@awak-app/simy-cli 0.3.3 → 0.4.0

package/README.md

@@ -203,6 +203,61 @@ limit. SIMY Web can edit that suggestion and call
 `provider_token_budget`. The CLI persists the higher limit and resumes the same
 run. SIMY token consumption remains a separate platform billing record.
 
+## SQM local checks
+
+SQM deliberately has two identity-bound stages:
+
+1. `simy sqm min-check` quickly inspects committed changes, the working tree,
+   untracked files, and deletions. It runs only deterministic low-cost rules,
+   reports preliminary findings, and writes the applicable state, transition,
+   stress, and scenario plan. A passing min-check is not a complete validation.
+2. `simy sqm check` verifies that repository, base, HEAD, working-tree digest,
+   and signed bundle still match the min-check. It then evaluates applicable
+   state transitions, invariants, stress/strength expectations, and scenarios,
+   writes `proof.json`, and signs that proof with the local device identity.
+
+Normal runs do not require a separate sync command: the CLI
+uses a verified local cache and revalidates it with TTL and ETag semantics.
+The Agentic Loop runs min-check after each code modification and the full check
+before PR readiness. Findings and the redacted signed-proof summary are recorded
+in its audit; source text is never uploaded.
+
+Configure the bundle service with `SIMY_SQM_BUNDLE_URL`. Authentication uses
+the current SIMY session in the coding loop, or `SIMY_SQM_TOKEN`/
+`SIMY_ACCESS_TOKEN` for the diagnostic command. On the first authenticated
+HTTPS request, the CLI receives the bundle verification key from the SIMY
+gateway, verifies the signed bundle, and pins that key to the endpoint,
+account, organization, and repository cache identity for offline use. Explicit
+trust anchors can instead be configured as a JSON key-ID map in
+`SIMY_SQM_PUBLIC_KEYS_JSON`, or as one `SIMY_SQM_KEY_ID` plus
+`SIMY_SQM_PUBLIC_KEY`. Public keys may be PEM, base64 SPKI, or a base64 raw
+32-byte Ed25519 key. Optional settings are:
+
+- `SIMY_SQM_CACHE_DIR`: verified bundle cache location.
+- `SIMY_SQM_CACHE_TTL_MS`: revalidation TTL, defaulting to five minutes.
+- `SIMY_SQM_ACCOUNT_ID` and `SIMY_SQM_ORGANIZATION_ID`: tenant identity for
+  diagnostic checks. Coding-loop checks receive tenant identity from the
+  authenticated session. Cache entries are isolated by endpoint, account,
+  organization, and repository, and the organization is verified against the
+  signed bundle. `SIMY_SQM_ORGANIZATION_ID` is required for standalone
+  diagnostic checks; without a tenant identity SQM fails closed in shadow mode.
+
+Use either phase with `--offline` to prohibit network access and `--refresh` to force
+ETag revalidation, `--base <branch>` to select a base branch, and `--json` for
+machine-readable results. Full check additionally accepts `--min-result`,
+`--proof`, `--signed-evidence`, and `--no-upload`. The min result and full proof
+share one pinned signed bundle and one exact repository identity, so a code
+change cannot silently reuse an old preflight. If Cloud is unavailable, the CLI clearly warns and
+uses the last unexpired signature-verified bundle only after a network failure
+or Cloud 5xx response. Authentication, authorization, compatibility,
+signature, schema, tenant, and expiry failures never execute stale knowledge.
+With no verified cache it skips SQM
+in shadow mode. Bundles contain only the fixed declarative checker vocabulary;
+the CLI never executes shell, JavaScript, Python, WASM, or another remotely
+supplied implementation. A module's matcher array has explicit **AND semantics**:
+every matcher must match before any check in that module runs; it is not an OR
+list.
+
 ## Interactive console
 
 Running `simy` in a terminal opens the Agentic Loop chat. It discovers the

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@awak-app/simy-cli",
-  "version": "0.3.3",
+  "version": "0.4.0",
   "description": "Local SIMY executor for non-coding Local Tasks and Agentic Loop runs.",
   "type": "module",
   "bin": {
@@ -14,6 +14,7 @@
     "start": "node ./src/index.js",
     "test": "node --test",
     "test:e2e:console": "node ./scripts/console-e2e.js",
+    "test:e2e:sqm-complete-loop": "node ./scripts/sqm-complete-loop-e2e.js",
     "test:e2e:console:narrow": "CLI_E2E_COLUMNS=78 CLI_E2E_ROWS=40 node ./scripts/console-e2e.js",
     "test:e2e:console:no-color": "CLI_E2E_NO_COLOR=1 node ./scripts/console-e2e.js",
     "test:e2e:console:recovery": "node ./scripts/console-recovery-e2e.js",
@@ -35,7 +36,8 @@
     "test:e2e:console:real-provider": "node ./scripts/real-provider-console-e2e.js",
     "test:e2e:console:fullstack": "node ./scripts/fullstack-cli-smoke.js",
     "check": "npm run check:auto-update && node --check ./src/desktop-executor.js && node --check ./src/local-task.js && node --check ./scripts/desktop-executor-e2e.js && node --check ./scripts/pre-guardrail-e2e.js && node --check ./scripts/fixtures/fake-desktop-provider.js && npm run check:syntax && npm run check:real-provider-syntax && npm test && npm run check:package",
-    "check:auto-update": "node --check ./src/auto-update.js && node --check ./scripts/auto-update-e2e.js",
+    "check:auto-update": "node --check ./src/auto-update.js && node --check ./scripts/auto-update-e2e.js && npm run check:sqm",
+    "check:sqm": "node --check ./src/sqm/canonical.js && node --check ./src/sqm/validation.js && node --check ./src/sqm/repository.js && node --check ./src/sqm/checkers.js && node --check ./src/sqm/bundle-store.js && node --check ./src/sqm/proof.js && node --check ./src/sqm/evidence-client.js && node --check ./src/sqm/session.js && node --check ./src/sqm/index.js && node --check ./src/sqm/command.js && node --check ./scripts/sqm-complete-loop-e2e.js",
     "check:real-provider-syntax": "node --check ./scripts/real-codex-probe.js && node --check ./scripts/real-claude-probe.js && node --check ./scripts/real-provider-console-fixture.js && node --check ./scripts/real-provider-console-e2e.js",
     "check:syntax": "node --check ./src/index.js && node --check ./src/agent.js && node --check ./src/browser.js && node --check ./src/web-api.js && node --check ./src/durable-local-task-worker.js && node --check ./src/durable-local-task-steps-contract.js && node --check ./src/bounded-local-task-subtasks-contract.js && node --check ./src/bounded-local-task-subtask-pool.js && node --check ./src/local-task-artifact-contract.js && node --check ./src/execution-capability-contract.js && node --check ./src/shutdown.js && node --check ./src/run-registry.js && node --check ./src/direct-executor.js && node --check ./src/execution-guardrail.js && node --check ./src/backend-executable.js && node --check ./src/provider-stream.js && node --check ./src/console/index.js && node --check ./src/console/app.js && node --check ./src/console/commands.js && node --check ./src/local-attachments.js && node --check ./src/repository-inventory.js && node --check ./src/session-store.js && node --check ./src/web-origin.js && node --check ./src/workspace-context.js && node --check ./src/orchestrator/index.js && node --check ./src/orchestrator/shared.js && node --check ./src/orchestrator/recovery.js && node --check ./src/orchestrator/risk.js && node --check ./src/orchestrator/contract.js && node --check ./src/orchestrator/completion-contract.js && node --check ./src/orchestrator/instruction.js && node --check ./src/orchestrator/problem-solving.js && node --check ./src/orchestrator/budget.js && node --check ./src/orchestrator/execution-io.js && node --check ./src/orchestrator/presentation.js && node --check ./src/orchestrator/result.js && node --check ./src/orchestrator/retry.js && node --check ./src/orchestrator/evidence.js && node --check ./src/orchestrator/independent-audit.js && node --check ./src/orchestrator/audit.js && node --check ./src/orchestrator/loop.js && node --check ./src/runner.js && node --check ./scripts/fixtures/completion-contract-fixture.js && node --check ./scripts/fixtures/fake-coding-backend.js && node --check ./scripts/e2e-terminal-evidence.js && node --check ./scripts/audit-gate-e2e.js && node --check ./scripts/completion-contract-e2e.js && node --check ./scripts/retry-circuit-e2e.js && node --check ./scripts/follow-up-charter-e2e.js && node --check ./scripts/task-routing-e2e.js && node --check ./scripts/executor-version-preflight-e2e.js && node --check ./scripts/blocked-recovery-e2e.js && node --check ./scripts/process-localization-e2e.js && node --check ./scripts/hypothesis-retries-e2e.js && node --check ./scripts/budget-enforcement-e2e.js && node --check ./scripts/local-task-default-workspace-e2e.js && node --check ./scripts/local-task-idempotency-e2e.js && node --check ./scripts/console-e2e-fixture.js && node --check ./scripts/console-e2e.js && node --check ./scripts/console-recovery-e2e-fixture.js && node --check ./scripts/console-recovery-e2e.js && node --check ./scripts/real-provider-console-fixture.js && node --check ./scripts/real-provider-console-e2e.js && node --check ./scripts/fullstack-cli-smoke.js && node --check ./scripts/check-package-contents.js",
     "check:package": "node ./scripts/check-package-contents.js"

package/src/agent.js

@@ -557,6 +557,16 @@ export async function startAgent({
           device_id: typeof body.device_id === "string" ? body.device_id : null,
           api_origin: apiOrigin,
           api_base_url: apiBaseUrl,
+          account_id: typeof body.account_id === "string"
+            ? body.account_id
+            : typeof body.auth_user_id === "string"
+            ? body.auth_user_id
+            : null,
+          organization_id: typeof body.organization_id === "string"
+            ? body.organization_id
+            : typeof body.org_id === "string"
+            ? body.org_id
+            : null,
           expires_at: typeof body.expires_at === "string" ? body.expires_at : expiresAtFromNow(),
         };
         await writeSession(apiOrigin, session, sessionRoot);
@@ -679,6 +689,13 @@ export async function startAgent({
           json(res, 400, { error: "instruction is required" });
           return;
         }
+        const authorizationInstruction = String(
+          body.authorization_instruction || instruction,
+        ).trim();
+        if (!authorizationInstruction) {
+          json(res, 400, { error: "authorization_instruction is required" });
+          return;
+        }
         if (body.backend !== "codex" && body.backend !== "claude") {
           json(res, 400, { error: "backend must be codex or claude" });
           return;
@@ -686,7 +703,7 @@ export async function startAgent({
         const idempotencyKey = String(
           req.headers["idempotency-key"] || body.client_request_id || "",
         ).trim();
-        const guardrail = classifyExecutionRequirement(instruction);
+        const guardrail = classifyExecutionRequirement(authorizationInstruction);
         if (
           guardrail.decision !== "direct_executor" ||
           body.guardrail?.policy_version !== EXECUTION_GUARDRAIL_POLICY_VERSION ||

package/src/cli-contract.js

@@ -13,7 +13,7 @@ import {
 } from "./durable-local-task-steps-contract.js";
 import { buildExecutionCapabilityContract } from "./execution-capability-contract.js";
 
-export const CLI_VERSION = "0.3.3";
+export const CLI_VERSION = "0.4.0";
 export const CLI_API_CONTRACT_VERSION = 10;
 
 export function withCliContract(

package/src/execution-guardrail.js

@@ -1,4 +1,4 @@
-export const EXECUTION_GUARDRAIL_POLICY_VERSION = "2026-07-26.1";
+export const EXECUTION_GUARDRAIL_POLICY_VERSION = "2026-07-29.1";
 
 const OBSERVE_PATTERN =
   /\b(monitor|watch|observe|track|status|progress|keep an eye on)\b|監視|見守|進捗|状況を?(?:見|確認)|监控|監控|观察|觀察|进度|進度|状态|狀態/i;
@@ -98,7 +98,7 @@ export function classifyExecutionRequirement(sourceMessage) {
       reason_code: "observe_existing_provider_session",
     });
   }
-  if (changeRequested && knowledgeWork && !codingTarget) {
+  if (changeRequested && (knowledgeWork || hasObject) && !codingTarget) {
     return guardrail("direct_executor", {
       change_requested: true,
       repository_required: false,

package/src/index.js

@@ -21,11 +21,25 @@ import { DEFAULT_WEB_ORIGIN, resolveWebOrigin } from "./web-origin.js";
 const argv = process.argv.slice(2);
 const args = new Set(argv);
 
+if (argv[0] === "sqm") {
+  const packageInfo = await readCliPackageInfo();
+  try {
+    const { runSqmCommand } = await import("./sqm/command.js");
+    process.exitCode = await runSqmCommand(argv.slice(1), { cliVersion: packageInfo.version });
+  } catch (error) {
+    console.error(error instanceof Error ? error.message : String(error));
+    process.exitCode = 2;
+  }
+  process.exit();
+}
+
 if (args.has("--help") || args.has("-h")) {
   console.log(`Usage:
   simy            Start the local SIMY agent
   simy --daemon   Start it in the background
   simy --no-tui   Start the foreground HTTP agent without the interactive console
+  simy sqm min-check  Run the fast deterministic SQM diff preflight
+  simy sqm check      Run full scenarios, write proof.json, and sign the run
 
 Options:
   --daemon, --deamon  Run detached in the background

package/src/local-task.js

@@ -3,15 +3,17 @@ import { createHash, randomUUID } from "node:crypto";
 import { EventEmitter, once } from "node:events";
 import {
   mkdir,
+  mkdtemp,
   lstat,
   readFile,
   readdir,
   realpath,
   rename,
+  rm,
   stat,
   writeFile,
 } from "node:fs/promises";
-import { homedir } from "node:os";
+import { homedir, tmpdir } from "node:os";
 import path from "node:path";
 import { promisify } from "node:util";
 
@@ -426,17 +428,38 @@ export async function startLocalTask(
   // synchronous spawn boundary so a stopped task can never start Provider work.
   if (task.stop_requested || task.status !== "running") return task;
 
-  return new Promise((resolve) => {
+  const runtimeTempBase = process.platform === "darwin" ? "/tmp" : tmpdir();
+  const runtimeTempRoot = await mkdtemp(
+    path.join(runtimeTempBase, `simy-local-task-${task.id}-`),
+  );
+  allowCodexRuntimeTemp(command, runtimeTempRoot);
+
+  return new Promise((resolve, reject) => {
     let settled = false;
     let timeout = null;
     const rawStdout = [];
     const tokenRecords = [];
-    const child = command.spawn(command.bin, command.args, {
-      cwd: task.workspace_path,
-      env: { ...process.env, ...command.env },
-      stdio: ["ignore", "pipe", "pipe"],
-      detached: process.platform !== "win32",
-    });
+    let child;
+    try {
+      child = command.spawn(command.bin, command.args, {
+        cwd: task.workspace_path,
+        env: {
+          ...process.env,
+          TMPDIR: runtimeTempRoot,
+          TMP: runtimeTempRoot,
+          TEMP: runtimeTempRoot,
+          ...command.env,
+        },
+        stdio: ["ignore", "pipe", "pipe"],
+        detached: process.platform !== "win32",
+      });
+    } catch (error) {
+      void rm(runtimeTempRoot, { recursive: true, force: true }).then(
+        () => reject(error),
+        () => reject(error),
+      );
+      return;
+    }
     task.child = child;
 
     const onLine = (line) => {
@@ -523,6 +546,7 @@ export async function startLocalTask(
       let artifacts = [];
       let scenarioAcceptance = null;
       try {
+        await rm(runtimeTempRoot, { recursive: true, force: true });
         artifacts = task.outputs_root
           ? await collectLocalTaskArtifacts(task.outputs_root, {
               localTaskId: task.id,
@@ -1085,6 +1109,25 @@ function providerTokenCount(record) {
   return Number(record?.total_tokens || 0);
 }
 
+function allowCodexRuntimeTemp(command, runtimeTempRoot) {
+  if (
+    command.backend !== "codex" ||
+    command.execution_kind !== "direct" ||
+    command.verification === "explicit_command_override" ||
+    command.args[0] !== "exec" ||
+    command.args.length < 2
+  ) {
+    return;
+  }
+  const instruction = command.args.at(-1);
+  command.args = [
+    ...command.args.slice(0, -1),
+    "--add-dir",
+    runtimeTempRoot,
+    instruction,
+  ];
+}
+
 function providerLabel(backend) {
   return backend === "claude" ? "Claude Code" : "Codex";
 }

package/src/orchestrator/audit.js

@@ -13,7 +13,7 @@ import {
   normalizeVisualReview,
 } from "./completion-contract.js";
 
-export async function auditAttempt(charter, attempt, { previousAttempt = null } = {}) {
+export async function auditAttempt(charter, attempt, { previousAttempt = null, sqm = null } = {}) {
   const checks = [];
   const addCheck = (
     id,
@@ -219,6 +219,7 @@ export async function auditAttempt(charter, attempt, { previousAttempt = null }
       ? "Implementation evidence passed local verification."
       : "Implementation evidence failed local verification.",
     checks,
+    sqm: normalizeSqmAudit(sqm),
   };
 
   return {
@@ -257,6 +258,46 @@ export async function auditAttempt(charter, attempt, { previousAttempt = null }
     release_gate: null,
     work_log_signals: [],
     work_log_interventions: [],
+    sqm: normalizeSqmAudit(sqm),
+  };
+}
+
+function normalizeSqmAudit(sqm) {
+  if (!sqm) return null;
+  return {
+    status: sqm.status || "unavailable",
+    mode: "shadow",
+    bundle: sqm.bundle || null,
+    warnings: Array.isArray(sqm.warnings) ? sqm.warnings : [],
+    findings: (Array.isArray(sqm.findings) ? sqm.findings : []).map((finding) => ({
+      finding_id: finding.finding_id,
+      module_id: finding.module_id,
+      module_version: finding.module_version,
+      rule_id: finding.rule_id,
+      severity: finding.severity,
+      file: finding.file || null,
+      line: finding.line || null,
+      side: finding.side || null,
+      evidence_hash: finding.evidence_hash,
+      bundle_id: finding.bundle_id,
+      bundle_version: finding.bundle_version,
+      bundle_digest: finding.bundle_digest,
+    })),
+    min_check: sqm.min_check ? {
+      result_digest: sqm.min_check.result_digest || null,
+      status: sqm.min_check.status || null,
+      executed_at: sqm.min_check.executed_at || null,
+    } : null,
+    proof: sqm.proof ? {
+      proof_id: sqm.proof.proof_id || null,
+      digest: sqm.proof.integrity?.digest || null,
+      outcome: sqm.proof.outcome?.status || null,
+    } : null,
+    signed_evidence: sqm.signed_evidence ? {
+      evidence_id: sqm.signed_evidence.evidence_id || null,
+      key_id: sqm.signed_evidence.signer?.key_id || null,
+      algorithm: sqm.signed_evidence.integrity?.algorithm || null,
+    } : null,
   };
 }
 

package/src/orchestrator/loop.js

@@ -14,6 +14,7 @@ export async function runCodingLoop({
   executeAttempt,
   executeIndependentAudit,
   collectEvidence,
+  checkSqm = null,
   onUpdate,
   humanGuidance = "",
   resume = false,
@@ -127,6 +128,7 @@ export async function runCodingLoop({
     });
     await publish(snapshot, "collecting_evidence", onUpdate);
     attempt.observed_evidence = await safeEvidence(collectEvidence, attempt);
+    attempt.sqm = await safeSqm(checkSqm, attempt);
     if (shouldStop()) return stopCodingLoop(snapshot, onUpdate);
 
     appendEvent(snapshot, "auditing", `Verifying local evidence for attempt ${attemptNumber}.`, {
@@ -140,7 +142,10 @@ export async function runCodingLoop({
         attempt.observed_evidence?.github?.available === true,
     });
     await publish(snapshot, "auditing", onUpdate);
-    attempt.audit = await auditAttempt(snapshot.charter, attempt, { previousAttempt });
+    attempt.audit = await auditAttempt(snapshot.charter, attempt, {
+      previousAttempt,
+      sqm: attempt.sqm,
+    });
     if (shouldStop()) return stopCodingLoop(snapshot, onUpdate);
     attempt.implementation_gate = attempt.audit.implementation_gate;
     snapshot.attempts.push(attempt);
@@ -212,8 +217,12 @@ export async function runCodingLoop({
 
     // Re-collect after the read-only auditor to catch any mutated HEAD or working tree.
     attempt.observed_evidence = await safeEvidence(collectEvidence, attempt);
+    attempt.sqm = await safeSqm(checkSqm, attempt, attempt.sqm);
     if (shouldStop()) return stopCodingLoop(snapshot, onUpdate);
-    attempt.audit = await auditAttempt(snapshot.charter, attempt, { previousAttempt });
+    attempt.audit = await auditAttempt(snapshot.charter, attempt, {
+      previousAttempt,
+      sqm: attempt.sqm,
+    });
     if (shouldStop()) return stopCodingLoop(snapshot, onUpdate);
     attempt.implementation_gate = attempt.audit.implementation_gate;
 
@@ -267,7 +276,7 @@ async function stopCodingLoop(snapshot, onUpdate) {
   return snapshot;
 }
 
-export async function recheckPrReadiness({ snapshot, collectEvidence, onUpdate }) {
+export async function recheckPrReadiness({ snapshot, collectEvidence, checkSqm = null, onUpdate }) {
   const attempt = snapshot.attempts.at(-1);
   if (!attempt || !attempt.audit?.passed || !attempt.independent_audit?.passed) return snapshot;
   appendEvent(snapshot, "checking_pr", "Refreshing GitHub review and CI evidence.", {
@@ -275,8 +284,10 @@ export async function recheckPrReadiness({ snapshot, collectEvidence, onUpdate }
   });
   await publish(snapshot, "checking_pr", onUpdate);
   attempt.observed_evidence = await safeEvidence(collectEvidence, attempt);
+  attempt.sqm = await safeSqm(checkSqm, attempt, attempt.sqm, "full");
   attempt.audit = await auditAttempt(snapshot.charter, attempt, {
     previousAttempt: snapshot.attempts.at(-2) ?? null,
+    sqm: attempt.sqm,
   });
   snapshot.implementation_gate_passed = attempt.audit.passed;
   attempt.pr_readiness = evaluatePrReadiness(snapshot.charter, attempt);
@@ -352,6 +363,21 @@ async function safeEvidence(collector, attempt) {
   }
 }
 
+async function safeSqm(checker, attempt, previous = null, phase = "min") {
+  if (!checker) return previous;
+  try {
+    return await checker(attempt, { phase });
+  } catch (error) {
+    return {
+      status: "unavailable",
+      mode: "shadow",
+      bundle: null,
+      findings: [],
+      warnings: [error instanceof Error ? error.message : "SQM shadow check failed."],
+    };
+  }
+}
+
 function unavailableEvidence(error) {
   return {
     collected_at: new Date().toISOString(),

package/src/runner.js

@@ -40,6 +40,8 @@ import {
 import { LocalRunRegistry } from "./run-registry.js";
 import { webApiHeaders, webApiUrl } from "./web-api.js";
 import { normalizeGitHubRemote } from "./workspace-context.js";
+import { CLI_VERSION } from "./cli-contract.js";
+import { createSqmChecker } from "./sqm/index.js";
 
 const execFileAsync = promisify(execFile);
 const MAX_LOCAL_LOG_LINES = 1_000;
@@ -543,6 +545,20 @@ async function runLocalCodingRun(
         attempt,
         repositoryPath,
       }));
+  const sqmChecker =
+    run.sqmChecker ||
+    createSqmChecker({
+      cwd: repositoryPath,
+      baseBranch: run.snapshot.charter.base_branch,
+      cliVersion: CLI_VERSION,
+      token: run.session?.token,
+      endpoint: sqmBundleEndpoint(run.session),
+      evidenceEndpoint: sqmEvidenceEndpoint(run.session),
+      accountId: run.session?.account_id || run.session?.auth_user_id || run.session?.device_id,
+      organizationId: run.session?.organization_id || run.session?.org_id,
+      deviceId: run.session?.device_id,
+    });
+  run.sqmChecker = sqmChecker;
 
   try {
     await runCodingLoop({
@@ -550,6 +566,7 @@ async function runLocalCodingRun(
       executeAttempt: executor,
       executeIndependentAudit: independentAuditor,
       collectEvidence: evidenceCollector,
+      checkSqm: sqmChecker,
       humanGuidance,
       resume,
       shouldStop: () => run.stopRequested,
@@ -601,9 +618,24 @@ export async function recheckLocalCodingRun(run, { collectEvidence } = {}) {
         attempt,
         repositoryPath,
       }));
+  const sqmChecker =
+    run.sqmChecker ||
+    createSqmChecker({
+      cwd: repositoryPath,
+      baseBranch: run.snapshot.charter.base_branch,
+      cliVersion: CLI_VERSION,
+      token: run.session?.token,
+      endpoint: sqmBundleEndpoint(run.session),
+      evidenceEndpoint: sqmEvidenceEndpoint(run.session),
+      accountId: run.session?.account_id || run.session?.auth_user_id || run.session?.device_id,
+      organizationId: run.session?.organization_id || run.session?.org_id,
+      deviceId: run.session?.device_id,
+    });
+  run.sqmChecker = sqmChecker;
   await recheckPrReadiness({
     snapshot: run.snapshot,
     collectEvidence: evidenceCollector,
+    checkSqm: sqmChecker,
     onUpdate: async (snapshot) => {
       run.snapshot = snapshot;
       await updateRun(run, snapshot.state);
@@ -612,6 +644,18 @@ export async function recheckLocalCodingRun(run, { collectEvidence } = {}) {
   return run.snapshot;
 }
 
+function sqmBundleEndpoint(session) {
+  if (process.env.SIMY_SQM_BUNDLE_URL?.trim()) return process.env.SIMY_SQM_BUNDLE_URL.trim();
+  if (!session?.api_base_url) return undefined;
+  return new URL("sqm/knowledge-bundle", session.api_base_url).href;
+}
+
+function sqmEvidenceEndpoint(session) {
+  if (process.env.SIMY_SQM_EVIDENCE_URL?.trim()) return process.env.SIMY_SQM_EVIDENCE_URL.trim();
+  if (!session?.api_base_url) return undefined;
+  return new URL("sqm/run-evidence", session.api_base_url).href;
+}
+
 async function executeProcessAttempt({
   backend,
   instruction,