@foldrun/core 2.4.0 → 2.6.0

package/dist/src/compare.js

@@ -0,0 +1,116 @@
+// Two runs of one flow side by side (FOL-72 step 6): "why did this get
+// worse" read off the records — which files changed between the revisions
+// they ran, and step by step what differs: status, the instruction, the
+// model, time, tokens, model calls, the tools it used and the errors it hit.
+// Pure; the caller hands in the changed files (history.ts changedPathsBetween).
+const firstLine = (s, n = 200) => {
+    const l = (s ?? "").split("\n").map((x) => x.trim()).find(Boolean);
+    return l ? l.slice(0, n) : null;
+};
+function side(s) {
+    const tools = {};
+    let toolErrors = 0;
+    for (const e of s.events) {
+        if (e.type !== "tool")
+            continue;
+        // A pair is one call: count the call, and its completion's error.
+        if (e.ms == null)
+            tools[e.text] = (tools[e.text] ?? 0) + 1;
+        else if (e.err)
+            toolErrors++;
+    }
+    const start = s.startedAt ? Date.parse(s.startedAt) : NaN;
+    const end = s.finishedAt ? Date.parse(s.finishedAt) : NaN;
+    return {
+        status: s.status,
+        instruction: s.instruction,
+        ...(s.model ? { model: s.model } : {}),
+        secs: Number.isFinite(start) && Number.isFinite(end) ? Math.max(0, Math.round((end - start) / 1000)) : null,
+        tokensIn: s.tokens?.input ?? 0,
+        tokensOut: s.tokens?.output ?? 0,
+        modelCalls: s.calls?.length ?? s.turns ?? 0,
+        tools,
+        toolErrors,
+        errors: s.events.filter((e) => e.type === "error").slice(0, 3).map((e) => firstLine(e.text) ?? ""),
+        said: firstLine(s.conclusion ?? s.result),
+    };
+}
+const k = (n) => (n >= 1000 ? `${(n / 1000).toFixed(1)}k` : String(n));
+/** Much more or much less: by a quarter and by a real amount. */
+const moved = (a, b, floor) => Math.abs(b - a) >= floor && (a === 0 ? b > 0 : Math.abs(b - a) / a >= 0.25);
+function changes(a, b) {
+    if (!a && b)
+        return ["new step: not in the base run"];
+    if (a && !b)
+        return ["not in this run"];
+    if (!a || !b)
+        return [];
+    const out = [];
+    if (a.status !== b.status)
+        out.push(`status: ${a.status} → ${b.status}`);
+    const newErrors = b.errors.filter((e) => !a.errors.includes(e));
+    if (newErrors.length)
+        out.push(`new error: ${newErrors[0]}`);
+    if (a.instruction.trim() !== b.instruction.trim())
+        out.push("instruction changed");
+    if ((a.model ?? "") !== (b.model ?? ""))
+        out.push(`model: ${a.model ?? "default"} → ${b.model ?? "default"}`);
+    if (b.toolErrors > a.toolErrors)
+        out.push(`tool errors: ${a.toolErrors} → ${b.toolErrors}`);
+    const names = new Set([...Object.keys(a.tools), ...Object.keys(b.tools)]);
+    const toolDiff = [...names]
+        .map((n) => ({ n, d: (b.tools[n] ?? 0) - (a.tools[n] ?? 0) }))
+        .filter((x) => x.d !== 0)
+        .sort((x, y) => Math.abs(y.d) - Math.abs(x.d))
+        .slice(0, 4)
+        .map((x) => `${x.d > 0 ? "+" : "−"}${x.n} ×${Math.abs(x.d)}`);
+    if (toolDiff.length)
+        out.push(`tools: ${toolDiff.join(", ")}`);
+    if (a.secs !== null && b.secs !== null && moved(a.secs, b.secs, 10))
+        out.push(`took ${a.secs}s → ${b.secs}s`);
+    if (moved(a.tokensIn, b.tokensIn, 5000))
+        out.push(`tokens in ${k(a.tokensIn)} → ${k(b.tokensIn)}`);
+    if (moved(a.modelCalls, b.modelCalls, 3))
+        out.push(`model calls ${a.modelCalls} → ${b.modelCalls}`);
+    if (a.said !== b.said && b.said)
+        out.push(`said: ${b.said}`);
+    return out;
+}
+/** Steps lined up: the flow's own steps by position where the agents agree,
+ *  fan-out instances by agent and order. */
+function align(a, b) {
+    const pairs = [];
+    const used = new Set();
+    b.forEach((s, i) => {
+        let j = a[i] && a[i].agent === s.agent && !used.has(i) ? i : -1;
+        if (j < 0)
+            j = a.findIndex((x, m) => !used.has(m) && x.agent === s.agent);
+        if (j >= 0)
+            used.add(j);
+        pairs.push([j >= 0 ? a[j] : null, s]);
+    });
+    a.forEach((s, m) => !used.has(m) && pairs.push([s, null]));
+    return pairs;
+}
+export function compareRuns(base, run, changedFiles = null) {
+    const head = (r) => ({ id: r.id, status: r.status, startedAt: r.startedAt, revision: r.revision ?? null });
+    return {
+        base: head(base),
+        run: head(run),
+        revisionChanged: (base.revision ?? null) !== (run.revision ?? null),
+        changedFiles,
+        steps: align(base.steps, run.steps).map(([a, b], i) => {
+            const sa = a ? side(a) : null;
+            const sb = b ? side(b) : null;
+            return { step: b ? run.steps.indexOf(b) + 1 : i + 1, agent: (b ?? a).agent, base: sa, run: sb, changes: changes(sa, sb) };
+        }),
+    };
+}
+/** The run to compare a run with when none is named: the newest earlier run
+ *  of the same flow that finished well (completed, not BLOCKED or BAD), or
+ *  null. `outcomeOf` is the caller's, so this stays free of the verdict reader. */
+export function lastGoodBefore(runs, run, good) {
+    return (runs
+        .filter((r) => r.flow === run.flow && r.id !== run.id && r.startedAt < run.startedAt && good(r))
+        .sort((a, b) => b.startedAt.localeCompare(a.startedAt))[0] ?? null);
+}

package/dist/src/completions.js

@@ -9,7 +9,7 @@
 // go here. No React, no fetch — so the rules are testable and one component
 // renders them.
 import { PROVIDERS } from "./providers.js";
-import { FRONTMATTER } from "./frontmatter-fields.js";
+import { FRONTMATTER, JOBS, fieldsOfJob } from "./frontmatter-fields.js";
 const MODELS = [
     { label: "fast", hint: "haiku — cheap, for checks and triage" },
     { label: "default", hint: "sonnet — the working default" },
@@ -37,6 +37,7 @@ const TOOL_GROUPS = [
     { label: "code", hint: "Bash — runs anything in the sandbox" },
     { label: "web", hint: "search, fetch, browse, crawl, map, extract, answer, monitor — providers under web:" },
     { label: "ask", hint: "ask_person — ask the person running the desk mid-step, and wait for the answer" },
+    { label: "peers", hint: "peers_list + peers_message — the colleagues running beside it in its parallel group, and a message to one of them" },
     { label: "install", hint: "install apt, pip or npm packages mid-step — every agent has it; disallowedTools: [install] removes it" },
 ];
 const SDK_TOOL_NAMES = [
@@ -586,8 +587,30 @@ export function completionsAt(path, text, cursor, vocab) {
             };
         }
     }
-    // 6. An indented option under a flow step.
-    if (kind === "flow" && /^\s+[a-z]*$/.test(line) && line.trim().length >= 0) {
+    // 5b. An indented line inside one of the four job blocks (governance,
+    //     guardrail, observability, evaluation): that job's fields for this
+    //     kind of file — the block takes nothing else.
+    const fmClose = text.indexOf("\n---", text.indexOf("---") + 3);
+    const insideFrontmatter = text.startsWith("---") && (fmClose === -1 || cursor <= fmClose);
+    const nested = line.match(/^(\s+)([a-zA-Z_]*)$/);
+    if (insideFrontmatter && nested) {
+        const header = before.slice(0, lineStart).split("\n").reverse().find((l) => /^\S/.test(l));
+        const job = JOBS.find((j) => new RegExp(`^${j.name}\\s*:\\s*$`).test(header ?? ""));
+        if (job) {
+            const schemaKind = /(^|\/)AGENTS\.md$/.test(path) || path === "project.md" ? "agents-md" : SCHEMA_OF[kind];
+            const keys = new Set(schemaKind ? fieldsOfJob(schemaKind, job.name) : []);
+            const partial = nested[2] ?? "";
+            return {
+                from: cursor - partial.length,
+                query: partial,
+                items: filter(fieldsFor(path, kind).filter((c) => keys.has(c.label.split(".")[0])), partial),
+                title: `${job.title} — ${job.what}`,
+            };
+        }
+    }
+    // 6. An indented option under a flow step — the body's steps, never a
+    //    line inside the frontmatter.
+    if (kind === "flow" && !insideFrontmatter && /^\s+[a-z]*$/.test(line) && line.trim().length >= 0) {
         const partial = line.trim();
         return {
             from: cursor - partial.length,

package/dist/src/deploy.d.ts

@@ -47,7 +47,27 @@ export interface DeployResult extends DeployPlan {
  * other things is the normal case, not an error.
  */
 export declare const SUBAGENT_IMPORT_DIRS: readonly [".agents/agents", ".claude/agents"];
-export declare function readTree(dir: string): DeployFile[];
+/** Bounds for a reader that only looks at the text (the checks, the
+ *  assistant): on 20 Oct 2026 the daily rescan read one desk's 1.2 GB of
+ *  state/ into a 2 GB heap and crash-looped the worker. A deploy sets none. */
+export interface ReadTreeOptions {
+    /** Data (DATA_PATH) larger than this is left out, unread. */
+    maxDataFileBytes?: number;
+    /** Data past this many bytes in all, or this many files, is left out. */
+    maxDataBytes?: number;
+    maxDataFiles?: number;
+    /** Everything else past this many bytes in all: readTree throws
+     *  TreeTooLarge rather than return a part of the definitions, which a
+     *  check would read as missing agents and flows. */
+    maxSourceBytes?: number;
+    /** Each data file left out, and its size. */
+    onSkip?: (path: string, bytes: number) => void;
+}
+export declare class TreeTooLarge extends Error {
+    /** What an HTTP route answers with it. */
+    readonly status = 413;
+}
+export declare function readTree(dir: string, opts?: ReadTreeOptions): DeployFile[];
 /**
  * Everything wrong with an incoming workspace, before any of it is live.
  *
@@ -77,6 +97,21 @@ export declare function unopenedFrontmatter(raw: string): string | null;
  * advice (an agent that could leak, an unpinned package) is for `foldrun
  * check` and the Checks page, not for every deploy's output.
  */
+/**
+ * What `deploy_block:` in AGENTS.md refuses (FOL-58). `none`, the default:
+ * the scanner's findings are warnings and the deploy goes ahead, as it always
+ * did. `secrets`: a key or password written into a file is refused.
+ * `security`: every security finding is — secrets, hidden or injected text,
+ * the lethal trifecta, pipe-to-shell, an unpinned MCP server, a step that
+ * acts outside with no check or approval. A
+ * `foldrun-ignore` with a reason still accepts one.
+ */
+export declare const DEPLOY_BLOCK_MODES: readonly ["none", "secrets", "security"];
+export type DeployBlockMode = (typeof DEPLOY_BLOCK_MODES)[number];
+/** The workspace's own AGENTS.md, else the account's, else none. */
+export declare function deployBlockMode(files: DeployFile[], accountKeys: Record<string, unknown>): DeployBlockMode;
+/** The findings `mode` turns into refusals, as deploy issues. */
+export declare function deployBlockers(files: DeployFile[], mode: DeployBlockMode, options?: ScanOptions): DeployIssue[];
 export declare function deployWarnings(files: DeployFile[]): DeployIssue[];
 /**
  * Everything the platform can say about a workspace's files, as findings

package/dist/src/deploy.js

@@ -20,20 +20,27 @@
 import fs from "node:fs";
 import os from "node:os";
 import path from "node:path";
-import { saveWorkspace, keptOnDeploy, workspaceDir, listRunSummaries, listWorkspaceFiles, parseFlow, parseToolDef, WORKSPACE_DIRS, assertSafeName, } from "./store.js";
-import { lintFlow } from "./flow-lint.js";
+import { saveWorkspace, keptOnDeploy, workspaceDir, listRunSummaries, listWorkspaceFiles, parseFlow, parseToolDef, WORKSPACE_DIRS, assertSafeName, accountDir, frontmatterErrorText, } from "./store.js";
+import { readAgentsMdKeys } from "./agents-md.js";
+import { libraryTools } from "./library.js";
+import { lintFlow, regexProblem } from "./flow-lint.js";
+import { parseEval } from "./evals.js";
 import { refNames } from "./refs.js";
-import matter from "gray-matter";
+import matter, { configMatter } from "./matter.js";
+import { frontmatterProblems, schemaKindOf } from "./frontmatter-schema.js";
 import { conformanceIssues } from "./okf.js";
 import { timezoneProblem } from "./clock.js";
 import { webProblems, webWarnings, runnerEngines } from "./providers.js";
 import { readLimits } from "./limits.js";
+import { parseAlerts } from "./alerts.js";
+import { parseTelemetry } from "./otel-config.js";
+import { parseJudge } from "./judge-verdict.js";
 import { networkProblems } from "./network.js";
 import { actionProblems } from "./web-actions.js";
 import { languageProblem } from "./language.js";
 import { localeProblems } from "./locale.js";
 import { entriesNoFollow } from "./paths.js";
-import { filterIgnored, findingFingerprint, ruleForWhere, scanFiles } from "./scan.js";
+import { filterIgnored, findingFingerprint, ruleForWhere, scanFiles, scanRule, STRICT_FRONTMATTER_PATH } from "./scan.js";
 /** Directories a deploy never reads out of a source tree. */
 // `.cache` is what a run's tools leave in an agent's folder (HOME is that
 // folder): logs and font caches, never authored.
@@ -73,9 +80,40 @@ export function isSourcePath(rel) {
 // head. Shared by the deploy import (readTree) and the CLI checker so the two
 // agree on what counts as an agent.
 export const SUBAGENT_IMPORT_DIRS = [".agents/agents", ".claude/agents"];
-export function readTree(dir) {
+/** What agents write as they run, not what anyone authored: state/ and
+ *  memory/, the workspace's or one agent's. */
+const DATA_PATH = /^(?:agents\/[^/]+\/)?(?:state|memory)\//;
+export class TreeTooLarge extends Error {
+    /** What an HTTP route answers with it. */
+    status = 413;
+}
+export function readTree(dir, opts = {}) {
     const root = path.resolve(dir);
     const out = [];
+    let dataBytes = 0;
+    let dataFiles = 0;
+    let sourceBytes = 0;
+    /** May this file be read? Data over its budget is left out; source over
+     *  its budget ends the read. */
+    const admit = (rel, bytes) => {
+        if (DATA_PATH.test(rel)) {
+            const over = (opts.maxDataFileBytes !== undefined && bytes > opts.maxDataFileBytes) ||
+                (opts.maxDataBytes !== undefined && dataBytes + bytes > opts.maxDataBytes) ||
+                (opts.maxDataFiles !== undefined && dataFiles >= opts.maxDataFiles);
+            if (over) {
+                opts.onSkip?.(rel, bytes);
+                return false;
+            }
+            dataBytes += bytes;
+            dataFiles++;
+            return true;
+        }
+        sourceBytes += bytes;
+        if (opts.maxSourceBytes !== undefined && sourceBytes > opts.maxSourceBytes) {
+            throw new TreeTooLarge(`the workspace's files other than state/ and memory/ are over ${Math.round(opts.maxSourceBytes / 1048576)} MiB — not read`);
+        }
+        return true;
+    };
     const walk = (abs, rel) => {
         let entries;
         try {
@@ -104,6 +142,8 @@ export function readTree(dir) {
                 walk(full, next);
             }
             else if (next === "AGENTS.md" || next === "project.md" || IN_WORKSPACE_DIR.test(next)) {
+                if (!admit(next, stat.size))
+                    continue;
                 out.push({ path: next, content: fs.readFileSync(full, "utf8") });
             }
         }
@@ -143,11 +183,16 @@ export function readTree(dir) {
                 continue;
             const full = path.join(root, importDir, entry);
             try {
-                if (fs.lstatSync(full).isSymbolicLink())
+                const st = fs.lstatSync(full);
+                if (st.isSymbolicLink())
+                    continue;
+                if (!admit(target, st.size))
                     continue;
                 out.push({ path: target, content: fs.readFileSync(full, "utf8") });
             }
-            catch {
+            catch (err) {
+                if (err instanceof TreeTooLarge)
+                    throw err;
                 // an unreadable import is skipped, not fatal
             }
         }
@@ -195,6 +240,89 @@ export function unopenedFrontmatter(raw) {
  * advice (an agent that could leak, an unpinned package) is for `foldrun
  * check` and the Checks page, not for every deploy's output.
  */
+/**
+ * What `deploy_block:` in AGENTS.md refuses (FOL-58). `none`, the default:
+ * the scanner's findings are warnings and the deploy goes ahead, as it always
+ * did. `secrets`: a key or password written into a file is refused.
+ * `security`: every security finding is — secrets, hidden or injected text,
+ * the lethal trifecta, pipe-to-shell, an unpinned MCP server, a step that
+ * acts outside with no check or approval. A
+ * `foldrun-ignore` with a reason still accepts one.
+ */
+export const DEPLOY_BLOCK_MODES = ["none", "secrets", "security"];
+const blockMode = (v) => typeof v === "string" && DEPLOY_BLOCK_MODES.includes(v.trim()) ? v.trim() : null;
+/** The workspace's own AGENTS.md, else the account's, else none. */
+export function deployBlockMode(files, accountKeys) {
+    // project.md is the older name readAgentsMdKeys still reads (Codex review).
+    const own = files.find((f) => f.path === "AGENTS.md") ?? files.find((f) => f.path === "project.md");
+    let fromWorkspace = null;
+    if (own) {
+        try {
+            fromWorkspace = blockMode(configMatter(own.content).data.deploy_block);
+        }
+        catch {
+            // an AGENTS.md that does not parse is reported elsewhere
+        }
+    }
+    return fromWorkspace ?? blockMode(accountKeys.deploy_block) ?? "none";
+}
+function blockersFor(tenant, given) {
+    // The tree as it will be written: `./AGENTS.md` is saved as AGENTS.md, so
+    // it is read as that here too (Codex review).
+    // Two entries for one path: the save keeps the last, so this does too.
+    const byPath = new Map();
+    for (const f of given) {
+        // path.normalize, as saveWorkspace writes it (a backslash is a filename
+        // character here, not a separator — Codex review).
+        const p = path.normalize(f.path);
+        byPath.set(p, { ...f, path: p });
+    }
+    const files = [...byPath.values()];
+    const account = readAgentsMdKeys(accountDir(tenant));
+    const mode = deployBlockMode(files, account);
+    if (mode === "none")
+        return [];
+    // Nearest wins: a workspace tool of the same name replaces the library's,
+    // and the scanner adds the workspace's own outward tools itself. Named as
+    // the runtime names them — the definition's name:, else the file's.
+    const ownTools = new Set();
+    for (const f of files) {
+        const m = /^tools\/([^/]+?)(?:\/tool)?\.md$/.exec(f.path);
+        if (!m)
+            continue;
+        let data = {};
+        try {
+            data = matter(f.content).data;
+        }
+        catch {
+            continue; // unreadable: the runtime skips it and keeps the library's
+        }
+        // Only a definition the runtime accepts replaces the library's; an
+        // invalid one is skipped there, and the library tool stays (Codex review).
+        const def = parseToolDef(data, m[1], f.content);
+        if (def)
+            ownTools.add(def.name ?? m[1]);
+    }
+    const outwardTools = Object.entries(libraryTools(tenant))
+        .filter(([n, d]) => d.outward === true && !ownTools.has(n))
+        .map(([n]) => n);
+    return deployBlockers(files, mode, { accountNetwork: account.network, outwardTools });
+}
+/** The findings `mode` turns into refusals, as deploy issues. */
+export function deployBlockers(files, mode, options = {}) {
+    if (mode === "none")
+        return [];
+    // Every finding checkFiles reports — the scanner's and the structural
+    // ones, flow/outward-ungated among them (Codex review) — with the same
+    // ignores honoured, kept by its rule's category.
+    const categories = new Set(mode === "secrets" ? ["secret"] : ["secret", "content", "security", "supply-chain"]);
+    return checkFiles(files, options)
+        .filter((f) => f.level !== "info" && categories.has(scanRule(f.rule)?.category ?? ""))
+        .map((f) => ({
+        where: `${f.file}${f.line ? `:${f.line}` : ""}`,
+        message: `${f.message} [${f.rule}] — refused: deploy_block: ${mode} in AGENTS.md`,
+    }));
+}
 export function deployWarnings(files) {
     const scanned = scanFiles(files, { only: ["secret", "content"] })
         .filter((f) => f.level !== "info")
@@ -217,11 +345,11 @@ export function checkFiles(files, options = {}) {
     };
     const own = [
         ...deployIssues(files).map((i) => finding(i, "error")),
-        ...structuralWarnings(files).map((i) => finding(i, "warn", i.kind)),
+        ...structuralWarnings(files, options.outwardTools).map((i) => finding(i, "warn", i.kind)),
     ];
     return [...filterIgnored(own, files), ...scanFiles(files, options)].sort((a, b) => a.file.localeCompare(b.file) || (a.line ?? 0) - (b.line ?? 0) || a.rule.localeCompare(b.rule));
 }
-function structuralWarnings(files) {
+function structuralWarnings(files, extraOutward = []) {
     const front = (content) => {
         try {
             return matter(content).data;
@@ -230,8 +358,9 @@ function structuralWarnings(files) {
             return {};
         }
     };
-    // Workspace tools that change something outside the workspace.
-    const outwardTools = new Set();
+    // Tools that change something outside the workspace: the workspace's own,
+    // and the library's the caller resolved (nearest wins already applied).
+    const outwardTools = new Set(extraOutward);
     for (const f of files) {
         const m = f.path.match(/^tools\/([^/]+?)(?:\/tool)?\.md$/);
         if (!m)
@@ -242,6 +371,9 @@ function structuralWarnings(files) {
         // and the CLI use; parseToolDef does not fold it onto the def.
         if (def && data.outward === true)
             outwardTools.add(def.name ?? m[1]);
+        // A workspace tool that is not outward replaces a library one that was.
+        else if (def)
+            outwardTools.delete(def.name ?? m[1]);
     }
     // Agents that grant one of them.
     const outwardAgents = [];
@@ -265,6 +397,41 @@ function structuralWarnings(files) {
         for (const w of webWarnings(data, { chrome, chromium }))
             out.push({ where: f.path, message: w });
     }
+    // An eval's `matches:` is the same JavaScript RegExp as a verify's; one
+    // that does not compile fails its case on every run. Read through
+    // parseEval, so a block scalar (`matches: |`) or a continued line is
+    // tested as the runtime will run it. The line is the item's own: the
+    // parsed assertions and the `- matches:` lines come in the same order.
+    for (const f of files) {
+        if (!/^evals\/[^/]+\.md$/.test(f.path))
+            continue;
+        let info;
+        try {
+            info = parseEval(f.path, f.content);
+        }
+        catch {
+            continue;
+        }
+        const lines = [];
+        f.content.split("\n").forEach((line, n) => { if (/^\s*-\s*matches:/.test(line))
+            lines.push(n + 1); });
+        // When a `- matches:` line sits outside a case (an example in the
+        // prose), the order no longer pairs up: name the file, not a wrong line.
+        const parsed = info.cases.reduce((n, c) => n + c.expect.filter((a) => a.type === "matches").length, 0);
+        const pairs = lines.length === parsed;
+        let k = 0;
+        for (const c of info.cases) {
+            for (const a of c.expect) {
+                if (a.type !== "matches")
+                    continue;
+                const at = pairs ? lines[k] : undefined;
+                k++;
+                const problem = regexProblem(a.value);
+                if (problem)
+                    out.push({ where: at ? `${f.path}:${at}` : f.path, message: `case "${c.name}": matches: ${problem}` });
+            }
+        }
+    }
     if (!outwardAgents.length)
         return out;
     for (const f of files) {
@@ -311,6 +478,50 @@ export function deployIssues(files) {
         if (m)
             agents.add(m[1]);
     }
+    // Frontmatter whose YAML does not parse is a file the runtime cannot read:
+    // an agent with no tools and the default model, a flow that never fires,
+    // a tool that is skipped. Refused where it was written. Until 20 Oct 2026
+    // nothing said so — gray-matter's cache let a second parse pass — and one
+    // such agent file kept the worker from booting for every account.
+    // Definition files only: a skill is read leniently (an unquoted colon is
+    // quoted and retried, matter.ts parseLenient), and the markdown beside a
+    // definition — references, a tool's README — is prose, not frontmatter.
+    // The scanner warns about skills and library files (config/invalid-frontmatter).
+    for (const f of files) {
+        if (!STRICT_FRONTMATTER_PATH.test(f.path))
+            continue;
+        if (!/^\uFEFF?---\r?\n/.test(f.content))
+            continue;
+        try {
+            matter(f.content);
+        }
+        catch (err) {
+            at(f.path, frontmatterErrorText(err));
+        }
+    }
+    // The four job blocks (frontmatter-fields.ts JOB_FIELDS): a setting
+    // written both at the top and in its block, or in another job's block, is
+    // a setting that does not do what the file says — a guardrail under
+    // governance: guards nothing — so the deploy refuses it as check does
+    // (config/conflict, config/misplaced; Codex debate, 21 Oct 2026).
+    for (const f of files) {
+        const kind = schemaKindOf(f.path);
+        if (kind !== "agent" && kind !== "flow" && kind !== "agents-md")
+            continue;
+        if (!/^\uFEFF?---\r?\n/.test(f.content))
+            continue;
+        let front;
+        try {
+            front = configMatter(f.content).data;
+        }
+        catch {
+            continue; // unparseable frontmatter is its own report
+        }
+        for (const p of frontmatterProblems(kind, front, () => null)) {
+            if (p.level === "error" && (p.rule === "config/conflict" || p.rule === "config/misplaced"))
+                at(f.path, `${p.message} [${p.rule}]`);
+        }
+    }
     // `timezone:` is read at four levels and a value nothing can parse falls
     // silently through to the level above — so it is refused where it was
     // written, not discovered as a date that is a day out.
@@ -322,7 +533,7 @@ export function deployIssues(files) {
             at(f.path, unopened);
         let front = {};
         try {
-            front = matter(f.content).data;
+            front = configMatter(f.content).data;
         }
         catch {
             continue; // unparseable frontmatter is its own report
@@ -346,6 +557,16 @@ export function deployIssues(files) {
         // above it — wider or narrower than the author wrote.
         for (const w of networkProblems(front.network))
             at(f.path, w);
+        // `alerts:` that cannot be read would never alert (FOL-72).
+        for (const w of parseAlerts(front.alerts).problems)
+            at(f.path, w);
+        // `telemetry:` that cannot be read would never send — and a token
+        // written into it would ship in the file.
+        for (const w of parseTelemetry(front.telemetry).problems)
+            at(f.path, w);
+        // `judge:` that cannot be read would leave every judge on the default.
+        for (const w of parseJudge(front.judge).problems)
+            at(f.path, w);
         const lang = languageProblem(front.language);
         if (lang)
             at(f.path, lang);
@@ -489,7 +710,10 @@ export function planDeploy(tenant, workspace, files, opts = {}) {
         added: added.sort(),
         updated: updated.sort(),
         removed: removed.sort(),
-        issues: deployIssues(files),
+        // deploy_block: (FOL-58) turns the scanner's findings into refusals —
+        // scanned with what the Checks page passes too: the account's network:
+        // and the library's outward tools (Codex review).
+        issues: [...deployIssues(files), ...blockersFor(tenant, files)],
         warnings: deployWarnings(files),
         blockedBy: runsInFlight(tenant, workspace),
     };

package/dist/src/egress.d.ts

@@ -1,3 +1,4 @@
+import type { PeerInfo } from "./operator.ts";
 import type { TestEffect } from "./test-mode.ts";
 import type { NetworkLevel } from "./network.ts";
 /** `${NAME}` — the shape a secret reference takes everywhere in foldrun. */
@@ -92,14 +93,28 @@ export interface EgressHooks {
      *  policy in test-mode.ts to every request on this lease. Carried on the
      *  lease, not the request, because the pod is the party not trusted to
      *  say so. */
-    /** `step` — the step's index in run.steps; keys that step's operator inbox. */
+    /** `step` — the step's index in run.steps; keys that step's operator inbox.
+     *  `agent` and `peers` — this step's agent and the other steps of its
+     *  parallel group (tools: [peers]): the proxy serves the roster and
+     *  addresses a colleague's message to the right inbox. */
     lease(args: {
         tenant: string;
         runId: string;
         grant: EgressGrant;
         test?: boolean;
         step?: number;
+        agent?: string;
+        peers?: PeerInfo[];
     }): Promise<EgressLease | null>;
+    /** The step is over — every attempt, however it ended (tools: [peers]).
+     *  A lease comes and goes per attempt, so it cannot say this: a sibling
+     *  between retries, or waiting for a slot, holds none and is not done.
+     *  Optional: a platform without it keeps every sibling reachable. */
+    stepEnded?(args: {
+        tenant: string;
+        runId: string;
+        step: number;
+    }): Promise<void>;
 }
 /** Strip a header set of the proxy's own and hop-by-hop headers. */
 export declare const HOP_BY_HOP: Set<string>;

package/dist/src/evals.d.ts

@@ -49,8 +49,20 @@ export interface EvalInfo {
     inputs: boolean;
     cases: EvalCase[];
 }
-export declare function parseEval(file: string, raw: string): EvalInfo;
+/** `defaults`: the workspace's `judge:` (AGENTS.md), used where the eval
+ *  names no model or effort of its own. */
+export declare function parseEval(file: string, raw: string, defaults?: {
+    model?: string;
+    effort?: string;
+}): EvalInfo;
 export declare function listEvals(tenant: string, workspace: string): EvalInfo[];
+/** `judge:` from AGENTS.md, field by field: the workspace's model (or
+ *  effort), else the account's — so a workspace that sets only an effort
+ *  keeps the account's model (Codex debate: the form says so). */
+export declare function judgeDefaults(tenant: string, workspace: string): {
+    model?: string;
+    effort?: string;
+};
 /**
  * Turn a finished run into a regression case.
  *
@@ -62,10 +74,14 @@ export declare function listEvals(tenant: string, workspace: string): EvalInfo[]
  * regressions file when there is one, so a flow collects its cases in one
  * place instead of one file per press.
  */
-export declare function promoteRunToEval(tenant: string, workspace: string, runId: string, opts?: {
+export declare function promoteRunToEval(tenant: string, workspace: string, runId: string, 
+/** `should`: what a run that went wrong should have done, in a sentence —
+ *  the judge's claim for the case (FOL-72 step 10). */
+opts?: {
     evalName?: string;
     caseName?: string;
     expect?: string[];
+    should?: string;
     by?: string;
 }): {
     file: string;
@@ -101,6 +117,15 @@ export interface EvalResult {
      *  answers. */
     error?: string;
 }
+/**
+ * The judge's environment: this process's, with the platform's model
+ * credential read live. The process's own CLAUDE_CODE_OAUTH_TOKEN is the copy
+ * it was handed at boot; the box refreshes the login every four hours and the
+ * old token is then revoked, so a judge on the boot copy failed with "OAuth
+ * token revoked" from the first refresh until the pod restarted, while the
+ * agent steps (which read the live file) kept working (2026-10-21).
+ */
+export declare function judgeProcessEnv(): Record<string, string | undefined>;
 export declare function runEval(tenant: string, workspace: string, info: EvalInfo): Promise<EvalResult>;
 /**
  * The latest result, and one line of history.