@pome-sh/cli 0.26.8 → 0.26.10

package/dist/build-info.json

@@ -1,6 +1,6 @@
 {
   "package": "pome-sh",
-  "version": "0.26.8",
-  "git_sha": "26bbe25a36b4510303122c7cfd4e385aed5fa135",
-  "build_time": "2026-08-23T07:35:31.094Z"
+  "version": "0.26.10",
+  "git_sha": "dc130eecd4b26498dee164b4ba3ad4750b4c9f39",
+  "build_time": "2026-08-23T18:53:01.788Z"
 }

package/dist/{checks-UOJUUVZB.js → checks-3LVRPHOK.js}

@@ -1,8 +1,8 @@
-import { findManifestPath, readManifest } from './chunk-U6MQ5KBT.js';
+import { findManifestPath, readManifest } from './chunk-CXGMLUZ4.js';
 import { getAvailablePort } from './chunk-XDU6TD4O.js';
 import { buildEgressAllowlist } from './chunk-CBFKZZBR.js';
-import './chunk-KSX2PAEI.js';
-import './chunk-JUESW6G4.js';
+import './chunk-BZO3YCJS.js';
+import './chunk-6KJC4BTO.js';
 import './chunk-SG6ZTIMT.js';
 import { serve } from '@hono/node-server';
 import { randomUUID, randomBytes } from 'node:crypto';
@@ -183,7 +183,7 @@ async function checkTwinReachable(_configDir) {
   });
   let harness;
   try {
-    const { bootTwin } = await import('./twinHarness-OC6VQRXO.js');
+    const { bootTwin } = await import('./twinHarness-6NVAKIOB.js');
     harness = await bootTwin({
       twin: "github",
       seedState: void 0,

package/dist/{chunk-IDNSKKEC.js → chunk-2ZGVDTJC.js}

@@ -179,7 +179,7 @@ var noReactionAdded = defineCheck({
   polarity: () => "negative",
   // The reaction name, because that is the literal this predicate compares
   // against `reactions[].name` — the line below has said so since the check
-  // shipped, and this field said `null` anyway (F-1157).
+  // shipped, and this field said `null` anyway.
   //
   // It is the sharpest case in the vocabulary for why that mattered. A NEGATIVE
   // criterion asserting a scanned literal is absent reads a redactor's work as

package/dist/{chunk-OFA4E6RJ.js → chunk-6IVXTU67.js}

@@ -1,6 +1,6 @@
-import { readManifest, normalizeManifestTwins } from './chunk-U6MQ5KBT.js';
-import { createHostedClient, perTwinReturnedByCloud, parseTaskFile, runAgentCommand, writeRunArtifactsCore, toTwinHttpEvent, redactJsonl, uploadRunBlobs, scoreFromFinalizeResponse, scoreStatus, evaluationCounts } from './chunk-7WPD3DTO.js';
-import { MOUNTED_TWINS, HostedAuthError, HostedDiscardRefusedError, HostedQuotaError, HostedOrchError, HostedTrialError, agentResponseSchema } from './chunk-KSX2PAEI.js';
+import { readManifest, normalizeManifestTwins } from './chunk-CXGMLUZ4.js';
+import { createHostedClient, perTwinReturnedByCloud, parseTaskFile, runAgentCommand, writeRunArtifactsCore, toTwinHttpEvent, redactJsonl, uploadRunBlobs, scoreFromFinalizeResponse, scoreStatus, evaluationCounts } from './chunk-ANKO3RCB.js';
+import { MOUNTED_TWINS, HostedAuthError, HostedDiscardRefusedError, HostedQuotaError, HostedOrchError, HostedTrialError, agentResponseSchema } from './chunk-BZO3YCJS.js';
 import { redactSecrets, redactEvent } from './chunk-SG6ZTIMT.js';
 import { randomUUID, createHash } from 'node:crypto';
 import { rm, readFile, stat, mkdir, writeFile, chmod, mkdtemp, readdir, rename } from 'node:fs/promises';
@@ -1118,7 +1118,7 @@ async function runTaskHosted(options) {
       // back. For events.jsonl the conventional `team-<>/session-<>/events.jsonl`
       // path matches what /result-upload-url signs, so omitting traceStorageKey
       // still resolves correctly. For state blobs there is no conventional
-      // fallback today (FDRS-395) — omitting them means cloud's judge sees
+      // fallback today — omitting them means cloud's judge sees
       // "{}", which we accept as best-effort degradation.
       traceStorageKey: eventsJsonlUrl ?? void 0,
       stateInitialStorageKey: stateKeys.initialKey ?? void 0,

package/dist/{chunk-JUESW6G4.js → chunk-6KJC4BTO.js}

@@ -18,7 +18,7 @@ var recorderEventObjectSchema = z.object({
   // the correlator (dynamic grouping: "this event landed in Step stp_xyz").
   // 90% of events use only one; both can coexist.
   //
-  // W3 vocab (FDRS-653): `task_step_id` is canonical; `scenario_step_id` is
+  // Task vocab: `task_step_id` is canonical; `scenario_step_id` is
   // the 0.3.0-era spelling. BOTH stay in the schema for the tolerant-reader
   // window — this row shape is the frozen v1 trace format and its emitters
   // (twin runtimes, shipped CLIs on vendored 0.3.0) still write the old key.
@@ -34,7 +34,7 @@ var recorderEventObjectSchema = z.object({
   method: z.string().min(1),
   path: z.string(),
   request_body: z.unknown(),
-  // F-1125 — the request headers as received, keys lowercased by the runtime.
+  // The request headers as received, keys lowercased by the runtime.
   //
   // Recorded WHOLESALE rather than through an allowlist. An allowlist is a
   // narrowing no downstream consumer can lift and no task author can extend,
@@ -46,14 +46,14 @@ var recorderEventObjectSchema = z.object({
   // by key. Asserted both ways in `packages/sdk/test/redaction.test.ts`: the
   // bearer must not survive, and `x-payment` must.
   //
-  // Optional, not nullable: ABSENT means this row predates F-1125, and a
+  // Optional, not nullable: ABSENT means this row predates the field, and a
   // present-but-empty map would erase that distinction. A required field here
   // would be far worse than a missing one — `twinHttpEventSchema` is the only
   // gate into the cloud's tape and a row that fails it is dropped SILENTLY, so
   // every recording an older CLI wrote would arrive as an empty tape, which for
   // a negative criterion is a free pass.
   request_headers: z.record(z.string(), z.string()).optional(),
-  // F-1125 — the twin ACTION this call invoked, when the twin declares one for
+  // The twin ACTION this call invoked, when the twin declares one for
   // the surface that served it. This is the field that stops a tape check from
   // reverse-engineering a tool name out of an MCP transport path.
   //
@@ -335,7 +335,7 @@ var otelSpanEventObjectSchema = z.object({
   // ── shared event-union base (mirrors `eventBaseShape` in recorder-events.ts) ─
   ts: z.string().datetime(),
   event_id: canonicalSpanIdSchema,
-  // F-1200 — `parent_event_id` replaces `parent_id`. For THIS kind the field is
+  // `parent_event_id` replaces `parent_id`. For THIS kind the field is
   // fully redundant with `parent_span_id` (the invariant below pins them
   // equal), so the tolerant read needs no `parent_id` lookup at all: a row
   // written under either spelling normalizes to the same value, derived from

package/dist/{chunk-7WPD3DTO.js → chunk-ANKO3RCB.js}

@@ -1,9 +1,9 @@
-import { criterionSchema, finalizeResponseSchema, HostedDiscardRefusedError, HostedOrchError, HostedAuthError, HostedQuotaError, submitResultResponseSchema, createEvalSessionResponseSchema, createSessionResponseSchema, sessionPublicSchema } from './chunk-KSX2PAEI.js';
-import { seedSchema, parseSeed, defaultSeedState as defaultSeedState$2 } from './chunk-B22TYIEM.js';
+import { criterionSchema, finalizeResponseSchema, HostedDiscardRefusedError, HostedOrchError, HostedAuthError, HostedQuotaError, submitResultResponseSchema, createEvalSessionResponseSchema, createSessionResponseSchema, sessionPublicSchema } from './chunk-BZO3YCJS.js';
+import { seedSchema, parseSeed, defaultSeedState as defaultSeedState$2 } from './chunk-QXQAVKTE.js';
 import { gmailSeedSchema, defaultSeedState } from './chunk-NJ246QPJ.js';
 import { linearSeedSchema, defaultSeedState as defaultSeedState$1 } from './chunk-IZIZC7ZW.js';
-import { isTwinName, TWIN_REGISTRY } from './chunk-CKN743FJ.js';
-import { toTwinHttpEventRow } from './chunk-WEKJIGUD.js';
+import { isTwinName, TWIN_REGISTRY } from './chunk-EIUCTFQV.js';
+import { toTwinHttpEventRow } from './chunk-CFXEETE3.js';
 import { redactEvent, redactSecrets } from './chunk-SG6ZTIMT.js';
 import { mkdir, appendFile, writeFile, readFile } from 'node:fs/promises';
 import { existsSync } from 'node:fs';
@@ -191,7 +191,7 @@ var slackSeedStateSchema = z.object({
   team: z.record(z.string(), z.unknown()).optional(),
   users: z.array(z.record(z.string(), z.unknown())).default([]),
   channels: z.array(z.record(z.string(), z.unknown())).default([]),
-  // F-1509. Permissive like its siblings — the vendored `parseSeed` does the
+  // Permissive like its siblings — the vendored `parseSeed` does the
   // regex-level validation. It has to be listed at all because `.strict()`
   // REJECTS an unlisted key: without this line a slack seed declaring `files`
   // fails to parse rather than being stripped.
@@ -1177,7 +1177,7 @@ function createHostedClient(config) {
             {
               method: "DELETE",
               // authHeaders, not a hardcoded x-api-key: demo teardown carries a
-              // bearer demo_token (FDRS-643 live-run finding — the hardcoded
+              // bearer demo_token (a live-run finding — the hardcoded
               // header made every demo DELETE an opaque 404, silently swallowed
               // by best-effort).
               headers: authHeaders,
@@ -1596,7 +1596,7 @@ var SAFE_PARENT_ENV = /* @__PURE__ */ new Set([
 var DEFAULT_AGENT_ENV_ALLOWLIST = /* @__PURE__ */ new Set([
   "AI_GATEWAY_API_KEY",
   "ANTHROPIC_API_KEY",
-  // FDRS-667 — Claude subscription auth (`claude setup-token`). Without
+  // Claude subscription auth (`claude setup-token`). Without
   // this the Claude Agent SDK inside the agent subprocess only sees an API
   // key, and subscription-only users fail auth under `pome run` while the
   // same agent works when launched by hand.

package/dist/{chunk-KSX2PAEI.js → chunk-BZO3YCJS.js}

@@ -1,4 +1,4 @@
-import { twinIdSchema } from './chunk-JUESW6G4.js';
+import { twinIdSchema } from './chunk-6KJC4BTO.js';
 import { z } from 'zod';
 
 var SLUG_RE = /^[a-z0-9]+(?:-[a-z0-9]+)*$/;
@@ -138,7 +138,7 @@ var runObjectSchema = z.object({
   // CLI-computed (BYOK Flavor #1)
   criteria_results: z.array(criterionResultSchema),
   trace_s3_key: z.string().nullable(),
-  // s3 key for events.jsonl (hosted only; F-689 deleted tool_calls.jsonl)
+  // s3 key for events.jsonl (hosted only)
   state_s3_key: z.string().nullable(),
   // s3 key for state_final.json
   meta_s3_key: z.string().nullable(),
@@ -149,7 +149,7 @@ var runObjectSchema = z.object({
   // which model judged [model] criteria (free-form)
   judge_tokens_in: z.number().int().min(0).nullable(),
   judge_tokens_out: z.number().int().min(0).nullable(),
-  // ── FDRS-613: reconciled from pome-cloud /v1 wire truth (all additive with
+  // ── Reconciled from pome-cloud /v1 wire truth (all additive with
   // defaults so pre-existing Run constructors stay valid) ────────────────────
   // Sim deep-telemetry — per-run agent telemetry rollup, computed at finalize
   // from the agent's independently-correlated `gen_ai` span tree. Null = no
@@ -163,12 +163,12 @@ var runObjectSchema = z.object({
   agent_telemetry_span_count: z.number().int().min(0).nullable().default(null),
   // Which server-side correlator produced lanes/steps.
   correlator_kind: correlatorKindSchema.default("heuristic"),
-  // M0.2 (FDRS-509) — which surface this run belongs to. 'simulation' =
+  // M0.2 — which surface this run belongs to. 'simulation' =
   // CLI/staging scenario run (default for every legacy row); 'production' = an
   // ingested OTLP production trace (M2).
   environment: z.enum(["production", "simulation"]).default("simulation"),
-  // M0.5 (FDRS-512) — replay loop linkage (prod-run → task → replay-run).
-  // W3 vocab: canonical key; 0.3.0 alias: promoted_scenario_id.
+  // M0.5 — replay loop linkage (prod-run → task → replay-run).
+  // Canonical key; 0.3.0 alias: promoted_scenario_id.
   promoted_task_id: z.string().nullable().default(null),
   replay_run_id: z.string().nullable().default(null),
   // Storage key for the tar-and-upload state archive the replay engine seeds a
@@ -184,7 +184,7 @@ var runObjectSchema = z.object({
   // LLM endpoint failure, or legacy pre-M4-1 runs.
   fix_prompt: z.string().nullable().default(null),
   // Storage KEY (path) of the raw events.jsonl blob — NOT a URL (dashboard mints
-  // a signed GET URL on read). FDRS-613: relaxed from `.url()` to match the
+  // a signed GET URL on read). Relaxed from `.url()` to match the
   // pome-cloud shape, since persisted storage keys are not URLs. Null in
   // self-host mode, on upload failure, --no-upload opt-out, or legacy runs.
   events_jsonl_url: z.string().nullable().default(null),
@@ -415,7 +415,7 @@ var slackSeedStateSchema = z.object({
       ).default([])
     })
   ).default([]),
-  // F-1509. Mirrors `seedSchema.files` in `@pome-sh/twin-slack`. `user` and
+  // Same shape as `seedSchema.files` in `@pome-sh/twin-slack`. `user` and
   // `channels` are seed HANDLES (a user/channel `name`) or ids.
   files: z.array(
     z.object({
@@ -708,7 +708,7 @@ var taskClassSchema = z.enum(["conformance", "restraint", "adversarial"]);
 var taskConfigSchema = z.object({
   twins: z.array(z.string()).default(["github"]),
   class: taskClassSchema.optional(),
-  // F-1302 — conformance vs the exam half
+  // conformance vs the exam half
   timeout: z.number().int().positive().default(60),
   // seconds
   runs: z.number().int().positive().default(1),
@@ -766,7 +766,7 @@ var createSessionRequestObjectSchema = z.object({
   // base64-encoded UTF-8 markdown; 0.3.0 alias: scenario_source
   task_id: z.string().optional(),
   // alternative: stored task; 0.3.0 alias: scenario_id
-  // FDRS-580 / ADR-015 (adopted from pome-cloud, FDRS-613): the seed override
+  // ADR-015 (adopted from pome-cloud): the seed override
   // is a PERMISSIVE, shape-blind boundary. The twin pod's own `parseSeed` is
   // the sole authority on the seed's domain shape; the cloud forwards it
   // verbatim. `z.record` keeps the one invariant that is the boundary's
@@ -780,14 +780,14 @@ var createSessionRequestObjectSchema = z.object({
   // POST /v1/sessions. The dashboard generates one per Start-button click;
   // legacy clients work without it.
   idempotency_key: z.string().uuid().optional(),
-  // M3 / FDRS-636: client-minted trial-group identity — `pome run -n k`
+  // Client-minted trial-group identity — `pome run -n k`
   // (and `pome demo`) stamp one id per invocation, shared by all k trial
   // sessions. The cloud copies it onto sessions.group_id at mint and onto
   // runs.group_id at finalize; the demo/eval mints already accept the same
   // field. Format mirrors the cloud's GROUP_ID_RE. Legacy clients omit it.
   group_id: z.string().regex(/^[A-Za-z0-9_-]{6,64}$/).optional(),
-  // F-818 (spec F-804): per-run override of the manifest's agent.version —
-  // an opaque user-declared label stamped onto the session/run rows (F-820).
+  // Per the manifest format spec: per-run override of the manifest's agent.version —
+  // an opaque user-declared label stamped onto the session/run rows.
   // Absent = the agent's registered version. Additive; older clients omit it
   // and an older cloud strips it.
   agent_version: z.string().optional()
@@ -897,9 +897,9 @@ var submitResultRequestObjectSchema = z.object({
   lanes: z.array(laneSchema).default([]),
   steps: z.array(stepSchema).default([]),
   fix_prompt: z.string().nullable().default(null),
-  // FDRS-357 (adopted from pome-cloud, FDRS-613): storage key (NOT URL) returned
+  // Adopted from pome-cloud: storage key (NOT URL) returned
   // by POST /v1/sessions/:id/result-upload-url. Null on upload failure
-  // (best-effort), --no-upload opt-out, or pre-FDRS-357 CLI.
+  // (best-effort), --no-upload opt-out, or a CLI that predates the key.
   events_jsonl_url: z.string().nullable().default(null),
   // Trace blobs — safe to upload (HTTP between agent and twin, not LLM prompts):
   trace_jsonl_b64: z.string(),
@@ -924,7 +924,7 @@ var createEvalSessionResponseSchema = z.object({
 var criterionDefSchema = z.object({
   id: z.string().min(1),
   text: z.string().min(1),
-  // Tolerant reader (F-778): released CLIs still send the legacy "D"/"P"
+  // Tolerant reader: released CLIs still send the legacy "D"/"P"
   // spellings; parsed output is always the canonical "code"/"model". Single
   // source of truth for the rename is LEGACY_CRITERION_KIND_MAP.
   kind: z.enum(["D", "P", "code", "model"]).transform(
@@ -934,7 +934,7 @@ var criterionDefSchema = z.object({
   // attributes to. Absent = the session's primary twin (twins[0]). Additive —
   // single-twin tasks omit it and score against the sole twin as before.
   twin: z.string().min(1).optional(),
-  // F-1296 (pome-cloud) / F-1299 — forwards the markdown `always-scored`
+  // Forwards the markdown `always-scored`
   // keyword so the cloud's seed-exclusion rule
   // (docs/grading/seed-exclusion.md, pome-cloud) knows this [code] criterion
   // must be graded even when the seed already satisfies it. snake_case to
@@ -948,7 +948,7 @@ var criterionDefSchema = z.object({
 });
 z.object({
   name: z.string().min(1),
-  // Manifest identity (F-818, spec F-804): human-ish slug input — the server
+  // Manifest identity (per the format spec): human-ish slug input — the server
   // derives the canonical kebab slug with the same deriveAgentSlug exported
   // from `./manifest.js`, then validates it against SLUG_RE. Cap mirrors the
   // control-plane edge; shape is deliberately NOT enforced here.
@@ -957,7 +957,7 @@ z.object({
   // User-declared version label from the manifest's agent.version — an opaque
   // string, never auto-bumped, never semver-interpreted.
   version: z.string().optional(),
-  // Open enum by design (F-804): unknown frameworks get a did-you-mean warning
+  // Open enum by design: unknown frameworks get a did-you-mean warning
   // server-side, never a validation error.
   framework: z.string().min(1).optional(),
   // Multi-twin (M3): the twins this agent is allowed to exercise. Absent = the
@@ -971,18 +971,18 @@ var agentResponseSchema = z.object({
   slug: z.string(),
   display_name: z.string(),
   judge_model: z.string(),
-  // Manifest identity (F-818): registered agent.framework / agent.description /
-  // agent.version, nullable where the server has nothing stored (F-1213:
-  // unset, never a guessed default). Optional for the pre-F-820 cloud, which
+  // Manifest identity: registered agent.framework / agent.description /
+  // agent.version, nullable where the server has nothing stored (unset,
+  // never a guessed default). Optional for a cloud that predates the resolver, which
   // omits them.
   framework: z.string().nullable().optional(),
   description: z.string().nullable().optional(),
   version: z.string().nullable().optional(),
-  // F-818 resolver semantics: true when POST /v1/agents auto-registered a new
+  // Resolver semantics: true when POST /v1/agents auto-registered a new
   // agent for this slug, false when it resolved an existing one. Optional for
-  // the pre-F-820 cloud; absence means "unknown", not "resolved".
+  // a cloud that predates the resolver; absence means "unknown", not "resolved".
   created: z.boolean().optional(),
-  // F-861 slug-rename hint (cloud-emitted since v0.4.18): how the resolver
+  // Slug-rename hint (cloud-emitted since v0.4.18): how the resolver
   // matched this slug. Known values today are "slug" (live match), "alias" (an
   // old slug that was renamed; the returned `slug` is the new canonical), and
   // "created" (fresh auto-register) — the CLI surfaces a rename notice only on
@@ -1168,7 +1168,7 @@ var HostedAuthError = class extends Error {
 };
 var HostedQuotaError = class extends Error {
   /** `details` mirrors the cloud error envelope's machine-readable details
-   *  (e.g. `{ kind: "daily_judge_cap" }`) so `pome demo` (FDRS-643/662) can
+   *  (e.g. `{ kind: "daily_judge_cap" }`) so `pome demo` can
    *  render honest labeled at-capacity states. Optional: older responses and
    *  the twin-pod 401 shape carry none. */
   constructor(message, requestId, details) {
@@ -1183,7 +1183,7 @@ var HostedQuotaError = class extends Error {
 var HostedOrchError = class extends Error {
   /** `status` is the HTTP status that produced this error, when one exists
    *  (network/parse failures leave it undefined). `pome eval` uses it to
-   *  scope its reaped-session retry to 404/410 only (FDRS-656 review). */
+   *  scope its reaped-session retry to 404/410 only. */
   constructor(message, requestId, status, type) {
     super(message);
     this.requestId = requestId;

package/dist/{chunk-WEKJIGUD.js → chunk-CFXEETE3.js}

@@ -970,13 +970,13 @@ function buildEventCore(c, deps, fields) {
     task_step_id: stepId,
     scenario_step_id: stepId,
     step_id: null,
-    // FDRS-402 adapter-rich path — per-twin pin, see recorder.ts (F-682).
+    // adapter-rich path — per-twin pin, see recorder.ts.
     tool_call_id: deps.definition.stampToolCallId ? correlationHeader : null,
     method: c.req.method,
     path: new URL(c.req.url).pathname,
     request_body: fields.requestBody,
     request_headers: recordedRequestHeaders(c),
-    // F-1125 — the whole reason the field exists. This surface is where the
+    // The whole reason the field exists. This surface is where the
     // tool name used to be reachable only by digging it out of `request_body`
     // on a `/mcp` path; a check that had to do that was reverse-engineering
     // transport, and getting it wrong false-passes a negative criterion.
@@ -1176,7 +1176,7 @@ function createRecorderHandle(options) {
       task_step_id: stepId,
       scenario_step_id: stepId,
       step_id: null,
-      // FDRS-402 adapter-rich path: only twins that pin `stampToolCallId`
+      // adapter-rich path: only twins that pin `stampToolCallId`
       // persist the header here (github); the default tape stamps null.
       tool_call_id: options.stampToolCallId ? correlationHeader : null,
       method: c.req.method,
@@ -1478,7 +1478,7 @@ function failureInjectionMiddleware(store, options) {
         method,
         path: rawPath,
         request_body: requestBody,
-        // F-1125 — same capture policy as the engine's emit(); an injected
+        // Same capture policy as the engine's emit(); an injected
         // fault must not be the one row a header-reading check cannot see.
         request_headers: recordedRequestHeaders(c),
         // Injection is transport-level: it intercepts a (method, path) tuple,

package/dist/{chunk-U6MQ5KBT.js → chunk-CXGMLUZ4.js}

@@ -1,4 +1,4 @@
-import { HostedOrchError, manifestSchema, deriveAgentSlug, SLUG_RE } from './chunk-KSX2PAEI.js';
+import { HostedOrchError, manifestSchema, deriveAgentSlug, SLUG_RE } from './chunk-BZO3YCJS.js';
 import { readFile, writeFile } from 'node:fs/promises';
 import { resolve, join, dirname } from 'node:path';
 import { stringify, parse } from 'yaml';

package/dist/{chunk-CKN743FJ.js → chunk-EIUCTFQV.js}

@@ -39,7 +39,7 @@ var TWIN_REGISTRY = {
         defaultSeedState,
         GitHubDomain,
         openGitHubCloneDatabase
-      } = await import('./src-UEO2KIBJ.js');
+      } = await import('./src-JJNS46T6.js');
       const db = openGitHubCloneDatabase();
       const domain = new GitHubDomain(db);
       domain.seed(seedState === void 0 ? defaultSeedState() : seedState);
@@ -59,9 +59,9 @@ var TWIN_REGISTRY = {
     envName: "SLACK",
     defaultPort: 3333,
     version: package_default2.version,
-    defaultSeed: async () => (await import('./src-4E5WAGNJ.js')).defaultSeedState(),
+    defaultSeed: async () => (await import('./src-L6F5YXSP.js')).defaultSeedState(),
     async boot({ seedState, runId, recorder }) {
-      const { createSlackTwinApp, openSlackTwinDatabase, SlackDomain } = await import('./src-4E5WAGNJ.js');
+      const { createSlackTwinApp, openSlackTwinDatabase, SlackDomain } = await import('./src-L6F5YXSP.js');
       const db = openSlackTwinDatabase(":memory:");
       const domain = new SlackDomain(db);
       domain.applySeed(seedState);
@@ -84,10 +84,10 @@ var TWIN_REGISTRY = {
     envName: "STRIPE",
     defaultPort: 3333,
     version: package_default3.version,
-    defaultSeed: async () => (await import('./src-AAF7TZMO.js')).defaultSeed(),
+    defaultSeed: async () => (await import('./src-FXRQSKBK.js')).defaultSeed(),
     async boot({ seedState, runId, recorder, twinBaseUrl }) {
-      const stripeTwin = await import('./src-AAF7TZMO.js');
-      const { createApp } = await import('./server-TPAFPKLC.js');
+      const stripeTwin = await import('./src-FXRQSKBK.js');
+      const { createApp } = await import('./server-TK5YBK6E.js');
       const {
         applySeed: applyStripeSeed,
         createTwinStripeApp,
@@ -128,9 +128,9 @@ var TWIN_REGISTRY = {
     portEnvName: "GMAIL_TWIN_PORT",
     tokenEnvName: "POME_GMAIL_TOKEN",
     version: package_default4.version,
-    defaultSeed: async () => (await import('./src-2M54EY2P.js')).defaultSeedState(),
+    defaultSeed: async () => (await import('./src-GWA7QVQS.js')).defaultSeedState(),
     async boot({ seedState, runId, recorder }) {
-      const { createGmailTwinApp, GmailDomain, openGmailTwinDatabase, parseSeed } = await import('./src-2M54EY2P.js');
+      const { createGmailTwinApp, GmailDomain, openGmailTwinDatabase, parseSeed } = await import('./src-GWA7QVQS.js');
       const db = openGmailTwinDatabase(":memory:");
       const seed = parseSeed(seedState);
       const domain = new GmailDomain(db);
@@ -149,7 +149,7 @@ var TWIN_REGISTRY = {
     portEnvName: "LINEAR_TWIN_PORT",
     tokenEnvName: "POME_LINEAR_TOKEN",
     version: package_default5.version,
-    defaultSeed: async () => (await import('./src-Q4MBHYC5.js')).defaultSeedState(),
+    defaultSeed: async () => (await import('./src-Q4JNJE5S.js')).defaultSeedState(),
     async boot({ seedState, runId, recorder }) {
       const {
         createLinearTwinApp,
@@ -157,7 +157,7 @@ var TWIN_REGISTRY = {
         LinearDomain,
         openLinearTwinDatabase,
         parseSeed
-      } = await import('./src-Q4MBHYC5.js');
+      } = await import('./src-Q4JNJE5S.js');
       const db = openLinearTwinDatabase(":memory:");
       const seed = parseSeed(seedState);
       const domain = new LinearDomain(db);
@@ -173,7 +173,7 @@ var TWIN_REGISTRY = {
   }
 };
 async function createGitHubSmokeApp() {
-  const { createGitHubCloneApp } = await import('./src-UEO2KIBJ.js');
+  const { createGitHubCloneApp } = await import('./src-JJNS46T6.js');
   return createGitHubCloneApp();
 }
 function defaultPortFor(twin, env = process.env) {

package/dist/{chunk-NUXVJ4E6.js → chunk-FQGR7KDT.js}

@@ -1,8 +1,8 @@
 import { getAvailablePort } from './chunk-XDU6TD4O.js';
 import { buildEgressAllowlist, readBlockedEgress } from './chunk-CBFKZZBR.js';
-import { parseTaskFile, seedStateForTwin, runAgentCommand, writeRunArtifactsCore } from './chunk-7WPD3DTO.js';
-import { createRecorder, bootTwin } from './chunk-5EE7YWA3.js';
-import { eventSchema } from './chunk-JUESW6G4.js';
+import { parseTaskFile, seedStateForTwin, runAgentCommand, writeRunArtifactsCore } from './chunk-ANKO3RCB.js';
+import { createRecorder, bootTwin } from './chunk-KIXYRPVY.js';
+import { eventSchema } from './chunk-6KJC4BTO.js';
 import { redactSecrets, redactEvent } from './chunk-SG6ZTIMT.js';
 import { serve } from '@hono/node-server';
 import { randomUUID, randomBytes } from 'node:crypto';
@@ -320,7 +320,7 @@ async function runTask(options) {
     authSecret
   );
   const proxyEnv = captureServer ? {
-    // FDRS-399 — agent's outbound traffic flows through the capture-server.
+    // Agent's outbound traffic flows through the capture-server.
     // Twin traffic is localhost, NO_PROXY excludes it so it stays a
     // TwinHttpEvent (recorded in-process) and isn't double-counted as a
     // proxy-captured LlmCallEvent.

package/dist/{chunk-2Q3P45LK.js → chunk-IZFM7W2V.js}

@@ -132,7 +132,7 @@ function declareRouteInputs(spec) {
 function routeInputDeclarer(undeclared) {
   return (spec) => {
     if (spec.undeclared !== void 0) {
-      throw new Error(`route-inputs: ${spec.method} ${spec.path} sets undeclared: '${spec.undeclared}' on its own spec, but its twin already rules '${undeclared}' for every route \u2014 the disposition is one ruling per twin (F-1372)`);
+      throw new Error(`route-inputs: ${spec.method} ${spec.path} sets undeclared: '${spec.undeclared}' on its own spec, but its twin already rules '${undeclared}' for every route \u2014 the disposition is one ruling per twin`);
     }
     return declareRouteInputs({ ...spec, undeclared });
   };

package/dist/{chunk-5EE7YWA3.js → chunk-KIXYRPVY.js}

@@ -1,5 +1,5 @@
-import { TWIN_NAMES, isTwinName, TWIN_REGISTRY } from './chunk-CKN743FJ.js';
-import { createFileBackedRecorderStore, createRecorderStore } from './chunk-WEKJIGUD.js';
+import { TWIN_NAMES, isTwinName, TWIN_REGISTRY } from './chunk-EIUCTFQV.js';
+import { createFileBackedRecorderStore, createRecorderStore } from './chunk-CFXEETE3.js';
 
 // src/recorder/recorder.ts
 function createRecorder(options = {}) {

package/dist/{chunk-B22TYIEM.js → chunk-QXQAVKTE.js}

@@ -19,7 +19,7 @@ var seedSchema = z.object({
       color: z.string().default("ededed"),
       description: z.string().default("")
     })).default([]),
-    // F-1500 — `renamed_from` is how a seed expresses a MOVE, and with it the
+    // `renamed_from` is how a seed expresses a MOVE, and with it the
     // `status: "renamed"` the row type has always declared and no world could
     // reach. A seeded branch is created from the default branch and inherits
     // every path, and a plain `files[]` entry can only add or overwrite, so
@@ -65,7 +65,7 @@ var seedSchema = z.object({
         });
       }
     })).default([]),
-    // F-1421 — milestones, tags and releases are repository-level entities the
+    // Milestones, tags and releases are repository-level entities the
     // twin already SERVES (`GET /milestones`, `/tags`, `/releases`,
     // `/releases/latest`, `/releases/tags/:tag`) and the seed could not
     // express. Zod strips unknown keys, so a seed naming one reached the
@@ -111,7 +111,7 @@ var seedSchema = z.object({
       labels: z.array(z.string().min(1)).default([]),
       assignees: z.array(z.string().min(1)).default([]),
       // The issue's conversation timeline, served at
-      // `GET /repos/:o/:r/issues/:n/comments` (F-1421). `author` is
+      // `GET /repos/:o/:r/issues/:n/comments`. `author` is
       // seeded honestly rather than taken from the write path, which
       // stamps every comment `pome-agent`: a world in which the agent
       // under test wrote every comment on the issue it is being asked to
@@ -144,9 +144,9 @@ var seedSchema = z.object({
         state: z.enum(["error", "failure", "pending", "success"]).default("success"),
         description: z.string().default("")
       })).default([]),
-      // F-1421 — the PR's CONVERSATION timeline. Same table, same route
+      // The PR's CONVERSATION timeline. Same table, same route
       // and same number space as an issue's comments, because GitHub
-      // models a pull request as an issue (F-1151). This is the third
+      // models a pull request as an issue. This is the third
       // thing a reader could call "a comment on the PR" and the seed
       // keeps all three apart: `reviews[].body` is the prose on a review
       // verdict, `review_comments[]` below is anchored to a file and
@@ -155,7 +155,7 @@ var seedSchema = z.object({
         body: z.string().min(1),
         author: z.string().min(1).optional()
       })).default([]),
-      // F-1421 — inline review comments, served at
+      // Inline review comments, served at
       // `GET /repos/:o/:r/pulls/:n/comments`. Seeded through the domain's
       // own write path, so `path` must name a file the PR changes and
       // `line` must exist in it: a seeded review comment is one

package/dist/{runDemo-MZPIXV6R.js → runDemo-XO5R5QTM.js}

@@ -1,18 +1,18 @@
 import { newGroupId, reassuranceBox, twinReadyLine, trialsHeaderLine, trialLine, summaryLines, evaluatingLine, criterionPhrase } from './chunk-RGZBC7NF.js';
 import { DemoCapacityError, capacityLabel, parseCapacityMarker, capacityKindFrom } from './chunk-ZX4WNSZ5.js';
-import { runTask, demoTaskPath, DEMO_TASK_NAME, DEMO_REPO } from './chunk-NUXVJ4E6.js';
+import { runTask, demoTaskPath, DEMO_TASK_NAME, DEMO_REPO } from './chunk-FQGR7KDT.js';
 import { getAvailablePort } from './chunk-XDU6TD4O.js';
 import './chunk-CBFKZZBR.js';
-import { createHostedClient, parseTaskFile, uploadRunBlobs, scoreFromFinalizeResponse, scoreStatus, outcomeOf } from './chunk-7WPD3DTO.js';
+import { createHostedClient, parseTaskFile, uploadRunBlobs, scoreFromFinalizeResponse, scoreStatus, outcomeOf } from './chunk-ANKO3RCB.js';
 import './chunk-NW7HGA2K.js';
-import { HostedQuotaError, HostedOrchError } from './chunk-KSX2PAEI.js';
-import './chunk-B22TYIEM.js';
+import { HostedQuotaError, HostedOrchError } from './chunk-BZO3YCJS.js';
+import './chunk-QXQAVKTE.js';
 import './chunk-NJ246QPJ.js';
 import './chunk-IZIZC7ZW.js';
-import { bootTwin } from './chunk-5EE7YWA3.js';
-import './chunk-CKN743FJ.js';
-import './chunk-WEKJIGUD.js';
-import './chunk-JUESW6G4.js';
+import { bootTwin } from './chunk-KIXYRPVY.js';
+import './chunk-EIUCTFQV.js';
+import './chunk-CFXEETE3.js';
+import './chunk-6KJC4BTO.js';
 import './chunk-SG6ZTIMT.js';
 import { readFile } from 'node:fs/promises';
 import { join } from 'node:path';

package/dist/{runTrialGroup-INW4QLSL.js → runTrialGroup-CLJJOO4J.js}

@@ -1,15 +1,15 @@
 import { newGroupId, criterionPhrase } from './chunk-RGZBC7NF.js';
-import { runTaskHosted, resolveRunAgentIdentity } from './chunk-OFA4E6RJ.js';
-import './chunk-U6MQ5KBT.js';
-import { createHostedClient, parseTaskFile, outcomeOf } from './chunk-7WPD3DTO.js';
+import { runTaskHosted, resolveRunAgentIdentity } from './chunk-6IVXTU67.js';
+import './chunk-CXGMLUZ4.js';
+import { createHostedClient, parseTaskFile, outcomeOf } from './chunk-ANKO3RCB.js';
 import './chunk-NW7HGA2K.js';
-import { HostedQuotaError, HostedTrialError } from './chunk-KSX2PAEI.js';
-import './chunk-B22TYIEM.js';
+import { HostedQuotaError, HostedTrialError } from './chunk-BZO3YCJS.js';
+import './chunk-QXQAVKTE.js';
 import './chunk-NJ246QPJ.js';
 import './chunk-IZIZC7ZW.js';
-import './chunk-CKN743FJ.js';
-import './chunk-WEKJIGUD.js';
-import './chunk-JUESW6G4.js';
+import './chunk-EIUCTFQV.js';
+import './chunk-CFXEETE3.js';
+import './chunk-6KJC4BTO.js';
 import './chunk-SG6ZTIMT.js';
 import { randomUUID } from 'node:crypto';
 import { readFile } from 'node:fs/promises';
@@ -155,7 +155,7 @@ async function runTrialGroup(options) {
     }
   } catch (err) {
     await Promise.all(
-      // F-983: these sessions were minted and never launched, so there is no
+      // These sessions were minted and never launched, so there is no
       // tape to lose — an explicit discard is honest here.
       sessions.map(
         (s) => client.deleteSession(s.session_id, true, { discard: true }).catch(
@@ -206,7 +206,7 @@ async function runTrialGroup(options) {
         agentModel: options.agentModel,
         premintedSession: session,
         abandonOnFailure: true,
-        // FDRS-644 — stamped into the trial's verdict.json so fix-prompt
+        // Stamped into the trial's verdict.json so fix-prompt
         // can reassemble this run set from local artifacts.
         groupId
       });
@@ -217,7 +217,7 @@ async function runTrialGroup(options) {
       row = {
         kind: "completed",
         score: result.score.satisfaction,
-        // F-925 — the trial's own verdict, carried out of the run rather than
+        // The trial's own verdict, carried out of the run rather than
         // re-derived here. It was `result.exitCode === 0`, which cannot express
         // the third state (1 means both "failed" and "could not be graded"), so
         // a 100/100 trial with 3 of 4 criteria skipped counted as a clean pass.

package/dist/{server-TPAFPKLC.js → server-TK5YBK6E.js}

@@ -1,3 +1,3 @@
-export { FAILURE_INJECTION_OVERRIDE_KEY, POME_RECORDER_EVENTS_PATH, PROVIDER_SHAPED_TEAM_ID, TwinBootError, TwinError, UnknownToolError, bearerAuth, createAdminGate, createApp, createFailureInjectionStore, createFileBackedRecorderStore, createRecorderHandle, createRecorderStore, created, ensureTwinAuthSecret, failureInjectionMiddleware, failureInjectionRuleSchema, formTokenResolver, isLoopbackHost, mintProviderToken, ok, queryTokenResolver, recordedRequestHeaders, requireAdminAuth, resolveAuthSecret, resolveRecorderStore, serve, setClientIp, setRecordedTool, toTwinHttpEventRow, twinBuildInfo, verifyProviderToken } from './chunk-WEKJIGUD.js';
-import './chunk-JUESW6G4.js';
+export { FAILURE_INJECTION_OVERRIDE_KEY, POME_RECORDER_EVENTS_PATH, PROVIDER_SHAPED_TEAM_ID, TwinBootError, TwinError, UnknownToolError, bearerAuth, createAdminGate, createApp, createFailureInjectionStore, createFileBackedRecorderStore, createRecorderHandle, createRecorderStore, created, ensureTwinAuthSecret, failureInjectionMiddleware, failureInjectionRuleSchema, formTokenResolver, isLoopbackHost, mintProviderToken, ok, queryTokenResolver, recordedRequestHeaders, requireAdminAuth, resolveAuthSecret, resolveRecorderStore, serve, setClientIp, setRecordedTool, toTwinHttpEventRow, twinBuildInfo, verifyProviderToken } from './chunk-CFXEETE3.js';
+import './chunk-6KJC4BTO.js';
 export { redactEvent, redactSecrets } from './chunk-SG6ZTIMT.js';