log-llm-config 1.4.11 → 1.5.0

package/dist/apply_deferred_vscdb.js

@@ -25,13 +25,13 @@ applyDeferredVscdbFromDisk()
         catch (e) {
             hookRunLog(`apply_deferred_vscdb: post_apply_verification error: ${e instanceof Error ? e.message : String(e)}`);
             if (complianceLogPath) {
-                await finalizeAndUploadComplianceSessionLog(complianceLogPath, 'error');
+                await finalizeAndUploadComplianceSessionLog(complianceLogPath, 'failures');
             }
         }
     }
     else if (complianceLogPath) {
         hookRunLog('apply_deferred_vscdb: apply failed');
-        await finalizeAndUploadComplianceSessionLog(complianceLogPath, 'error');
+        await finalizeAndUploadComplianceSessionLog(complianceLogPath, 'failures');
     }
     process.exit(ok ? 0 : 1);
 })

package/dist/bootstrap_constants.js

@@ -3,3 +3,13 @@
  * Used by auth, hook logging, and audit output. Do not add agent-specific paths here.
  */
 export const OPT_AI_SEC_MANAGEMENT_REL = 'opt-ai-sec/management';
+/**
+ * All hook-written log files live under this subdirectory, grouped by type
+ * (see LOG_GROUP_* below). Keeping logs in one subtree leaves the management
+ * root limited to secrets/identity/state (auth_key, organization-uuid, contracts).
+ */
+export const OPT_AI_SEC_LOGS_REL = `${OPT_AI_SEC_MANAGEMENT_REL}/logs`;
+/** Log group subdirectories under {@link OPT_AI_SEC_LOGS_REL}. */
+export const LOG_GROUP_HOOK = 'hook';
+export const LOG_GROUP_COMPLIANCE = 'compliance';
+export const LOG_GROUP_AUDIT = 'audit';

package/dist/cli.js

@@ -111,4 +111,34 @@ function parseAndSetLogUuidEnvVars() {
     if (agentArg)
         process.env.OPTIMUS_AGENT = agentArg;
 }
-void main();
+/** Map each cli command to its functional unit for failure telemetry. */
+const COMMAND_UNIT = {
+    log_uuid: 'auth_version',
+    log_config_files: 'inventory',
+    log_sensitive_paths_audit: 'inventory',
+    compliance_prompt_gate: 'compliance',
+    compliance_check_runner: 'compliance',
+    'apply-deferred-vscdb': 'compliance',
+    'execute-trusted-restarts': 'compliance',
+    dialog_prefs: 'compliance',
+};
+main().catch(async (err) => {
+    // Top-level safety net: any uncaught error in a cli command is reported as a failed
+    // FunctionalRun (awaited so the POST lands before exit), then surfaced + non-zero exit.
+    try {
+        const cmd = args[0] || '';
+        const unit = COMMAND_UNIT[cmd] || 'inventory';
+        const { reportFunctionalFailureAwait } = await import('./log_config_files/runtime/client_event_reporter.js');
+        await reportFunctionalFailureAwait(unit, cmd, err);
+    }
+    catch {
+        /* never let telemetry mask the original error */
+    }
+    console.error(err instanceof Error ? err.stack || err.message : String(err));
+    try {
+        process.exit(1);
+    }
+    catch {
+        /* process.exit may be mocked in tests */
+    }
+});

package/dist/compliance_check_runner.js

@@ -3,6 +3,7 @@ import { complianceRunnerRunnerLine, hookLogAppendSection } from './log_config_f
 import { normalizeAgentToken, runComplianceCheck, } from './log_config_files/runtime/compliance_check.js';
 import { finalizeAndUploadComplianceSessionLog, initComplianceSessionForRunner, isFinalizeComplianceSessionArgv, isInflightComplianceLogPath, parseComplianceLogArg, resolveComplianceSessionLogPath, } from './log_config_files/runtime/compliance_session_log.js';
 import { existsSync } from 'node:fs';
+import { getStoryId, flushBufferedClientEvents, reportFunctionalRun, reportFunctionalFailureAwait, } from './log_config_files/runtime/client_event_reporter.js';
 function parseAgentArg() {
     const eq = process.argv.find((a) => a.startsWith('--agent='));
     if (!eq)
@@ -24,7 +25,6 @@ function parseAgentArg() {
             complianceLogPath = initComplianceSessionForRunner(resolved);
         }
         else {
-            // Gate may have finalized+moved the session before this background runner started.
             complianceLogPath = null;
         }
     }
@@ -32,9 +32,13 @@ function parseAgentArg() {
         hookLogAppendSection('compliance_check_runner (background sync + check)');
     }
     complianceRunnerRunnerLine('compliance_check_runner: start');
+    // Background runner: opportunistically flush any telemetry the (non-blocking) gate buffered.
+    getStoryId();
+    await flushBufferedClientEvents();
     try {
         await runComplianceCheck(parseAgentArg());
         complianceRunnerRunnerLine('compliance_check_runner: finished ok');
+        await reportFunctionalRun({ unit: 'compliance', command: 'compliance_check_runner', outcome: 'ok' });
     }
     catch (err) {
         const detail = err instanceof Error ? err.stack ?? err.message : String(err);
@@ -42,8 +46,9 @@ function parseAgentArg() {
         complianceRunnerRunnerLine(`compliance_check_runner: stack_or_detail ${detail.slice(0, 4000)}`);
         process.stderr.write(`compliance_check_runner error: ${err instanceof Error ? err.message : String(err)}\n`);
         if (complianceLogPath) {
-            await finalizeAndUploadComplianceSessionLog(complianceLogPath, 'error');
+            await finalizeAndUploadComplianceSessionLog(complianceLogPath, 'failures');
         }
+        await reportFunctionalFailureAwait('compliance', 'compliance_check_runner', err);
         process.exit(1);
     }
     if (complianceLogPath) {

package/dist/compliance_prompt_gate.js

@@ -11,6 +11,7 @@ import { isRemediationQuarantined } from './log_config_files/runtime/remediation
 import { existsSync, readFileSync, statSync } from 'node:fs';
 import { getRemediationInstructionsPath } from './log_config_files/runtime/management_storage.js';
 import { hookLogSessionBanner, hookRunLog, logRemediationApplyFailure } from './log_config_files/runtime/hook_logger.js';
+import { getStoryId, bufferFunctionalRun } from './log_config_files/runtime/client_event_reporter.js';
 import { finalizeAndUploadComplianceSessionLog, initComplianceSessionForGate, parseComplianceLogArg, } from './log_config_files/runtime/compliance_session_log.js';
 import { isThisCliModule } from './cli_invocation_match.js';
 import { ensureAuthentication } from './log_config_files/auth/auth_flow.js';
@@ -188,7 +189,22 @@ async function _uploadSecondaryFile(entry) {
  * {@link isRunAsCliModule} is false and the gate must be invoked explicitly from cli.ts.
  */
 export async function runCompliancePromptGateCli() {
-    await runCompliancePromptGate().catch(() => printAllow(parseIde()));
+    getStoryId();
+    try {
+        await runCompliancePromptGate();
+        // Gate blocks prompt submit — buffer telemetry (no inline POST); the background runner flushes it.
+        bufferFunctionalRun({ unit: 'compliance', command: 'compliance_prompt_gate', outcome: 'ok' });
+    }
+    catch (err) {
+        bufferFunctionalRun({
+            unit: 'compliance',
+            command: 'compliance_prompt_gate',
+            outcome: 'failed',
+            message: err instanceof Error ? `${err.name}: ${err.message}` : String(err),
+            detail: err instanceof Error && err.stack ? err.stack : String(err),
+        });
+        printAllow(parseIde());
+    }
 }
 /** Exported for tests; runs when `dist/compliance_prompt_gate.js` is the process entry (argv[1]). */
 export async function runCompliancePromptGate() {

package/dist/log_config_files/auth/auth_flow.js

@@ -4,7 +4,7 @@ import { ensureAuthentication as ensureTofuAuthentication } from '../../tofu.js'
 import { loadEndpointBase } from '../sender/endpoint_config.js';
 import { OPT_AI_SEC_MANAGEMENT_REL } from '../../bootstrap_constants.js';
 import { hookRunLog } from '../runtime/hook_logger.js';
-const AUTH_KEY_RELATIVE_PATH = path.join(OPT_AI_SEC_MANAGEMENT_REL, 'auth_key.txt');
+const AUTH_KEY_RELATIVE_PATH = path.join(OPT_AI_SEC_MANAGEMENT_REL, 'auth', 'auth_key.txt');
 /** Ensure authentication — verify stored key or request new one via handshake. */
 async function ensureAuthentication(hardwareUuid, endpointBase) {
     const key = await ensureTofuAuthentication({

package/dist/log_config_files/auth/auth_key_store.js

@@ -1,7 +1,7 @@
 import path from 'node:path';
 import { getAuthKeyPath as getSharedAuthKeyPath, readStoredAuthKey as readSharedStoredAuthKey, } from '../../tofu.js';
 import { OPT_AI_SEC_MANAGEMENT_REL } from '../../bootstrap_constants.js';
-const AUTH_KEY_RELATIVE_PATH = path.join(OPT_AI_SEC_MANAGEMENT_REL, 'auth_key.txt');
+const AUTH_KEY_RELATIVE_PATH = path.join(OPT_AI_SEC_MANAGEMENT_REL, 'auth', 'auth_key.txt');
 const AUTH_KEY_OPTIONS = { authRelativePath: AUTH_KEY_RELATIVE_PATH };
 /** Return absolute path to auth_key.txt, or null if home dir is unavailable. */
 function getAuthKeyPath() {

package/dist/log_config_files/collection/directory_collector.js

@@ -101,7 +101,15 @@ function collectDirectoryMetadata(t) {
     try {
         const dirStat = statSync(t.path);
         const glob = t.dir_glob ?? '*';
-        const newest = findNewestMatchingFile(t.path, glob, 0, METADATA_DIR_SCAN_MAX_DEPTH);
+        // A "|"-delimited dir_glob is an ordered priority list: use the newest match of the FIRST
+        // glob that matches anything, so e.g. "**/*.jsonl|**/*" prefers a session transcript
+        // (events.jsonl) over any other session-state file — even when a non-jsonl file is newer.
+        let newest = null;
+        for (const g of glob.split('|')) {
+            newest = findNewestMatchingFile(t.path, g, 0, METADATA_DIR_SCAN_MAX_DEPTH);
+            if (newest)
+                break;
+        }
         const bestPath = newest?.path ?? t.path;
         const bestMtime = newest?.mtime ?? dirStat.mtime;
         return {

package/dist/log_config_files/runtime/client_event_reporter.js

@@ -0,0 +1,337 @@
+/**
+ * Fire-and-forget client telemetry → POST /endpoint_security/api/client-event/.
+ *
+ * Reports HookRun / FunctionalRun / Flow so the backend has visibility into what ran and
+ * what failed — even when a unit fails locally before any happy-path object exists.
+ *
+ * Guarantees the event is never lost AND never breaks the hook:
+ * - All calls are best-effort and never throw.
+ * - On send failure (backend down / network / no auth) the event is appended to a durable
+ *   JSONL buffer and flushed on the next successful send (atomic-rename claim, like tool-call).
+ * - The backend accepts uuid-keyed reports without a valid signature, so auth failures report too.
+ */
+import { existsSync, mkdirSync, appendFileSync, readFileSync, renameSync, unlinkSync, statSync } from 'node:fs';
+import path from 'node:path';
+import { randomUUID } from 'node:crypto';
+import { OPT_AI_SEC_MANAGEMENT_REL } from '../../bootstrap_constants.js';
+import { executeBody } from '../../endpoint_client/http_transport.js';
+import { loadEndpointBase } from '../sender/endpoint_config.js';
+import { createSignature } from '../sender/signing.js';
+import { readStoredAuthKey } from '../auth/auth_key_store.js';
+import { resolveHardwareUuid } from './hardware_uuid.js';
+import { buildLogMetadataObject } from './log_metadata.js';
+const CLIENT_EVENT_PATH = '/endpoint_security/api/client-event/';
+const SEND_TIMEOUT_MS = 4000;
+const BUFFER_BASENAME = 'client_events.jsonl';
+const MAX_BUFFER_BYTES = 1 * 1024 * 1024;
+const MAX_FLUSH_EVENTS = 50;
+function bufferPath() {
+    const home = process.env.HOME || process.env.USERPROFILE;
+    if (!home)
+        return null;
+    return path.join(home, OPT_AI_SEC_MANAGEMENT_REL, 'telemetry', BUFFER_BASENAME);
+}
+/** File start-every-prompt overwrites each submit with this prompt's story id (short-lived handoff). */
+function storyFilePath() {
+    const home = process.env.HOME || process.env.USERPROFILE;
+    if (!home)
+        return null;
+    return path.join(home, OPT_AI_SEC_MANAGEMENT_REL, 'telemetry', 'current_story.id');
+}
+/** Match shell OPTIMUS_STORY_FILE_MAX_AGE_SEC — ignore stale ids from a prior prompt. */
+const STORY_FILE_MAX_AGE_MS = 180_000;
+function readStoryIdFromFileIfFresh(filePath) {
+    try {
+        const st = statSync(filePath);
+        if (Date.now() - st.mtimeMs > STORY_FILE_MAX_AGE_MS)
+            return null;
+        const fromFile = readFileSync(filePath, 'utf8').trim();
+        return fromFile || null;
+    }
+    catch {
+        return null;
+    }
+}
+/** Map a functional unit to the shell hook that runs it (every npm command belongs to one hook). */
+const UNIT_HOOK = {
+    inventory: 'start_every_prompt',
+    auth_version: 'start_every_prompt',
+    compliance: 'compliance_check',
+    tool_call: 'tool_call',
+    install: 'install',
+};
+/**
+ * story_id groups all hooks + npm of one prompt submit. Resolution order:
+ *   1. OPTIMUS_STORY_ID env (when the hook successfully exported it), then
+ *   2. current_story.id if mtime is fresh (same temp handoff the shell hooks use), then
+ *   3. a fresh id (standalone / manually-run command).
+ * Cached on the env for the rest of this process.
+ */
+export function getStoryId() {
+    const fromEnv = (process.env.OPTIMUS_STORY_ID || '').trim();
+    if (fromEnv)
+        return fromEnv;
+    const p = storyFilePath();
+    if (p) {
+        const fromFile = readStoryIdFromFileIfFresh(p);
+        if (fromFile) {
+            process.env.OPTIMUS_STORY_ID = fromFile;
+            return fromFile;
+        }
+    }
+    const id = randomUUID();
+    process.env.OPTIMUS_STORY_ID = id;
+    return id;
+}
+/** The shell hook this process runs under: env, else derived from the unit. */
+function resolveHookName(unit) {
+    const fromEnv = (process.env.OPTIMUS_HOOK_NAME || '').trim();
+    if (fromEnv)
+        return fromEnv;
+    if (unit && UNIT_HOOK[unit])
+        return UNIT_HOOK[unit];
+    return '';
+}
+/** File written by optimus_hook_begin for this hook invocation (gate + runner share it). */
+function hookRunFilePath() {
+    const home = process.env.HOME || process.env.USERPROFILE;
+    if (!home)
+        return null;
+    return path.join(home, OPT_AI_SEC_MANAGEMENT_REL, 'telemetry', 'current_hook_run.id');
+}
+/**
+ * hook_run_id: one uuid per shell hook invocation.
+ *   1. OPTIMUS_HOOK_RUN_ID env
+ *   2. current_hook_run.id (same hook process tree)
+ *   3. `${story_id}::${hook_name}` legacy fallback only
+ */
+export function getHookRunId(unit) {
+    const fromEnv = (process.env.OPTIMUS_HOOK_RUN_ID || '').trim();
+    if (fromEnv)
+        return fromEnv;
+    const hp = hookRunFilePath();
+    if (hp) {
+        try {
+            const fromFile = readFileSync(hp, 'utf8').trim();
+            if (fromFile) {
+                process.env.OPTIMUS_HOOK_RUN_ID = fromFile;
+                return fromFile;
+            }
+        }
+        catch {
+            // fall through
+        }
+    }
+    const hook = resolveHookName(unit);
+    return hook ? `${getStoryId()}::${hook}` : getStoryId();
+}
+function agentFromEnv() {
+    const v = (process.env.OPTIMUS_AGENT || process.env.OPTIMUS_HOOK_TYPE || '').trim().toLowerCase();
+    return v || 'unknown';
+}
+function enrich(kind, fields, unit) {
+    return {
+        kind,
+        story_id: fields.story_id ?? getStoryId(),
+        hook_run_id: fields.hook_run_id ?? getHookRunId(unit),
+        outcome: fields.outcome,
+        exit_code: fields.exit_code ?? null,
+        message: fields.message ?? '',
+        detail: fields.detail ?? '',
+        metadata: { ...buildLogMetadataObject(), ...(fields.metadata ?? {}) },
+    };
+}
+function appendToBuffer(events) {
+    const p = bufferPath();
+    if (!p)
+        return;
+    try {
+        const dir = path.dirname(p);
+        if (!existsSync(dir))
+            mkdirSync(dir, { recursive: true, mode: 0o700 });
+        if (existsSync(p) && statSync(p).size > MAX_BUFFER_BYTES)
+            return; // cap; drop rather than grow unbounded
+        appendFileSync(p, events.map((e) => JSON.stringify(e)).join('\n') + '\n', 'utf8');
+    }
+    catch {
+        // best-effort
+    }
+}
+/** Atomically claim + read buffered events so a concurrent hook won't double-send. */
+function claimBufferedEvents() {
+    const p = bufferPath();
+    if (!p || !existsSync(p))
+        return [];
+    const claimed = `${p}.sending.${process.pid}`;
+    try {
+        renameSync(p, claimed);
+    }
+    catch {
+        return [];
+    }
+    try {
+        const lines = readFileSync(claimed, 'utf8').split('\n').filter((l) => l.trim());
+        unlinkSync(claimed);
+        return lines
+            .slice(0, MAX_FLUSH_EVENTS)
+            .map((l) => {
+            try {
+                return JSON.parse(l);
+            }
+            catch {
+                return null;
+            }
+        })
+            .filter((e) => e !== null);
+    }
+    catch {
+        return [];
+    }
+}
+async function postEvents(events) {
+    if (events.length === 0)
+        return true;
+    let hardwareUuid;
+    try {
+        hardwareUuid = resolveHardwareUuid();
+    }
+    catch {
+        return false;
+    }
+    const base = loadEndpointBase().replace(/\/+$/, '');
+    const url = `${base}${CLIENT_EVENT_PATH}`;
+    const signingPayload = { hardware_uuid: hardwareUuid, events };
+    let signature = '';
+    try {
+        const authKey = readStoredAuthKey();
+        if (authKey?.key)
+            signature = createSignature(signingPayload, authKey.key);
+    }
+    catch {
+        // unsigned is fine — backend stores signature_valid=false and still records
+    }
+    const body = JSON.stringify({ ...signingPayload, signature });
+    try {
+        const res = await executeBody(url, 'POST', body, SEND_TIMEOUT_MS);
+        return res.statusCode >= 200 && res.statusCode < 300;
+    }
+    catch {
+        return false;
+    }
+}
+/** Core: send these events + opportunistically flush the buffer; buffer on failure. Never throws. */
+async function send(events) {
+    try {
+        const buffered = claimBufferedEvents();
+        const all = [...buffered, ...events];
+        const ok = await postEvents(all);
+        if (!ok)
+            appendToBuffer(all);
+    }
+    catch {
+        appendToBuffer(events);
+    }
+}
+/**
+ * Each report* returns the send promise but never rejects. Callers on a hot path ignore it
+ * (fire-and-forget); callers on a process-exit path `await` it so the POST lands before exit.
+ */
+export function reportHookRun(fields) {
+    try {
+        const hook_name = fields.hook_name;
+        return send([
+            {
+                ...enrich('hook_run', { ...fields, hook_run_id: fields.hook_run_id ?? getHookRunId(undefined) }),
+                agent: fields.agent ?? agentFromEnv(),
+                hook_name,
+            },
+        ]);
+    }
+    catch {
+        return Promise.resolve();
+    }
+}
+export function reportFunctionalRun(fields) {
+    try {
+        return send([
+            {
+                ...enrich('functional_run', fields, fields.unit),
+                unit: fields.unit,
+                command: fields.command ?? '',
+                hook_name: fields.hook_name ?? resolveHookName(fields.unit),
+                log_text: fields.log_text ?? '',
+            },
+        ]);
+    }
+    catch {
+        return Promise.resolve();
+    }
+}
+/**
+ * Append a functional run to the durable buffer WITHOUT an inline POST. For latency-critical
+ * paths (the compliance gate blocks prompt submit) — the next background run flushes it.
+ */
+export function bufferFunctionalRun(fields) {
+    try {
+        appendToBuffer([
+            {
+                ...enrich('functional_run', fields, fields.unit),
+                unit: fields.unit,
+                command: fields.command ?? '',
+                hook_name: fields.hook_name ?? resolveHookName(fields.unit),
+                log_text: fields.log_text ?? '',
+            },
+        ]);
+    }
+    catch {
+        /* never throw */
+    }
+}
+/** Convenience for catch blocks: report a functional-unit failure with stack. */
+export function reportFunctionalFailure(unit, command, err, extra) {
+    const message = extra?.message ?? (err instanceof Error ? `${err.name}: ${err.message}` : String(err));
+    const detail = err instanceof Error && err.stack ? err.stack : String(err);
+    reportFunctionalRun({
+        unit,
+        command,
+        outcome: 'failed',
+        message,
+        detail,
+        exit_code: extra?.exit_code ?? null,
+    });
+}
+/**
+ * Awaitable failure report for the fatal-exit path (so the POST completes before process.exit).
+ * Falls back to the durable buffer if the send fails. Never throws.
+ */
+export async function reportFunctionalFailureAwait(unit, command, err, extra) {
+    try {
+        const message = extra?.message ?? (err instanceof Error ? `${err.name}: ${err.message}` : String(err));
+        const detail = err instanceof Error && err.stack ? err.stack : String(err);
+        const event = {
+            ...enrich('functional_run', { outcome: 'failed', message, detail, exit_code: extra?.exit_code ?? null }, unit),
+            unit,
+            command,
+            hook_name: resolveHookName(unit),
+            log_text: '',
+        };
+        await send([event]);
+    }
+    catch {
+        /* never throw on the exit path */
+    }
+}
+/** Flush any buffered events (call opportunistically at the start of a run). Never throws. */
+export async function flushBufferedClientEvents() {
+    try {
+        const buffered = claimBufferedEvents();
+        if (buffered.length === 0)
+            return;
+        const ok = await postEvents(buffered);
+        if (!ok)
+            appendToBuffer(buffered);
+    }
+    catch {
+        /* best-effort */
+    }
+}

package/dist/log_config_files/runtime/compliance_session_log.js

@@ -1,13 +1,16 @@
 import { existsSync, mkdirSync, readdirSync, renameSync, statSync, unlinkSync, writeFileSync, appendFileSync, readFileSync, } from 'node:fs';
 import path from 'node:path';
 import { homedir } from 'node:os';
-import { OPT_AI_SEC_MANAGEMENT_REL } from '../../bootstrap_constants.js';
-const COMPLIANCE_SUBDIR = 'compliance';
+import { OPT_AI_SEC_LOGS_REL, LOG_GROUP_COMPLIANCE } from '../../bootstrap_constants.js';
+import { buildLogMetadataBlock } from './log_metadata.js';
+const COMPLIANCE_SUBDIR = LOG_GROUP_COMPLIANCE;
 const TIER_NOOP = 'noop';
 const TIER_SUCCESS = 'success';
-const TIER_ERROR = 'error';
+const TIER_FAILURES = 'failures';
 const TIER_IN_PROCESS = 'in_process';
-const TIER_DIRS = [TIER_NOOP, TIER_SUCCESS, TIER_ERROR];
+const TIER_DIRS = [TIER_NOOP, TIER_SUCCESS, TIER_FAILURES];
+/** Server upload contract still uses "error" for failed remediation sessions. */
+const UPLOAD_OUTCOME_ERROR = 'error';
 const NOOP_MAX_AGE_MS = 30 * 60 * 1000;
 const SUCCESS_ERROR_MAX_AGE_MS = 24 * 60 * 60 * 1000;
 /** In-flight logs in compliance/in_process/ before finalize. */
@@ -32,7 +35,7 @@ export function isFinalizeComplianceSessionArgv(argv) {
     return argv.includes('--finalize-compliance-session');
 }
 export function getComplianceLogDir() {
-    return path.join(homedir(), OPT_AI_SEC_MANAGEMENT_REL, COMPLIANCE_SUBDIR);
+    return path.join(homedir(), OPT_AI_SEC_LOGS_REL, COMPLIANCE_SUBDIR);
 }
 export function getActiveComplianceLogPath() {
     return activeComplianceLogPath;
@@ -109,7 +112,7 @@ export function pruneComplianceSessionLogs(exceptPath) {
     let removed = 0;
     removed += pruneLogFilesInDir(path.join(base, TIER_NOOP), NOOP_MAX_AGE_MS, keep);
     removed += pruneLogFilesInDir(path.join(base, TIER_SUCCESS), SUCCESS_ERROR_MAX_AGE_MS, keep);
-    removed += pruneLogFilesInDir(path.join(base, TIER_ERROR), SUCCESS_ERROR_MAX_AGE_MS, keep);
+    removed += pruneLogFilesInDir(path.join(base, TIER_FAILURES), SUCCESS_ERROR_MAX_AGE_MS, keep);
     removed += pruneLogFilesInDir(path.join(base, TIER_IN_PROCESS), INFLIGHT_MAX_AGE_MS, keep);
     if (!existsSync(base))
         return removed;
@@ -137,7 +140,7 @@ export function pruneComplianceSessionLogs(exceptPath) {
 /**
  * Classify a compliance session for finalize + optional server upload.
  *
- * Only two outcomes are uploaded (success / error): remediation **succeeded** or **failed**.
+ * Only two outcomes are uploaded (success / error on the wire): remediation **succeeded** or **failed**.
  * Policy violations, in-flight restart, and sync-only sessions are noop (local retention only).
  */
 export function classifyComplianceSessionLog(content) {
@@ -155,7 +158,7 @@ export function classifyComplianceSessionLog(content) {
         /enforceRemediation.*failed/i,
     ];
     if (remediationFailedPatterns.some((p) => p.test(text))) {
-        return TIER_ERROR;
+        return TIER_FAILURES;
     }
     return TIER_NOOP;
 }
@@ -212,7 +215,7 @@ export function complianceLogSessionBanner(logPath, label, mode) {
         if (!existsSync(dir))
             mkdirSync(dir, { recursive: true, mode: 0o700 });
         if (mode === 'replace') {
-            writeFileSync(resolved, banner, 'utf8');
+            writeFileSync(resolved, banner + buildLogMetadataBlock(), 'utf8');
         }
         else {
             appendFileSync(resolved, banner, 'utf8');
@@ -235,7 +238,7 @@ export function initComplianceSessionForGate(logPath) {
         writeLatestPointer(resolved);
     }
     if (removed > 0) {
-        appendComplianceLine(resolved, `${new Date().toISOString()} compliance_session: pruned ${removed} log(s) (in_process 2h, noop 30m, success/error 24h)\n`);
+        appendComplianceLine(resolved, `${new Date().toISOString()} compliance_session: pruned ${removed} log(s) (in_process 2h, noop 30m, success/failures 24h)\n`);
     }
     return resolved;
 }
@@ -247,12 +250,12 @@ export function initComplianceSessionForRunner(logPath) {
     setActiveComplianceLogPath(resolved);
     complianceLogSessionBanner(resolved, 'compliance_check_runner (background sync + check)', 'append');
     if (removed > 0) {
-        appendComplianceLine(resolved, `${new Date().toISOString()} compliance_session: pruned ${removed} log(s) (in_process 2h, noop 30m, success/error 24h)\n`);
+        appendComplianceLine(resolved, `${new Date().toISOString()} compliance_session: pruned ${removed} log(s) (in_process 2h, noop 30m, success/failures 24h)\n`);
     }
     return resolved;
 }
 /**
- * Move session log from compliance/ root into noop|success|error/ and prune tiers.
+ * Move session log from compliance/ root into noop|success|failures/ and prune tiers.
  * No-op if file missing or already finalized.
  */
 export function finalizeComplianceSessionLog(logPath, forcedTier) {
@@ -263,6 +266,9 @@ export function finalizeComplianceSessionLog(logPath, forcedTier) {
     if (isTierDirName(parentName)) {
         return { tier: parentName, logPath: resolved, moved: false };
     }
+    if (parentName === 'error') {
+        return { tier: TIER_FAILURES, logPath: resolved, moved: false };
+    }
     const content = readFileSync(resolved, 'utf8');
     if (isRemediationCycleInflight(content)) {
         return null;
@@ -310,10 +316,10 @@ function appendLineToSessionLogFile(logPath, message) {
     }
 }
 /**
- * Upload full session log to the server (success and error tiers only, first finalize only).
+ * Upload full session log to the server (success and failures tiers only, first finalize only).
  */
 export async function uploadComplianceSessionLogFromFinalize(result) {
-    if (result.tier !== TIER_SUCCESS && result.tier !== TIER_ERROR)
+    if (result.tier !== TIER_SUCCESS && result.tier !== TIER_FAILURES)
         return;
     if (!result.moved)
         return;
@@ -338,7 +344,7 @@ export async function uploadComplianceSessionLogFromFinalize(result) {
         return;
     }
     const sessionFilename = path.basename(result.logPath);
-    const outcome = result.tier;
+    const outcome = result.tier === TIER_FAILURES ? UPLOAD_OUTCOME_ERROR : result.tier;
     const signingPayload = {
         hardware_uuid: hardwareUuid,
         outcome,
@@ -362,7 +368,7 @@ export async function uploadComplianceSessionLogFromFinalize(result) {
         appendLineToSessionLogFile(result.logPath, `compliance_session_upload: failed ${msg}`);
     }
 }
-/** Finalize session file into success|error|noop tier, then upload when success or error. */
+/** Finalize session file into success|failures|noop tier, then upload when success or failures. */
 export async function finalizeAndUploadComplianceSessionLog(logPath, forcedTier) {
     const result = finalizeComplianceSessionLog(logPath, forcedTier);
     if (result) {