docs(worker): update stale sdk comments

apps/worker/src/services/agent-execution.ts

@@ -312,7 +312,7 @@ export class AgentExecutionService {
   static toMetrics(endResult: AgentEndResult, result: PiPromptResult): AgentMetrics {
     return {
       durationMs: endResult.duration_ms,
-      inputTokens: null, // Not currently exposed by SDK wrapper
+      inputTokens: null, // Not currently exposed by the pi executor
       outputTokens: null,
       costUsd: endResult.cost_usd,
       numTurns: result.turns ?? null,

apps/worker/src/services/error-handling.ts

@@ -160,7 +160,7 @@ function classifyByErrorCode(code: ErrorCode, retryableFromError: boolean): { ty
  *
  * Classification priority:
  * 1. If error is PentestError with ErrorCode, classify by code (reliable)
- * 2. Fall through to string matching for external errors (SDK, network, etc.)
+ * 2. Fall through to string matching for external errors (provider, network, etc.)
  */
 export function classifyErrorForTemporal(error: unknown): { type: string; retryable: boolean } {
   // === CODE-BASED CLASSIFICATION (Preferred for internal errors) ===

apps/worker/src/services/findings-renderer.ts

@@ -9,7 +9,7 @@
  *
  * Used when exploit=false: the exploit agents didn't run, so there is no
  * `*_exploitation_evidence.md` to concatenate into the report. This module
- * reads each `*_exploitation_queue.json` (already SDK-validated against the
+ * reads each `*_exploitation_queue.json` (already validated by the submit tool against the
  * schemas in ../ai/queue-schemas.ts) and writes a `*_findings.md` per class
  * in the canonical body shape that report-executive.txt's cleanup expects.
  *

apps/worker/src/services/preflight.ts

@@ -247,7 +247,7 @@ async function validateCodePathsExist(
 
 // === Credential Validation ===
 
-/** Map SDK error type to a human-readable preflight PentestError. */
+/** Map provider error text to a human-readable preflight PentestError. */
 /** Classify a provider error message (thrown or from a failed turn) into a PentestError. */
 function classifyCredentialError(text: string, authType: string): Result<void, PentestError> {
   const lower = text.toLowerCase();
@@ -357,7 +357,7 @@ async function validateCredentials(
   providerConfig?: import('../types/config.js').ProviderConfig,
 ): Promise<Result<void, PentestError>> {
   // 0. If providerConfig is present, credentials are managed by the caller.
-  //    The executor will map providerConfig directly to sdkEnv — no process.env needed.
+  //    The executor/provider layer owns providerConfig resolution — no env preflight needed.
   if (providerConfig) {
     logger.info(
       `Provider config present (type: ${providerConfig.providerType || 'anthropic_api'}) — skipping env-based credential validation`,
@@ -365,7 +365,7 @@ async function validateCredentials(
     return ok(undefined);
   }
 
-  // 0b. If apiKey provided via config, set it in env for SDK validation
+  // 0b. If apiKey provided via config, set it in env for pi validation
   //     This avoids requiring process.env.ANTHROPIC_API_KEY when key is threaded via input
   if (apiKey) {
     process.env.ANTHROPIC_API_KEY = apiKey;
@@ -594,7 +594,7 @@ export async function runPreflightChecks(
     }
   }
 
-  // 4. Credential check (cheap — 1 SDK round-trip, skipped when providerConfig present)
+  // 4. Credential check (cheap — 1 pi round-trip, skipped when providerConfig present)
   const credResult = await validateCredentials(logger, apiKey, providerConfig);
   if (!credResult.ok) {
     return credResult;