@nexus-cortex/cli 4.124.26 → 4.124.28

package/.cortex/orient

@@ -60,6 +60,56 @@ elif command -v git >/dev/null 2>&1 && git -C "$W" rev-parse --is-inside-work-tr
 else
   echo "-- git: not a repository (no baseline to diff your edits against)"
 fi
+# Workspace baseline (CORTEX_ORIENT_BASELINE=1, dark, 2026-09-27): MiMo tb64 lost ~10-14% of tasks per run to the grader's
+# protected-file guard (a file outside the task's repair set was modified, usually vendored library code) and the workspaces are not git
+# repos, so nothing could show the agent what it had changed. Record a checksum list ONCE (never overwritten, so a re-run of orient keeps
+# the start state) and ship `.cortex/changed`, which lists modified / added / deleted files against it. POSIX cksum; capped.
+if [ "${CORTEX_ORIENT_BASELINE:-0}" = "1" ]; then
+  mkdir -p "$W/.cortex" 2>/dev/null
+  cat > "$W/.cortex/changed" 2>/dev/null <<'CHANGED'
+#!/bin/sh
+# Lists files modified / added / deleted since orient recorded .cortex/baseline.cksum (the task's start state).
+cd "$(dirname "$0")/.." || exit 0
+B=.cortex/baseline.cksum
+[ -f "$B" ] || { echo "no baseline recorded (.cortex/baseline.cksum missing)"; exit 0; }
+T=$(mktemp 2>/dev/null || echo /tmp/cortex-now.$$)
+find . \( -path ./.git -o -path ./.cortex -o -name node_modules -o -name __pycache__ -o -name .venv -o -name venv -o -name .cache -o -name .pytest_cache -o -name .mypy_cache \) -prune -o -type f -size -20M -print 2>/dev/null | head -20000 | tr '\n' '\0' | xargs -0 cksum 2>/dev/null > "$T"
+awk 'function k(  f) { f=$0; sub(/^[0-9]+[ \t]+[0-9]+[ \t]+/, "", f); return f }
+  NR==FNR { b[k()]=$1" "$2; next } { n[k()]=$1" "$2 } END {
+  for (f in n) { if (!(f in b)) print "added     " f; else if (b[f] != n[f]) print "modified  " f }
+  for (f in b) if (!(f in n)) print "deleted   " f }' "$B" "$T" | sort -k2
+rm -f "$T"
+CHANGED
+  if [ ! -f "$W/.cortex/baseline.cksum" ]; then
+    ( cd "$W" && find . \( -path ./.git -o -path ./.cortex -o -name node_modules -o -name __pycache__ -o -name .venv -o -name venv -o -name .cache -o -name .pytest_cache -o -name .mypy_cache \) -prune -o -type f -size -20M -print 2>/dev/null | head -20000 | tr '\n' '\0' | xargs -0 cksum 2>/dev/null > .cortex/baseline.cksum )
+  fi
+  BN=$(wc -l < "$W/.cortex/baseline.cksum" 2>/dev/null | tr -d ' ')
+  echo "-- baseline: ${BN:-0} files recorded at start; \`sh .cortex/changed\` lists files you modified/added/deleted. Before finishing, run it and revert every change the task did not require."
+elif [ "${CORTEX_ORIENT_BASELINE:-0}" = "auto" ] && ! { command -v git >/dev/null 2>&1 && git -C "$W" rev-parse --is-inside-work-tree >/dev/null 2>&1; }; then
+  # auto (general work, 2026-09-27): a git repo already has `git status`, so skip it; otherwise keep the baseline OUTSIDE the project
+  # (the user's ~/.cortex, else /tmp), keyed by the workspace path, so nothing is written into the tree being worked on.
+  KEY=$(printf %s "$W" | cksum | cut -d' ' -f1)
+  BD="${HOME:-/tmp}/.cortex/baselines/$KEY"
+  mkdir -p "$BD" 2>/dev/null && [ -w "$BD" ] || { BD="${TMPDIR:-/tmp}/cortex-baselines/$KEY"; mkdir -p "$BD" 2>/dev/null; }
+  { printf '#!/bin/sh\n# Lists files modified / added / deleted in %s since orient recorded its start state.\nW=%s\nB=%s\n' "$W" "'$W'" "'$BD/baseline.cksum'"
+    cat <<'CHANGED'
+cd "$W" || exit 0
+[ -f "$B" ] || { echo "no baseline recorded ($B missing)"; exit 0; }
+T=$(mktemp 2>/dev/null || echo /tmp/cortex-now.$$)
+find . \( -path ./.git -o -path ./.cortex -o -name node_modules -o -name __pycache__ -o -name .venv -o -name venv -o -name .cache -o -name .pytest_cache -o -name .mypy_cache \) -prune -o -type f -size -20M -print 2>/dev/null | head -20000 | tr '\n' '\0' | xargs -0 cksum 2>/dev/null > "$T"
+awk 'function k(  f) { f=$0; sub(/^[0-9]+[ \t]+[0-9]+[ \t]+/, "", f); return f }
+  NR==FNR { b[k()]=$1" "$2; next } { n[k()]=$1" "$2 } END {
+  for (f in n) { if (!(f in b)) print "added     " f; else if (b[f] != n[f]) print "modified  " f }
+  for (f in b) if (!(f in n)) print "deleted   " f }' "$B" "$T" | sort -k2
+rm -f "$T"
+CHANGED
+  } > "$BD/changed" 2>/dev/null
+  if [ ! -f "$BD/baseline.cksum" ]; then
+    ( cd "$W" && find . \( -path ./.git -o -path ./.cortex -o -name node_modules -o -name __pycache__ -o -name .venv -o -name venv -o -name .cache -o -name .pytest_cache -o -name .mypy_cache \) -prune -o -type f -size -20M -print 2>/dev/null | head -20000 | tr '\n' '\0' | xargs -0 cksum 2>/dev/null > "$BD/baseline.cksum" )
+  fi
+  BN=$(wc -l < "$BD/baseline.cksum" 2>/dev/null | tr -d ' ')
+  echo "-- baseline: ${BN:-0} files recorded at start (not a git repo); \`sh $BD/changed\` lists files you modified/added/deleted. Before finishing, run it and revert changes to existing files the task did not require."
+fi
 # Bare-box hint (2026-09-03, operator-simplified): a task container may ship WITHOUT the language, compiler,
 # package or library the objective needs — on purpose (the agent phase is bare; internet is usually allowed).
 # State the FACTS (package manager present, whether we are root) and ONE principled directive — no command

package/.env.defaults

@@ -1120,6 +1120,10 @@ CORTEX_ENDTURN_GATE=true
 # [LEDGER 2026-09-27 @in-tree] OFFLINE on 175 replayed MiMo final states: judge alone J 0.11 (FA 82% / FH 7%); "any spec check fails" 73–92% false
 # holds; judge AND averaged fraction <0.5 (3 samples, R174c grounding) J 0.30 (FA 51% / FH 18%); one sample J 0.08–0.25. Live smoke 4:40 AM PT:
 # specSets 3, specFrac banked on endturn_resolver. FIELD: pending (needs a cell; spec tests stay OFF by default).
+# [LEDGER 2026-09-27 @4.124.26] LIVE VERDICT: HARMFUL as delivered — MiMo tb64 validation arm sp 28/64 = 43.8% vs control 59.9% (K=3),
+# P<0.0001 vs per-task control rates; 4 always-pass tasks lost. The judge quotes a failing blind check (specFrac 0.17-0.25, below the veto
+# fraction) as its own named check → ordinary veto → the agent reshapes correct output to the invented check. KEEP DARK; redesign so check
+# text never reaches the judge/writer (r-mimo64-val-2026-09-27.md §2).
 #CORTEX_JUDGE_SPEC_TESTS_SAMPLES=
 #CORTEX_JUDGE_SPEC_VETO_FRAC=
 # CORTEX_JUDGE_VETO_MIN_REMAINING / _GAP_HOLD_MIN_INTERVAL_MS / _GAP_HOLD_PLAN_MAX_SIMILARITY — R173c (4.121.0, 2026-09-20, cell g1
@@ -1760,7 +1764,28 @@ CORTEX_ORIENT_BOOTSTRAP=1
 # vendor-tree guard sentence on the bootstrap directive. Unset = the v1 output byte-for-byte.
 # [LEDGER 2026-09-27 @4.124.26] DARK (default 0) — validated for exit/size in 64 MiMo containers (0 failures); outcome effect UNMEASURED:
 # the MiMo validation cell (4.124.26, orient-v2 arm vs spec-tests arm vs the 4.124.20 K=3 control 59.9%) decides it.
+# [LEDGER 2026-09-27 @4.124.26] MiMo tb64 validation arm o2: 43/64 = 67.2% vs control 59.9% (K=3), +7.3 pts, P=0.019 vs per-task control
+# rates (one run). Positive single run — replicate (K=2 more) before flipping the default (r-mimo64-val-2026-09-27.md).
+# [LEDGER 2026-09-27 @4.124.27] NOT REPLICATED: five sweep arms on o2 + edit-scope pair pooled 194/320 = 60.6% (control 59.9%); o2's 43/64 was
+# most likely a high draw (the pair could offset it — no o2-only replicate). Stays DARK.
 #CORTEX_ORIENT_V2=
+# CORTEX_ORIENT_BASELINE / CORTEX_LIFT_PLAN_SCOPE — edit-scope pair (2026-09-27, r-mimo64-val-2026-09-27.md §8). MiMo tb64: the grader's
+# protected-file guard rejected 4-9 sessions per run (31 across 5 runs, ~10-14% of tasks) — a file outside the task's repair set was
+# modified, usually vendored library code; on 2329 the planner itself declared an unnamed file mutable. BASELINE: orient records a cksum
+# list of the workspace once (never overwritten) and ships `.cortex/changed` (modified/added/deleted vs start) + a pre-finish
+# "revert every change the task did not require" line. SCOPE: the lift planner lists the files it will modify; only the files the task names
+# are modified; ends with the changed-files check.
+# [LEDGER 2026-09-27 @4.124.27] DARK (both default off) — fixture-tested (dash; start state kept across orient re-runs; spaces in names);
+# efficacy UNMEASURED: the MiMo reasoning sweep carries both ON with an o2+both base arm.
+# [LEDGER 2026-09-27 in tree] general-work variants (operator: "how will this work in interactive sessions or other benchmarks"):
+# CORTEX_LIFT_PLAN_SCOPE=adaptive (named files bind; tests/runners/fixtures/data in scope only when the task asks; revert EXISTING files only)
+# and CORTEX_ORIENT_BASELINE=auto (skip git repos; baseline stored outside the project in ~/.cortex/baselines, else /tmp). true / 1 are
+# unchanged = what the MiMo sweep measures. Scope only reaches headless sessions: the lift planner is skipped on a TTY unless
+# CORTEX_LIFT_PLAN_INTERACTIVE=true. DARK; validate adaptive/auto on TB2.1 or TB4.0 (build-style tasks) before any default.
+# [LEDGER 2026-09-27 @4.124.27] MiMo sweep (r-mimo64-sweep-2026-09-27.md): with SCOPE=true + BASELINE=1 on the o2 config, protected-file rejects
+# fell to 13/320 (4.1%) vs 31/320 (9.7%) in the five prior runs — mechanism works; pass rate unchanged (5 arms pooled 60.6% vs control 59.9%). DARK.
+#CORTEX_ORIENT_BASELINE=
+#CORTEX_LIFT_PLAN_SCOPE=
 # [LEDGER 2026-09-02 @4.89.0] code default 30 (4.88.0) — 20 made the break rung (2N=24) unreachable; preserves 40%/80% density semantics.
 #NEARDUP_WINDOW=30
 # [LEDGER 2026-09-02 @4.89.0] code default 12 (4.88.0) — 8 misfired on persistence-wins grinds (rstan-to-pystan regressed both arms).

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nexus-cortex/cli",
-  "version": "4.124.26",
+  "version": "4.124.28",
   "description": "Nexus Cortex CLI - Terminal interface for multi-provider LLM orchestration",
   "main": "dist/index.js",
   "type": "module",
@@ -19,7 +19,7 @@
     "prepack": "node ../../scripts/copy-pkg-cortex-scaffold.mjs"
   },
   "dependencies": {
-    "@nexus-cortex/core": "4.124.26",
+    "@nexus-cortex/core": "4.124.28",
     "chalk": "^4.1.2",
     "cli-spinners": "^2.9.0",
     "commander": "^11.0.0",