@nexus-cortex/cli 4.124.25 → 4.124.27

package/.cortex/orient

@@ -7,6 +7,16 @@
 W="$(pwd)"
 echo "== WORKSPACE MAP: $W =="
 ls -1A "$W" 2>/dev/null | head -40
+# orient v2 ships DARK (2026-09-27): every v2 section runs only with CORTEX_ORIENT_V2=1; unset = the v1 output byte-for-byte.
+V2="${CORTEX_ORIENT_V2:-0}"
+# orient v2 (2026-09-27, MiMo: the whole library lived under vendor/ and the map showed one level): one more level for the top
+# directories (skipping caches/vendored deps of the toolchain), capped so the map stays small.
+[ "$V2" = "1" ] && for d in $(ls -1A "$W" 2>/dev/null | head -40); do
+  [ -d "$W/$d" ] || continue
+  case "$d" in .git|node_modules|__pycache__|.venv|venv|.cache|.cortex|.addon-tools|dist|build|target) continue;; esac
+  n=$(ls -1A "$W/$d" 2>/dev/null | wc -l | tr -d ' ')
+  echo "  $d/ ($n): $(ls -1A "$W/$d" 2>/dev/null | head -8 | tr '\n' ' ')"
+done | head -8
 PROJECT=""
 CMDS=""
 if [ -f package.json ]; then
@@ -38,15 +48,85 @@ for b in file xxd strings ps pgrep free pdftotext tesseract gcc make git curl; d
   if command -v "$b" >/dev/null 2>&1; then HAVE="$HAVE $b"; else MISS="$MISS $b"; fi
 done
 echo "-- tooling:${TI:- (no python/node on PATH)} | have:${HAVE:- none} | missing:${MISS:- none}"
+# orient v2: the baseline the judge's workspace delta is computed against — know it before editing.
+if [ "$V2" != "1" ]; then :
+elif command -v git >/dev/null 2>&1 && git -C "$W" rev-parse --is-inside-work-tree >/dev/null 2>&1; then
+  CH=$(git -C "$W" status --porcelain 2>/dev/null | wc -l | tr -d ' ')
+  if git -C "$W" rev-parse --verify -q HEAD >/dev/null 2>&1; then
+    echo "-- git: $(git -C "$W" rev-parse --abbrev-ref HEAD 2>/dev/null) @ $(git -C "$W" log -1 --format=%h 2>/dev/null), $CH changed file(s) — \`git diff\` shows your edits"
+  else
+    echo "-- git: repository with no commits yet ($CH untracked/changed path(s)) — commit a baseline before editing to diff your work"
+  fi
+else
+  echo "-- git: not a repository (no baseline to diff your edits against)"
+fi
+# Workspace baseline (CORTEX_ORIENT_BASELINE=1, dark, 2026-09-27): MiMo tb64 lost ~10-14% of tasks per run to the grader's
+# protected-file guard (a file outside the task's repair set was modified, usually vendored library code) and the workspaces are not git
+# repos, so nothing could show the agent what it had changed. Record a checksum list ONCE (never overwritten, so a re-run of orient keeps
+# the start state) and ship `.cortex/changed`, which lists modified / added / deleted files against it. POSIX cksum; capped.
+if [ "${CORTEX_ORIENT_BASELINE:-0}" = "1" ]; then
+  mkdir -p "$W/.cortex" 2>/dev/null
+  cat > "$W/.cortex/changed" 2>/dev/null <<'CHANGED'
+#!/bin/sh
+# Lists files modified / added / deleted since orient recorded .cortex/baseline.cksum (the task's start state).
+cd "$(dirname "$0")/.." || exit 0
+B=.cortex/baseline.cksum
+[ -f "$B" ] || { echo "no baseline recorded (.cortex/baseline.cksum missing)"; exit 0; }
+T=$(mktemp 2>/dev/null || echo /tmp/cortex-now.$$)
+find . \( -path ./.git -o -path ./.cortex -o -name node_modules -o -name __pycache__ -o -name .venv -o -name venv -o -name .cache -o -name .pytest_cache -o -name .mypy_cache \) -prune -o -type f -size -20M -print 2>/dev/null | head -20000 | tr '\n' '\0' | xargs -0 cksum 2>/dev/null > "$T"
+awk 'function k(  f) { f=$0; sub(/^[0-9]+[ \t]+[0-9]+[ \t]+/, "", f); return f }
+  NR==FNR { b[k()]=$1" "$2; next } { n[k()]=$1" "$2 } END {
+  for (f in n) { if (!(f in b)) print "added     " f; else if (b[f] != n[f]) print "modified  " f }
+  for (f in b) if (!(f in n)) print "deleted   " f }' "$B" "$T" | sort -k2
+rm -f "$T"
+CHANGED
+  if [ ! -f "$W/.cortex/baseline.cksum" ]; then
+    ( cd "$W" && find . \( -path ./.git -o -path ./.cortex -o -name node_modules -o -name __pycache__ -o -name .venv -o -name venv -o -name .cache -o -name .pytest_cache -o -name .mypy_cache \) -prune -o -type f -size -20M -print 2>/dev/null | head -20000 | tr '\n' '\0' | xargs -0 cksum 2>/dev/null > .cortex/baseline.cksum )
+  fi
+  BN=$(wc -l < "$W/.cortex/baseline.cksum" 2>/dev/null | tr -d ' ')
+  echo "-- baseline: ${BN:-0} files recorded at start; \`sh .cortex/changed\` lists files you modified/added/deleted. Before finishing, run it and revert every change the task did not require."
+fi
 # Bare-box hint (2026-09-03, operator-simplified): a task container may ship WITHOUT the language, compiler,
 # package or library the objective needs — on purpose (the agent phase is bare; internet is usually allowed).
 # State the FACTS (package manager present, whether we are root) and ONE principled directive — no command
 # cookbook: the model bootstraps correctly on its own (pro solved a bare-box torch task with only this line).
 # Prescribing exact incantations is prompt mass that misdirects; observation + intent is enough.
+# The directive exists because some bench task containers ship WITHOUT the dependencies the task needs (operator, 09-27): they must be
+# installed efficiently — once, cached, never duplicated. Trigger unchanged from v1 (no interpreter OR no C compiler). orient v2 adds a
+# guard instead of suppressing the line: the MiMo doctrine mine found 21 sessions pip-installing into the task's frozen vendor trees.
 if [ "${CORTEX_ORIENT_BOOTSTRAP:-0}" = "1" ] && { ! command -v python3 >/dev/null 2>&1 && ! command -v python >/dev/null 2>&1 || ! command -v cc >/dev/null 2>&1; }; then
   PM=""; for m in apt-get apk dnf yum pacman zypper brew; do command -v "$m" >/dev/null 2>&1 && { PM="$m"; break; }; done
   ROOT=$([ "$(id -u 2>/dev/null)" = "0" ] && echo yes || echo no)
-  echo "-- setup: this box may be missing a tool/language/library the task needs (pkg-mgr=${PM:-none}, root=$ROOT). If so, INSTALL what you need yourself following standard practice (the system package manager, or the language's own installer); install ONCE and reuse it, and prefer a fast cached installer for the language (uv for Python, bun for JS) — do not re-download a large dependency twice. Pin versions, then verify with a real run before finishing. An empty box is part of the task, not an error."
+  GUARD=""; [ "$V2" = "1" ] && GUARD=" Install into the system or a venv, never into the task's own source or vendored tree."
+  echo "-- setup: this box may be missing a tool/language/library the task needs (pkg-mgr=${PM:-none}, root=$ROOT). If so, INSTALL what you need yourself following standard practice (the system package manager, or the language's own installer); install ONCE and reuse it, and prefer a fast cached installer for the language (uv for Python, bun for JS) — do not re-download a large dependency twice.$GUARD Pin versions, then verify with a real run before finishing. An empty box is part of the task, not an error."
+fi
+# orient v2 — VERIFICATION ENTRY POINTS: how this task's correctness is checked, so work is built and verified against the real
+# criteria, not the agent's own guess (MiMo K=3: in 57/79 failures the agent's own test passed on a wrong solution). Same usage-line
+# logic as the judge/planner env report (R193), plus probe/test scripts, test config and test directories. Read-only, capped.
+VE=""; TC=""; TD=""
+if [ "$V2" = "1" ]; then
+VE=$(find . -maxdepth 3 \( -iname "*check*" -o -iname "*verif*" -o -iname "*validat*" -o -iname "*grade*" -o -iname "*probe*" -o -name "test_*.py" -o -name "*_test.py" -o -iname "run_tests*" \) \( -name "*.py" -o -name "*.sh" \) 2>/dev/null | grep -vE "node_modules|/\.|site-packages|/vendor/.*/tests?/" | head -6)
+TC=""
+for f in pytest.ini tox.ini setup.cfg pyproject.toml Makefile package.json; do
+  [ -f "$f" ] || continue
+  case "$f" in
+    pytest.ini|tox.ini) TC="$TC $f";;
+    setup.cfg) grep -q "tool:pytest" "$f" 2>/dev/null && TC="$TC setup.cfg[tool:pytest]";;
+    pyproject.toml) grep -q "tool.pytest" "$f" 2>/dev/null && TC="$TC pyproject.toml[tool.pytest]";;
+    Makefile) grep -qE "^(test|check)[a-z_-]*:" "$f" 2>/dev/null && TC="$TC make:$(grep -oE '^(test|check)[a-z_-]*' "$f" | head -3 | tr '\n' ',' | sed 's/,$//')";;
+    package.json) grep -q '"test"' "$f" 2>/dev/null && TC="$TC npm-test";;
+  esac
+done
+TD=$(find . -maxdepth 3 -type d \( -name tests -o -name test \) 2>/dev/null | grep -vE "node_modules|/\.|site-packages" | head -4 | tr '\n' ' ')
+fi
+if [ -n "$VE$TC$TD" ]; then
+  echo "== VERIFICATION ENTRY POINTS (build to and verify against these — not a test you invent) =="
+  for f in $VE; do
+    echo "  $f"
+    { grep -n -m3 -iE "usage|^ *Run:|add_argument|sys\.argv|getopts" "$f" 2>/dev/null; } | head -3 | cut -c1-150 | sed 's/^/      /'
+  done
+  [ -n "$TC" ] && echo "  test config:$TC"
+  [ -n "$TD" ] && echo "  test dirs: $TD"
 fi
 if [ -f README.md ]; then
   echo "-- README head --"
@@ -55,7 +135,7 @@ fi
 # Capability index — harness-owned steering (item 9b): the skills shipped with
 # the install, reachable through plain bash reads (works under any tool frame).
 SK="${CORTEX_ROOT:-$HOME}/.cortex/skills"
-if [ -d "$SK" ]; then
+if [ -d "$SK" ] && [ "$V2" != "1" ]; then
   echo "== CAPABILITY GUIDES (load one with: cat <path>/SKILL.md) =="
   for d in "$SK"/*/; do
     [ -d "$d" ] || continue
@@ -64,6 +144,11 @@ if [ -d "$SK" ]; then
     case "$desc" in ">"|"|"|"") desc="guide";; esac
     echo "  $SK/$n — $desc"
   done | head -14
+elif [ -d "$SK" ]; then
+  # orient v2: one line (was 12 full paths + descriptions ≈ half the output, mostly irrelevant to the task at hand).
+  NAMES=$(for d in "$SK"/*/; do [ -d "$d" ] && basename "$d"; done | tr '\n' ' ')
+  echo "== CAPABILITY GUIDES: $NAMES(read one: cat $SK/<name>/SKILL.md)"
+  [ -f "$SK/verify-work/SKILL.md" ] && echo "  before finishing, verify-work: cat $SK/verify-work/SKILL.md"
 fi
 echo "note: when your tool list is limited, additional tools may be discoverable via the SearchTools tool."
 # Mechanical CORTEX.md (items 9c + 10): machine-authored sections live between

package/.env.defaults

@@ -595,6 +595,7 @@ CORTEX_LIFT_NUDGE=true
 # [LEDGER 2026-09-06 @4.93.0] ON (reson standard baseline). Part of the reson stack (GATE+REQ+LIFT+RESOLVER) that shipped through resolver-k5 (proven net-positive as a stack). NOTE: k5 held LIFT on in BOTH arms (shared baseline, not the A/B variable) — its independent efficacy stands from the 2026-09-04 isolated eval (plan quality excellent at max/4000); k5 ratifies the reson stack as standard, not LIFT in isolation.
 # [LEDGER 2026-09-11 @4.107.1] PLANNER DOCTRINE +4 bullets (HB-PLAN-DOCTRINE, cell-n-r1 census): ONE INSTALL LAYER (uv owns venv+packages / bun / reuse what is present — no python→.venv→python stacks), LONG WAITS (background + poll ≤60 s, no minute-long sleeps), EXACT-OUTPUT (byte-level, never parse→re-serialize), EXPECTED LITERALS ARE LAW + graders re-parameterize (derive at run time, never bake constants). Prompt-only; efficacy = next hard-core run on 4.107.1 vs cell-n-r1 flash-none 10/24. Same release: EndTurn discoveryTier standard→essential (HB-ENDTURN-TIER, not a lever).
 CORTEX_LIFT_PLAN=true
+# [LEDGER 2026-09-27] MiMo K=3 wire (banked `mentor`, 192 lift plans): pro thinking-on @max median 108 s, p90 166 s, 15/192 thinking-off retries — 12–22% of a 900 s MiMo agent budget. e6 (09-18) found no effort level separating (max 10/28, high 12/29, none 11/29 at 10× faster lift); max buys nothing measured. Candidate: CORTEX_LIFT_PLAN_REASONING=none (operator decision).
 #CORTEX_LIFT_PLAN_EFFORT=max
 #CORTEX_LIFT_PLAN_BUDGET_TOKENS=4000
 #CORTEX_LIFT_PLAN_TIMEOUT_MS=90000
@@ -1109,8 +1110,22 @@ CORTEX_ENDTURN_GATE=true
 # the judge's post-hoc checks (f1: 122 checks confirmed the agent's reading of the spec). Events: spec_tests {checks, genLatencyMs,
 # refused}; endturn_resolver += {specTests, specChecks, specRan, specPassed, specFailed, specInconclusive, specGenLatencyMs}. Default off.
 # [LEDGER 2026-09-20 @4.120.0] BUILT + unit-tested (R174 block in endTurnResolver.test.ts). FIELD: pending (cell g1).
+# [LEDGER 2026-09-27 @4.124.25+tree] RELIABILITY MEASURED OFFLINE (.bench/specrel/, 64 MiMo tb64 tasks; checks run in each task's container on the BROKEN state and on grader-confirmed CORRECT states rebuilt by replaying a passing session, 44/47 confirmed): per-check false alarm 29% on correct solutions, 48% discriminating, 23% blind; check SETS vetoed a correct solution 53–55% of the time, detected the broken state 89%. Causes: invented literals/paths (84), multi-line commands truncated by the one-line parser (18), 14% refused by the denylist, some checks WRITE the deliverable. A v2 persona with explicit rules: NO gain (set FA 60%). R174c (in tree dc4059bbe7) = structural: groundSpecCheck (drop checks whose literals/paths neither the task nor the env report states) + specCheckParses (`sh -n`): set FA 44%, detection 86%. Still NOT fit as a hard veto; gate value on actual agent final states = see r-specrel-2026-09-27.
 #CORTEX_JUDGE_SPEC_TESTS=
 #CORTEX_JUDGE_SPEC_TESTS_MAX=
+# CORTEX_JUDGE_SPEC_TESTS_SAMPLES / CORTEX_JUDGE_SPEC_VETO_FRAC — R174d (in tree, 2026-09-27, r-specrel-2026-09-27): the blind spec checks are authored
+# SAMPLES times (1..5, default 3; parallel, thinking-off ≈3 s) and the veto evidence is the averaged per-sample spec-fail fraction ≥ VETO_FRAC
+# (0<f≤1, default 0.5) — not ANY failed check. And a MEETS is held ONCE (inside the evidence cap) when that fraction is reached: before
+# R174d decideVetoAction returned 'accept' on MEETS before looking at spec evidence, so the checks could never touch the confident-wrong finish.
+# [LEDGER 2026-09-27 @in-tree] OFFLINE on 175 replayed MiMo final states: judge alone J 0.11 (FA 82% / FH 7%); "any spec check fails" 73–92% false
+# holds; judge AND averaged fraction <0.5 (3 samples, R174c grounding) J 0.30 (FA 51% / FH 18%); one sample J 0.08–0.25. Live smoke 4:40 AM PT:
+# specSets 3, specFrac banked on endturn_resolver. FIELD: pending (needs a cell; spec tests stay OFF by default).
+# [LEDGER 2026-09-27 @4.124.26] LIVE VERDICT: HARMFUL as delivered — MiMo tb64 validation arm sp 28/64 = 43.8% vs control 59.9% (K=3),
+# P<0.0001 vs per-task control rates; 4 always-pass tasks lost. The judge quotes a failing blind check (specFrac 0.17-0.25, below the veto
+# fraction) as its own named check → ordinary veto → the agent reshapes correct output to the invented check. KEEP DARK; redesign so check
+# text never reaches the judge/writer (r-mimo64-val-2026-09-27.md §2).
+#CORTEX_JUDGE_SPEC_TESTS_SAMPLES=
+#CORTEX_JUDGE_SPEC_VETO_FRAC=
 # CORTEX_JUDGE_VETO_MIN_REMAINING / _GAP_HOLD_MIN_INTERVAL_MS / _GAP_HOLD_PLAN_MAX_SIMILARITY — R173c (4.121.0, 2026-09-20, cell g1
 # attribution r-tb4-g1-2026-09-20.md §3): the ONE attributable regression was an evidence veto at 15% budget (27 min left → fail; control's
 # judge accepted at 25% and passed); the three 6-hold failures re-finished six times inside 2–4% of the budget (the ≥3-call progress rule
@@ -1744,6 +1759,24 @@ CORTEX_SLICE_NUDGE=true
 # [LEDGER 2026-09-03 @4.91.1] DARK (default 0) — ships dark, A/B-able (def-60a1dfc55a); do NOT bake into the k=5 pin.
 # [LEDGER 2026-09-06 @4.93.0] ON=1 (reson standard, operator directive: match the full bench COMMON). CAVEAT: was a SHARED BASELINE in both k5 arms (on in reson AND resoff), so NOT independently A/B-validated — it's part of the proven reson BUNDLE (+17pp) but its solo contribution is unmeasured. A/B-able (def-60a1dfc55a) if isolated efficacy is ever needed.
 CORTEX_ORIENT_BOOTSTRAP=1
+# CORTEX_ORIENT_V2 — orient v2 (2026-09-27, r-specrel-2026-09-27 §7/§7a): VERIFICATION ENTRY POINTS (checker/probe/test scripts with usage
+# lines, test config, test dirs), a `-- git:` baseline line, a 2-level map of the top dirs, capability guides collapsed to one line, and a
+# vendor-tree guard sentence on the bootstrap directive. Unset = the v1 output byte-for-byte.
+# [LEDGER 2026-09-27 @4.124.26] DARK (default 0) — validated for exit/size in 64 MiMo containers (0 failures); outcome effect UNMEASURED:
+# the MiMo validation cell (4.124.26, orient-v2 arm vs spec-tests arm vs the 4.124.20 K=3 control 59.9%) decides it.
+# [LEDGER 2026-09-27 @4.124.26] MiMo tb64 validation arm o2: 43/64 = 67.2% vs control 59.9% (K=3), +7.3 pts, P=0.019 vs per-task control
+# rates (one run). Positive single run — replicate (K=2 more) before flipping the default (r-mimo64-val-2026-09-27.md).
+#CORTEX_ORIENT_V2=
+# CORTEX_ORIENT_BASELINE / CORTEX_LIFT_PLAN_SCOPE — edit-scope pair (2026-09-27, r-mimo64-val-2026-09-27.md §8). MiMo tb64: the grader's
+# protected-file guard rejected 4-9 sessions per run (31 across 5 runs, ~10-14% of tasks) — a file outside the task's repair set was
+# modified, usually vendored library code; on 2329 the planner itself declared an unnamed file mutable. BASELINE: orient records a cksum
+# list of the workspace once (never overwritten) and ships `.cortex/changed` (modified/added/deleted vs start) + a pre-finish
+# "revert every change the task did not require" line. SCOPE: the lift planner lists the files it will modify; only the files the task names
+# are modified; ends with the changed-files check.
+# [LEDGER 2026-09-27 @4.124.27] DARK (both default off) — fixture-tested (dash; start state kept across orient re-runs; spaces in names);
+# efficacy UNMEASURED: the MiMo reasoning sweep carries both ON with an o2+both base arm.
+#CORTEX_ORIENT_BASELINE=
+#CORTEX_LIFT_PLAN_SCOPE=
 # [LEDGER 2026-09-02 @4.89.0] code default 30 (4.88.0) — 20 made the break rung (2N=24) unreachable; preserves 40%/80% density semantics.
 #NEARDUP_WINDOW=30
 # [LEDGER 2026-09-02 @4.89.0] code default 12 (4.88.0) — 8 misfired on persistence-wins grinds (rstan-to-pystan regressed both arms).

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nexus-cortex/cli",
-  "version": "4.124.25",
+  "version": "4.124.27",
   "description": "Nexus Cortex CLI - Terminal interface for multi-provider LLM orchestration",
   "main": "dist/index.js",
   "type": "module",
@@ -19,7 +19,7 @@
     "prepack": "node ../../scripts/copy-pkg-cortex-scaffold.mjs"
   },
   "dependencies": {
-    "@nexus-cortex/core": "4.124.25",
+    "@nexus-cortex/core": "4.124.27",
     "chalk": "^4.1.2",
     "cli-spinners": "^2.9.0",
     "commander": "^11.0.0",