@haystackeditor/cli 0.15.24 → 0.15.26

package/README.md

@@ -105,6 +105,21 @@ haystack verify hosted status cv_<48-lowercase-hex-characters> \
   --json
 ```
 
+To execute a completed run's exact validated risk plan again, keep the same
+repository and commit pair and pass:
+
+```bash
+haystack verify hosted start owner/repo \
+  --base <40-character-commit-sha> \
+  --head <40-character-commit-sha> \
+  --replay-plan-from cv_<48-lowercase-hex-characters> \
+  --json
+```
+
+A successful replay emits a schema-9 terminal result whose
+`riskPlanReplayReceipt` binds the source run and canonical risk-plan hash. The
+replay does not mint or deliver a planning-model credential.
+
 Agents can use the same production lifecycle over stdio MCP:
 
 ```bash
@@ -116,7 +131,8 @@ The hosted server exposes only `verify_start`, `verify_status`, and
 credentials, repository source, provider metadata, and sandbox mutation are
 not exposed.
 
-Repeat the same exact production launch to detect planner or assessment drift:
+Freeze one production plan and repeat its exact execution to detect executor or
+assessment drift:
 
 ```bash
 haystack verify hosted reproducibility owner/repo \
@@ -126,10 +142,12 @@ haystack verify hosted reproducibility owner/repo \
   --json
 ```
 
-Each run gets a distinct idempotency key derived from one printed series key.
-Pass `--series-key <key>` to resume the same series without creating duplicate
-runs. The report compares stable risk-cell, capability, and comparison IDs.
-Plan drift, assessment drift, timeouts, unsupported receipts, and inconclusive
+The first run creates the source plan; every later run names it through
+`replayPlanFromRunId`. Each run gets a distinct idempotency key derived from one
+printed series key. Pass `--series-key <key>` to resume the same series without
+creating duplicate runs. The report verifies schema-9 replay provenance and
+compares stable risk-cell, capability, and comparison IDs. Missing replay
+provenance, assessment drift, timeouts, unsupported receipts, and inconclusive
 cells all prevent a reproducible verdict and exit 2.
 
 **`haystack setup --json`** speaks NDJSON: events (`question`, `permission`,

package/dist/commands/verify-hosted-mcp.js

@@ -53,6 +53,10 @@ export const HOSTED_VERIFY_TOOLS = [
                     pattern: '^[A-Za-z0-9][A-Za-z0-9._:-]{7,127}$',
                     description: 'Optional stable retry key. Omit to derive it from the exact repository and commits.',
                 },
+                replay_plan_from_run_id: {
+                    ...runIdInput,
+                    description: 'Optional completed owned run whose exact validated risk plan must be replayed.',
+                },
                 account: accountInput,
             },
             required: ['repository', 'base_commit', 'head_commit'],
@@ -120,6 +124,7 @@ function assertToolInputFields(name, input) {
             'base_commit',
             'head_commit',
             'idempotency_key',
+            'replay_plan_from_run_id',
             'repository',
         ]);
         return;
@@ -147,6 +152,7 @@ export async function executeHostedVerifyTool(name, input, context) {
             base: requireInputString(input, 'base_commit'),
             head: requireInputString(input, 'head_commit'),
             idempotencyKey: optionalInputString(input, 'idempotency_key'),
+            replayPlanFrom: optionalInputString(input, 'replay_plan_from_run_id'),
             wait: false,
         }, context.token);
         return buildHostedJson('start', started.state, {

package/dist/commands/verify-hosted-reproducibility.d.ts

@@ -4,16 +4,30 @@ export interface HostedReproducibilityOptions {
     head: string;
     runs?: string;
     seriesKey?: string;
+    freshPlans?: boolean;
     account?: string;
     interval?: string;
     timeout?: string;
     json?: boolean;
 }
+type HostedReproducibilityMode = 'exact_plan_replay' | 'fresh_plans';
 interface HostedReproducibilityRun {
     state: HostedRunState;
     timedOut: boolean;
 }
+interface HostedReproducibilityIdentity {
+    seriesKey: string;
+    repository: string;
+    baseCommit: string;
+    headCommit: string;
+    requestedRuns?: number;
+    mode?: HostedReproducibilityMode;
+}
 interface ParsedAssessment {
+    schemaVersion: 8 | 9;
+    riskPlanSha256: string;
+    replaySourceRunId: string | null;
+    replaySourceResultSchemaVersion: 8 | 9 | null;
     planIdentities: Array<{
         cellId: string;
         capabilityId: string | null;
@@ -49,9 +63,15 @@ export interface HostedReproducibilityReport {
     repository: string;
     base_commit: string;
     head_commit: string;
+    reproducibility_mode: HostedReproducibilityMode;
     requested_runs: number;
+    launched_runs: number;
+    unstarted_runs: number;
     analyzable_runs: number;
     run_ids: string[];
+    replay_source_run_id: string | null;
+    plan_replay_verified: boolean;
+    planner_reproducibility_tested: boolean;
     planner_reproducible: boolean;
     assessment_reproducible: boolean;
     reproducible: boolean;
@@ -62,12 +82,8 @@ export interface HostedReproducibilityReport {
     inconclusive_cell_ids: string[];
     unrunnable_runs: RunFailure[];
 }
-export declare function hostedReproducibilityRunKey(seriesKey: string, repository: string, baseCommit: string, headCommit: string, ordinal: number): string;
-export declare function analyzeHostedReproducibility(runs: HostedReproducibilityRun[], identity: {
-    seriesKey: string;
-    repository: string;
-    baseCommit: string;
-    headCommit: string;
-}): HostedReproducibilityReport;
+export declare function hostedReproducibilityRunKey(seriesKey: string, repository: string, baseCommit: string, headCommit: string, ordinal: number, mode?: HostedReproducibilityMode): string;
+export declare function analyzeHostedReproducibility(runs: HostedReproducibilityRun[], identity: HostedReproducibilityIdentity): HostedReproducibilityReport;
+export declare function isHostedReproducibilityReplaySource(run: HostedReproducibilityRun, identity: HostedReproducibilityIdentity): boolean;
 export declare function verifyHostedReproducibilityCommand(repositoryArg: string, options: HostedReproducibilityOptions): Promise<void>;
 export {};

package/dist/commands/verify-hosted-reproducibility.js

@@ -6,6 +6,7 @@ import { hostedPollingOptions, parseHostedRepository, startHostedVerification, w
 const CELL_ID = /^cell_[0-9a-f]{32}$/;
 const CAPABILITY_ID = /^repository_driver_[0-9a-f]{64}$/;
 const COMPARISON_ID = /^driver_comparison_[0-9a-f]{64}$/;
+const RUN_ID = /^cv_[0-9a-f]{48}$/;
 const SHA256 = /^[0-9a-f]{64}$/;
 const SERIES_KEY = /^[A-Za-z0-9][A-Za-z0-9._:-]{7,63}$/;
 const TERMINAL_STATUSES = new Set([
@@ -68,21 +69,41 @@ function requireSeriesKey(value) {
     }
     return key;
 }
-export function hostedReproducibilityRunKey(seriesKey, repository, baseCommit, headCommit, ordinal) {
+export function hostedReproducibilityRunKey(seriesKey, repository, baseCommit, headCommit, ordinal, mode = 'exact_plan_replay') {
     const digest = createHash('sha256')
-        .update(JSON.stringify([
-        seriesKey,
-        repository,
-        baseCommit,
-        headCommit,
-        ordinal,
-    ]))
+        .update(JSON.stringify(mode === 'exact_plan_replay'
+        ? [
+            seriesKey,
+            repository,
+            baseCommit,
+            headCommit,
+            ordinal,
+        ]
+        : [
+            mode,
+            seriesKey,
+            repository,
+            baseCommit,
+            headCommit,
+            ordinal,
+        ]))
         .digest('hex');
     return `repro:${digest}`;
 }
+function stable(value) {
+    if (Array.isArray(value))
+        return value.map(stable);
+    if (value && typeof value === 'object') {
+        const object = value;
+        return Object.fromEntries(Object.keys(object)
+            .sort()
+            .map(key => [key, stable(object[key])]));
+    }
+    return value;
+}
 function fingerprint(value) {
     return createHash('sha256')
-        .update(JSON.stringify(value))
+        .update(JSON.stringify(stable(value)))
         .digest('hex');
 }
 function expectedCellStatus(reasonCode) {
@@ -124,11 +145,51 @@ function parseAssessment(state, identity) {
         throw new Error('run identity does not match the requested exact launch');
     }
     const output = record(state.output, 'terminal output');
-    if (output.schemaVersion !== 8
+    if ((output.schemaVersion !== 8 && output.schemaVersion !== 9)
         || output.status !== 'driver_assessment_recorded') {
-        throw new Error('run did not produce a schema-8 driver assessment');
+        throw new Error('run did not produce a schema-8 or schema-9 driver assessment');
     }
     const riskPlan = record(output.riskPlanReceipt, 'risk plan receipt');
+    const riskPlanSha256 = fingerprint(riskPlan);
+    let replaySourceRunId = null;
+    let replaySourceResultSchemaVersion = null;
+    if (output.schemaVersion === 9) {
+        if (output.planningCredentialDelivery !== 'not-required-plan-replay') {
+            throw new Error('schema-9 replay used an invalid planning credential mode');
+        }
+        const replay = record(output.riskPlanReplayReceipt, 'risk plan replay receipt');
+        const fields = Object.keys(replay);
+        if (fields.length !== 6
+            || fields.some(field => ![
+                'schemaVersion',
+                'sourceContentPersisted',
+                'sourceResultSchemaVersion',
+                'sourceRiskPlanReceiptSha256',
+                'sourceRunId',
+                'status',
+            ].includes(field))
+            || replay.schemaVersion !== 1
+            || replay.status !== 'risk_plan_replay_verified'
+            || typeof replay.sourceRunId !== 'string'
+            || !RUN_ID.test(replay.sourceRunId)
+            || (replay.sourceResultSchemaVersion !== 8
+                && replay.sourceResultSchemaVersion !== 9)
+            || replay.sourceRiskPlanReceiptSha256 !== riskPlanSha256
+            || typeof replay.sourceRiskPlanReceiptSha256 !== 'string'
+            || !SHA256.test(replay.sourceRiskPlanReceiptSha256)
+            || replay.sourceContentPersisted !== false) {
+            throw new Error('risk plan replay receipt is malformed');
+        }
+        replaySourceRunId = replay.sourceRunId;
+        replaySourceResultSchemaVersion = replay.sourceResultSchemaVersion;
+    }
+    else if (output.riskPlanReplayReceipt !== undefined) {
+        throw new Error('schema-8 result contains unversioned replay provenance');
+    }
+    else if (output.planningCredentialDelivery
+        !== 'per-command-env-gateway-placeholder') {
+        throw new Error('schema-8 result used an invalid planning credential mode');
+    }
     const assessment = record(output.driverAssessmentReceipt, 'driver assessment receipt');
     const planCells = array(riskPlan.cells, 'risk plan cells');
     const assessmentCells = array(assessment.cells, 'assessment cells');
@@ -219,6 +280,10 @@ function parseAssessment(state, identity) {
         throw new Error('driver assessment overall status is inconsistent');
     }
     return {
+        schemaVersion: output.schemaVersion,
+        riskPlanSha256,
+        replaySourceRunId,
+        replaySourceResultSchemaVersion,
         planIdentities,
         cellIds,
         status: assessment.status,
@@ -315,10 +380,37 @@ export function analyzeHostedReproducibility(runs, identity) {
             });
         }
     }
+    const requestedRuns = identity.requestedRuns ?? runs.length;
+    const allRequestedRunsLaunched = runs.length === requestedRuns;
     const planVariants = groupedPlanVariants(parsed);
     const assessmentVariants = groupedOutcomeVariants(parsed);
-    const plannerReproducible = parsed.length === runs.length && planVariants.length === 1;
-    const assessmentReproducible = plannerReproducible && assessmentVariants.length === 1;
+    const mode = identity.mode ?? 'exact_plan_replay';
+    const replaySourceRunId = mode === 'exact_plan_replay'
+        ? parsed[0]?.runId ?? null
+        : null;
+    const planReplayVerified = mode === 'exact_plan_replay'
+        && allRequestedRunsLaunched
+        && parsed.length === runs.length
+        && parsed.length > 1
+        && parsed[0]?.assessment.schemaVersion === 8
+        && parsed[0]?.assessment.replaySourceRunId === null
+        && parsed.slice(1).every(item => item.assessment.schemaVersion === 9
+            && item.assessment.replaySourceRunId === replaySourceRunId
+            && item.assessment.replaySourceResultSchemaVersion
+                === parsed[0].assessment.schemaVersion
+            && item.assessment.riskPlanSha256
+                === parsed[0].assessment.riskPlanSha256);
+    const plannerReproducibilityTested = mode === 'fresh_plans' && parsed.length > 1;
+    const plannerReproducible = plannerReproducibilityTested
+        && allRequestedRunsLaunched
+        && parsed.length === runs.length
+        && parsed.every(item => item.assessment.schemaVersion === 8
+            && item.assessment.replaySourceRunId === null)
+        && planVariants.length === 1;
+    const assessmentReproducible = (mode === 'exact_plan_replay'
+        ? planReplayVerified
+        : plannerReproducible)
+        && assessmentVariants.length === 1;
     const planDriftCellIds = driftIds(parsed, assessment => new Map(assessment.planIdentities.map(plan => [
         plan.cellId,
         { capabilityId: plan.capabilityId },
@@ -340,12 +432,22 @@ export function analyzeHostedReproducibility(runs, identity) {
         repository: identity.repository,
         base_commit: identity.baseCommit,
         head_commit: identity.headCommit,
-        requested_runs: runs.length,
+        reproducibility_mode: mode,
+        requested_runs: requestedRuns,
+        launched_runs: runs.length,
+        unstarted_runs: Math.max(0, requestedRuns - runs.length),
         analyzable_runs: parsed.length,
         run_ids: runs.map(run => run.state.runId),
+        replay_source_run_id: replaySourceRunId,
+        plan_replay_verified: planReplayVerified,
+        planner_reproducibility_tested: plannerReproducibilityTested,
         planner_reproducible: plannerReproducible,
         assessment_reproducible: assessmentReproducible,
-        reproducible: assessmentReproducible && inconclusiveCellIds.length === 0,
+        reproducible: (mode === 'exact_plan_replay'
+            ? planReplayVerified
+            : plannerReproducible)
+            && assessmentReproducible
+            && inconclusiveCellIds.length === 0,
         plan_variants: planVariants,
         assessment_variants: assessmentVariants,
         plan_drift_cell_ids: planDriftCellIds,
@@ -354,11 +456,36 @@ export function analyzeHostedReproducibility(runs, identity) {
         unrunnable_runs: unrunnableRuns,
     };
 }
+export function isHostedReproducibilityReplaySource(run, identity) {
+    if (run.timedOut || run.state.status !== 'complete')
+        return false;
+    try {
+        const assessment = parseAssessment(run.state, identity);
+        return assessment.schemaVersion === 8
+            && assessment.replaySourceRunId === null;
+    }
+    catch {
+        return false;
+    }
+}
 function renderHostedReproducibility(report) {
     const icon = report.reproducible ? chalk.green('✓') : chalk.yellow('!');
     console.log(`${icon} Hosted reproducibility: ${report.reproducible ? 'reproducible' : 'not established'}`);
-    console.log(`  ${chalk.dim('Runs:')} ${report.analyzable_runs}/${report.requested_runs} analyzable`);
+    console.log(`  ${chalk.dim('Runs:')} ${report.analyzable_runs}/${report.requested_runs} analyzable; ${report.launched_runs} launched`);
+    console.log(`  ${chalk.dim('Mode:')} ${report.reproducibility_mode === 'fresh_plans'
+        ? 'independent fresh plans'
+        : 'exact plan replay'}`);
     console.log(`  ${chalk.dim('Plan variants:')} ${report.plan_variants.length}`);
+    console.log(`  ${chalk.dim('Exact plan replay:')} ${report.reproducibility_mode === 'fresh_plans'
+        ? 'not requested'
+        : report.plan_replay_verified
+            ? 'verified'
+            : 'not verified'}`);
+    console.log(`  ${chalk.dim('Independent planner reproducibility:')} ${report.planner_reproducibility_tested
+        ? report.planner_reproducible
+            ? 'verified'
+            : 'not reproducible'
+        : 'not tested'}`);
     console.log(`  ${chalk.dim('Assessment variants:')} ${report.assessment_variants.length}`);
     if (report.plan_drift_cell_ids.length > 0) {
         console.log(`  ${chalk.dim('Plan drift:')} ${report.plan_drift_cell_ids.length} stable cell id(s)`);
@@ -377,6 +504,9 @@ export async function verifyHostedReproducibilityCommand(repositoryArg, options)
     const repository = parseHostedRepository(repositoryArg);
     const requestedRuns = boundedInteger(options.runs, DEFAULT_RUNS, '--runs', 2, MAX_RUNS);
     const seriesKey = requireSeriesKey(options.seriesKey);
+    const mode = options.freshPlans
+        ? 'fresh_plans'
+        : 'exact_plan_replay';
     const auth = await resolveAuthContext({
         preferredLogin: options.account,
         owner: repository.owner,
@@ -391,7 +521,10 @@ export async function verifyHostedReproducibilityCommand(repositoryArg, options)
         const started = await startHostedVerification(repositoryArg, {
             base: options.base,
             head: options.head,
-            idempotencyKey: hostedReproducibilityRunKey(seriesKey, repository.fullName, options.base, options.head, index + 1),
+            idempotencyKey: hostedReproducibilityRunKey(seriesKey, repository.fullName, options.base, options.head, index + 1, mode),
+            replayPlanFrom: options.freshPlans || index === 0
+                ? undefined
+                : runs[0]?.state.runId,
             wait: false,
         }, auth.token);
         let state = started.state;
@@ -406,12 +539,28 @@ export async function verifyHostedReproducibilityCommand(repositoryArg, options)
             timedOut = waited.timedOut;
         }
         runs.push({ state, timedOut });
+        if (!options.freshPlans
+            &&
+                index === 0
+            && !isHostedReproducibilityReplaySource(runs[0], {
+                seriesKey,
+                repository: repository.fullName,
+                baseCommit: options.base,
+                headCommit: options.head,
+            })) {
+            if (!options.json) {
+                console.error(chalk.yellow('Source run is not replayable; later runs were not launched.'));
+            }
+            break;
+        }
     }
     const report = analyzeHostedReproducibility(runs, {
         seriesKey,
         repository: repository.fullName,
         baseCommit: options.base,
         headCommit: options.head,
+        requestedRuns,
+        mode,
     });
     if (options.json) {
         process.stdout.write(`${JSON.stringify(withSchema('cloud-verifier', {

package/dist/commands/verify-hosted.d.ts

@@ -2,6 +2,7 @@ export interface HostedStartOptions {
     base: string;
     head: string;
     idempotencyKey?: string;
+    replayPlanFrom?: string;
     account?: string;
     wait?: boolean;
     interval?: string;
@@ -41,7 +42,7 @@ export declare function parseHostedRepository(value: string): {
     repository: string;
     fullName: string;
 };
-export declare function defaultHostedIdempotencyKey(repository: string, baseCommit: string, headCommit: string): string;
+export declare function defaultHostedIdempotencyKey(repository: string, baseCommit: string, headCommit: string, replayPlanFrom?: string): string;
 export declare function hostedPollingOptions(interval: string | undefined, timeout: string | undefined, onStatus?: (state: HostedRunState) => void): HostedPollOptions;
 export declare function startHostedVerification(repositoryArg: string, options: HostedStartOptions, token: string): Promise<{
     state: HostedRunState;

package/dist/commands/verify-hosted.js

@@ -121,9 +121,11 @@ function requireCommit(value, flag) {
     }
     return value;
 }
-export function defaultHostedIdempotencyKey(repository, baseCommit, headCommit) {
+export function defaultHostedIdempotencyKey(repository, baseCommit, headCommit, replayPlanFrom) {
     const digest = createHash('sha256')
-        .update(JSON.stringify([repository, baseCommit, headCommit]))
+        .update(JSON.stringify(replayPlanFrom
+        ? [repository, baseCommit, headCommit, replayPlanFrom]
+        : [repository, baseCommit, headCommit]))
         .digest('hex');
     return `cli:${digest}`;
 }
@@ -153,8 +155,12 @@ export async function startHostedVerification(repositoryArg, options, token) {
     const repository = parseHostedRepository(repositoryArg);
     const baseCommit = requireCommit(options.base, '--base');
     const headCommit = requireCommit(options.head, '--head');
+    const replayPlanFrom = options.replayPlanFrom;
+    if (replayPlanFrom !== undefined && !RUN_ID.test(replayPlanFrom)) {
+        throw new Error('--replay-plan-from must match cv_ followed by 48 lowercase hex characters.');
+    }
     const idempotencyKey = requireIdempotencyKey(options.idempotencyKey
-        ?? defaultHostedIdempotencyKey(repository.fullName, baseCommit, headCommit));
+        ?? defaultHostedIdempotencyKey(repository.fullName, baseCommit, headCommit, replayPlanFrom));
     const response = await haystackJson('/api/agent/cloud-verifier/runs', token, {
         method: 'POST',
         headers: { 'Content-Type': 'application/json' },
@@ -164,6 +170,9 @@ export async function startHostedVerification(repositoryArg, options, token) {
             baseCommit,
             headCommit,
             idempotencyKey,
+            ...(replayPlanFrom
+                ? { replayPlanFromRunId: replayPlanFrom }
+                : {}),
         }),
     });
     const state = parseHostedRunState(response);
@@ -200,7 +209,7 @@ function delay(milliseconds) {
 export async function waitForHostedVerification(runId, token, options) {
     const startedAt = Date.now();
     let lastStatus;
-    while (true) {
+    for (;;) {
         const state = await getHostedVerification(runId, token);
         if (state.status !== lastStatus) {
             options.onStatus?.(state);

package/dist/index.js

@@ -219,6 +219,7 @@ hostedVerify
     .option('--base <sha>', 'Required: exact 40-character lowercase base commit SHA')
     .option('--head <sha>', 'Required: exact 40-character lowercase head commit SHA')
     .option('--idempotency-key <key>', 'Stable retry key (default: deterministic from repository and commits)')
+    .option('--replay-plan-from <run-id>', 'Reuse the exact validated risk plan from a completed owned run')
     .option('--account <login>', 'Use a specific saved Haystack account')
     .option('--no-wait', 'Return after the production workflow is queued')
     .option('--interval <seconds>', 'Polling interval while waiting (default 5)')
@@ -228,9 +229,12 @@ hostedVerify
 The default idempotency key makes an exact retry return the original run. Pass
 --idempotency-key with a new stable key only when you intentionally want a
 fresh production execution of the same commit pair.
+--replay-plan-from requires the same repository and exact commit pair and emits
+a schema-9 terminal receipt with replay provenance.
 
 Examples:
   haystack verify hosted start owner/repo --base <sha> --head <sha>
+  haystack verify hosted start owner/repo --base <sha> --head <sha> --replay-plan-from cv_<48 lowercase hex characters>
   haystack verify hosted start owner/repo --base <sha> --head <sha> --no-wait --json
 `)
     .action(async (repository, _options, cmd) => {
@@ -258,24 +262,31 @@ Example:
 });
 hostedVerify
     .command('reproducibility')
-    .description('Repeat an exact hosted verification and report plan or assessment drift')
+    .description('Replay one exact hosted risk plan or run fresh plans to report drift')
     .argument('<repository>', 'Exact GitHub owner/repository name')
     .option('--base <sha>', 'Required: exact 40-character lowercase base commit SHA')
     .option('--head <sha>', 'Required: exact 40-character lowercase head commit SHA')
     .option('--runs <n>', 'Number of sequential production runs (default 3; min 2, max 10)')
     .option('--series-key <key>', 'Stable series key for resumable idempotent retries')
+    .option('--fresh-plans', 'Run the planner independently for every run instead of replaying the first plan')
     .option('--account <login>', 'Use a specific saved Haystack account')
     .option('--interval <seconds>', 'Polling interval for each run (default 5)')
     .option('--timeout <minutes>', 'Maximum wait per run (default 35)')
     .option('--json', 'Versioned machine-readable reproducibility report')
     .addHelpText('after', `
-Every run uses the same repository and exact commit pair with a distinct,
-series-derived idempotency key. The report compares stable risk-cell identities
-and deterministic assessment outcomes; inconclusive cells never count as a
-reproducible verdict.
+The first run creates a fresh risk plan. Every later run replays that exact
+validated plan against the same repository and commit pair with a distinct,
+series-derived idempotency key. A reproducible verdict requires schema-9 replay
+provenance, stable assessment outcomes, and no inconclusive cells.
+
+With --fresh-plans, every run plans independently. A reproducible verdict then
+requires one stable-id plan variant, one assessment variant, no replay
+provenance, and no inconclusive cells. Use this mode to detect planner drift;
+use the default mode to isolate executor or assessment drift.
 
 Example:
   haystack verify hosted reproducibility owner/repo --base <sha> --head <sha> --runs 3
+  haystack verify hosted reproducibility owner/repo --base <sha> --head <sha> --runs 3 --fresh-plans
 `)
     .action(async (repository, _options, cmd) => {
     const options = { ...cmd.optsWithGlobals(), ...cmd.opts() };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@haystackeditor/cli",
-  "version": "0.15.24",
+  "version": "0.15.26",
   "description": "Set up Haystack for your project — automated PR review, triage, and merge queue",
   "type": "module",
   "bin": {