@claude-flow/cli 3.34.0 → 3.35.0

package/dist/src/services/daemon-autostart.d.ts

@@ -9,6 +9,30 @@ export declare function isDaemonAlive(projectRoot: string): boolean;
  * read-only command in any Claude project to spawn a detached daemon (#2852).
  */
 export declare function isRufloProject(projectRoot: string): boolean;
+/**
+ * #2877: Normalize a working directory to the project root that owns the
+ * daemon lock/PID key.
+ *
+ * The lock (`<root>/.claude-flow/daemon.lock`) and PID file
+ * (`<root>/.claude-flow/daemon.pid`) were keyed to the raw cwd, so invoking
+ * the CLI from `/proj` and from `/proj/packages/foo` produced two different
+ * keys for one logical project — bypassing the atomic-lockfile dedup added
+ * for #2407/#2484 entirely (each cwd races against a different lock file)
+ * and leaving two daemons supervising the same tree.
+ *
+ * Resolution walks up from `startDir` and returns the NEAREST enclosing
+ * directory carrying a durable Ruflo marker (`isRufloProject`). Nearest-wins
+ * is what keeps a monorepo's independently-initialized sub-project on its own
+ * daemon: it matches its own marker before the walk ever reaches the parent.
+ *
+ * A `.git` directory is a hard stop — the repository boundary. Without it the
+ * walk could escape into an unrelated ancestor (a Ruflo project living at
+ * `$HOME`, say) and hand every repo below it the same daemon.
+ *
+ * Returns the resolved `startDir` unchanged when no marker is found, so a
+ * non-Ruflo directory still fails `isRufloProject` and declines autostart.
+ */
+export declare function resolveDaemonProjectRoot(startDir: string): string;
 export interface EnsureResult {
     started: boolean;
     reason?: string;
@@ -16,10 +40,14 @@ export interface EnsureResult {
 /** Spawn `daemon start` detached, reusing all its lock/TTL machinery. Injectable for tests. */
 export type SpawnDaemonFn = (projectRoot: string) => void;
 /**
- * Ensure a daemon is running for `projectRoot`. No-op when disabled or when one
- * is already alive. Best-effort; never throws.
+ * Ensure a daemon is running for the project enclosing `startDir`. No-op when
+ * disabled or when one is already alive. Best-effort; never throws.
+ *
+ * #2877: `startDir` is normalized to the owning project root first, so a call
+ * from a subdirectory reads the same config, pidfile, and lock as a call from
+ * the root and cannot spawn a second daemon for the same project.
  */
-export declare function ensureDaemonRunning(projectRoot: string, opts?: {
+export declare function ensureDaemonRunning(startDir: string, opts?: {
     spawnFn?: SpawnDaemonFn;
     isAlive?: (root: string) => boolean;
 }): EnsureResult;

package/dist/src/services/daemon-autostart.js

@@ -105,6 +105,43 @@ export function isRufloProject(projectRoot) {
     catch { /* absent/malformed/non-Ruflo MCP config */ }
     return false;
 }
+/**
+ * #2877: Normalize a working directory to the project root that owns the
+ * daemon lock/PID key.
+ *
+ * The lock (`<root>/.claude-flow/daemon.lock`) and PID file
+ * (`<root>/.claude-flow/daemon.pid`) were keyed to the raw cwd, so invoking
+ * the CLI from `/proj` and from `/proj/packages/foo` produced two different
+ * keys for one logical project — bypassing the atomic-lockfile dedup added
+ * for #2407/#2484 entirely (each cwd races against a different lock file)
+ * and leaving two daemons supervising the same tree.
+ *
+ * Resolution walks up from `startDir` and returns the NEAREST enclosing
+ * directory carrying a durable Ruflo marker (`isRufloProject`). Nearest-wins
+ * is what keeps a monorepo's independently-initialized sub-project on its own
+ * daemon: it matches its own marker before the walk ever reaches the parent.
+ *
+ * A `.git` directory is a hard stop — the repository boundary. Without it the
+ * walk could escape into an unrelated ancestor (a Ruflo project living at
+ * `$HOME`, say) and hand every repo below it the same daemon.
+ *
+ * Returns the resolved `startDir` unchanged when no marker is found, so a
+ * non-Ruflo directory still fails `isRufloProject` and declines autostart.
+ */
+export function resolveDaemonProjectRoot(startDir) {
+    const start = path.resolve(startDir);
+    let dir = start;
+    for (;;) {
+        if (isRufloProject(dir))
+            return dir;
+        if (fs.existsSync(path.join(dir, '.git')))
+            return start;
+        const parent = path.dirname(dir);
+        if (parent === dir)
+            return start;
+        dir = parent;
+    }
+}
 const defaultSpawn = (projectRoot) => {
     const cliBin = process.argv[1]; // the running bin/cli.js
     const child = spawn(process.execPath, [cliBin, 'daemon', 'start', '--quiet'], {
@@ -116,11 +153,16 @@ const defaultSpawn = (projectRoot) => {
     child.unref();
 };
 /**
- * Ensure a daemon is running for `projectRoot`. No-op when disabled or when one
- * is already alive. Best-effort; never throws.
+ * Ensure a daemon is running for the project enclosing `startDir`. No-op when
+ * disabled or when one is already alive. Best-effort; never throws.
+ *
+ * #2877: `startDir` is normalized to the owning project root first, so a call
+ * from a subdirectory reads the same config, pidfile, and lock as a call from
+ * the root and cannot spawn a second daemon for the same project.
  */
-export function ensureDaemonRunning(projectRoot, opts = {}) {
+export function ensureDaemonRunning(startDir, opts = {}) {
     try {
+        const projectRoot = resolveDaemonProjectRoot(startDir);
         if (autostartDisabled(projectRoot))
             return { started: false, reason: 'disabled (RUFLO_DAEMON_AUTOSTART=0 or project config)' };
         if (!isRufloProject(projectRoot)) {

package/dist/src/services/distill-oracle.d.ts

@@ -36,7 +36,7 @@
  */
 import { type VerifyTaskKind } from '../ruvector/output-verifier.js';
 import { FableHarness, type ReflectItem, type ReflectResult } from './fable-harness.js';
-export declare const MH_DARWIN_PIN = "0.8.0";
+export declare const MH_DARWIN_PIN = "0.8.3";
 export type ResolvedProvenance = 'oracle:test-exec' | 'judge:fable' | 'proxy:structural';
 /** SWE-bench-shaped / bench-suite-mapped test spec that Tier 1 can execute. */
 export interface TestSpec {

package/dist/src/services/distill-oracle.js

@@ -43,8 +43,8 @@ import { FableHarness, } from './fable-harness.js';
 // behavior mid-run (the #142 pin-drift failure mode). Pin it, and let
 // scripts/check-metaharness-pins.mjs watch this constant for drift. Kept in
 // lock-step with the optionalDependencies pin in package.json and the plugin
-// darwin cache (darwin-cache-0.8.0).
-export const MH_DARWIN_PIN = '0.8.0';
+// darwin cache (versioned by the plugin's own `~0.8.0` pin in _darwin.mjs).
+export const MH_DARWIN_PIN = '0.8.3';
 // ── Public API ───────────────────────────────────────────────────────────
 /**
  * Label each trajectory with `resolved` + honest provenance, trying the tiers

package/dist/src/services/evolve-proof.d.ts

@@ -1,4 +1,5 @@
 import { type PromotionVerdict, type AcceptResult } from './harness-benchmark.js';
+import { SEQUENTIAL_EVIDENCE_VERSION } from './flywheel-sequential-evidence.js';
 import { type ProvenConfigManifest } from '../config/proven-config.js';
 /**
  * The promotion rule is versioned so a receipt pins exactly which semantics
@@ -6,8 +7,16 @@ import { type ProvenConfigManifest } from '../config/proven-config.js';
  * term: the per-held-out-task deltas must have a positive one-sided 95% bootstrap
  * lower bound, so a small-N mean gain can't ride on noise. The canary term is a
  * SEPARATE deployment-safety signal (a distinct slice), not held-out dominance.
+ *
+ * v2+seq (ADR-381 §3) adds a third conjunct: an anytime-valid sequential-
+ * evidence e-process over the holdout's paired per-task scores, judged at the
+ * alpha allocated to this bundle's position in the lineage's adaptive test
+ * stream (alpha_k = alphaTotal · 6/(π²k²)). The rule version is pinned PER
+ * BUNDLE, so a lineage may contain both v1 and v2 bundles and each replays
+ * under its own recorded semantics.
  */
 export declare const PROMOTION_RULE_VERSION = "accept/v1+sig";
+export declare const PROMOTION_RULE_VERSION_V2 = "accept/v2+seq";
 export declare const PROOF_LABEL = "single-round proof-of-mechanism";
 export declare const NOT_CLAIMS: readonly ["not flywheel proof", "not compounding learning", "not production learning"];
 export interface HoldoutTask {
@@ -62,9 +71,26 @@ export interface RegressionRecord {
     candidateManifestHash: string;
     ancestor: string | null;
     mutationClass: string;
-    failureCause: 'holdout' | 'security' | 'drift' | 'replay' | 'governance' | 'canary' | 'significance';
+    failureCause: 'holdout' | 'security' | 'drift' | 'replay' | 'governance' | 'canary' | 'significance' | 'sequential';
     failedTerms: string[];
 }
+/**
+ * The v2 sequential-evidence term, embedded so `verifyReceiptBundle` can
+ * replay it from the bundle's own holdout: the recorded testIndex/alphaTotal/
+ * lambda fully determine the threshold, and the e-value recomputes from the
+ * embedded per-task scores.
+ */
+export interface SequentialEvidenceRecord {
+    version: typeof SEQUENTIAL_EVIDENCE_VERSION;
+    testIndex: number;
+    alphaTotal: number;
+    lambda: number;
+    alphaAllocated: number;
+    eValue: number;
+    threshold: number;
+    informativePairs: number;
+    significant: boolean;
+}
 export interface EvolveReceiptBundle {
     label: typeof PROOF_LABEL;
     disclaimers: typeof NOT_CLAIMS;
@@ -80,6 +106,8 @@ export interface EvolveReceiptBundle {
         version: string;
         result: boolean;
     };
+    /** Present iff the bundle was decided under accept/v2+seq (ADR-381 §3). */
+    sequentialEvidence?: SequentialEvidenceRecord;
     decisionReceipt: DecisionReceipt;
     shadow: ShadowRegistration | null;
     costReceipt: CostReceipt;
@@ -115,6 +143,16 @@ export interface AssembleOpts {
     humanEvalHash?: string;
     layer?: string;
     corpus?: string;
+    /**
+     * ADR-381 §3 — supply to decide the bundle under accept/v2+seq: the bundle's
+     * 1-based position in the lineage's adaptive test stream, plus optional
+     * alpha/lambda overrides. Omit for legacy v1+sig semantics.
+     */
+    sequential?: {
+        testIndex: number;
+        alphaTotal?: number;
+        lambda?: number;
+    };
 }
 /**
  * Assemble a receipt bundle from a holdout + configs. This is the SHARED core:
@@ -144,6 +182,7 @@ export declare function runRealEvolveRound(opts: {
     humanRelevanceDelta?: number;
     humanEvalHash?: string;
     corpus: string;
+    sequential?: AssembleOpts['sequential'];
 }): EvolveReceiptBundle;
 /**
  * Run ONE deterministic synthetic evolve round and produce the receipt bundle.

package/dist/src/services/evolve-proof.js

@@ -21,6 +21,7 @@
 import { createHash } from 'node:crypto';
 import { accept } from './harness-benchmark.js';
 import { bootstrapDeltaCILow } from './harness-improvement-ledger.js';
+import { DEFAULT_ALPHA_TOTAL, DEFAULT_LAMBDA, SEQUENTIAL_EVIDENCE_VERSION, sequentialEvidenceVerdict, } from './flywheel-sequential-evidence.js';
 import { canonicalManifestBytes } from '../config/proven-config.js';
 /**
  * The promotion rule is versioned so a receipt pins exactly which semantics
@@ -28,8 +29,16 @@ import { canonicalManifestBytes } from '../config/proven-config.js';
  * term: the per-held-out-task deltas must have a positive one-sided 95% bootstrap
  * lower bound, so a small-N mean gain can't ride on noise. The canary term is a
  * SEPARATE deployment-safety signal (a distinct slice), not held-out dominance.
+ *
+ * v2+seq (ADR-381 §3) adds a third conjunct: an anytime-valid sequential-
+ * evidence e-process over the holdout's paired per-task scores, judged at the
+ * alpha allocated to this bundle's position in the lineage's adaptive test
+ * stream (alpha_k = alphaTotal · 6/(π²k²)). The rule version is pinned PER
+ * BUNDLE, so a lineage may contain both v1 and v2 bundles and each replays
+ * under its own recorded semantics.
  */
 export const PROMOTION_RULE_VERSION = 'accept/v1+sig';
+export const PROMOTION_RULE_VERSION_V2 = 'accept/v2+seq';
 export const PROOF_LABEL = 'single-round proof-of-mechanism';
 export const NOT_CLAIMS = ['not flywheel proof', 'not compounding learning', 'not production learning'];
 function sha256(s) { return 'sha256:' + createHash('sha256').update(s).digest('hex'); }
@@ -73,22 +82,46 @@ export function assembleBundle(baseline, candidate, holdout, o) {
     // the per-task deltas must be > 0.
     const deltaCILow = bootstrapDeltaCILow(holdout.map((h) => h.candidateScore - h.baselineScore));
     const significant = deltaCILow > 0;
+    // v2 sequential term (ADR-381 §3): anytime-valid e-process over the paired
+    // per-task scores, at this bundle's allocated share of the family-wise alpha.
+    let sequentialEvidence;
+    if (o.sequential) {
+        const alphaTotal = o.sequential.alphaTotal ?? DEFAULT_ALPHA_TOTAL;
+        const lambda = o.sequential.lambda ?? DEFAULT_LAMBDA;
+        const verdict = sequentialEvidenceVerdict(holdout.map((h) => ({ taskId: h.taskId, baselineScore: h.baselineScore, candidateScore: h.candidateScore })), o.sequential.testIndex, { alphaTotal, lambda });
+        sequentialEvidence = {
+            version: SEQUENTIAL_EVIDENCE_VERSION,
+            testIndex: verdict.testIndex,
+            alphaTotal,
+            lambda,
+            alphaAllocated: verdict.alphaAllocated,
+            eValue: verdict.eValue,
+            threshold: verdict.threshold,
+            informativePairs: verdict.informativePairs,
+            significant: verdict.significant,
+        };
+    }
+    const ruleVersion = sequentialEvidence ? PROMOTION_RULE_VERSION_V2 : PROMOTION_RULE_VERSION;
     const verdictInputs = {
         heldOutScore: candidateHeldOut, baselineHeldOutScore: baselineHeldOut,
         redblue: o.redblue ?? 'PASS', drift: o.drift ?? 0, driftThreshold: 0.05,
         replayDeterministic: true, receiptCoverage: 1, canaryRollbackRate, baselineRollbackRate: 0,
     };
     const result = accept(verdictInputs);
-    const promoted = result.accept && significant;
+    const promoted = result.accept && significant && (sequentialEvidence?.significant ?? true);
     const baselineManifest = mkManifest(baseline, o.layer, o.corpus);
     const candidateManifest = mkManifest(candidate, o.layer, o.corpus);
     const baselineManifestHash = manifestHash(baselineManifest);
     const candidateManifestHash = manifestHash(candidateManifest);
     const inputHoldoutHash = sha256(canon(holdout));
-    const failed = [...result.failed, ...(!significant ? ['significant'] : [])];
+    const failed = [
+        ...result.failed,
+        ...(!significant ? ['significant'] : []),
+        ...(sequentialEvidence && !sequentialEvidence.significant ? ['sequential_evidence'] : []),
+    ];
     const decisionReceipt = {
-        promotionRuleVersion: PROMOTION_RULE_VERSION, verdictInputs, result, significant, deltaCILow, promoted,
-        reason: promoted ? `promoted (all ${PROMOTION_RULE_VERSION} terms held)` : `rejected — ${failed.join(', ')}`,
+        promotionRuleVersion: ruleVersion, verdictInputs, result, significant, deltaCILow, promoted,
+        reason: promoted ? `promoted (all ${ruleVersion} terms held)` : `rejected — ${failed.join(', ')}`,
     };
     const shadow = promoted ? {
         registrationId: sha256(`${candidateManifestHash}|gen${o.generation}|shadow`).replace('sha256:', 'shadow:'),
@@ -99,12 +132,16 @@ export function assembleBundle(baseline, candidate, holdout, o) {
     const promotion = promoted ? { parentManifestHash: o.parent, candidateManifestHash, mutationClass, mutationSummary, deltas, decisionReceipt } : null;
     const regression = promoted ? null : {
         candidateManifestHash, ancestor: o.parent ?? baselineManifestHash, mutationClass,
-        failureCause: !significant && result.accept ? 'significance' : (FAILURE_CAUSE[result.failed[0]] ?? 'holdout'), failedTerms: failed,
+        failureCause: result.accept
+            ? (!significant ? 'significance' : 'sequential')
+            : (FAILURE_CAUSE[result.failed[0]] ?? 'holdout'),
+        failedTerms: failed,
     };
     return {
         label: PROOF_LABEL, disclaimers: NOT_CLAIMS, generation: o.generation, parent: o.parent, branch: o.branch, kind: o.kind, createdAt: o.now,
         inputHoldoutHash, baselineManifestHash, candidateManifestHash,
-        meetsPromotionRule: { version: PROMOTION_RULE_VERSION, result: promoted },
+        meetsPromotionRule: { version: ruleVersion, result: promoted },
+        ...(sequentialEvidence ? { sequentialEvidence } : {}),
         decisionReceipt, shadow,
         costReceipt: { usd: 0, llmCalls: 0, tier: o.cost.tier, notes: o.cost.notes },
         mutationClass, mutationSummary, deltas, humanEvalHash: o.humanEvalHash, promotion, regression,
@@ -125,6 +162,7 @@ export function runRealEvolveRound(opts) {
         redblue: opts.redblue, drift: opts.drift, canaryRollbackRate: opts.canaryRollbackRate,
         humanRelevanceDelta: opts.humanRelevanceDelta, humanEvalHash: opts.humanEvalHash,
         layer: 'real/retrieval', corpus: opts.corpus,
+        sequential: opts.sequential,
     });
 }
 /**
@@ -182,16 +220,36 @@ export function verifyReceiptBundle(bundle) {
     const canaryRollbackRate = bundle.decisionReceipt.verdictInputs.canaryRollbackRate;
     const deltaCILow = bootstrapDeltaCILow(bundle.holdout.map((h) => h.candidateScore - h.baselineScore));
     const significant = deltaCILow > 0;
-    // Re-run the SAME versioned rule on independently-recomputed inputs.
-    const ruleVersionMatches = bundle.decisionReceipt.promotionRuleVersion === PROMOTION_RULE_VERSION
-        && bundle.meetsPromotionRule.version === PROMOTION_RULE_VERSION;
+    // Re-run the SAME versioned rule the bundle was decided under (pinned per
+    // bundle — a lineage may legitimately mix v1 and v2, ADR-381 §3). The rule
+    // version and the presence of the sequential record must agree.
+    const expectedVersion = bundle.sequentialEvidence ? PROMOTION_RULE_VERSION_V2 : PROMOTION_RULE_VERSION;
+    const ruleVersionMatches = bundle.decisionReceipt.promotionRuleVersion === expectedVersion
+        && bundle.meetsPromotionRule.version === expectedVersion;
     if (!ruleVersionMatches)
-        mismatches.push(`promotion rule version != ${PROMOTION_RULE_VERSION}`);
+        mismatches.push(`promotion rule version != ${expectedVersion} (or sequential record inconsistent with version)`);
+    // v2: replay the sequential e-process from the embedded holdout using the
+    // recorded testIndex/alphaTotal/lambda — the recorded verdict must recompute.
+    let sequentialOk = true;
+    if (bundle.sequentialEvidence) {
+        const s = bundle.sequentialEvidence;
+        try {
+            const replayed = sequentialEvidenceVerdict(bundle.holdout.map((h) => ({ taskId: h.taskId, baselineScore: h.baselineScore, candidateScore: h.candidateScore })), s.testIndex, { alphaTotal: s.alphaTotal, lambda: s.lambda });
+            sequentialOk = Math.abs(replayed.eValue - s.eValue) < 1e-9
+                && replayed.significant === s.significant
+                && replayed.informativePairs === s.informativePairs;
+        }
+        catch {
+            sequentialOk = false;
+        }
+        if (!sequentialOk)
+            mismatches.push('recorded sequential-evidence verdict does not recompute from the embedded holdout');
+    }
     const decision = accept({
         ...bundle.decisionReceipt.verdictInputs,
         heldOutScore: candidateHeldOut, baselineHeldOutScore: baselineHeldOut,
     });
-    const promotedRecomputed = decision.accept && significant;
+    const promotedRecomputed = decision.accept && significant && (bundle.sequentialEvidence ? bundle.sequentialEvidence.significant && sequentialOk : true);
     const decisionMatches = promotedRecomputed === bundle.decisionReceipt.promoted && promotedRecomputed === bundle.meetsPromotionRule.result;
     if (!decisionMatches)
         mismatches.push('recomputed decision != recorded decision');
@@ -208,10 +266,14 @@ export function verifyReceiptBundle(bundle) {
     if (!causalConsistent)
         mismatches.push('causal record inconsistent with the decision (promotion/regression/delta)');
     const valid = hashChecks.inputHoldout && hashChecks.baselineManifest && hashChecks.candidateManifest
-        && ruleVersionMatches && decisionMatches && noAutoServe && causalConsistent;
+        && ruleVersionMatches && decisionMatches && noAutoServe && causalConsistent && sequentialOk;
     const why = promotedRecomputed
-        ? `PASS under ${PROMOTION_RULE_VERSION}: held_out ${candidateHeldOut.toFixed(4)} > ${baselineHeldOut.toFixed(4)} (Δ CI-low ${deltaCILow.toFixed(4)} > 0, significant), canary rollback ${canaryRollbackRate} ≤ 0, all terms held`
-        : `FAIL under ${PROMOTION_RULE_VERSION}: ${[...decision.failed, ...(!significant ? ['significant'] : [])].join(', ')}`;
+        ? `PASS under ${expectedVersion}: held_out ${candidateHeldOut.toFixed(4)} > ${baselineHeldOut.toFixed(4)} (Δ CI-low ${deltaCILow.toFixed(4)} > 0, significant), canary rollback ${canaryRollbackRate} ≤ 0, all terms held`
+        : `FAIL under ${expectedVersion}: ${[
+            ...decision.failed,
+            ...(!significant ? ['significant'] : []),
+            ...(bundle.sequentialEvidence && !(bundle.sequentialEvidence.significant && sequentialOk) ? ['sequential_evidence'] : []),
+        ].join(', ')}`;
     return {
         valid, hashChecks,
         recomputed: { baselineHeldOut, candidateHeldOut, canaryRollbackRate, decision },

package/dist/src/services/flywheel-receipt.d.ts

@@ -1,3 +1,4 @@
+import { type PairedTaskOutcome } from './flywheel-sequential-evidence.js';
 export declare const RECEIPT_SCHEMA = "ruflo.flywheel-receipt/v1";
 export declare const RECEIPT_DOMAIN = "ruflo/flywheel-receipt/v1";
 export declare const GENESIS_LEDGER_HEAD: string;
@@ -66,6 +67,18 @@ export interface FlywheelReceiptPayload {
     baselineScore: string;
     candidateScore: string;
     heldOutDeltas: string[];
+    /**
+     * Task-level paired outcomes behind heldOutDeltas — same order, same length,
+     * per-task delta reproducible from the two scores. Optional in the payload
+     * so pre-existing receipts still verify byte-identically, but the promotion
+     * authority (flywheel-transaction.ts) REQUIRES it by default: aggregate-only
+     * evidence is refused rather than silently falling back to the weaker gate.
+     */
+    pairedOutcomes?: Array<{
+        taskId: string;
+        baselineScore: string;
+        candidateScore: string;
+    }>;
     statistics: PromotionStatistics;
     gates: Record<string, boolean>;
     resourceEvidence: ResourceEvidence;
@@ -97,6 +110,8 @@ export interface CreateReceiptInput {
     baselineScore: number;
     candidateScore: number;
     heldOutDeltas: number[];
+    /** Task-level paired outcomes behind heldOutDeltas (same order). */
+    pairedOutcomes?: PairedTaskOutcome[];
     frozenAnchorRegression: number;
     gates: Record<string, boolean>;
     resourceEvidence?: Partial<ResourceEvidence>;

package/dist/src/services/flywheel-receipt.js

@@ -7,6 +7,7 @@
  * tracked separately by flywheel-transaction.ts.
  */
 import { createHash, randomBytes, sign as edSign, verify as edVerify, } from 'node:crypto';
+import { checkPairedOutcomesConsistency } from './flywheel-sequential-evidence.js';
 export const RECEIPT_SCHEMA = 'ruflo.flywheel-receipt/v1';
 export const RECEIPT_DOMAIN = 'ruflo/flywheel-receipt/v1';
 export const GENESIS_LEDGER_HEAD = `sha256:${'0'.repeat(64)}`;
@@ -215,6 +216,15 @@ export function createFlywheelReceipt(input) {
         baselineScore: decimal(input.baselineScore),
         candidateScore: decimal(input.candidateScore),
         heldOutDeltas: input.heldOutDeltas.map((v) => decimal(v)),
+        ...(input.pairedOutcomes
+            ? {
+                pairedOutcomes: input.pairedOutcomes.map((o) => ({
+                    taskId: o.taskId,
+                    baselineScore: decimal(o.baselineScore),
+                    candidateScore: decimal(o.candidateScore),
+                })),
+            }
+            : {}),
         statistics,
         gates: input.gates,
         resourceEvidence: {
@@ -287,6 +297,18 @@ export function verifyFlywheelReceipt(receipt, trustedPublicKeys) {
             : 'rejected';
         if (receipt.payload.decision !== recomputedDecision)
             errors.push('receipt decision does not recompute');
+        if (receipt.payload.pairedOutcomes) {
+            // Paired outcomes must reproduce the aggregate they claim to back.
+            // Tolerance covers the decimal(scale 12) round-trip of both scores.
+            const paired = receipt.payload.pairedOutcomes.map((o) => ({
+                taskId: o.taskId,
+                baselineScore: Number(o.baselineScore),
+                candidateScore: Number(o.candidateScore),
+            }));
+            const check = checkPairedOutcomesConsistency(paired, receipt.payload.heldOutDeltas.map(Number), 1e-9);
+            if (!check.ok)
+                errors.push(`paired outcomes inconsistent: ${check.reasons.join('; ')}`);
+        }
         if (!receipt.signature) {
             errors.push('receipt is unsigned');
         }

package/dist/src/services/flywheel-sequential-evidence.d.ts

@@ -0,0 +1,102 @@
+/**
+ * Sequential promotion evidence — family-wise error control for an ADAPTIVE
+ * candidate stream (report item 2 / upstream @metaharness/flywheel 0.1.10
+ * `withSequentialEvidence` interop, implemented in-house so ruflo keeps the
+ * property with every MetaHarness package removed).
+ *
+ * THE GAP THIS CLOSES: every promotion gate ruflo runs (accept/v1+sig, the
+ * ruflo.flywheel-gate/v1 bootstrap) spends a FRESH alpha per candidate. A
+ * flywheel proposes candidates adaptively — each new candidate is chosen after
+ * looking at the last one's scores — so per-candidate alpha does not bound the
+ * probability that ANY promotion in the stream is false. Published
+ * measurements of greedy accept-if-improved loops put the false-commit rate at
+ * 30-42% under exactly this regime.
+ *
+ * TWO COMPOSED MECHANISMS, both required by the promotion authority:
+ *
+ * 1. Anytime-valid e-process per candidate (testing-by-betting). Per paired
+ *    task, a discordant pair multiplies the e-value by (1+lambda) when the
+ *    candidate wins and (1-lambda) when the baseline wins; concordant pairs
+ *    carry no information (McNemar). Under the null the e-value is a
+ *    non-negative martingale with expectation 1, so by Ville's inequality
+ *    P(e ever reaches 1/alpha) <= alpha — no penalty for peeking mid-stream.
+ *
+ * 2. Alpha allocation ACROSS candidates. Candidate k in the lineage's test
+ *    stream must clear 1/alpha_k where alpha_k = alphaTotal * 6/(pi^2 * k^2),
+ *    so sum(alpha_k) = alphaTotal for arbitrarily many adaptively-chosen
+ *    candidates. The allocation index is persisted per receipt in the
+ *    transaction state — looking spends alpha whether or not the candidate
+ *    promotes, and retrying the same receipt reuses its index (no double
+ *    spend, no index shopping).
+ *
+ * Family-wise guarantee: P(any false promotion, ever, in the stream)
+ * <= sum_k alpha_k = alphaTotal. The acceptance test for this module is the
+ * 1,000-null-simulation in flywheel-sequential-evidence.test.ts.
+ *
+ * Pure, $0, deterministic. Never throws on well-typed input.
+ */
+export declare const SEQUENTIAL_EVIDENCE_VERSION = "ruflo.sequential-evidence/v1";
+export declare const DEFAULT_ALPHA_TOTAL = 0.05;
+export declare const DEFAULT_LAMBDA = 0.5;
+/** Score tie-band: |candidate - baseline| <= epsilon is a concordant (uninformative) pair. */
+export declare const DEFAULT_SCORE_EPSILON = 1e-9;
+/** Task-level paired outcome — the evidence unit receipts must now carry. */
+export interface PairedTaskOutcome {
+    taskId: string;
+    baselineScore: number;
+    candidateScore: number;
+}
+export interface SequentialEvidenceConfig {
+    /** Total family-wise type-I budget across the WHOLE candidate stream. */
+    alphaTotal?: number;
+    /** Betting fraction in (0,1); 0.5 needs no tuning. */
+    lambda?: number;
+    /** Tie band on score comparisons. */
+    epsilon?: number;
+}
+export interface SequentialEvidenceVerdict {
+    significant: boolean;
+    eValue: number;
+    threshold: number;
+    alphaAllocated: number;
+    testIndex: number;
+    informativePairs: number;
+    totalPairs: number;
+    version: typeof SEQUENTIAL_EVIDENCE_VERSION;
+}
+/**
+ * Alpha share for the k-th test in the stream: alphaTotal * 6/(pi^2 k^2).
+ * Chosen over 2^-k because it decays polynomially — test 10 still gets a
+ * workable ~0.6% of a 5% budget instead of ~0.005%.
+ */
+export declare function alphaForTest(testIndex: number, alphaTotal?: number): number;
+/**
+ * Fold paired outcomes into an anytime-valid e-value and judge it against the
+ * k-th test's allocated alpha. Deterministic; order of outcomes does not
+ * change the final e-value (the product commutes).
+ */
+export declare function sequentialEvidenceVerdict(outcomes: PairedTaskOutcome[], testIndex: number, config?: SequentialEvidenceConfig): SequentialEvidenceVerdict;
+/**
+ * Minimum number of INFORMATIVE (discordant) pairs a candidate must win —
+ * with zero losses — to clear the k-th test's threshold: the smallest n with
+ * (1+lambda)^n >= 1/alpha_k. The pre-flight power check (ADR-381 §4): an
+ * evaluation whose promotion holdout is smaller than this cannot promote even
+ * on a perfect sweep, so it should be refused BEFORE compute is spent and
+ * before a doomed receipt can be presented to the gate (spending alpha).
+ */
+export declare function minInformativePairsToClear(testIndex: number, config?: SequentialEvidenceConfig): number;
+/** Family-wise budget left after `testsRun` allocated tests: alphaTotal - Σ alpha_k. */
+export declare function remainingAlphaBudget(testsRun: number, alphaTotal?: number): number;
+export interface PairedEvidenceCheck {
+    ok: boolean;
+    reasons: string[];
+}
+/**
+ * Structural consistency between a receipt's paired outcomes and its
+ * aggregate heldOutDeltas: same length and order, unique non-empty task IDs,
+ * and each delta must equal candidateScore - baselineScore. This is what makes
+ * paired outcomes EVIDENCE rather than decoration — an aggregate that cannot
+ * be reproduced from its own per-task rows is refused.
+ */
+export declare function checkPairedOutcomesConsistency(pairedOutcomes: PairedTaskOutcome[], heldOutDeltas: number[], tolerance?: number): PairedEvidenceCheck;
+//# sourceMappingURL=flywheel-sequential-evidence.d.ts.map