@foldrun/core 2.5.0 → 2.7.0

package/dist/src/store.js

@@ -27,7 +27,7 @@ import { recordRevision, registerTreeReader } from "./history.js";
 import { dataRoot, singleWorkspace, singleAccountRoot, entriesNoFollow } from "./paths.js";
 import { platform } from "./platform.js";
 import { toLF, asRaw } from "./eol.js";
-import matter from "./matter.js";
+import matter, { frontmatterErrorText, configMatter } from "./matter.js";
 import { readAgentsMdKeys } from "./agents-md.js";
 /**
  * The frontmatter of one markdown file, as the runtime reads it. Exported
@@ -39,7 +39,7 @@ import { readAgentsMdKeys } from "./agents-md.js";
  * the runtime, and there is nothing to fail to import.
  */
 export function readFrontmatter(file) {
-    return matter(fs.readFileSync(file, "utf8")).data;
+    return configMatter(fs.readFileSync(file, "utf8")).data;
 }
 import { ownToolNames, legacyUseNames, retiredToolNames } from "./tool-names.js";
 import { refNames } from "./refs.js";
@@ -1126,7 +1126,7 @@ export function listAgents(tenant, workspace) {
         let data = {};
         let frontmatterError;
         try {
-            ({ data } = matter(fs.readFileSync(path.join(dir, name, "agent.md"), "utf8")));
+            ({ data } = configMatter(fs.readFileSync(path.join(dir, name, "agent.md"), "utf8")));
         }
         catch (err) {
             frontmatterError = frontmatterErrorText(err);
@@ -1181,12 +1181,9 @@ export function listAgents(tenant, workspace) {
         };
     });
 }
-/** The first line of a YAML parse error, with where it is: what a person
- *  needs to fix the file, without the parser's excerpt. */
-export function frontmatterErrorText(err) {
-    const msg = err instanceof Error ? err.message : String(err);
-    return `frontmatter does not parse — ${msg.split("\n")[0].trim()}. Quote a value that contains a colon followed by a space.`;
-}
+// Kept here for callers that import it from the store; it lives in matter.ts
+// so the scanner can use it without the store.
+export { frontmatterErrorText };
 /** The body of a file whose frontmatter would not parse: what follows the
  *  closing fence, so a flow's steps can still be read and shown. */
 function bodyAfterFrontmatter(raw) {
@@ -1360,7 +1357,7 @@ export function parseFlow(file, raw) {
     let content;
     let frontError = null;
     try {
-        ({ data, content } = matter(raw));
+        ({ data, content } = configMatter(raw));
     }
     catch (err) {
         frontError = frontmatterErrorText(err);
@@ -2658,6 +2655,13 @@ export function sumAttempts(tries) {
 }
 export { tokensOf, sumTokens, cacheHitRate, measuredHitRate, runTokens, promptLayersChanged, promptCacheNote } from "./tokens.js";
 import { sumTokens } from "./tokens.js";
+/** The marker rescueStep puts in a rescue's instruction; how a rescue record
+ *  written before `rescueOf` existed is still recognised. */
+export const RESCUE_MARKER = "<rescue>\nYou are taking this step over:";
+/** Is this record an on-fail rescue rather than a step of the flow? */
+export function isRescueRecord(step) {
+    return !!step.rescueOf || (step.instruction ?? "").includes(RESCUE_MARKER);
+}
 // ---------------------------------------------------------------- captured calls
 //
 // What each tool call took and gave (FOL-54 step 4), beside the run under

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@foldrun/core",
-  "version": "2.5.0",
+  "version": "2.7.0",
   "description": "Agents are just folders. The format, the runner, the checks.",
   "license": "SEE LICENSE IN LICENSE",
   "type": "module",

package/src/agent-import.ts

@@ -15,7 +15,7 @@
 
 import fs from "node:fs";
 import path from "node:path";
-import matter from "./matter.ts";
+import { configMatter } from "./matter.ts";
 import {
   assertSafeName,
   listWorkspaceFiles,
@@ -99,7 +99,7 @@ export function importAgent(
     let content = readWorkspaceFile(tenant, from, src);
     const rel = src.slice(`agents/${agent}/`.length);
     if (rel === "agent.md") {
-      front = matter(content).data as Record<string, unknown>;
+      front = configMatter(content).data as Record<string, unknown>;
       // The folder is the name flows address; a `name:` that disagrees with
       // it is the first thing check would complain about.
       if (name !== agent) content = content.replace(/^(---\r?\n(?:[\s\S]*?\r?\n)?)name:[^\n]*$/m, `$1name: ${name}`);

package/src/agent-tools.ts

@@ -17,7 +17,7 @@
 import fs from "node:fs";
 import os from "node:os";
 import path from "node:path";
-import matter from "./matter.ts";
+import { configMatter } from "./matter.ts";
 import { z } from "zod";
 import { createSdkMcpServer, tool } from "@anthropic-ai/claude-agent-sdk";
 import { resolveModel, resolveEffort, type Effort } from "./store.ts";
@@ -51,7 +51,7 @@ export function gatherConsults(
       missing.push(name);
       continue;
     }
-    const parsed = matter(fs.readFileSync(file, "utf8"));
+    const parsed = configMatter(fs.readFileSync(file, "utf8"));
     consults.push({
       name,
       systemPrompt:

package/src/agents-md.ts

@@ -9,7 +9,12 @@
 
 import fs from "node:fs";
 import path from "node:path";
-import matter from "./matter.ts";
+import matter, { configMatter } from "./matter.ts";
+import { keySpan, dropEmptyBlock } from "./frontmatter-text.ts";
+import { guardEdit } from "./frontmatter-guard.ts";
+import { JOBS, FOLDABLE } from "./frontmatter-fields.ts";
+
+export { keySpan };
 
 const FRONT = /^(---\r?\n)([\s\S]*?)(\r?\n---)(\r?\n|$)/;
 
@@ -19,7 +24,7 @@ export function readAgentsMdKeys(dir: string): Record<string, unknown> {
     const file = path.join(dir, name);
     if (!fs.existsSync(file)) continue;
     try {
-      return (matter(fs.readFileSync(file, "utf8")).data ?? {}) as Record<string, unknown>;
+      return (configMatter(fs.readFileSync(file, "utf8")).data ?? {}) as Record<string, unknown>;
     } catch {
       return {};
     }
@@ -37,8 +42,31 @@ function dumpKey(key: string, value: unknown): string[] {
 
 /** The text of `content` with each key in `patch` replaced (or removed for
  *  null), everything else byte for byte as it was. A file with no
- *  frontmatter gets one. */
+ *  frontmatter gets one. Read back before it is returned (frontmatter-guard
+ *  .ts): an edit that would not parse, would change another key or would
+ *  double one into its block throws UnsafeEditError (409). */
 export function patchFrontmatter(content: string, patch: Record<string, unknown | null>): string {
+  // The guard reads the result folded (matter.ts configMatter), so a patch
+  // that writes a whole job block is checked as the keys it holds: each
+  // field the block may hold may change, and each one it sets reads back.
+  const changed = new Set<string>();
+  const expect: Record<string, unknown> = {};
+  for (const [key, value] of Object.entries(patch)) {
+    changed.add(key);
+    const job = JOBS.find((j) => j.name === key)?.name;
+    if (!job) {
+      expect[key] = value;
+      continue;
+    }
+    for (const k of FOLDABLE[job]) changed.add(k);
+    if (value && typeof value === "object" && !Array.isArray(value)) {
+      for (const [k, v] of Object.entries(value)) if (FOLDABLE[job].has(k)) expect[k] = v;
+    }
+  }
+  return guardEdit(content, patchFrontmatterText(content, patch), [...changed], expect);
+}
+
+function patchFrontmatterText(content: string, patch: Record<string, unknown | null>): string {
   const m = content.match(FRONT);
   let open = "---\n";
   let body = "";
@@ -52,18 +80,15 @@ export function patchFrontmatter(content: string, patch: Record<string, unknown
   }
   let lines = body === "" ? [] : body.split("\n");
   for (const [key, value] of Object.entries(patch)) {
-    const at = lines.findIndex((l) => new RegExp(`^${key.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")}\\s*:`).test(l));
-    let end = at;
-    if (at !== -1) {
-      end = at + 1;
-      // The block continues while lines are indented or blank-inside-block.
-      while (end < lines.length && (/^[ \t]/.test(lines[end]) || lines[end].trim() === "")) end++;
-      // A blank line at the block's foot belongs to what follows.
-      while (end > at + 1 && lines[end - 1].trim() === "") end--;
+    // Where it is written now — at the top or inside its job block — is
+    // where it is edited; a key written nowhere is added at the top.
+    const where = keySpan(lines, key);
+    const replacement = value === null || value === undefined ? [] : dumpKey(key, value).map((l) => `${where?.indent ?? ""}${l}`);
+    if (!where) lines = [...lines, ...replacement];
+    else {
+      lines = [...lines.slice(0, where.at), ...replacement, ...lines.slice(where.end)];
+      if (!replacement.length && where.block !== null) lines = dropEmptyBlock(lines, where.block);
     }
-    const replacement = value === null || value === undefined ? [] : dumpKey(key, value);
-    if (at === -1) lines = [...lines, ...replacement];
-    else lines = [...lines.slice(0, at), ...replacement, ...lines.slice(end)];
   }
   const front = lines.length ? `${open}${lines.join("\n")}${close}` : "";
   if (!front) return rest.replace(/^(\r?\n)+/, "");

package/src/capture.ts

@@ -7,7 +7,7 @@
 
 import { redactText } from "./scan.ts";
 import { writeCapturedCall, CAPTURE_CAP } from "./store.ts";
-import { isFileValue, fileContent } from "./secrets.ts";
+import { isFileValue, fileContent, isApiValue, apiConfigOf, isClientCertValue, clientCertOf } from "./secrets.ts";
 import type { CallIo } from "./step-exec.ts";
 
 /** How much past the cap a step sends, so masking sees a secret whole
@@ -31,6 +31,38 @@ export function redactionsFor(secrets: Record<string, string | undefined>): [str
   };
   for (const [name, raw] of Object.entries(secrets)) {
     if (typeof raw !== "string") continue;
+    // An API connection's header values are each a secret in their own right
+    // (a token, Basic credentials) — and a Basic header's password too.
+    // An exported client certificate's passphrase and private key reach the
+    // sandbox as files: each is masked, whole and line by line.
+    if (isClientCertValue(raw)) {
+      const c = clientCertOf(raw);
+      for (const v of [c.passphrase, c.key]) {
+        if (!v) continue;
+        add(v, name);
+        add(v.trim(), name);
+        const escaped = JSON.stringify(v).slice(1, -1);
+        if (escaped !== v) add(escaped, name);
+        for (const line of v.split(/\r?\n/)) if (line.trim().length >= 16) add(line.trim(), name);
+      }
+    }
+    if (isApiValue(raw)) {
+      // Each as written and as JSON would escape it, like every value here.
+      const both = (v: string) => {
+        add(v, name);
+        const escaped = JSON.stringify(v).slice(1, -1);
+        if (escaped !== v) add(escaped, name);
+      };
+      for (const v of Object.values(apiConfigOf(raw).headers ?? {})) {
+        both(v);
+        const basic = /^Basic\s+([A-Za-z0-9+/=]+)$/i.exec(v.trim());
+        if (basic) {
+          both(basic[1]!);
+          const decoded = Buffer.from(basic[1]!, "base64").toString("utf8");
+          if (decoded.includes(":")) both(decoded.slice(decoded.indexOf(":") + 1));
+        }
+      }
+    }
     for (const v of isFileValue(raw) ? [raw, fileContent(raw)] : [raw]) {
       add(v, name);
       add(v.trim(), name);

package/src/completions.ts

@@ -10,7 +10,7 @@
 // renders them.
 
 import { PROVIDERS } from "./providers.ts";
-import { FRONTMATTER, type SchemaKind } from "./frontmatter-fields.ts";
+import { FRONTMATTER, JOBS, fieldsOfJob, type SchemaKind } from "./frontmatter-fields.ts";
 
 export interface Vocabulary {
   agents: string[];
@@ -660,8 +660,31 @@ export function completionsAt(
     }
   }
 
-  // 6. An indented option under a flow step.
-  if (kind === "flow" && /^\s+[a-z]*$/.test(line) && line.trim().length >= 0) {
+  // 5b. An indented line inside one of the four job blocks (governance,
+  //     guardrail, observability, evaluation): that job's fields for this
+  //     kind of file — the block takes nothing else.
+  const fmClose = text.indexOf("\n---", text.indexOf("---") + 3);
+  const insideFrontmatter = text.startsWith("---") && (fmClose === -1 || cursor <= fmClose);
+  const nested = line.match(/^(\s+)([a-zA-Z_]*)$/);
+  if (insideFrontmatter && nested) {
+    const header = before.slice(0, lineStart).split("\n").reverse().find((l) => /^\S/.test(l));
+    const job = JOBS.find((j) => new RegExp(`^${j.name}\\s*:\\s*$`).test(header ?? ""));
+    if (job) {
+      const schemaKind = /(^|\/)AGENTS\.md$/.test(path) || path === "project.md" ? "agents-md" : SCHEMA_OF[kind];
+      const keys = new Set(schemaKind ? fieldsOfJob(schemaKind, job.name) : []);
+      const partial = nested[2] ?? "";
+      return {
+        from: cursor - partial.length,
+        query: partial,
+        items: filter(fieldsFor(path, kind).filter((c) => keys.has(c.label.split(".")[0]!)), partial),
+        title: `${job.title} — ${job.what}`,
+      };
+    }
+  }
+
+  // 6. An indented option under a flow step — the body's steps, never a
+  //    line inside the frontmatter.
+  if (kind === "flow" && !insideFrontmatter && /^\s+[a-z]*$/.test(line) && line.trim().length >= 0) {
     const partial = line.trim();
     return {
       from: cursor - partial.length,

package/src/deploy.ts

@@ -38,21 +38,24 @@ import {
 } from "./store.ts";
 import { readAgentsMdKeys } from "./agents-md.ts";
 import { libraryTools } from "./library.ts";
-import { lintFlow } from "./flow-lint.ts";
+import { lintFlow, regexProblem } from "./flow-lint.ts";
+import { parseEval } from "./evals.ts";
 import { refNames } from "./refs.ts";
-import matter from "./matter.ts";
+import matter, { configMatter } from "./matter.ts";
+import { frontmatterProblems, schemaKindOf } from "./frontmatter-schema.ts";
 import { conformanceIssues } from "./okf.ts";
 import { timezoneProblem } from "./clock.ts";
 import { webProblems, webWarnings, runnerEngines } from "./providers.ts";
 import { readLimits } from "./limits.ts";
 import { parseAlerts } from "./alerts.ts";
 import { parseTelemetry } from "./otel-config.ts";
+import { parseJudge } from "./judge-verdict.ts";
 import { networkProblems } from "./network.ts";
 import { actionProblems } from "./web-actions.ts";
 import { languageProblem } from "./language.ts";
 import { localeProblems } from "./locale.ts";
 import { entriesNoFollow } from "./paths.ts";
-import { filterIgnored, findingFingerprint, ruleForWhere, scanFiles, scanRule, type ScanFinding, type ScanOptions } from "./scan.ts";
+import { filterIgnored, findingFingerprint, ruleForWhere, scanFiles, scanRule, STRICT_FRONTMATTER_PATH, type ScanFinding, type ScanOptions } from "./scan.ts";
 
 /** Directories a deploy never reads out of a source tree. */
 // `.cache` is what a run's tools leave in an agent's folder (HOME is that
@@ -321,7 +324,7 @@ export function deployBlockMode(files: DeployFile[], accountKeys: Record<string,
   let fromWorkspace: DeployBlockMode | null = null;
   if (own) {
     try {
-      fromWorkspace = blockMode((matter(own.content).data as Record<string, unknown>).deploy_block);
+      fromWorkspace = blockMode((configMatter(own.content).data as Record<string, unknown>).deploy_block);
     } catch {
       // an AGENTS.md that does not parse is reported elsewhere
     }
@@ -450,6 +453,32 @@ function structuralWarnings(files: DeployFile[], extraOutward: Iterable<string>
     if (refNames(data.tools).some((t: string) => outwardTools.has(t))) outwardAgents.push(m[1]);
     for (const w of webWarnings(data, { chrome, chromium })) out.push({ where: f.path, message: w });
   }
+  // An eval's `matches:` is the same JavaScript RegExp as a verify's; one
+  // that does not compile fails its case on every run. Read through
+  // parseEval, so a block scalar (`matches: |`) or a continued line is
+  // tested as the runtime will run it. The line is the item's own: the
+  // parsed assertions and the `- matches:` lines come in the same order.
+  for (const f of files) {
+    if (!/^evals\/[^/]+\.md$/.test(f.path)) continue;
+    let info;
+    try { info = parseEval(f.path, f.content); } catch { continue; }
+    const lines: number[] = [];
+    f.content.split("\n").forEach((line, n) => { if (/^\s*-\s*matches:/.test(line)) lines.push(n + 1); });
+    // When a `- matches:` line sits outside a case (an example in the
+    // prose), the order no longer pairs up: name the file, not a wrong line.
+    const parsed = info.cases.reduce((n, c) => n + c.expect.filter((a) => a.type === "matches").length, 0);
+    const pairs = lines.length === parsed;
+    let k = 0;
+    for (const c of info.cases) {
+      for (const a of c.expect) {
+        if (a.type !== "matches") continue;
+        const at = pairs ? lines[k] : undefined;
+        k++;
+        const problem = regexProblem(a.value);
+        if (problem) out.push({ where: at ? `${f.path}:${at}` : f.path, message: `case "${c.name}": matches: ${problem}` });
+      }
+    }
+  }
   if (!outwardAgents.length) return out;
   for (const f of files) {
     if (!/^flows\/[^/]+\.md$/.test(f.path)) continue;
@@ -496,10 +525,11 @@ export function deployIssues(files: DeployFile[]): DeployIssue[] {
   // nothing said so — gray-matter's cache let a second parse pass — and one
   // such agent file kept the worker from booting for every account.
   // Definition files only: a skill is read leniently (an unquoted colon is
-  // quoted and retried, runner.ts safeMatter), and the markdown beside a
+  // quoted and retried, matter.ts parseLenient), and the markdown beside a
   // definition — references, a tool's README — is prose, not frontmatter.
+  // The scanner warns about skills and library files (config/invalid-frontmatter).
   for (const f of files) {
-    if (!/^(AGENTS\.md|agents\/[^/]+\/agent\.md|flows\/[^/]+\.md|tools\/[^/]+\.md|tools\/[^/]+\/tool\.md|evals\/[^/]+\.md|hooks\/[^/]+\/hook\.md|\.claude\/agents\/[^/]+\.md)$/.test(f.path)) continue;
+    if (!STRICT_FRONTMATTER_PATH.test(f.path)) continue;
     if (!/^\uFEFF?---\r?\n/.test(f.content)) continue;
     try {
       matter(f.content);
@@ -508,6 +538,26 @@ export function deployIssues(files: DeployFile[]): DeployIssue[] {
     }
   }
 
+  // The four job blocks (frontmatter-fields.ts JOB_FIELDS): a setting
+  // written both at the top and in its block, or in another job's block, is
+  // a setting that does not do what the file says — a guardrail under
+  // governance: guards nothing — so the deploy refuses it as check does
+  // (config/conflict, config/misplaced; Codex debate, 21 Oct 2026).
+  for (const f of files) {
+    const kind = schemaKindOf(f.path);
+    if (kind !== "agent" && kind !== "flow" && kind !== "agents-md") continue;
+    if (!/^\uFEFF?---\r?\n/.test(f.content)) continue;
+    let front: Record<string, unknown>;
+    try {
+      front = configMatter(f.content).data as Record<string, unknown>;
+    } catch {
+      continue; // unparseable frontmatter is its own report
+    }
+    for (const p of frontmatterProblems(kind, front, () => null)) {
+      if (p.level === "error" && (p.rule === "config/conflict" || p.rule === "config/misplaced")) at(f.path, `${p.message} [${p.rule}]`);
+    }
+  }
+
   // `timezone:` is read at four levels and a value nothing can parse falls
   // silently through to the level above — so it is refused where it was
   // written, not discovered as a date that is a day out.
@@ -517,7 +567,7 @@ export function deployIssues(files: DeployFile[]): DeployIssue[] {
     if (unopened) at(f.path, unopened);
     let front: Record<string, unknown> = {};
     try {
-      front = matter(f.content).data as Record<string, unknown>;
+      front = configMatter(f.content).data as Record<string, unknown>;
     } catch {
       continue; // unparseable frontmatter is its own report
     }
@@ -541,6 +591,8 @@ export function deployIssues(files: DeployFile[]): DeployIssue[] {
     // `telemetry:` that cannot be read would never send — and a token
     // written into it would ship in the file.
     for (const w of parseTelemetry(front.telemetry).problems) at(f.path, w);
+    // `judge:` that cannot be read would leave every judge on the default.
+    for (const w of parseJudge(front.judge).problems) at(f.path, w);
     const lang = languageProblem(front.language);
     if (lang) at(f.path, lang);
     for (const w of localeProblems(front)) at(f.path, w);

package/src/egress.ts

@@ -96,6 +96,14 @@ export function hostOf(url: string): string | null {
  * from the step's declared secrets and the hosts its tools and provider
  * name; the proxy enforces it per request.
  */
+/** Which workload a lease is for — the runner's word, never the pod's: what
+ *  an identity token's subject is built from (oidc-issuer.ts). */
+export interface LeaseWho {
+  workspace: string;
+  agent: string;
+  flow?: string;
+}
+
 export interface EgressGrant {
   /** Secret name → the hosts that secret may be substituted for. */
   secrets: Record<string, { value: string; hosts: string[] }>;
@@ -116,6 +124,9 @@ export interface EgressGrant {
   /** Refuse a site off the list (true), or allow it and name it in the
    *  trace (false: report only). Set by the platform when it leases. */
   enforce?: boolean;
+  /** Identity name → the audience its tokens are for: the only identities
+   *  this step may ask the proxy's /identity door to mint (oidc-issuer.ts). */
+  identities?: Record<string, { audience: string }>;
 }
 
 export interface EgressLease {
@@ -161,7 +172,10 @@ export interface EgressHooks {
    *  `agent` and `peers` — this step's agent and the other steps of its
    *  parallel group (tools: [peers]): the proxy serves the roster and
    *  addresses a colleague's message to the right inbox. */
-  lease(args: { tenant: string; runId: string; grant: EgressGrant; test?: boolean; step?: number; agent?: string; peers?: PeerInfo[] }): Promise<EgressLease | null>;
+  lease(args: { tenant: string; runId: string; grant: EgressGrant; test?: boolean; step?: number; agent?: string; peers?: PeerInfo[]; who?: LeaseWho }): Promise<EgressLease | null>;
+  /** The run is still being driven: renew its leases' heartbeat. Optional —
+   *  an install without leases has nothing to renew. */
+  renew?(runId: string): Promise<number>;
   /** The step is over — every attempt, however it ended (tools: [peers]).
    *  A lease comes and goes per attempt, so it cannot say this: a sibling
    *  between retries, or waiting for a slot, holds none and is not done.

package/src/evals.ts

@@ -34,15 +34,19 @@
 import { accountModelEnv, withModelEnv } from "./model-env.ts";
 import type { TranslatorSpec } from "./translator.ts";
 import { sdkEnv } from "./step-exec.ts";
+import { platformModelEnv } from "./runner.ts";
 import fs from "node:fs";
 import path from "node:path";
 import { deployedCommit } from "./deploy.ts";
 import { latestRevisionId } from "./history.ts";
 import matter from "./matter.ts";
 import { spawn } from "node:child_process";
+import { judgeVerdict, JUDGE_VERDICT_INSTRUCTION, parseJudge } from "./judge-verdict.ts";
+import { readAgentsMdKeys } from "./agents-md.ts";
 import { query } from "@anthropic-ai/claude-agent-sdk";
 import {
   workspaceDir,
+  accountDir,
   readRun,
   runVerdict,
   writeWorkspaceFile,
@@ -146,7 +150,9 @@ function readScalar(
   return { value: [first, ...parts].join(" ").trim(), end: i };
 }
 
-export function parseEval(file: string, raw: string): EvalInfo {
+/** `defaults`: the workspace's `judge:` (AGENTS.md), used where the eval
+ *  names no model or effort of its own. */
+export function parseEval(file: string, raw: string, defaults: { model?: string; effort?: string } = {}): EvalInfo {
   const { data, content } = matter(raw);
   const cases: EvalCase[] = [];
   let current: EvalCase | null = null;
@@ -197,8 +203,8 @@ export function parseEval(file: string, raw: string): EvalInfo {
     file,
     agent: typeof data.agent === "string" ? data.agent : null,
     flow: typeof data.flow === "string" ? data.flow : null,
-    model: resolveModel(data.model ?? "fast"),
-    effort: resolveEffort(data.effort ?? "low"),
+    model: resolveModel(data.model ?? defaults.model ?? "fast"),
+    effort: resolveEffort(data.effort ?? defaults.effort ?? "low"),
     trigger: data.trigger === "manual" ? "manual" : "deploy",
     live: data.live === true,
     inputs: data.inputs === true,
@@ -213,7 +219,18 @@ export function listEvals(tenant: string, workspace: string): EvalInfo[] {
     .readdirSync(dir)
     .filter((f) => f.endsWith(".md"))
     .sort()
-    .map((f) => parseEval(f, fs.readFileSync(path.join(dir, f), "utf8")));
+    .map((f) => parseEval(f, fs.readFileSync(path.join(dir, f), "utf8"), judgeDefaults(tenant, workspace)));
+}
+
+/** `judge:` from AGENTS.md, field by field: the workspace's model (or
+ *  effort), else the account's — so a workspace that sets only an effort
+ *  keeps the account's model (Codex debate: the form says so). */
+export function judgeDefaults(tenant: string, workspace: string): { model?: string; effort?: string } {
+  const ws = parseJudge(readAgentsMdKeys(workspaceDir(tenant, workspace)).judge);
+  const account = parseJudge(readAgentsMdKeys(accountDir(tenant)).judge);
+  const model = ws.model ?? account.model;
+  const effort = ws.effort ?? account.effort;
+  return { ...(model ? { model } : {}), ...(effort ? { effort } : {}) };
 }
 
 // ---------- promoting a run ----------
@@ -484,9 +501,12 @@ function shell(command: string, cwd: string): Promise<{ code: number | null; out
   });
 }
 
-// The judge gets the rubric and the output, and must answer with one word.
+// The judge gets the rubric and the output, and ends with one word.
 // Constrained output beats asking for a score: "PASS" or "FAIL" can't be
-// misread, where "7/10" needs a threshold nobody agreed on.
+// misread, where "7/10" needs a threshold nobody agreed on. The word comes
+// LAST, after the reasoning: asked for it first, the judge committed before
+// it had looked, then argued the other way — "FAIL … which meets the
+// criterion" (vaza evals, 21 Oct 2026).
 async function judge(
   rubric: string,
   output: string,
@@ -495,8 +515,7 @@ async function judge(
   env: Record<string, string | undefined>,
 ): Promise<AssertionResult["detail"] & string> {
   const prompt =
-    `You are grading one piece of output against one criterion. Answer with exactly ` +
-    `PASS or FAIL on the first line, then one short sentence of reason.\n\n` +
+    `You are grading one piece of output against one criterion. ${JUDGE_VERDICT_INSTRUCTION}\n\n` +
     `Criterion: ${rubric}\n\n<output>\n${output.slice(0, 20000)}\n</output>`;
 
   let text = "";
@@ -523,13 +542,26 @@ async function judge(
   return text.trim();
 }
 
+/**
+ * The judge's environment: this process's, with the platform's model
+ * credential read live. The process's own CLAUDE_CODE_OAUTH_TOKEN is the copy
+ * it was handed at boot; the box refreshes the login every four hours and the
+ * old token is then revoked, so a judge on the boot copy failed with "OAuth
+ * token revoked" from the first refresh until the pod restarted, while the
+ * agent steps (which read the live file) kept working (2026-10-21).
+ */
+export function judgeProcessEnv(): Record<string, string | undefined> {
+  const live = Object.fromEntries(Object.entries(platformModelEnv()).filter(([, v]) => v !== undefined));
+  return sdkEnv({ ...process.env, ...live });
+}
+
 async function checkAssertion(
   assertion: Assertion,
   output: string,
   agentDir: string,
   model: string,
   effort: Effort | null,
-  judgeEnv: () => { env: Record<string, string | undefined>; translator?: TranslatorSpec | null } = () => ({ env: sdkEnv(undefined) }),
+  judgeEnv: () => { env: Record<string, string | undefined>; translator?: TranslatorSpec | null } = () => ({ env: judgeProcessEnv() }),
 ): Promise<AssertionResult> {
   const hay = output.toLowerCase();
   switch (assertion.type) {
@@ -570,9 +602,9 @@ async function checkAssertion(
       } catch (err) {
         return { assertion, passed: false, detail: `judge not run — ${err instanceof Error ? err.message : String(err)}` };
       }
-      const verdict = await withModelEnv(m, (env) => judge(assertion.value, output, model, effort, env));
-      const passed = /^\s*PASS\b/i.test(verdict);
-      return { assertion, passed, detail: verdict.slice(0, 300) || "judge returned nothing" };
+      const text = await withModelEnv(m, (env) => judge(assertion.value, output, model, effort, env));
+      const { passed, detail } = judgeVerdict(text);
+      return { assertion, passed, detail };
     }
   }
 }
@@ -653,7 +685,7 @@ export async function runEval(
       const judges = testCase.expect.filter((a) => a.type === "judge");
       for (const a of cheap) assertions.push(await checkAssertion(a, output, agentDir, info.model, info.effort));
       if (assertions.every((r) => r.passed)) {
-        const judgeEnv = () => accountModelEnv(tenant, workspace, () => sdkEnv(undefined));
+        const judgeEnv = () => accountModelEnv(tenant, workspace, judgeProcessEnv);
         for (const a of judges) assertions.push(await checkAssertion(a, output, agentDir, info.model, info.effort, judgeEnv));
       } else {
         for (const a of judges) {

package/src/flow-lint.ts

@@ -91,6 +91,27 @@ const LOOKS_LIKE_SHELL =
  *  prefix, nothing shell-shaped anywhere in it, and enough words to be a
  *  sentence — so a bare `./check.sh` or a one-word command is left alone and
  *  the warning only fires where the author plainly wrote prose. */
+/**
+ * Why a `matches:` pattern will not compile, or null when it does. The
+ * runtime tests it as a JavaScript RegExp with the `i` flag (step-exec.ts,
+ * evals.ts), and a pattern that throws fails its check on every run with
+ * "invalid regular expression". The usual cause is another dialect: on
+ * 2026-10-21 Python's inline `(?m)` broke five eval checks on vaza, and
+ * nothing said so before they ran.
+ */
+export function regexProblem(pattern: string): string | null {
+  try {
+    new RegExp(pattern, "i");
+    return null;
+  } catch (err) {
+    const why = err instanceof Error ? err.message.replace(/^Invalid regular expression: /, "") : String(err);
+    const inline = /\(\?[a-z]+\)/.test(pattern)
+      ? " — JavaScript has no inline flags like (?m); write (^|\\n) for the start of a line"
+      : "";
+    return `is not a valid JavaScript regular expression (${why})${inline}`;
+  }
+}
+
 function looksLikeProse(verify: string): boolean {
   const v = verify.trim();
   if (!v || VERIFY_ASSERTION.test(v)) return false;
@@ -443,6 +464,21 @@ export function lintFlow(flow: FlowInfo, known?: KnownNames): FlowWarning[] {
       });
     }
 
+    // A `verify: matches:` the runtime cannot compile fails the step on
+    // every run, whatever the agent did.
+    const verifyRe = step.verify ? /^matches:\s*(.*)$/.exec(step.verify.trim()) : null;
+    // The same normalisation checkVerify applies (step-exec.ts): one quote
+    // off each end, so the pattern checked is the pattern that runs.
+    const reProblem = verifyRe ? regexProblem(verifyRe[1].trim().replace(/^["']|["']$/g, "")) : null;
+    if (reProblem) {
+      warnings.push({
+        step: i,
+        line: step.line,
+        message: `verify: matches: ${reProblem}`,
+        detail: "The runtime tests matches: as a JavaScript regular expression, case-insensitive. One that does not compile fails this step on every run.",
+      });
+    }
+
     // A step's OTHER agent references — the ones no parser validates,
     // because they are options rather than the step's target. Both fail
     // silently and at the worst possible moment: a misspelled `delegate:`