === 'get' ? 'config.read' : 'config.write'
-        : `config.${subcommand}`;
+    const operationId = isRelationRole
+        ? subcommand === 'get' ? 'role.relation.read' : subcommand === 'set' ? 'role.assign' : 'role.revoke'
+        : isManagementOperation
+            ? subcommand === 'get' ? 'config.read' : 'config.write'
+            : `config.${subcommand}`;
     let route;
     const routeRequired = subcommand !== 'get' || !isManagementOperation;
     try {
@@ -173,6 +179,23 @@ function resolveFieldCommand(argv, subcommand, options = {}) {
                 return parsedOwners;
             value = parsedOwners.value;
         }
+        else if (isRelationRole) {
+            const raw = rawValue.trim();
+            if (!raw)
+                return { ok: false, code: 'INVALID_CONFIG_VALUE', reason: 'Config field role cannot be empty' };
+            try {
+                const parsed = JSON.parse(raw);
+                if (typeof parsed === 'string')
+                    value = parsed;
+                else if (parsed === null)
+                    return { ok: false, code: 'INVALID_CONFIG_VALUE', reason: 'config set role requires a role ID; use config unset role to revoke it' };
+                else
+                    return { ok: false, code: 'INVALID_CONFIG_VALUE', reason: 'Config field role must be a role ID or null' };
+            }
+            catch {
+                value = raw;
+            }
+        }
         else if (fieldRule.class === 'safe-scalar') {
             const parsedValue = parseConfigFieldValue(field, rawValue);
             if (!parsedValue.ok)

package/dist/config-store.js

@@ -58,7 +58,7 @@ export function loadDaemonConfig() {
     return validateDaemonConfig(normalizeProcessConfigCompat(normalizeDaemonServices(sanitized)), false);
 }
 export function isFullAccessEnabled(config = loadDaemonConfig()) {
-    return config.fullaccess?.enabled === true;
+    return config.fullaccess?.enabled === undefined || config.fullaccess.enabled === true;
 }
 let eckSnapshotsConfigCache;
 /** Parse the process-level snapshot gate once for the current daemon lifecycle. */

package/dist/core/agent-application-service.js

@@ -48,6 +48,8 @@ function errorFrom(error, fallback = 'agent operation failed') {
  */
 export class AgentApplicationService {
     deps;
+    initialization;
+    setInitializationService(service) { this.initialization = service; }
     constructor(deps) {
         this.deps = deps;
     }
@@ -85,13 +87,14 @@ export class AgentApplicationService {
                 unique_peer_count: stats?.uniquePeerCount ?? 0,
             }
             : null;
-        const config = agent.config;
+        const config = (loadAgent(aid) ?? agent.config);
         const identity = readAgentMdIdentity(aid);
         const paths = resolvePaths();
         return {
             ok: true,
             aid,
             status: info.status || 'stopped',
+            lifecycle: config?.lifecycle ?? null,
             identity,
             config: {
                 baseagent: info.baseagent || null,
@@ -211,6 +214,8 @@ export class AgentApplicationService {
         }
         if (!config)
             return { ok: false, error: `Agent "${aid}" not found`, code: 'NOT_FOUND' };
+        if (!enabled)
+            await this.initialization?.cancel(aid);
         const previousEnabled = config.enabled;
         try {
             config.enabled = enabled;
@@ -239,6 +244,7 @@ export class AgentApplicationService {
         return { ok: true, aid, enabled, reloaded: result.ok };
     }
     async delete(aid, purge = false) {
+        await this.initialization?.cancel(aid);
         const paths = resolvePaths();
         const agentDir = path.join(paths.agentsDir, aid);
         const configPath = path.join(agentDir, 'config.json');

package/dist/core/audit/event-key.js

@@ -7,16 +7,31 @@ function stableDigest(parts) {
     const material = parts.map(part => compactPart(part) ?? '-').join('\u0000');
     return crypto.createHash('sha256').update(material).digest('hex').slice(0, 20);
 }
+/** Preserve distinct source IDs; fill aliases only when the producer omitted them. */
+export function normalizeToolCorrelation(input) {
+    const callId = compactPart(input.callId);
+    const correlationId = compactPart(input.correlationId);
+    const requestId = compactPart(input.requestId);
+    return {
+        callId: callId ?? correlationId ?? requestId,
+        correlationId: correlationId ?? callId ?? requestId,
+        requestId: requestId ?? callId ?? correlationId,
+    };
+}
 /** Stable across source/mirror records for one tool-call lifecycle. */
 export function buildToolLifecycleEventKey(input) {
+    const { callId } = normalizeToolCorrelation(input);
+    // No source ID means no safe join. Never merge unrelated anonymous calls.
+    if (!callId)
+        return `tool:unlinked:${crypto.randomUUID()}`;
     return `tool:${stableDigest([
         input.sessionId ?? 'unknown',
-        input.callId ?? input.correlationId ?? input.requestId ?? 'unknown',
+        callId,
     ])}`;
 }
 /** Stable across repeated projections of one authorization decision. */
 export function buildAuthorizationEventKey(input) {
-    const lifecycleId = input.callId ?? input.correlationId ?? input.requestId;
+    const lifecycleId = normalizeToolCorrelation(input).callId;
     if (lifecycleId) {
         return `${buildToolLifecycleEventKey({
             sessionId: input.sessionId,

package/dist/core/audit/log-integrity.js

@@ -1,6 +1,7 @@
 import crypto from 'node:crypto';
 import fs from 'node:fs';
 import path from 'node:path';
+import { buildToolLifecycleEventKey, normalizeToolCorrelation } from './event-key.js';
 // Logger rotation is hourly/daily, but the suffix is intentionally generic so
 // this check also covers future rotation formats without changing the audit.
 const STRUCTURED_LOG_RE = /^(?:daemon|events|channel-in|channel-out|messages|command-audit)(?:-[^.]+)?\.log$/;
@@ -33,6 +34,7 @@ export function inspectStructuredLogs(logDir, options = {}) {
             // daemon logs mix human-readable entries with structured audit lines.
             // Ignore the former, but still validate malformed structured payloads.
             if (MIXED_TEXT_LOG_RE.test(file)) {
+                raw = raw.replace(/^\[[^\]]+\] \[(?:DEBUG|INFO|WARN|ERROR)\] /, '');
                 if (raw.startsWith('[CommandAuditRecord] '))
                     raw = raw.slice('[CommandAuditRecord] '.length);
                 else if (!raw.startsWith('{'))
@@ -57,8 +59,9 @@ export function inspectStructuredLogs(logDir, options = {}) {
                 issues.push({ file, line: index + 1, reason: 'missing_agent', key });
             if (isLifecycleRecord(value) && !hasContextValue(lifecycleField(value, 'permissionMode')))
                 issues.push({ file, line: index + 1, reason: 'missing_permission_mode', key });
-            if (isCorrelatableRecord(value) && !key)
+            if (isCorrelatableRecord(value) && (!key || value.correlationMissing === true || key.startsWith('tool:unlinked:'))) {
                 issues.push({ file, line: index + 1, reason: 'missing_correlation' });
+            }
         });
     }
     const seen = new Set();
@@ -79,16 +82,33 @@ export function inspectStructuredLogs(logDir, options = {}) {
 function structuredRecordKey(value) {
     const nested = nestedRecord(value);
     const eventKey = firstDefined(value, nested, ['eventKey', 'event_key']);
-    const eventPhase = firstDefined(value, nested, ['eventPhase', 'event_phase']);
+    const eventPhase = recordPhase(value);
     if (eventKey)
         return `${String(eventKey)}${eventPhase ? `:${String(eventPhase)}` : ''}`;
+    if (isLifecycleRecord(value)) {
+        const correlation = normalizeToolCorrelation({
+            callId: firstDefined(value, nested, ['callId', 'call_id', 'toolUseId', 'tool_use_id']),
+            correlationId: firstDefined(value, nested, ['correlationId', 'correlation_id']),
+            requestId: firstDefined(value, nested, ['requestId', 'request_id']),
+        });
+        if (!correlation.callId)
+            return undefined;
+        return `${buildToolLifecycleEventKey({
+            sessionId: lifecycleField(value, 'sessionId'),
+            ...correlation,
+        })}:${eventPhase}`;
+    }
     const correlation = firstDefined(value, nested, [
         'correlationId', 'correlation_id', 'callId', 'call_id', 'toolUseId', 'tool_use_id',
         'requestId', 'request_id', 'msgId', 'operationId',
     ]);
     if (!correlation)
         return undefined;
-    return `${canonicalEventType(value)}:${String(correlation)}`;
+    return JSON.stringify([lifecycleField(value, 'sessionId'), canonicalEventType(value), correlation, eventPhase]);
+}
+function recordPhase(value) {
+    return firstDefined(value, nestedRecord(value), ['eventPhase', 'event_phase'])
+        ?? (canonicalEventType(value) === 'tool_use' ? 'use' : canonicalEventType(value) === 'tool_result' ? 'result' : undefined);
 }
 function isLifecycleRecord(value) {
     const type = canonicalEventType(value);
@@ -101,11 +121,13 @@ function isCorrelatableRecord(value) {
 }
 function stableHash(value) {
     const nested = nestedRecord(value);
-    const eventKey = firstDefined(value, nested, ['eventKey', 'event_key']);
+    const eventKey = structuredRecordKey(value);
     const canonical = {
         eventKey,
-        eventPhase: firstDefined(value, nested, ['eventPhase', 'event_phase']),
+        eventPhase: recordPhase(value),
         type: canonicalEventType(value),
+        operation: firstDefined(value, nested, ['operation']),
+        targetAgentAid: firstDefined(value, nested, ['targetAgentAid']),
         toolName: firstDefined(value, nested, ['toolName', 'tool', 'name']),
         callId: eventKey ? undefined : firstDefined(value, nested, ['callId', 'call_id', 'toolUseId', 'tool_use_id']),
         correlationId: eventKey ? undefined : firstDefined(value, nested, ['correlationId', 'correlation_id']),
@@ -116,11 +138,15 @@ function stableHash(value) {
         isError: firstDefined(value, nested, ['isError', 'is_error']) ?? (value.ok === false || nested?.ok === false ? true : undefined),
         errorCode: firstDefined(value, nested, ['errorCode', 'error_code']),
         decision: firstDefined(value, nested, ['decision']),
+        decisionSource: firstDefined(value, nested, ['decisionSource', 'decision_source']),
+        policyCode: firstDefined(value, nested, ['policyCode', 'policy_code']),
         executed: firstDefined(value, nested, ['executed']),
         executionState: firstDefined(value, nested, ['executionState', 'execution_state']),
-        input: firstDefined(value, nested, ['input']),
-        result: firstDefined(value, nested, ['result', 'content']),
-        error: firstDefined(value, nested, ['error', 'errorMessage']),
+        // A lifecycle stage may be mirrored without its large input/output body.
+        // Keep decision/classification differences, not projection payload size.
+        input: eventKey && isLifecycleRecord(value) ? undefined : firstDefined(value, nested, ['input']),
+        result: eventKey && isLifecycleRecord(value) ? undefined : firstDefined(value, nested, ['result', 'content']),
+        error: eventKey && isLifecycleRecord(value) ? undefined : firstDefined(value, nested, ['error', 'errorMessage']),
     };
     return crypto.createHash('sha256').update(JSON.stringify(canonical)).digest('hex').slice(0, 16);
 }