@evomap/evolver-core 2.0.0-beta.0

package/dist/exec/policy/destructive.d.ts

@@ -0,0 +1,45 @@
+import type { PolicyViolation } from './constraints.js';
+export interface NumstatRow {
+    /** The destination path (for a rename) or the changed path (otherwise). */
+    file: string;
+    /** The source path of a rename, when this row is a rename; undefined for a non-rename change. */
+    from?: string;
+    added: number;
+    deleted: number;
+}
+/**
+ * Resolve a numstat path field that may encode a rename into its source + destination paths. git emits a
+ * rename as ONE row whose path field is `old => new` OR a brace form `{old => new}`, `prefix/{old => new}`,
+ * `{old => new}/suffix`, or `prefix/{old => new}/suffix` (the common prefix/suffix factored out of the brace).
+ * Returns `{ from, to }` with both fully expanded (from===to and from===undefined-equivalent for a non-rename).
+ *   - `MEMORY.md => x.ts`            → { from: 'MEMORY.md',         to: 'x.ts' }
+ *   - `src/{old.ts => new.ts}`       → { from: 'src/old.ts',       to: 'src/new.ts' }
+ *   - `{a => b}/file.ts`             → { from: 'a/file.ts',        to: 'b/file.ts' }
+ *   - `a/{b => c}/d.ts`              → { from: 'a/b/d.ts',         to: 'a/c/d.ts' }
+ * A field with no `=>` is returned as { from: undefined, to: <path> }. Both sides are normalized.
+ */
+export declare function resolveRenamePaths(field: string): {
+    from?: string;
+    to: string;
+};
+/**
+ * Parse `git diff --numstat` output into per-file added/deleted counts (ported from v1 parseNumstatRows).
+ * Each row is `<added>\t<deleted>\t<path>`. Binary files report `-` for the counts → treated as 0. A rename
+ * row (`old => new` or the brace form `prefix/{old => new}/suffix`) keeps BOTH paths: `file` is the new path
+ * and `from` is the original — so a protected SOURCE moved out from under the guards is still visible (the
+ * rename-bypass fix). v1 only kept the new path; that let a rename of a protected file slip every check.
+ */
+export declare function parseNumstat(text: string): NumstatRow[];
+/**
+ * The set of original (source) paths of every rename in a numstat. A rename moves a file out from under the
+ * `--name-only` listing (which shows only the destination), so a protected SOURCE would otherwise be invisible
+ * to the protected-path guard. Surfacing these lets the policy treat a moved-away protected file as a touch.
+ */
+export declare function renameSourcePaths(numstat?: string): string[];
+/**
+ * GLOBAL destructive-change guard — ALWAYS enforced. Returns a violation for any critical-protected path whose
+ * numstat shows it was deleted or emptied (added === 0 && deleted > 0). Independent of any gene/constraints.
+ * When no numstat is available (caller didn't run `git diff --numstat`), returns [] — the protected-path guard
+ * still catches an EDIT to these paths; this only adds the stronger "it was wiped out" signal when we have it.
+ */
+export declare function detectDestructiveChanges(numstat?: string): PolicyViolation[];

package/dist/exec/policy/destructive.js

@@ -0,0 +1,108 @@
+// Destructive-change guard (ported from v1 src/gep/policyCheck.js detectDestructiveChanges + parseNumstatRows).
+// v1's heuristic: a critical-protected path that was DELETED (no longer on disk) or EMPTIED (size 0) after the
+// agent ran is destructive — the agent wiped out its own identity/config rather than editing it. v1 read that
+// from the live filesystem (fs.existsSync / statSync.size === 0) AFTER the cycle, which works against the repo
+// working tree. v2 runs the agent in a THROWAWAY worktree that is removed in claudeBridge's `finally`, so a
+// live-FS check at decision time is unreliable. Instead we read the same signal from `git diff --numstat`:
+//  - a deleted file → numstat row `added=0` with a positive deletion count (every line removed, file gone)
+//  - an emptied file → numstat row `added=0` with all prior lines deleted
+// Both collapse to "a critical-protected path with added=0 and deleted>0", which is the destructive case we
+// reject. This is a useful subset of v1's check that needs no live FS. DEFERRED vs v1: the exact
+// "file still exists but is now 0 bytes due to a separate truncation" distinction and the baselineUntracked
+// new-file exemption are not reproduced — numstat already only reports paths the diff actually changed, and a
+// freshly-added empty file shows added=0/deleted=0 (not flagged). Pure + deterministic over the numstat text.
+import { isCriticalProtectedPath } from './protectedPaths.js';
+const norm = (p) => String(p ?? '').replace(/\\/g, '/').replace(/^\.\/+/, '').trim();
+/**
+ * Resolve a numstat path field that may encode a rename into its source + destination paths. git emits a
+ * rename as ONE row whose path field is `old => new` OR a brace form `{old => new}`, `prefix/{old => new}`,
+ * `{old => new}/suffix`, or `prefix/{old => new}/suffix` (the common prefix/suffix factored out of the brace).
+ * Returns `{ from, to }` with both fully expanded (from===to and from===undefined-equivalent for a non-rename).
+ *   - `MEMORY.md => x.ts`            → { from: 'MEMORY.md',         to: 'x.ts' }
+ *   - `src/{old.ts => new.ts}`       → { from: 'src/old.ts',       to: 'src/new.ts' }
+ *   - `{a => b}/file.ts`             → { from: 'a/file.ts',        to: 'b/file.ts' }
+ *   - `a/{b => c}/d.ts`              → { from: 'a/b/d.ts',         to: 'a/c/d.ts' }
+ * A field with no `=>` is returned as { from: undefined, to: <path> }. Both sides are normalized.
+ */
+export function resolveRenamePaths(field) {
+    const raw = String(field ?? '').trim();
+    if (!raw.includes('=>'))
+        return { to: norm(raw) };
+    // Brace form: `prefix/{old => new}/suffix` — the prefix/suffix are shared, only the brace differs.
+    const brace = raw.match(/^(.*)\{([^{}]*)=>([^{}]*)\}(.*)$/);
+    if (brace) {
+        const prefix = brace[1] ?? '';
+        const suffix = brace[4] ?? '';
+        const join = (mid) => norm(`${prefix}${mid.trim()}${suffix}`.replace(/\/{2,}/g, '/'));
+        return { from: join(brace[2] ?? ''), to: join(brace[3] ?? '') };
+    }
+    // Plain form: `old => new`.
+    const [left, right] = raw.split('=>');
+    return { from: norm((left ?? '').trim()), to: norm((right ?? '').trim()) };
+}
+/**
+ * Parse `git diff --numstat` output into per-file added/deleted counts (ported from v1 parseNumstatRows).
+ * Each row is `<added>\t<deleted>\t<path>`. Binary files report `-` for the counts → treated as 0. A rename
+ * row (`old => new` or the brace form `prefix/{old => new}/suffix`) keeps BOTH paths: `file` is the new path
+ * and `from` is the original — so a protected SOURCE moved out from under the guards is still visible (the
+ * rename-bypass fix). v1 only kept the new path; that let a rename of a protected file slip every check.
+ */
+export function parseNumstat(text) {
+    const rows = [];
+    for (const line of String(text ?? '').split('\n').map((l) => l.trim()).filter(Boolean)) {
+        const parts = line.split('\t');
+        if (parts.length < 3)
+            continue;
+        const a = Number(parts[0]);
+        const d = Number(parts[1]);
+        const { from, to } = resolveRenamePaths(parts.slice(2).join('\t'));
+        rows.push({
+            file: to,
+            ...(from !== undefined && from !== to ? { from } : {}),
+            added: Number.isFinite(a) ? a : 0,
+            deleted: Number.isFinite(d) ? d : 0,
+        });
+    }
+    return rows;
+}
+/**
+ * The set of original (source) paths of every rename in a numstat. A rename moves a file out from under the
+ * `--name-only` listing (which shows only the destination), so a protected SOURCE would otherwise be invisible
+ * to the protected-path guard. Surfacing these lets the policy treat a moved-away protected file as a touch.
+ */
+export function renameSourcePaths(numstat) {
+    if (!numstat)
+        return [];
+    return parseNumstat(numstat)
+        .map((r) => r.from)
+        .filter((f) => !!f);
+}
+/**
+ * GLOBAL destructive-change guard — ALWAYS enforced. Returns a violation for any critical-protected path whose
+ * numstat shows it was deleted or emptied (added === 0 && deleted > 0). Independent of any gene/constraints.
+ * When no numstat is available (caller didn't run `git diff --numstat`), returns [] — the protected-path guard
+ * still catches an EDIT to these paths; this only adds the stronger "it was wiped out" signal when we have it.
+ */
+export function detectDestructiveChanges(numstat) {
+    const violations = [];
+    if (!numstat)
+        return violations;
+    for (const row of parseNumstat(numstat)) {
+        // Rename of a critical-protected SOURCE: the protected file is being MOVED/removed out from under the
+        // guards (it vanishes from `--name-only`, which lists only the destination). This is destructive
+        // regardless of the row's added/deleted counts — renaming MEMORY.md → harmless.ts (added>0) must NOT slip
+        // through. The rename-bypass fix (Bugbot): without this, the protected source disappears with no violation.
+        if (row.from && isCriticalProtectedPath(row.from)) {
+            violations.push({ kind: 'destructive', detail: `critical_file_renamed_or_removed: ${row.from} => ${row.file}` });
+            continue;
+        }
+        if (!row.file)
+            continue;
+        if (!isCriticalProtectedPath(row.file))
+            continue;
+        if (row.added === 0 && row.deleted > 0) {
+            violations.push({ kind: 'destructive', detail: `critical_file_deleted_or_emptied: ${row.file}` });
+        }
+    }
+    return violations;
+}

package/dist/exec/policy/failureMode.d.ts

@@ -0,0 +1,33 @@
+import type { PolicyViolation } from './constraints.js';
+export interface FailureMode {
+    mode: 'hard' | 'soft';
+    reasonClass: 'constraint_destructive' | 'constraint' | 'validation' | 'unknown';
+    retryable: boolean;
+}
+/**
+ * Classify the failure mode from the policy violations + whether validation passed (ported from v1
+ * classifyFailureMode). hard ⇒ not retryable (re-running the same change won't help); soft ⇒ retryable.
+ */
+export declare function classifyFailureMode(opts: {
+    violations?: readonly PolicyViolation[];
+    validationPassed?: boolean;
+}): FailureMode;
+/**
+ * Build a one-line, length-capped human failure reason from policy violations + an optional validation error
+ * (ported from v1 buildFailureReason — the constraint + validation arms; v2 has no canary/protocol arms here).
+ */
+export declare function buildFailureReason(opts: {
+    violations?: readonly PolicyViolation[];
+    validationError?: string;
+}): string;
+/**
+ * Expand a soft failure into the semantic learning tags the cycle records (ported from v1
+ * buildSoftFailureLearningSignals). Keeps only the problem:/risk:/area:/action: tags so the next selection can
+ * steer away from the same failure class, not the raw noise. Uses v2's expandSignals (signals/expand.ts).
+ */
+export declare function buildSoftFailureLearningSignals(opts: {
+    signals?: readonly string[];
+    violations?: readonly PolicyViolation[];
+    failureReason?: string;
+    validationText?: string;
+}): string[];

package/dist/exec/policy/failureMode.js

@@ -0,0 +1,49 @@
+// Structured failure classification + soft-failure learning signals (ported from v1 src/gep/policyCheck.js:
+// classifyFailureMode, buildFailureReason, buildSoftFailureLearningSignals). Pure functions over a run's
+// violations / validation result. They turn a failed cycle into (a) a one-line human reason, (b) a hard/soft
+// classification with a retryable flag, and (c) the semantic learning tags the cycle records so the next
+// selection can avoid the same trap. No canary/protocol arms in v2 (canary is intentionally not ported and
+// protocol violations are handled elsewhere) — the constraint/validation arms are what the exec bridge feeds.
+import { expandSignals } from '../../signals/expand.js';
+// A destructive/protected/over-cap/forbidden constraint breach is a HARD, non-retryable failure: retrying the
+// SAME mutation would just hit it again. A validation failure is SOFT/retryable (the agent can try a different
+// edit). Pattern mirrors v1 classifyFailureMode's `constraint_destructive` regex over the violation details.
+const DESTRUCTIVE_VIOLATION_RE = /HARD CAP BREACH|CRITICAL OVERRUN|critical_file_deleted_or_emptied|critical_path_modified|forbidden path|forbidden_path/i;
+/**
+ * Classify the failure mode from the policy violations + whether validation passed (ported from v1
+ * classifyFailureMode). hard ⇒ not retryable (re-running the same change won't help); soft ⇒ retryable.
+ */
+export function classifyFailureMode(opts) {
+    const violations = opts.violations ?? [];
+    const hasDestructive = violations.some((v) => DESTRUCTIVE_VIOLATION_RE.test(v.detail) || v.kind === 'destructive' || v.kind === 'protected_path');
+    if (hasDestructive)
+        return { mode: 'hard', reasonClass: 'constraint_destructive', retryable: false };
+    if (violations.length > 0)
+        return { mode: 'hard', reasonClass: 'constraint', retryable: false };
+    if (opts.validationPassed === false)
+        return { mode: 'soft', reasonClass: 'validation', retryable: true };
+    return { mode: 'soft', reasonClass: 'unknown', retryable: true };
+}
+/**
+ * Build a one-line, length-capped human failure reason from policy violations + an optional validation error
+ * (ported from v1 buildFailureReason — the constraint + validation arms; v2 has no canary/protocol arms here).
+ */
+export function buildFailureReason(opts) {
+    const reasons = [];
+    for (const v of opts.violations ?? [])
+        reasons.push(`constraint: ${v.detail}`);
+    if (opts.validationError)
+        reasons.push(`validation_failed: ${opts.validationError.slice(0, 200)}`);
+    return reasons.join('; ').slice(0, 2000) || 'unknown';
+}
+/**
+ * Expand a soft failure into the semantic learning tags the cycle records (ported from v1
+ * buildSoftFailureLearningSignals). Keeps only the problem:/risk:/area:/action: tags so the next selection can
+ * steer away from the same failure class, not the raw noise. Uses v2's expandSignals (signals/expand.ts).
+ */
+export function buildSoftFailureLearningSignals(opts) {
+    const signals = opts.signals ?? [];
+    const violationDetails = (opts.violations ?? []).map((v) => v.detail);
+    const extra = `${opts.failureReason ?? ''} ${opts.validationText ?? ''}`.trim();
+    return expandSignals([...signals, ...violationDetails], extra).filter((tag) => /^(problem|risk|area|action):/.test(tag));
+}

package/dist/exec/policy/index.d.ts

@@ -0,0 +1,24 @@
+import type { DiffStat } from '../proofOfWork.js';
+import { type ChangeConstraints, type PolicyViolation } from './constraints.js';
+export interface PolicyInput {
+    /** Parsed `git diff --shortstat` → {files, lines}. */
+    stat: DiffStat;
+    /** `git diff --name-only` → changed file list. */
+    changedFiles: readonly string[];
+    /** Optional `git diff --numstat` output — enables the destructive (delete/empty of a protected path) guard. */
+    numstat?: string;
+    /** Optional per-gene constraints. When absent, ONLY the always-on global guards run. */
+    constraints?: ChangeConstraints;
+}
+/**
+ * Run the full policy over a diff. The global guards (blast hard cap + protected paths + destructive) ALWAYS
+ * run, gene or not. The per-gene constraints run additionally when `constraints` is supplied. Returns the
+ * combined violation list (empty = the change is within policy). The order is: global blast cap → protected
+ * paths → destructive → per-gene constraints.
+ */
+export declare function checkPolicy(input: PolicyInput): PolicyViolation[];
+export * from './constraints.js';
+export * from './blastRadius.js';
+export * from './protectedPaths.js';
+export * from './destructive.js';
+export * from './failureMode.js';

package/dist/exec/policy/index.js

@@ -0,0 +1,30 @@
+import { checkBlastRadius } from './blastRadius.js';
+import { checkProtectedPaths } from './protectedPaths.js';
+import { detectDestructiveChanges, renameSourcePaths } from './destructive.js';
+import { checkChangeConstraints } from './constraints.js';
+/**
+ * Run the full policy over a diff. The global guards (blast hard cap + protected paths + destructive) ALWAYS
+ * run, gene or not. The per-gene constraints run additionally when `constraints` is supplied. Returns the
+ * combined violation list (empty = the change is within policy). The order is: global blast cap → protected
+ * paths → destructive → per-gene constraints.
+ */
+export function checkPolicy(input) {
+    const violations = [];
+    // ── Always-on global guards (fire even with no gene / no constraints) ──
+    violations.push(...checkBlastRadius(input.stat, input.constraints));
+    // A rename moves a file out from under `git diff --name-only` (which lists only the destination). Fold the
+    // rename SOURCE paths from `--numstat` into the protected-path check so renaming a protected file (e.g.
+    // MEMORY.md => harmless.ts) is still caught here — not only by the destructive guard below (rename-bypass fix).
+    violations.push(...checkProtectedPaths([...input.changedFiles, ...renameSourcePaths(input.numstat)]));
+    violations.push(...detectDestructiveChanges(input.numstat));
+    // ── Per-gene constraints (layer on top when a gene supplies them) ──
+    if (input.constraints) {
+        violations.push(...checkChangeConstraints(input.changedFiles, input.constraints, input.stat.lines));
+    }
+    return violations;
+}
+export * from './constraints.js';
+export * from './blastRadius.js';
+export * from './protectedPaths.js';
+export * from './destructive.js';
+export * from './failureMode.js';

package/dist/exec/policy/protectedPaths.d.ts

@@ -0,0 +1,17 @@
+import type { PolicyViolation } from './constraints.js';
+export declare const CRITICAL_PROTECTED_PREFIXES: readonly string[];
+export declare const CRITICAL_PROTECTED_FILES: readonly string[];
+/**
+ * Is `relPath` a critical-protected path? Ported from v1 isCriticalProtectedPath.
+ *  - prefix subtree: rel === "skills/evolver" OR rel starts with "skills/evolver/"
+ *  - protected file: any path segment chain ending in a protected file name (e.g. ".env", "config/.env",
+ *    "package.json", "a/b/MEMORY.md). v1 only matched a bare top-level name; we extend to a segment-boundary
+ *    match so a nested copy (e.g. "packages/x/.env" / "packages/x/package.json") is protected too — strictly
+ *    safer, and consistent with constraints.pathIsForbidden's bare-segment rule.
+ */
+export declare function isCriticalProtectedPath(relPath: string): boolean;
+/**
+ * GLOBAL protected-path guard — ALWAYS enforced. Returns one violation per changed file that touches a
+ * critical-protected path. Independent of any gene/constraints: a protected-path edit fails the cycle outright.
+ */
+export declare function checkProtectedPaths(changedFiles: readonly string[]): PolicyViolation[];

package/dist/exec/policy/protectedPaths.js

@@ -0,0 +1,65 @@
+// Directory prefixes whose entire subtree is protected (ported verbatim from v1 gitOps.js).
+export const CRITICAL_PROTECTED_PREFIXES = [
+    'skills/skill-tools/',
+    'skills/git-sync/',
+    'skills/evolver/',
+];
+// Individual protected files — the agent's identity/config/secret surface (ported verbatim from v1 gitOps.js).
+export const CRITICAL_PROTECTED_FILES = [
+    'MEMORY.md',
+    'SOUL.md',
+    'IDENTITY.md',
+    'AGENTS.md',
+    'USER.md',
+    'HEARTBEAT.md',
+    'RECENT_EVENTS.md',
+    'TOOLS.md',
+    'TROUBLESHOOTING.md',
+    'openclaw.json',
+    'evolver.json',
+    '.env',
+    'package.json',
+];
+const norm = (p) => String(p ?? '').replace(/\\/g, '/').replace(/^\.\/+/, '').trim();
+/**
+ * Is `relPath` a critical-protected path? Ported from v1 isCriticalProtectedPath.
+ *  - prefix subtree: rel === "skills/evolver" OR rel starts with "skills/evolver/"
+ *  - protected file: any path segment chain ending in a protected file name (e.g. ".env", "config/.env",
+ *    "package.json", "a/b/MEMORY.md). v1 only matched a bare top-level name; we extend to a segment-boundary
+ *    match so a nested copy (e.g. "packages/x/.env" / "packages/x/package.json") is protected too — strictly
+ *    safer, and consistent with constraints.pathIsForbidden's bare-segment rule.
+ */
+export function isCriticalProtectedPath(relPath) {
+    const rel = norm(relPath);
+    if (!rel)
+        return false;
+    for (const prefix of CRITICAL_PROTECTED_PREFIXES) {
+        const p = prefix.replace(/\/+$/, '');
+        if (rel === p || rel.startsWith(`${p}/`))
+            return true;
+    }
+    const segments = rel.split('/');
+    for (const f of CRITICAL_PROTECTED_FILES) {
+        if (rel === f)
+            return true;
+        if (segments[segments.length - 1] === f)
+            return true; // protected basename at any depth
+    }
+    return false;
+}
+/**
+ * GLOBAL protected-path guard — ALWAYS enforced. Returns one violation per changed file that touches a
+ * critical-protected path. Independent of any gene/constraints: a protected-path edit fails the cycle outright.
+ */
+export function checkProtectedPaths(changedFiles) {
+    const violations = [];
+    for (const file of changedFiles) {
+        const rel = norm(file);
+        if (!rel)
+            continue;
+        if (isCriticalProtectedPath(rel)) {
+            violations.push({ kind: 'protected_path', detail: `critical_path_modified: ${rel}` });
+        }
+    }
+    return violations;
+}

package/dist/exec/policyCheck.d.ts

@@ -0,0 +1,2 @@
+export { checkChangeConstraints, pathIsForbidden, summarizeViolations, type ChangeConstraints, type PolicyViolation, } from './policy/constraints.js';
+export { checkPolicy, type PolicyInput } from './policy/index.js';

package/dist/exec/policyCheck.js

@@ -0,0 +1,7 @@
+// Back-compat shim: the per-gene constraint checker moved into ./policy/ when the v1 policyCheck safety core
+// was ported as split modules (blast hard cap + protected paths + destructive + failure classification, all
+// behind the single checkPolicy entry point). Existing imports of checkChangeConstraints / pathIsForbidden /
+// summarizeViolations / ChangeConstraints / PolicyViolation keep working through this re-export — and the
+// full policy core is available from ./policy/index.ts (re-exported here too via checkPolicy).
+export { checkChangeConstraints, pathIsForbidden, summarizeViolations, } from './policy/constraints.js';
+export { checkPolicy } from './policy/index.js';

package/dist/exec/prompt.d.ts

@@ -0,0 +1,34 @@
+import type { Mutation } from '../wire/index.js';
+import type { GeneDecision } from '../algo/geneSelection.js';
+import type { PersonalityStateInput } from '../personality/schema.js';
+/** The slice of a selected gene that shapes the instruction (all optional — pass what the store has). */
+export interface GeneStrategyInfo {
+    strategy?: readonly string[];
+    preconditions?: readonly string[];
+    summary?: string;
+    constraints?: {
+        max_files?: number;
+        forbidden_paths?: readonly string[];
+    };
+    /** Provenance: whether this gene's content is trusted enough to embed into an autonomous agent's prompt.
+     *  The exec bridge's requireTrustedGene gate uses this; hub-ingested/unverified genes should be false. */
+    trusted?: boolean;
+    /** Reuse provenance (#113): when this strategy was fetched from the hub by reuse-before-solve (a HIT short-
+     *  circuited a fresh solve), the source asset id. Surfaced in the prompt so the run — and the user reading it
+     *  — sees that a ready-made solution was reused rather than re-derived. */
+    reusedFromAssetId?: string;
+}
+/** Neutralize blatant injection directives in untrusted embedded text and cap its length (finding #39.3). */
+export declare function sanitizeInjection(text: string, maxLen?: number): string;
+export interface ExecPromptInput {
+    mutation: Mutation;
+    decision: GeneDecision;
+    gene?: GeneStrategyInfo;
+    /** Validation commands the change must pass, if the caller resolved a validation plan. */
+    validationCmds?: readonly string[];
+    /** Evolvable personality for this run — injected as a behavioral-style block (personality use-case ①).
+     *  Absent ⇒ no style block (fully back-compatible). Pass the store's current state per run. */
+    personality?: PersonalityStateInput | null;
+}
+/** Build the agent instruction. Deterministic: same input → same text (no clock, no randomness). */
+export declare function renderExecPrompt(input: ExecPromptInput): string;

package/dist/exec/prompt.js

@@ -0,0 +1,108 @@
+import { reuseSourceNote } from '../ops/valueOutreach.js';
+import { renderPersonalityBlock } from '../personality/prompt.js';
+// Blatant prompt-injection directives to neutralize before embedding untrusted content (gene/signal text) into
+// an autonomous agent's instruction (finding #39.3). Heuristic defense-in-depth — the primary control is the
+// trust gate (only embed trusted gene strategies); this just blunts the obvious "ignore your instructions" /
+// fake-role-tag attacks in whatever content does flow through. Kept tight to avoid redacting real strategy text.
+const INJECTION_PATTERNS = [
+    /\b(ignore|disregard|forget)\b[^.\n]{0,40}\b(previous|above|prior|preceding|earlier|all)\b[^.\n]{0,30}\b(instruction|prompt|context|rule|message)/gi,
+    /\b(new|updated|real|actual)\b[^.\n]{0,20}\b(instruction|system prompt|task|directive)s?\s*:/gi,
+    /<\/?\s*(system|user|assistant|instructions?|im_start|im_end)\s*>/gi,
+    /^\s*(system|assistant|developer)\s*:/gim,
+    /\b(jailbreak|do anything now|DAN mode|developer mode)\b/gi,
+];
+/** Neutralize blatant injection directives in untrusted embedded text and cap its length (finding #39.3). */
+export function sanitizeInjection(text, maxLen = 800) {
+    let out = text;
+    for (const re of INJECTION_PATTERNS)
+        out = out.replace(re, '[redacted: possible prompt injection]');
+    if (out.length > maxLen)
+        out = out.slice(0, maxLen) + '…[truncated]';
+    return out;
+}
+const MAX_ANTI_WARNINGS = 3;
+const MAX_AVOID_ITEMS_PER_WARNING = 4;
+function renderAntiWarning(warning, index, sanitize) {
+    const id = warning.antiGeneId || warning.assetId || `anti-warning-${index + 1}`;
+    const head = [`${index + 1}. ${sanitize(id)}`];
+    if (warning.severity)
+        head.push(`[${sanitize(warning.severity)}]`);
+    if (warning.summary)
+        head.push(`- ${sanitize(warning.summary, 240)}`);
+    const lines = [head.join(' ')];
+    if (warning.trigger.length > 0)
+        lines.push(`   Trigger: ${sanitize(warning.trigger.join(', '), 240)}`);
+    for (const avoid of warning.avoid.slice(0, MAX_AVOID_ITEMS_PER_WARNING))
+        lines.push(`   Avoid: ${sanitize(avoid, 320)}`);
+    if (warning.rationale)
+        lines.push(`   Why: ${sanitize(warning.rationale, 320)}`);
+    return lines;
+}
+/** Build the agent instruction. Deterministic: same input → same text (no clock, no randomness). */
+export function renderExecPrompt(input) {
+    const { mutation: m, decision: d, gene, validationCmds, personality } = input;
+    const s = sanitizeInjection; // every embedded (potentially untrusted) field is sanitized (finding #39.3)
+    const lines = [
+        'You are an autonomous coding agent applying ONE focused, minimal change.',
+        '',
+        '## Goal',
+        s(m.expected_effect),
+        '',
+        '## Target',
+        `Area/file: ${s(m.target)}`,
+        `Category: ${m.category}   Risk: ${m.risk_level}`,
+        `Triggering signals: ${s(m.trigger_signals.join(', ')) || '(none)'}`,
+    ];
+    if (d.selectedGeneId && gene) {
+        lines.push('', `## Strategy (learned gene ${d.selectedGeneId})`);
+        // Reuse provenance (#113): a HIT from reuse-before-solve fetched this ready-made solution instead of solving
+        // fresh — surface that so the run/transcript shows WHERE it came from. assetId is content-addressed (safe to
+        // print as-is); still sanitized for defense-in-depth like every other embedded field.
+        if (gene.reusedFromAssetId)
+            lines.push(reuseSourceNote(s(gene.reusedFromAssetId)));
+        if (gene.summary)
+            lines.push(s(gene.summary));
+        const steps = gene.strategy ?? [];
+        steps.forEach((step, i) => lines.push(`${i + 1}. ${s(step)}`));
+        if (gene.preconditions && gene.preconditions.length > 0) {
+            lines.push(`Preconditions: ${s(gene.preconditions.join('; '))}`);
+        }
+    }
+    else {
+        // No matching gene — this is an innovate/explore path; the agent devises the approach.
+        lines.push('', '## Strategy', 'No prior gene matched — devise and apply a sound minimal approach yourself.');
+    }
+    if (d.antiWarnings && d.antiWarnings.length > 0) {
+        lines.push('', '## Avoid');
+        lines.push('Known repeated failure patterns matched this task. Treat these as guardrails, not executable strategy steps.');
+        for (const [index, warning] of d.antiWarnings.slice(0, MAX_ANTI_WARNINGS).entries()) {
+            lines.push(...renderAntiWarning(warning, index, s));
+        }
+    }
+    const c = gene?.constraints;
+    if (c && (c.max_files !== undefined || (c.forbidden_paths && c.forbidden_paths.length > 0))) {
+        const parts = [];
+        if (c.max_files !== undefined)
+            parts.push(`touch at most ${c.max_files} file(s)`);
+        if (c.forbidden_paths && c.forbidden_paths.length > 0)
+            parts.push(`never modify: ${c.forbidden_paths.join(', ')}`);
+        lines.push('', `## Constraints`, parts.join('; '));
+    }
+    // Personality style block (use-case ①): behavioral posture for HOW to execute, not what to do. The block
+    // is fully model-generated from a validated numeric state (no untrusted embedded text), so it is NOT run
+    // through sanitizeInjection. Rendered after strategy/constraints, before the done criteria.
+    if (personality) {
+        lines.push('', renderPersonalityBlock(personality));
+    }
+    lines.push('', '## Done criteria');
+    if (validationCmds && validationCmds.length > 0) {
+        lines.push('Your change must make these commands pass:');
+        for (const cmd of validationCmds)
+            lines.push(`- ${cmd}`);
+    }
+    else {
+        lines.push('Make the smallest change that achieves the goal.');
+    }
+    lines.push('Do NOT git commit — leave your edits in the working tree for inspection.');
+    return lines.join('\n');
+}

package/dist/exec/proofOfWork.d.ts

@@ -0,0 +1,9 @@
+import type { ProofOfWork } from '../schema/proofOfWork.js';
+export interface DiffStat {
+    files: number;
+    lines: number;
+}
+/** Parse `git diff --shortstat` output, e.g. " 3 files changed, 12 insertions(+), 4 deletions(-)". */
+export declare function parseGitShortstat(out: string): DiffStat;
+/** Build a git_diff ProofOfWork from a parsed diff stat. */
+export declare function gitDiffProof(stat: DiffStat, patchRef?: string): ProofOfWork;

package/dist/exec/proofOfWork.js

@@ -0,0 +1,11 @@
+/** Parse `git diff --shortstat` output, e.g. " 3 files changed, 12 insertions(+), 4 deletions(-)". */
+export function parseGitShortstat(out) {
+    const files = /(\d+)\s+files?\s+changed/.exec(out)?.[1];
+    const ins = /(\d+)\s+insertions?\(\+\)/.exec(out)?.[1];
+    const del = /(\d+)\s+deletions?\(-\)/.exec(out)?.[1];
+    return { files: Number(files ?? 0), lines: Number(ins ?? 0) + Number(del ?? 0) };
+}
+/** Build a git_diff ProofOfWork from a parsed diff stat. */
+export function gitDiffProof(stat, patchRef) {
+    return { kind: 'git_diff', gitDiff: { files: stat.files, lines: stat.lines, ...(patchRef ? { patchRef } : {}) } };
+}