@evomap/evolver-core 2.0.0-beta.9 → 2.0.1

package/dist/events/public.js

@@ -3,7 +3,7 @@ export { Replayer } from './replayer.js';
 export { eventCountsProjector, DEFAULT_PROJECTORS } from './projectors.js';
 export { LineTooLargeError, MAX_LINE_BYTES } from './eventStore.js';
 export { ArchiveSegmentConflictError, InvalidRootEventArchiveError, InvalidRootEventLogError, RootEventHistoryGapError, archiveRootEvents, inspectRootEventArchive, planRootEventArchive, readRootEventHistory, rootEventArchiveDir, rootEventArchiveSegmentName, validateRootEventHistory, ROOT_EVENT_ARCHIVE_DEFAULT_KEEP_EVENTS, } from './eventArchive.js';
-export { rootEventsPath, evomapHome, mvDir, personalityStatePath, assetsDir, materialDir, materialStorePath, materialWatermarkPath, tracesDir, assetCallLogPath } from './paths.js';
+export { rootEventsPath, evomapHome, mvDir, personalityStatePath, assetsDir, materialDir, materialStorePath, materialWatermarkPath, tracesDir, assetCallLogPath, learningTraceDir } from './paths.js';
 export { EVENT_SCHEMA_VERSION } from './eventSchema.js';
-export { readEvents, statusReport, listCycles, showCycle, listTriggers, dailySummary, buildNarrativeSnapshot, NARRATIVE_DEFAULT_LIMIT, NARRATIVE_MAX_LIMIT, } from './reports.js';
+export { readEvents, statusReport, listCycles, showCycle, listTriggers, dailySummary, dailyCapsuleCount, buildNarrativeSnapshot, NARRATIVE_DEFAULT_LIMIT, NARRATIVE_MAX_LIMIT, } from './reports.js';
 export { buildRetentionReport, defaultMaterialCursorPath, defaultMaterialCursorPaths, RETENTION_DEFAULT_MAX_MATERIAL_BYTES, RETENTION_DEFAULT_MAX_MATERIAL_RECORDS, RETENTION_DEFAULT_MAX_ROOT_BYTES, RETENTION_DEFAULT_MAX_ROOT_EVENTS, RETENTION_DEFAULT_ROOT_TAIL_EVENTS, RETENTION_DEFAULT_WATCH_RATIO, } from './retention.js';

package/dist/events/reports.d.ts

@@ -61,6 +61,8 @@ export interface DailySummary {
     suppressedFailures: number;
 }
 export declare function dailySummary(evts: readonly ReportEvent[], dayPrefix: string): DailySummary;
+/** 统计指定日期前缀的 capsule.produced 事件数. */
+export declare function dailyCapsuleCount(evts: readonly ReportEvent[], dayPrefix: string): number;
 export type NarrativeOutcome = 'success' | 'failed' | 'inert' | 'unknown';
 export interface NarrativeEntry {
     seq: number;

package/dist/events/reports.js

@@ -85,6 +85,10 @@ export function dailySummary(evts, dayPrefix) {
         suppressedFailures,
     };
 }
+/** 统计指定日期前缀的 capsule.produced 事件数. */
+export function dailyCapsuleCount(evts, dayPrefix) {
+    return evts.filter((e) => e.type === 'capsule.produced' && e.ts.startsWith(dayPrefix)).length;
+}
 export const NARRATIVE_DEFAULT_LIMIT = 30;
 export const NARRATIVE_MAX_LIMIT = 200;
 const NARRATIVE_EVENTS = new Set([

package/dist/exec/autoExec.d.ts

@@ -1,15 +1,18 @@
 import type { AssetStoreProvider } from '../assetstore/provider.js';
 import { type ProvenanceStore } from '../assetstore/provenance.js';
 import type { ReviewLedger } from '../assetstore/reviewLedger.js';
-import type { GeneCandidateInput } from '../algo/geneSelection.js';
+import type { GeneCandidateInput, SelectionGuardMode } from '../algo/geneSelection.js';
 import type { CycleEngine, ExecutionFailureKind, SolidifyPermitGate } from '../algo/cycleEngine.js';
 import { type AutonomousSafety } from './autonomousCycle.js';
-import type { GitRunner, ValidateHook } from './claudeBridge.js';
+import { type GitRunner, type ValidateHook } from './claudeBridge.js';
 import type { AgentRunner } from './runnerRegistry.js';
 import { type OpenPrLister } from './openPrRegistry.js';
 import type { ReuseOutcomeSummary, ReuseOutcomeEvent } from '../ops/reuseOutcomes.js';
 import type { PersonalityStore } from '../personality/store.js';
 import type { MemoryGraphProvider } from '../algo/memoryGraph.js';
+import type { SelectionPolicy } from '../algo/ucb1.js';
+import { type LearningPacketSink, type TraceSink } from '../trace/learningTrace.js';
+import type { TraceReadOptions } from '../trace/trajectoryExport.js';
 export interface AutoExecTask {
     id: string;
     repo: string;
@@ -104,12 +107,50 @@ export interface AutoExecDeps {
     memoryGraph?: MemoryGraphProvider;
     /** Optional daemon-level explicit strategy preset name, e.g. EVOLVE_STRATEGY. */
     strategyName?: string;
+    /** Emergency rollback for semantic IDF selection. Omit to keep IDF enabled. */
+    disableSemanticIdf?: boolean;
+    /** Experimental plateau selection policy. Omit to preserve engine-health + legacy drift. */
+    selectionPolicy?: SelectionPolicy;
+    /** Production relevance-guard rollout. Omit only for legacy/custom composition. */
+    selectionGuard?: SelectionGuardMode;
+    /** Optional score floor canary. Omit to keep the selector default of zero. */
+    selectionFloor?: number;
     /** Optional evolvable personality store shared with CycleEngine and the exec prompt. */
     personality?: PersonalityStore;
     /** Test/custom seam: inject a runner instead of spawning a real agent. */
     agent?: AgentRunner;
     /** Test/custom seam: inject git instead of spawning git. */
     git?: GitRunner;
+    /**
+     * Learning trace (Learning Ops slice 2): when set, each task run gets its own AgentRunTraceRecorder
+     * (traceId = the cycleId) emitting run.started/model.called/tool.failed/run.completed, and a
+     * LearningPacket draft is submitted here after the cycle. Best-effort: trace/packet failures never
+     * change the verdict. Omit → zero trace work, byte-identical to today.
+     */
+    learningTrace?: {
+        /** Where packet drafts go (file/memory/hub-adapter implementation). */
+        packetSink: LearningPacketSink;
+        /** Optional live per-event sink (e.g. FileTraceSink JSONL tail). */
+        traceSink?: TraceSink;
+        /** Hub packet sourceRepo column; default 'evolver-v2'. */
+        sourceRepo?: string;
+        /**
+         * Proxy llm_turn fold (Learning Ops slice 5): when set, after the cycle (and BEFORE run.completed, so
+         * sequence order holds) the run's wall-clock window of proxy trace records is read from `dir`
+         * (llm-trace-*.jsonl day-files) and folded into the recorder via recordLlmTurn — real per-request
+         * model.called + tool.called/tool.failed detail instead of only the bridge's coarse spawn event.
+         * Correlation is the time window + session-first-turn heuristic (see trace/proxyTurns.ts). Best-effort:
+         * a missing dir / unreadable file / no proxy degrades to zero folded turns, never a verdict change.
+         */
+        proxyTraces?: {
+            /** Proxy trace day-file dir (events/paths.ts tracesDir()). */
+            dir: string;
+            /** Decryption material for encrypted trace envelopes (allowPartial is always forced on). */
+            readOptions?: TraceReadOptions;
+            /** Injected clock for deterministic tests. Default Date.now. */
+            now?: () => number;
+        };
+    };
 }
 export interface ForcedGeneFields {
     forcedGeneId?: unknown;

package/dist/exec/autoExec.js

@@ -1,20 +1,16 @@
-// Autonomous-exec task runner — the productized per-task kernel a resident daemon polls (the deployment form
-// of the scratch autoexec daemon). One task → one fully-hardened evolution cycle, with a deny-by-default
-// allowlist pre-check that yields a clean "refused" verdict WITHOUT running anything when the repo is not
-// allowlisted. Secure by construction: the execute is built by makeSafeExecute (all six controls); callers
-// cannot bypass the safety composition.
-import { resolve as resolvePath, sep } from 'node:path';
 import { normalizeForPut } from '../assetstore/provider.js';
 import { ingestUntrusted } from '../assetstore/provenance.js';
 import { mergePendingSignalsForStore } from '../assetstore/pendingSignals.js';
 import { intakeGene } from '../algo/geneIntake.js';
 import { runEvolutionCycle } from '../algo/orchestrator.js';
 import { makeSafeExecute, makeTrustedGeneResolver } from './autonomousCycle.js';
+import { isWithinRoot } from './claudeBridge.js';
 import { findSignalHints } from './openPrRegistry.js';
+import { AgentRunTraceRecorder, buildLearningPacketDraft } from '../trace/learningTrace.js';
+import { collectRunLlmTurns } from '../trace/proxyTurns.js';
 /** Same path-containment as the bridge guard — used here to refuse before running anything (clean verdict). */
 function withinAllowlist(repo, roots) {
-    const c = resolvePath(repo);
-    return roots.some((root) => { const r = resolvePath(root); return c === r || c.startsWith(r.endsWith(sep) ? r : r + sep); });
+    return roots.some((root) => isWithinRoot(repo, root));
 }
 function cleanForcedGeneId(value) {
     if (typeof value !== 'string')
@@ -136,6 +132,24 @@ export async function runAutoExecTask(deps, rawTask, safety) {
     // that throws degrades to solving fresh (no hub candidates) rather than failing the task.
     let hubCandidates = [];
     const cycleId = `autoexec-${task.id}`;
+    // Learning trace (slice 2): one recorder per task run, traceId = cycleId so the trace joins the event log.
+    // Purely observational — every recorder call and the packet submit are wrapped so they can never change
+    // the verdict or fail the task.
+    const traceRecorder = deps.learningTrace
+        ? new AgentRunTraceRecorder({
+            runId: cycleId,
+            taskId: task.id,
+            ...(deps.learningTrace.traceSink ? { sink: deps.learningTrace.traceSink } : {}),
+        })
+        : undefined;
+    // Wall-clock window of this run, used to correlate the proxy's llm_turn records (slice 5). Captured
+    // unconditionally-cheaply only when the fold is configured.
+    const proxyTraceClock = deps.learningTrace?.proxyTraces?.now ?? Date.now;
+    let runStartMs = 0;
+    try {
+        traceRecorder?.runStarted({ taskSummary: task.expectedEffect, signals: cycleSignals, metadata: { repo: task.repo, target: task.target } });
+    }
+    catch { /* observability only */ }
     if (deps.hubReuse) {
         try {
             hubCandidates = await executableHubCandidates(deps, await deps.hubReuse(cycleSignals, { cycleId }));
@@ -144,15 +158,30 @@ export async function runAutoExecTask(deps, rawTask, safety) {
             hubCandidates = [];
         }
     }
+    runStartMs = deps.learningTrace?.proxyTraces ? proxyTraceClock() : 0;
+    // evaluation fill-in (slice 6): the validate hook is the run's external verifier (sandboxed validation
+    // commands), so its result — when it actually RAN — becomes the packet's evaluation.verification
+    // (verifier 'automated_test'). Observation is a pass-through wrapper: the hook's result reaches the
+    // bridge unchanged, and a run where validation never fired keeps the evaluation placeholder.
+    let observedVerification;
+    const baseValidate = deps.validate?.(task);
+    const observingValidate = baseValidate
+        ? async (mutation, decision, cwd) => {
+            const v = await baseValidate(mutation, decision, cwd);
+            observedVerification = { verifier: 'automated_test', passed: v.passed, ...(v.score !== undefined ? { score: v.score } : {}) };
+            return v;
+        }
+        : undefined;
     const execute = makeSafeExecute(task.repo, deps.store, safety, {
         ...(deps.provenance ? { provenance: deps.provenance } : {}),
         ...(deps.review ? { review: deps.review } : {}),
         ...(deps.includeProbation ? { includeProbation: true } : {}),
         ...(task.validationCmds ? { validationCmds: task.validationCmds } : {}),
-        ...(deps.validate ? { validate: deps.validate(task) } : {}),
+        ...(observingValidate ? { validate: observingValidate } : {}),
         ...(deps.personality ? { personality: deps.personality } : {}),
         ...(deps.agent ? { agent: deps.agent } : {}),
         ...(deps.git ? { git: deps.git } : {}),
+        ...(traceRecorder ? { traceRecorder } : {}),
     });
     const strategyName = task.strategyName ?? deps.strategyName;
     // Intentional semantics (see #308 review M1): a task carrying `strategy` — even without an
@@ -180,6 +209,10 @@ export async function runAutoExecTask(deps, rawTask, safety) {
         ...(deps.recallEvents ? { recallEvents: deps.recallEvents } : {}),
         ...(memoryGraphAdvice ? { memoryGraphAdvice } : {}),
         ...(strategyName !== undefined ? { strategyName } : {}),
+        ...(deps.disableSemanticIdf ? { disableSemanticIdf: true } : {}),
+        ...(deps.selectionPolicy ? { selectionPolicy: deps.selectionPolicy } : {}),
+        ...(deps.selectionGuard ? { selectionGuard: deps.selectionGuard } : {}),
+        ...(deps.selectionFloor !== undefined ? { selectionFloor: deps.selectionFloor } : {}),
         ...(cycleForcedGeneId !== undefined ? { forcedGeneId: cycleForcedGeneId } : {}),
         cycleId,
         problem: {
@@ -194,6 +227,40 @@ export async function runAutoExecTask(deps, rawTask, safety) {
     });
     const status = res.finalStage === 'solidified' ? 'solidified' : res.finalStage === 'failed' ? 'failed' : 'innovated';
     const cap = res.capsule;
+    if (traceRecorder && deps.learningTrace) {
+        // Proxy llm_turn fold (slice 5): fold the run window's per-request turns BEFORE run.completed so the
+        // trajectory stays sequence-ordered (model/tool detail inside the run, completion last). Own try — a
+        // throwing sink mid-fold must not cost the run its completion event or packet draft.
+        try {
+            const proxyTraces = deps.learningTrace.proxyTraces;
+            if (proxyTraces) {
+                const turns = collectRunLlmTurns(proxyTraces.dir, { startMs: runStartMs, endMs: proxyTraceClock() }, proxyTraces.readOptions ? { readOptions: proxyTraces.readOptions } : {});
+                for (const turn of turns)
+                    traceRecorder.recordLlmTurn(turn);
+            }
+        }
+        catch { /* observability only */ }
+        try {
+            traceRecorder.runCompleted({
+                status: res.finalStage === 'solidified' ? 'success' : 'failed',
+                ...(cap?.outcome?.score !== undefined ? { score: cap.outcome.score } : {}),
+                ...(res.reasons.length > 0 ? { reason: res.reasons.join('; ') } : {}),
+                ...(res.producedValue !== undefined ? { producedValue: res.producedValue } : {}),
+                ...(res.failureKind !== undefined ? { failureKind: res.failureKind } : {}),
+            });
+            await deps.learningTrace.packetSink.submit(buildLearningPacketDraft(traceRecorder, {
+                sourceRepo: deps.learningTrace.sourceRepo ?? 'evolver-v2',
+                taskSummary: task.expectedEffect,
+                signals: cycleSignals,
+                environment: {
+                    repo: task.repo,
+                    runner: safety.runner ?? (deps.agent ? 'claude' : 'codex'),
+                },
+                ...(observedVerification !== undefined ? { verification: observedVerification } : {}),
+            }));
+        }
+        catch { /* packet delivery is best-effort; never fail the task */ }
+    }
     if (deps.memoryGraph && res.decision?.selectedGeneId && (res.finalStage === 'solidified' || res.finalStage === 'failed')) {
         const producedSuccess = res.finalStage === 'solidified' && res.producedValue === true;
         try {

package/dist/exec/autonomousCycle.d.ts

@@ -4,8 +4,9 @@ import type { ReviewLedger } from '../assetstore/reviewLedger.js';
 import type { Mutation } from '../wire/index.js';
 import type { GeneDecision } from '../algo/geneSelection.js';
 import type { ExecutionResult } from '../algo/cycleEngine.js';
-import { type GeneResolver, type ValidateHook, type AgentRunnerOptions, type RunnerName, type AgentRunner, type GitRunner } from './claudeBridge.js';
+import { type GeneResolver, type ValidateHook, type AgentRunnerOptions, type AgentSessionResume, type RunnerName, type AgentRunner, type GitRunner } from './claudeBridge.js';
 import type { PersonalityStore } from '../personality/store.js';
+import type { AgentRunTraceRecorder } from '../trace/learningTrace.js';
 /**
  * Resolve a gene's strategy from the store and whether it is safe to EMBED into an autonomous agent's prompt —
  * the exec-side link from #30 (provenance ledger) and the review-state gate to #45 (requireTrustedGene gate). A
@@ -18,9 +19,11 @@ export declare function makeTrustedGeneResolver(store: AssetStoreProvider, prove
 export interface AutonomousSafety {
     /** Deny-by-default repo allowlist (#41). Required — an empty array refuses everything. */
     allowedRoots: readonly string[];
-    /** Which built-in runner (#66). Default 'claude'. The same safety controls wrap whichever runner. cursor is a scaffold (unverified). */
+    /** Which built-in runner (#66). Default 'codex'. The same safety controls wrap whichever runner. cursor is a scaffold (unverified). */
     runner?: RunnerName;
-    /** Agent runner options (#38/#40). Default: bounded skip-permissions (Read/Edit/Write). */
+    /** Explicit opt-in to continue a native session owned by the selected runner. */
+    resume?: AgentSessionResume;
+    /** Agent runner options (#38/#40). Default: no pre-authorized host access. */
     agentOptions?: AgentRunnerOptions;
     /** Strip evolver/hub secrets from the agent env (#42). Default true. */
     scrubEnv?: boolean;
@@ -32,10 +35,23 @@ export interface AutonomousSafety {
     /** Cooperative cancellation propagated to the spawned runner process tree. */
     signal?: AbortSignal;
 }
+export declare class UnsupportedCursorAutonomousIsolationError extends Error {
+    constructor();
+}
+export declare class UnsupportedAutonomousHostAccessError extends Error {
+    constructor();
+}
+export declare class UnsupportedAutonomousClaudeRunnerError extends Error {
+    constructor();
+}
+export declare class UnsupportedAutonomousCodexRunnerError extends Error {
+    constructor();
+}
+export declare function resolveAutonomousAgentOptions(runner: RunnerName | undefined, isolation: AutonomousSafety['isolation'], overrides?: AgentRunnerOptions): AgentRunnerOptions;
 /**
  * Build the fully-hardened `execute` for an autonomous run against `repo`. Composes every exec-bridge control
  * with secure defaults so they can't be forgotten piecemeal: deny-by-default allowedRoots (#41) + worktree
- * isolation (#43) + env scrub (#42) + bounded skip-permissions agent (#38/#40) + trusted-gene gate fed by
+ * isolation (#43) + env scrub (#42) + non-bypassing agent permissions (#38/#40) + trusted-gene gate fed by
  * provenance (#45/#30). Pass the result as runEvolutionCycle's `execute`.
  */
 export declare function makeSafeExecute(repo: string, store: AssetStoreProvider, safety: AutonomousSafety, opts?: {
@@ -47,4 +63,6 @@ export declare function makeSafeExecute(repo: string, store: AssetStoreProvider,
     personality?: PersonalityStore;
     agent?: AgentRunner;
     git?: GitRunner;
+    /** Optional learning-trace recorder forwarded to the exec bridge (Learning Ops slice 2). */
+    traceRecorder?: AgentRunTraceRecorder;
 }): (mutation: Mutation, decision: GeneDecision) => Promise<ExecutionResult>;

package/dist/exec/autonomousCycle.js

@@ -1,4 +1,4 @@
-import { makeClaudeExecBridge } from './claudeBridge.js';
+import { CLAUDE_SAFE_AUTONOMOUS_TOOLS, hasBoundedClaudeFileAccess, makeClaudeExecBridge, validateAgentSessionResume } from './claudeBridge.js';
 const asStrings = (v) => (Array.isArray(v) ? v.filter((x) => typeof x === 'string') : []);
 /**
  * Resolve a gene's strategy from the store and whether it is safe to EMBED into an autonomous agent's prompt —
@@ -33,19 +33,19 @@ export function makeTrustedGeneResolver(store, provenance, review, includeProbat
         return info;
     };
 }
-// Claude's safe default: bypass the permission prompts but BOUND the agent to file edits (#38/#40).
-const CLAUDE_DEFAULT_AGENT_OPTIONS = { skipPermissions: true, allowedTools: ['Read', 'Edit', 'Write'] };
-// Codex's safe default is SANDBOXED (no skip): the autonomous-bypass flag is gated until verified (#66), so
-// skipPermissions would throw at construction. `codex exec` still runs non-interactively under its own sandbox.
+// Keep Claude's project path checks enabled and expose only file/search tools.
+// Bash, web, task, and MCP tools remain unavailable.
+const CLAUDE_DEFAULT_AGENT_OPTIONS = {
+    permissionMode: 'acceptEdits',
+    tools: CLAUDE_SAFE_AUTONOMOUS_TOOLS,
+};
+// Codex workspace-write prevents host writes but does not contain host reads. It therefore remains explicit.
 const CODEX_DEFAULT_AGENT_OPTIONS = {};
-// Cursor's safe default keeps skip OFF (#66 SCAFFOLD). The runner is flag-confirmed via `cursor-agent --help`
-// but not yet run-verified end to end (needs an authed cursor-agent). The `-p --force --trust` bypass would
-// auto-approve shell+write, but Cursor has no verified per-run allowlist/sandbox mapping yet, so skipPermissions
-// is refused outright. Use default cursor with worktree isolation until the CLI is run-verified.
+// Cursor has no verified host filesystem/network sandbox. Worktree isolation cannot safely authorize `--trust`.
 const CURSOR_DEFAULT_AGENT_OPTIONS = {};
 // Gemini's verified safe default is `--approval-mode auto_edit`; shell remains gated and --yolo is refused.
 const GEMINI_DEFAULT_AGENT_OPTIONS = {};
-/** Per-runner safe default agent options — claude bypasses-with-bounds; codex + cursor stay non-bypassing (codex sandboxed; cursor skip refused, #66). */
+/** Per-runner safe default agent options. Host permission bypass is never enabled by default. */
 function defaultAgentOptions(runner) {
     if (runner === 'codex')
         return CODEX_DEFAULT_AGENT_OPTIONS;
@@ -55,24 +55,75 @@ function defaultAgentOptions(runner) {
         return GEMINI_DEFAULT_AGENT_OPTIONS;
     return CLAUDE_DEFAULT_AGENT_OPTIONS;
 }
+export class UnsupportedCursorAutonomousIsolationError extends Error {
+    constructor() {
+        super('Autonomous Cursor cannot use worktree isolation because --trust grants host filesystem and network access');
+        this.name = 'UnsupportedCursorAutonomousIsolationError';
+    }
+}
+export class UnsupportedAutonomousHostAccessError extends Error {
+    constructor() {
+        super('Autonomous Claude requires project-scoped acceptEdits with bounded file/search tools; host access bypass or unsupported tools are forbidden because a worktree is not a security boundary');
+        this.name = 'UnsupportedAutonomousHostAccessError';
+    }
+}
+export class UnsupportedAutonomousClaudeRunnerError extends Error {
+    constructor() {
+        super('Autonomous claude is disabled because its headless edit mode has no verified host filesystem sandbox; inject an externally sandboxed agent or explicitly select a runner after reviewing its host-access boundary');
+        this.name = 'UnsupportedAutonomousClaudeRunnerError';
+    }
+}
+export class UnsupportedAutonomousCodexRunnerError extends Error {
+    constructor() {
+        super('Autonomous codex is disabled because workspace-write does not restrict host filesystem reads; inject an externally sandboxed agent');
+        this.name = 'UnsupportedAutonomousCodexRunnerError';
+    }
+}
+export function resolveAutonomousAgentOptions(runner, isolation, overrides) {
+    const options = {
+        ...defaultAgentOptions(runner),
+        ...(isolation !== 'none' ? { workspaceTrust: 'isolated-worktree' } : {}),
+        ...(overrides ?? {}),
+    };
+    if (runner === 'cursor' && isolation !== 'none') {
+        throw new UnsupportedCursorAutonomousIsolationError();
+    }
+    const effectiveRunner = runner ?? 'claude';
+    const unsafeClaudeOptions = effectiveRunner === 'claude' && !hasBoundedClaudeFileAccess(options);
+    if (unsafeClaudeOptions) {
+        throw new UnsupportedAutonomousHostAccessError();
+    }
+    return options;
+}
 /**
  * Build the fully-hardened `execute` for an autonomous run against `repo`. Composes every exec-bridge control
  * with secure defaults so they can't be forgotten piecemeal: deny-by-default allowedRoots (#41) + worktree
- * isolation (#43) + env scrub (#42) + bounded skip-permissions agent (#38/#40) + trusted-gene gate fed by
+ * isolation (#43) + env scrub (#42) + non-bypassing agent permissions (#38/#40) + trusted-gene gate fed by
  * provenance (#45/#30). Pass the result as runEvolutionCycle's `execute`.
  */
 export function makeSafeExecute(repo, store, safety, opts = {}) {
+    const runner = safety.runner ?? (opts.agent ? undefined : 'claude');
+    if (safety.resume && runner)
+        validateAgentSessionResume(safety.resume, runner);
+    if (!opts.agent && runner === 'claude') {
+        throw new UnsupportedAutonomousClaudeRunnerError();
+    }
+    if (!opts.agent && runner === 'codex') {
+        throw new UnsupportedAutonomousCodexRunnerError();
+    }
     return makeClaudeExecBridge({
         cwd: repo,
         enabled: true,
         ...(opts.agent ? { agent: opts.agent } : {}),
         ...(opts.git ? { git: opts.git } : {}),
+        ...(opts.traceRecorder ? { traceRecorder: opts.traceRecorder } : {}),
         allowedRoots: safety.allowedRoots,
-        ...(safety.runner ? { runner: safety.runner } : {}),
+        ...(runner ? { runner } : {}),
+        ...(safety.resume ? { resume: safety.resume } : {}),
         ...(safety.isolation === 'none' ? {} : { isolation: 'worktree' }),
         scrubEnv: safety.scrubEnv ?? true,
         requireTrustedGene: safety.requireTrustedGene ?? true,
-        agentOptions: safety.agentOptions ?? defaultAgentOptions(safety.runner),
+        agentOptions: resolveAutonomousAgentOptions(runner, safety.isolation, safety.agentOptions),
         ...(safety.timeoutMs !== undefined ? { timeoutMs: safety.timeoutMs } : {}),
         ...(safety.signal ? { signal: safety.signal } : {}),
         resolveGene: makeTrustedGeneResolver(store, opts.provenance, opts.review, opts.includeProbation ?? false),

package/dist/exec/claudeBridge.d.ts

@@ -3,9 +3,10 @@ import type { GeneDecision } from '../algo/geneSelection.js';
 import type { ExecutionResult } from '../algo/cycleEngine.js';
 import { type GeneStrategyInfo } from './prompt.js';
 import type { PersonalityStore } from '../personality/store.js';
-import { type AgentRunner, type AgentRunnerOptions, type RunnerName } from './runnerRegistry.js';
-export { resolveSpawnCommand, spawnCapture, DEFAULT_MAX_CAPTURE_BYTES, UnboundedSkipPermissionsError, UnsupportedCursorSkipPermissionsError, UnsupportedGeminiPermissionOptionsError, claudeRunnerArgs, makeClaudeHeadlessRunner, claudeHeadlessRunner, codexRunnerArgs, makeCodexHeadlessRunner, cursorRunnerArgs, makeCursorHeadlessRunner, getRunnerSpec, geminiRunnerArgs, makeGeminiHeadlessRunner, classifyGeminiRunnerResult, } from './runnerRegistry.js';
-export type { AgentRunContext, AgentRunResult, AgentRunner, RunnerName, AgentRunnerOptions, ClaudeRunnerOptions, CodexRunnerOptions, AgentRunnerSpec, } from './runnerRegistry.js';
+import type { AgentRunTraceRecorder } from '../trace/learningTrace.js';
+import { type AgentRunner, type AgentRunnerOptions, type AgentSessionResume, type RunnerName } from './runnerRegistry.js';
+export { resolveSpawnCommand, spawnCapture, DEFAULT_MAX_CAPTURE_BYTES, MAX_AGENT_SESSION_ID_CHARS, AgentSessionResumeError, validateAgentSessionResume, UnboundedSkipPermissionsError, UnsupportedCodexPermissionOptionsError, UnsupportedCursorAllowedToolsError, UnsupportedCursorSkipPermissionsError, UnsupportedCursorWorkspaceTrustError, UnsupportedGeminiPermissionOptionsError, claudeRunnerArgs, makeClaudeHeadlessRunner, claudeHeadlessRunner, codexRunnerArgs, makeCodexHeadlessRunner, cursorRunnerArgs, makeCursorHeadlessRunner, getRunnerSpec, hasBoundedClaudeFileAccess, CLAUDE_SAFE_AUTONOMOUS_TOOLS, geminiRunnerArgs, makeGeminiHeadlessRunner, classifyGeminiRunnerResult, } from './runnerRegistry.js';
+export type { AgentRunContext, AgentRunResult, AgentRunner, RunnerName, AgentRunnerOptions, ClaudeRunnerOptions, CodexRunnerOptions, AgentRunnerSpec, AgentSessionResume, } from './runnerRegistry.js';
 export interface GitRunnerOptions {
     processSignalMode?: 'cancel' | 'ignore';
 }
@@ -31,6 +32,8 @@ export interface ExecBridgeOptions {
     agent?: AgentRunner;
     /** Which built-in runner to use when `agent` is not injected (#66). Default 'claude' (byte-identical). cursor is a scaffold (unverified runner). */
     runner?: RunnerName;
+    /** Explicit native session continuation. Must name the same runner selected above. */
+    resume?: AgentSessionResume;
     /** When `agent` is not injected, options for the built-in headless runner (permission bypass / allowed tools / model). */
     agentOptions?: AgentRunnerOptions;
     /** Default: spawns `git`. Inject a fake in tests. */
@@ -86,6 +89,12 @@ export interface ExecBridgeOptions {
      * the store's default state (store.load never throws), it never fails the run.
      */
     personality?: PersonalityStore;
+    /**
+     * Optional learning-trace recorder (Learning Ops slice 2): when set, the bridge emits `model.called` around
+     * each agent spawn and `tool.failed`/`retry.attempted` metadata on failures. Best-effort observability — a
+     * recorder/sink failure must never affect the execution result, so every emission is wrapped defensively.
+     */
+    traceRecorder?: AgentRunTraceRecorder;
 }
 export declare class ExecBridgeDisabledError extends Error {
     constructor();
@@ -98,19 +107,33 @@ export declare class ExecBridgeForbiddenError extends Error {
  * Thrown when a FULL-ACCESS (or unverified) agent run is requested without worktree isolation. The throwaway
  * worktree is the containment WE control — allowedRoots gates the cwd but cannot stop an auto-approved or
  * unsandboxed process writing/running outside it. Gated runners:
- *  - codex with skipPermissions → `--sandbox danger-full-access` (no inner OS sandbox). Without skip it stays
- *    workspace-write, so only the skip path is gated.
+ *  - codex permission overrides are refused by the runner because it has no enforceable per-tool allowlist.
  *  - cursor default → gated UNCONDITIONALLY. cursor-agent base `-p` already documents write+shell access, cursor
  *    skipPermissions is rejected by the runner layer, and the scaffold remains unverified (#66/#181) — so default
  *    cursor still needs the wrapper worktree rather than risk mutating the real tree.
- * claude is exempt: its skip is bounded by --allowedTools (finding #80).
+ * Claude is fail-closed below because a tool-name allowlist does not constrain absolute filesystem paths.
  */
 export declare class UnsandboxedFullAccessRequiresIsolationError extends Error {
     constructor();
 }
+export declare class WorkspaceTrustRequiresIsolationError extends Error {
+    readonly code = "WORKSPACE_TRUST_REQUIRES_ISOLATION";
+    constructor();
+}
+export declare class UnsupportedCursorBuiltInRunnerError extends Error {
+    constructor();
+}
+export declare class UnsupportedClaudeBuiltInRunnerError extends Error {
+    constructor();
+}
+export declare class UnsupportedCodexBuiltInRunnerError extends Error {
+    constructor();
+}
 export declare class UnsafeWorktreePathError extends Error {
     constructor(reason: string);
 }
+/** Whether `child` is the same as, or nested under, `root`, including filesystem symlink resolution. */
+export declare function isWithinRoot(child: string, root: string): boolean;
 /**
  * Whitelist-filter `env` for a spawned agent/tool: keep ONLY the minimal runtime env + the caller-declared
  * extras (the runner's own auth via allowPrefixes/allowKeys); drop everything else. Fail-safe by construction —
@@ -127,4 +150,6 @@ export declare const defaultGitPatchWriter: GitPatchWriter;
  * Build the `execute` function CycleEngine/runEvolutionCycle consume. Default-off: throws
  * ExecBridgeDisabledError on first call unless enabled.
  */
-export declare function makeClaudeExecBridge(opts: ExecBridgeOptions): (mutation: Mutation, decision: GeneDecision) => Promise<ExecutionResult>;
+export declare function makeClaudeExecBridge(opts: ExecBridgeOptions, internal?: {
+    cursorWorktreeRoot?: string;
+}): (mutation: Mutation, decision: GeneDecision) => Promise<ExecutionResult>;