log-llm-config 1.4.12 → 1.5.2

package/dist/log_config_files/runtime/client_event_reporter.js

@@ -0,0 +1,347 @@
+/**
+ * Fire-and-forget client telemetry → POST /endpoint_security/api/client-event/.
+ *
+ * Reports HookRun / FunctionalRun / Flow so the backend has visibility into what ran and
+ * what failed — even when a unit fails locally before any happy-path object exists.
+ *
+ * Guarantees the event is never lost AND never breaks the hook:
+ * - All calls are best-effort and never throw.
+ * - On send failure (backend down / network / no auth) the event is appended to a durable
+ *   JSONL buffer and flushed on the next successful send (atomic-rename claim, like tool-call).
+ * - The backend accepts uuid-keyed reports without a valid signature, so auth failures report too.
+ */
+import { existsSync, mkdirSync, appendFileSync, readFileSync, renameSync, unlinkSync, statSync } from 'node:fs';
+import path from 'node:path';
+import { randomUUID } from 'node:crypto';
+import { OPT_AI_SEC_MANAGEMENT_REL } from '../../bootstrap_constants.js';
+import { executeBody } from '../../endpoint_client/http_transport.js';
+import { loadEndpointBase } from '../sender/endpoint_config.js';
+import { createSignature } from '../sender/signing.js';
+import { readStoredAuthKey } from '../auth/auth_key_store.js';
+import { resolveHardwareUuid } from './hardware_uuid.js';
+import { buildLogMetadataObject } from './log_metadata.js';
+const CLIENT_EVENT_PATH = '/endpoint_security/api/client-event/';
+const SEND_TIMEOUT_MS = 4000;
+const BUFFER_BASENAME = 'client_events.jsonl';
+const MAX_BUFFER_BYTES = 1 * 1024 * 1024;
+const MAX_FLUSH_EVENTS = 50;
+function bufferPath() {
+    const home = process.env.HOME || process.env.USERPROFILE;
+    if (!home)
+        return null;
+    return path.join(home, OPT_AI_SEC_MANAGEMENT_REL, 'telemetry', BUFFER_BASENAME);
+}
+/** Keep filename-safe chars only — must match optimus_sanitize_id in optimus-hook-common.sh. */
+function sanitizeId(v) {
+    return v.replace(/[^A-Za-z0-9._-]/g, '');
+}
+/** File start-every-prompt overwrites each submit with this prompt's story id (short-lived handoff). */
+function storyFilePath() {
+    const home = process.env.HOME || process.env.USERPROFILE;
+    if (!home)
+        return null;
+    const telemetryDir = path.join(home, OPT_AI_SEC_MANAGEMENT_REL, 'telemetry');
+    const session = sanitizeId((process.env.OPTIMUS_SESSION_ID || '').trim());
+    if (session) {
+        const agent = sanitizeId((process.env.OPTIMUS_HOOK_TYPE || process.env.OPTIMUS_AGENT || 'claude').trim()) || 'claude';
+        return path.join(telemetryDir, `current_story.${agent}.${session}.id`);
+    }
+    return path.join(telemetryDir, 'current_story.id');
+}
+/** Match shell OPTIMUS_STORY_FILE_MAX_AGE_SEC — ignore stale ids from a prior prompt. */
+const STORY_FILE_MAX_AGE_MS = 180_000;
+function readStoryIdFromFileIfFresh(filePath) {
+    try {
+        const st = statSync(filePath);
+        if (Date.now() - st.mtimeMs > STORY_FILE_MAX_AGE_MS)
+            return null;
+        const fromFile = readFileSync(filePath, 'utf8').trim();
+        return fromFile || null;
+    }
+    catch {
+        return null;
+    }
+}
+/** Map a functional unit to the shell hook that runs it (every npm command belongs to one hook). */
+const UNIT_HOOK = {
+    inventory: 'start_every_prompt',
+    auth_version: 'start_every_prompt',
+    compliance: 'compliance_check',
+    tool_call: 'tool_call',
+    install: 'install',
+};
+/**
+ * story_id groups all hooks + npm of one prompt submit. Resolution order:
+ *   1. OPTIMUS_STORY_ID env (when the hook successfully exported it), then
+ *   2. current_story.id if mtime is fresh (same temp handoff the shell hooks use), then
+ *   3. a fresh id (standalone / manually-run command).
+ * Cached on the env for the rest of this process.
+ */
+export function getStoryId() {
+    const fromEnv = (process.env.OPTIMUS_STORY_ID || '').trim();
+    if (fromEnv)
+        return fromEnv;
+    const p = storyFilePath();
+    if (p) {
+        const fromFile = readStoryIdFromFileIfFresh(p);
+        if (fromFile) {
+            process.env.OPTIMUS_STORY_ID = fromFile;
+            return fromFile;
+        }
+    }
+    const id = randomUUID();
+    process.env.OPTIMUS_STORY_ID = id;
+    return id;
+}
+/** The shell hook this process runs under: env, else derived from the unit. */
+function resolveHookName(unit) {
+    const fromEnv = (process.env.OPTIMUS_HOOK_NAME || '').trim();
+    if (fromEnv)
+        return fromEnv;
+    if (unit && UNIT_HOOK[unit])
+        return UNIT_HOOK[unit];
+    return '';
+}
+/** File written by optimus_hook_begin for this hook invocation (gate + runner share it). */
+function hookRunFilePath() {
+    const home = process.env.HOME || process.env.USERPROFILE;
+    if (!home)
+        return null;
+    return path.join(home, OPT_AI_SEC_MANAGEMENT_REL, 'telemetry', 'current_hook_run.id');
+}
+/**
+ * hook_run_id: one uuid per shell hook invocation.
+ *   1. OPTIMUS_HOOK_RUN_ID env
+ *   2. current_hook_run.id (same hook process tree)
+ *   3. `${story_id}::${hook_name}` legacy fallback only
+ */
+export function getHookRunId(unit) {
+    const fromEnv = (process.env.OPTIMUS_HOOK_RUN_ID || '').trim();
+    if (fromEnv)
+        return fromEnv;
+    const hp = hookRunFilePath();
+    if (hp) {
+        try {
+            const fromFile = readFileSync(hp, 'utf8').trim();
+            if (fromFile) {
+                process.env.OPTIMUS_HOOK_RUN_ID = fromFile;
+                return fromFile;
+            }
+        }
+        catch {
+            // fall through
+        }
+    }
+    const hook = resolveHookName(unit);
+    return hook ? `${getStoryId()}::${hook}` : getStoryId();
+}
+function agentFromEnv() {
+    const v = (process.env.OPTIMUS_AGENT || process.env.OPTIMUS_HOOK_TYPE || '').trim().toLowerCase();
+    return v || 'unknown';
+}
+function enrich(kind, fields, unit) {
+    return {
+        kind,
+        story_id: fields.story_id ?? getStoryId(),
+        hook_run_id: fields.hook_run_id ?? getHookRunId(unit),
+        outcome: fields.outcome,
+        exit_code: fields.exit_code ?? null,
+        message: fields.message ?? '',
+        detail: fields.detail ?? '',
+        metadata: { ...buildLogMetadataObject(), ...(fields.metadata ?? {}) },
+    };
+}
+function appendToBuffer(events) {
+    const p = bufferPath();
+    if (!p)
+        return;
+    try {
+        const dir = path.dirname(p);
+        if (!existsSync(dir))
+            mkdirSync(dir, { recursive: true, mode: 0o700 });
+        if (existsSync(p) && statSync(p).size > MAX_BUFFER_BYTES)
+            return; // cap; drop rather than grow unbounded
+        appendFileSync(p, events.map((e) => JSON.stringify(e)).join('\n') + '\n', 'utf8');
+    }
+    catch {
+        // best-effort
+    }
+}
+/** Atomically claim + read buffered events so a concurrent hook won't double-send. */
+function claimBufferedEvents() {
+    const p = bufferPath();
+    if (!p || !existsSync(p))
+        return [];
+    const claimed = `${p}.sending.${process.pid}`;
+    try {
+        renameSync(p, claimed);
+    }
+    catch {
+        return [];
+    }
+    try {
+        const lines = readFileSync(claimed, 'utf8').split('\n').filter((l) => l.trim());
+        unlinkSync(claimed);
+        return lines
+            .slice(0, MAX_FLUSH_EVENTS)
+            .map((l) => {
+            try {
+                return JSON.parse(l);
+            }
+            catch {
+                return null;
+            }
+        })
+            .filter((e) => e !== null);
+    }
+    catch {
+        return [];
+    }
+}
+async function postEvents(events) {
+    if (events.length === 0)
+        return true;
+    let hardwareUuid;
+    try {
+        hardwareUuid = resolveHardwareUuid();
+    }
+    catch {
+        return false;
+    }
+    const base = loadEndpointBase().replace(/\/+$/, '');
+    const url = `${base}${CLIENT_EVENT_PATH}`;
+    const signingPayload = { hardware_uuid: hardwareUuid, events };
+    let signature = '';
+    try {
+        const authKey = readStoredAuthKey();
+        if (authKey?.key)
+            signature = createSignature(signingPayload, authKey.key);
+    }
+    catch {
+        // unsigned is fine — backend stores signature_valid=false and still records
+    }
+    const body = JSON.stringify({ ...signingPayload, signature });
+    try {
+        const res = await executeBody(url, 'POST', body, SEND_TIMEOUT_MS);
+        return res.statusCode >= 200 && res.statusCode < 300;
+    }
+    catch {
+        return false;
+    }
+}
+/** Core: send these events + opportunistically flush the buffer; buffer on failure. Never throws. */
+async function send(events) {
+    try {
+        const buffered = claimBufferedEvents();
+        const all = [...buffered, ...events];
+        const ok = await postEvents(all);
+        if (!ok)
+            appendToBuffer(all);
+    }
+    catch {
+        appendToBuffer(events);
+    }
+}
+/**
+ * Each report* returns the send promise but never rejects. Callers on a hot path ignore it
+ * (fire-and-forget); callers on a process-exit path `await` it so the POST lands before exit.
+ */
+export function reportHookRun(fields) {
+    try {
+        const hook_name = fields.hook_name;
+        return send([
+            {
+                ...enrich('hook_run', { ...fields, hook_run_id: fields.hook_run_id ?? getHookRunId(undefined) }),
+                agent: fields.agent ?? agentFromEnv(),
+                hook_name,
+            },
+        ]);
+    }
+    catch {
+        return Promise.resolve();
+    }
+}
+export function reportFunctionalRun(fields) {
+    try {
+        return send([
+            {
+                ...enrich('functional_run', fields, fields.unit),
+                unit: fields.unit,
+                command: fields.command ?? '',
+                hook_name: fields.hook_name ?? resolveHookName(fields.unit),
+                log_text: fields.log_text ?? '',
+            },
+        ]);
+    }
+    catch {
+        return Promise.resolve();
+    }
+}
+/**
+ * Append a functional run to the durable buffer WITHOUT an inline POST. For latency-critical
+ * paths (the compliance gate blocks prompt submit) — the next background run flushes it.
+ */
+export function bufferFunctionalRun(fields) {
+    try {
+        appendToBuffer([
+            {
+                ...enrich('functional_run', fields, fields.unit),
+                unit: fields.unit,
+                command: fields.command ?? '',
+                hook_name: fields.hook_name ?? resolveHookName(fields.unit),
+                log_text: fields.log_text ?? '',
+            },
+        ]);
+    }
+    catch {
+        /* never throw */
+    }
+}
+/** Convenience for catch blocks: report a functional-unit failure with stack. */
+export function reportFunctionalFailure(unit, command, err, extra) {
+    const message = extra?.message ?? (err instanceof Error ? `${err.name}: ${err.message}` : String(err));
+    const detail = err instanceof Error && err.stack ? err.stack : String(err);
+    reportFunctionalRun({
+        unit,
+        command,
+        outcome: 'failed',
+        message,
+        detail,
+        exit_code: extra?.exit_code ?? null,
+    });
+}
+/**
+ * Awaitable failure report for the fatal-exit path (so the POST completes before process.exit).
+ * Falls back to the durable buffer if the send fails. Never throws.
+ */
+export async function reportFunctionalFailureAwait(unit, command, err, extra) {
+    try {
+        const message = extra?.message ?? (err instanceof Error ? `${err.name}: ${err.message}` : String(err));
+        const detail = err instanceof Error && err.stack ? err.stack : String(err);
+        const event = {
+            ...enrich('functional_run', { outcome: 'failed', message, detail, exit_code: extra?.exit_code ?? null }, unit),
+            unit,
+            command,
+            hook_name: resolveHookName(unit),
+            log_text: '',
+        };
+        await send([event]);
+    }
+    catch {
+        /* never throw on the exit path */
+    }
+}
+/** Flush any buffered events (call opportunistically at the start of a run). Never throws. */
+export async function flushBufferedClientEvents() {
+    try {
+        const buffered = claimBufferedEvents();
+        if (buffered.length === 0)
+            return;
+        const ok = await postEvents(buffered);
+        if (!ok)
+            appendToBuffer(buffered);
+    }
+    catch {
+        /* best-effort */
+    }
+}

package/dist/log_config_files/runtime/compliance_check.js

@@ -16,14 +16,14 @@ import { join } from 'node:path';
 import { parseJsonWithJsoncFallback } from '../readers/file_readers.js';
 import { mergeComposerShadowKeysFromReactiveBlob, readVscdbItemTableJson, } from '../readers/vscdb_reader.js';
 import { readRemediationInstructionsFile, writeRemediationInstructionsFile, } from './management_storage.js';
-import { resolveRemediationConfigPath } from './remediation_config_path.js';
+import { resolveRemediationConfigPath, resolveRemediationUploadFileType } from './remediation_config_path.js';
 import { resolveOpsTargetPath } from './ops_target_path.js';
 import { isRemediationQuarantined, markRemediationApplyPendingVerification, markRemediationApplyVerified, processPendingPostRestartVerifications, readRemediationApplyTrackingFile, writeRemediationApplyTrackingFile, } from './remediation_apply_tracking.js';
 import { complianceRunnerDiag, hookRunLog, logRemediationApplyFailure } from './hook_logger.js';
 import { isEnvBackedSecretValue, scanJsonForHardcodedSecrets, } from './secret_regex_scan.js';
 import { loadEndpointBase } from '../sender/endpoint_config.js';
 import { resolveHardwareUuid, tryResolveHardwareUuid } from './hardware_uuid.js';
-import { buildDeferredCursorRestartCommand, discoverAllWorkspaceVscdbs, enforceRemediation, fetchSync, isTrustedRestartCommandForAutofix, remediationFixSpec, reportAutofixApplied, syncRemediations, } from './remediation_sync.js';
+import { buildDeferredCursorRestartCommand, discoverAllWorkspaceVscdbs, enforceRemediation, fetchSync, globalCursorIgnoreListFromSettings, GLOBAL_CURSOR_IGNORE_SETTING_PATH, isTrustedRestartCommandForAutofix, remediationFixSpec, reportAutofixApplied, syncRemediations, } from './remediation_sync.js';
 import { sendConfigFile } from '../sender/batch_sender.js';
 import { ensureAuthentication } from '../auth/auth_flow.js';
 /** Normalize manifest/env/CLI agent tokens to a known Agent, or '' if unrecognized. */
@@ -220,6 +220,16 @@ function violationFromSecretScanFinding(entry, compliance, finding) {
         message: `[${compliance.finding_formatted_id}] ${entry.finding_title ?? compliance.description}\nDescription: ${entry.finding_description ?? compliance.description}\nHow to fix: Remove the hardcoded ${finding.secretType} from ${finding.path} in ${entry.config_file_path}`,
     };
 }
+function currentArrayAtComplianceTarget(configJson, targetPath) {
+    if (configJson &&
+        typeof configJson === 'object' &&
+        !Array.isArray(configJson) &&
+        targetPath === GLOBAL_CURSOR_IGNORE_SETTING_PATH) {
+        return globalCursorIgnoreListFromSettings(configJson);
+    }
+    const cur = getByPath(configJson, targetPath);
+    return Array.isArray(cur) ? cur : [];
+}
 function verifyOpsApplied(configJson, settingPath, ops) {
     const parts = settingPath.split('.');
     const leafKey = parts[parts.length - 1] ?? '';
@@ -231,15 +241,16 @@ function verifyOpsApplied(configJson, settingPath, ops) {
     for (const k of keys) {
         const targetPath = resolveOpsTargetPath(settingPath, k);
         if (Object.prototype.hasOwnProperty.call(set, k)) {
-            const cur = getByPath(configJson, targetPath);
             const expected = set[k];
-            if (!remediationSetOpSatisfied(cur, expected)) {
+            const currentForSet = targetPath === GLOBAL_CURSOR_IGNORE_SETTING_PATH
+                ? globalCursorIgnoreListFromSettings(configJson)
+                : getByPath(configJson, targetPath);
+            if (!remediationSetOpSatisfied(currentForSet, expected)) {
                 return { ok: false, expected: { op: 'set', path: targetPath, value: expected } };
             }
             continue;
         }
-        const cur = getByPath(configJson, targetPath);
-        const curArr = Array.isArray(cur) ? cur : [];
+        const curArr = currentArrayAtComplianceTarget(configJson, targetPath);
         const toAdd = add[k] ?? [];
         const toRemove = remove[k] ?? [];
         const isYoloAllowlist = leafKey === 'yoloCommandAllowlist' || targetPath.endsWith('.yoloCommandAllowlist');
@@ -565,9 +576,8 @@ export function reportPostRestartVerificationOutcomes(violations) {
     return { outcomes, reportPromises };
 }
 /**
- * Run immediately after a deferred state.vscdb write lands on disk (post-restart, before the
- * user's next prompt) so `pending_post_restart_verify` remediations are confirmed and reported
- * to the server right away — the UI does not need to wait for another gate invocation.
+ * After deferred vscdb apply (`apply_deferred_vscdb.ts`): confirm pending remediations and POST
+ * outcomes before the user's next prompt.
  */
 export async function runPostApplyVerification(agent = 'cursor') {
     const status = runLocalRemediationComplianceCheck(agent);
@@ -683,7 +693,7 @@ export function applyAutofixViolations(violations, agent = 'cursor') {
                     parseJsonWithJsoncFallback(readFileSync(configPathForDisk, 'utf8')) ?? undefined;
             }
             if (updatedContent !== undefined) {
-                const fileType = (inst.file_type ?? '').trim();
+                const fileType = resolveRemediationUploadFileType(inst.config_file_path, inst.file_type ?? undefined);
                 if (fileType) {
                     const hw = tryResolveHardwareUuid();
                     if (hw) {
@@ -888,8 +898,8 @@ export function uploadSatisfiedManifestConfigs(agent = 'cursor') {
         if (violations.length > 0)
             continue;
         const inst = entry;
-        const fileType = (inst.file_type ?? '').trim();
-        if (!fileType)
+        const uploadFileType = resolveRemediationUploadFileType(entry.config_file_path, inst.file_type ?? undefined);
+        if (!uploadFileType)
             continue;
         const diskPath = resolveRemediationConfigPath(entry.config_file_path);
         if (diskPath.includes('#'))
@@ -914,16 +924,24 @@ export function uploadSatisfiedManifestConfigs(agent = 'cursor') {
             continue;
         }
         const uploadPath = entry.config_file_path.trim() || diskPath;
+        const shouldReportVerified = !prev?.pending_post_restart_verify && !prev?.server_verified_at;
         promises.push(ensureAuthentication(hw)
-            .then((authKey) => sendConfigFile({ file_type: fileType, file_path: uploadPath, raw_content: rawContent }, hw, authKey))
-            .then((sentOk) => {
+            .then((authKey) => sendConfigFile({ file_type: uploadFileType, file_path: uploadPath, raw_content: rawContent }, hw, authKey))
+            .then(async (sentOk) => {
             hookRunLog(`satisfied_upload: uuid=${entry.uuid} path=${uploadPath} ok=${sentOk}`);
-            if (sentOk) {
-                const file = readRemediationApplyTrackingFile();
-                const ent = file.entries[entry.uuid] ?? { consecutive_verify_failures: 0, quarantined: false };
-                ent.last_satisfied_upload_at = new Date().toISOString();
-                file.entries[entry.uuid] = ent;
-                writeRemediationApplyTrackingFile(file);
+            if (!sentOk)
+                return;
+            const file = readRemediationApplyTrackingFile();
+            const ent = file.entries[entry.uuid] ?? { consecutive_verify_failures: 0, quarantined: false };
+            ent.last_satisfied_upload_at = new Date().toISOString();
+            file.entries[entry.uuid] = ent;
+            writeRemediationApplyTrackingFile(file);
+            if (shouldReportVerified) {
+                await reportAutofixApplied(entry.uuid, 'verified', {
+                    config_snapshot_after: rawContent,
+                });
+                markRemediationApplyVerified(entry.uuid);
+                hookRunLog(`satisfied_upload: reported verified uuid=${entry.uuid}`);
             }
         })
             .catch((err) => {
@@ -932,6 +950,35 @@ export function uploadSatisfiedManifestConfigs(agent = 'cursor') {
     }
     return promises;
 }
+/**
+ * When disk already matches remediation ops but autofix never ran, POST verified so the UI
+ * leaves Pending (EnforcementLog) even if satisfied_upload is throttled.
+ */
+export function reportCompliantRemediationVerifiedStatus(agent = 'cursor') {
+    const { remediations } = readRemediationInstructionsFile();
+    const entries = remediations.filter((e) => targetsCurrentAgent(e, agent));
+    const promises = [];
+    for (const entry of entries) {
+        const { violations } = evaluateManifestEntryCompliance(entry);
+        if (violations.length > 0)
+            continue;
+        const tracking = readRemediationApplyTrackingFile();
+        const prev = tracking.entries[entry.uuid];
+        if (prev?.pending_post_restart_verify || prev?.server_verified_at)
+            continue;
+        const diskPath = resolveRemediationConfigPath(entry.config_file_path);
+        if (diskPath.includes('#'))
+            continue;
+        const rawContent = parseJsonWithJsoncFallback(readFileSync(diskPath, 'utf8'));
+        if (rawContent === null)
+            continue;
+        promises.push(reportAutofixApplied(entry.uuid, 'verified', { config_snapshot_after: rawContent }).then(() => {
+            markRemediationApplyVerified(entry.uuid);
+            hookRunLog(`compliance_check: reported verified (already compliant) uuid=${entry.uuid}`);
+        }));
+    }
+    return promises;
+}
 /**
  * Background refresh: server sync for latest instructions, then the same local evaluation as the hook.
  * Apply (autofix) is intentionally deferred to the gate on the next prompt — this pass only downloads

package/dist/log_config_files/runtime/compliance_session_log.js

@@ -1,13 +1,16 @@
 import { existsSync, mkdirSync, readdirSync, renameSync, statSync, unlinkSync, writeFileSync, appendFileSync, readFileSync, } from 'node:fs';
 import path from 'node:path';
 import { homedir } from 'node:os';
-import { OPT_AI_SEC_MANAGEMENT_REL } from '../../bootstrap_constants.js';
-const COMPLIANCE_SUBDIR = 'compliance';
+import { OPT_AI_SEC_LOGS_REL, LOG_GROUP_COMPLIANCE } from '../../bootstrap_constants.js';
+import { buildLogMetadataBlock } from './log_metadata.js';
+const COMPLIANCE_SUBDIR = LOG_GROUP_COMPLIANCE;
 const TIER_NOOP = 'noop';
 const TIER_SUCCESS = 'success';
-const TIER_ERROR = 'error';
+const TIER_FAILURES = 'failures';
 const TIER_IN_PROCESS = 'in_process';
-const TIER_DIRS = [TIER_NOOP, TIER_SUCCESS, TIER_ERROR];
+const TIER_DIRS = [TIER_NOOP, TIER_SUCCESS, TIER_FAILURES];
+/** Server upload contract still uses "error" for failed remediation sessions. */
+const UPLOAD_OUTCOME_ERROR = 'error';
 const NOOP_MAX_AGE_MS = 30 * 60 * 1000;
 const SUCCESS_ERROR_MAX_AGE_MS = 24 * 60 * 60 * 1000;
 /** In-flight logs in compliance/in_process/ before finalize. */
@@ -32,7 +35,7 @@ export function isFinalizeComplianceSessionArgv(argv) {
     return argv.includes('--finalize-compliance-session');
 }
 export function getComplianceLogDir() {
-    return path.join(homedir(), OPT_AI_SEC_MANAGEMENT_REL, COMPLIANCE_SUBDIR);
+    return path.join(homedir(), OPT_AI_SEC_LOGS_REL, COMPLIANCE_SUBDIR);
 }
 export function getActiveComplianceLogPath() {
     return activeComplianceLogPath;
@@ -109,7 +112,7 @@ export function pruneComplianceSessionLogs(exceptPath) {
     let removed = 0;
     removed += pruneLogFilesInDir(path.join(base, TIER_NOOP), NOOP_MAX_AGE_MS, keep);
     removed += pruneLogFilesInDir(path.join(base, TIER_SUCCESS), SUCCESS_ERROR_MAX_AGE_MS, keep);
-    removed += pruneLogFilesInDir(path.join(base, TIER_ERROR), SUCCESS_ERROR_MAX_AGE_MS, keep);
+    removed += pruneLogFilesInDir(path.join(base, TIER_FAILURES), SUCCESS_ERROR_MAX_AGE_MS, keep);
     removed += pruneLogFilesInDir(path.join(base, TIER_IN_PROCESS), INFLIGHT_MAX_AGE_MS, keep);
     if (!existsSync(base))
         return removed;
@@ -137,7 +140,7 @@ export function pruneComplianceSessionLogs(exceptPath) {
 /**
  * Classify a compliance session for finalize + optional server upload.
  *
- * Only two outcomes are uploaded (success / error): remediation **succeeded** or **failed**.
+ * Only two outcomes are uploaded (success / error on the wire): remediation **succeeded** or **failed**.
  * Policy violations, in-flight restart, and sync-only sessions are noop (local retention only).
  */
 export function classifyComplianceSessionLog(content) {
@@ -155,7 +158,7 @@ export function classifyComplianceSessionLog(content) {
         /enforceRemediation.*failed/i,
     ];
     if (remediationFailedPatterns.some((p) => p.test(text))) {
-        return TIER_ERROR;
+        return TIER_FAILURES;
     }
     return TIER_NOOP;
 }
@@ -212,7 +215,7 @@ export function complianceLogSessionBanner(logPath, label, mode) {
         if (!existsSync(dir))
             mkdirSync(dir, { recursive: true, mode: 0o700 });
         if (mode === 'replace') {
-            writeFileSync(resolved, banner, 'utf8');
+            writeFileSync(resolved, banner + buildLogMetadataBlock(), 'utf8');
         }
         else {
             appendFileSync(resolved, banner, 'utf8');
@@ -235,7 +238,7 @@ export function initComplianceSessionForGate(logPath) {
         writeLatestPointer(resolved);
     }
     if (removed > 0) {
-        appendComplianceLine(resolved, `${new Date().toISOString()} compliance_session: pruned ${removed} log(s) (in_process 2h, noop 30m, success/error 24h)\n`);
+        appendComplianceLine(resolved, `${new Date().toISOString()} compliance_session: pruned ${removed} log(s) (in_process 2h, noop 30m, success/failures 24h)\n`);
     }
     return resolved;
 }
@@ -247,12 +250,12 @@ export function initComplianceSessionForRunner(logPath) {
     setActiveComplianceLogPath(resolved);
     complianceLogSessionBanner(resolved, 'compliance_check_runner (background sync + check)', 'append');
     if (removed > 0) {
-        appendComplianceLine(resolved, `${new Date().toISOString()} compliance_session: pruned ${removed} log(s) (in_process 2h, noop 30m, success/error 24h)\n`);
+        appendComplianceLine(resolved, `${new Date().toISOString()} compliance_session: pruned ${removed} log(s) (in_process 2h, noop 30m, success/failures 24h)\n`);
     }
     return resolved;
 }
 /**
- * Move session log from compliance/ root into noop|success|error/ and prune tiers.
+ * Move session log from compliance/ root into noop|success|failures/ and prune tiers.
  * No-op if file missing or already finalized.
  */
 export function finalizeComplianceSessionLog(logPath, forcedTier) {
@@ -263,6 +266,9 @@ export function finalizeComplianceSessionLog(logPath, forcedTier) {
     if (isTierDirName(parentName)) {
         return { tier: parentName, logPath: resolved, moved: false };
     }
+    if (parentName === 'error') {
+        return { tier: TIER_FAILURES, logPath: resolved, moved: false };
+    }
     const content = readFileSync(resolved, 'utf8');
     if (isRemediationCycleInflight(content)) {
         return null;
@@ -310,10 +316,10 @@ function appendLineToSessionLogFile(logPath, message) {
     }
 }
 /**
- * Upload full session log to the server (success and error tiers only, first finalize only).
+ * Upload full session log to the server (success and failures tiers only, first finalize only).
  */
 export async function uploadComplianceSessionLogFromFinalize(result) {
-    if (result.tier !== TIER_SUCCESS && result.tier !== TIER_ERROR)
+    if (result.tier !== TIER_SUCCESS && result.tier !== TIER_FAILURES)
         return;
     if (!result.moved)
         return;
@@ -338,7 +344,7 @@ export async function uploadComplianceSessionLogFromFinalize(result) {
         return;
     }
     const sessionFilename = path.basename(result.logPath);
-    const outcome = result.tier;
+    const outcome = result.tier === TIER_FAILURES ? UPLOAD_OUTCOME_ERROR : result.tier;
     const signingPayload = {
         hardware_uuid: hardwareUuid,
         outcome,
@@ -362,7 +368,7 @@ export async function uploadComplianceSessionLogFromFinalize(result) {
         appendLineToSessionLogFile(result.logPath, `compliance_session_upload: failed ${msg}`);
     }
 }
-/** Finalize session file into success|error|noop tier, then upload when success or error. */
+/** Finalize session file into success|failures|noop tier, then upload when success or failures. */
 export async function finalizeAndUploadComplianceSessionLog(logPath, forcedTier) {
     const result = finalizeComplianceSessionLog(logPath, forcedTier);
     if (result) {