@sema-agent/core 5.57.0 → 5.58.0

package/CHANGELOG.md

@@ -1,5 +1,53 @@
 # Changelog
 
+## 5.58.0 — 2026-08-24
+
+### BREAKING (design/375 case A — per-segment batch consent; ships as one window, no compatibility arms)
+- **`AskRequest.ruleSuggestions` → `ruleOffers`**: a closed discriminated union
+  (`single{rule,match,command}` | `batch{rules(1..5), uncoveredSegments}`); at most 2 offers, the
+  whole-string exact single always at index 0, the batch always last; choosing a batch is ONE yes to
+  all its members. `PendingAction.tool_approval` carries the same seat. An unknown offer kind
+  degrades to a single opaque row preserving the original wire index (fail toward asking).
+- **`RuleApprovalRecord` schema:2**: `schema`+`offers` required; `selectedCandidate` → `selectedOffer`.
+  Pre-v2 rows refuse loudly (`record_schema_stale`, envelope read, ownership concealment keeps
+  precedence) — pending approvals from before the upgrade are re-asked, never migrated. Supplying the
+  retired `selectedCandidate` key (or `selectedOffer: null`) refuses `config.invalid_argument`.
+- **`redeemRuleBatch`** returns a per-member discriminated table `{members, rev}` keyed by
+  `candidateIndex` (success rows carry `alreadyRedeemed`+`dot`, refused rows carry `reason`;
+  exactly one row per selected-offer member, projection map fixed); the three-array `ImportResult`
+  shape is deleted. `RuleApprovalRecordStore.get` may return `StaleRuleApprovalRecord` (envelope).
+- **Engine conjunction arm** (§5.1): a compound command whose EVERY segment is admitted by some
+  eligible persisted rule is allowed — the segment deny/ask fence stays strictly ahead, whole-string
+  exact and the compound-prefix form keep their precedence, and a single-command prefix still never
+  admits a compound. `PersistedRuleHit` becomes `{ rules }` (covering set; evidence dots = union).
+  Eligibility is two-layered and single-sourced (`eligiblePersisted`/`eligibleContext`;
+  tombstoned/foreign-scope rules can never join a conjunction).
+- The suggester mints offers (`suggestRulesForCommand` returns `RuleOffer[]`; only uncovered
+  segments enter a batch; the compound-prefix candidate is no longer offered — existing
+  compound-prefix rules keep matching forever); the card-edit face accepts one edited rule judged by
+  the single-rule coverage predicate.
+
+### Added
+- **LLM-driven memory consolidation, slices 1+2 (design/376; default OFF, additive)**: the fold-plan
+  distiller becomes a product module (frozen prompt contract byte-equal to the benchmark's, canonical
+  hash pinned; structural repairs counted, repair-budget abort); `runMemoryConsolidationDriver` host
+  verb with a first-class run row (claim/attempt single-writer, stale-rev replay guard, write-failure
+  groups end the run `driver_failed`, `memory.consolidation_incomplete` notice, FORCED announcement
+  once per run); `consolidate` model role resolving consolidate → summarize → loud refusal (never the
+  default model). The bench rig now consumes the product module (scripted-arm projection digest
+  unchanged across the port). Auto-trigger wiring is a later slice; nothing runs without an explicit
+  driver seat.
+- **Dependency-direction gate**: the engine's bottom-of-graph position is frozen mechanically (no
+  sibling `@sema-agent/*` in manifest or src imports).
+
+### Fixed
+- **Internal-wording sweep over the shipped surface** (S10 class): board-coordinate and campaign-name
+  vocabulary cleared to zero across shipped `.d.ts` JSDoc and runtime strings (744 comment lines
+  rewritten 1:1, two runtime string leaks fixed); the wording gate's lexicon now also catches
+  3-digit coordinate forms.
+- Bench provenance axis (P1) landed with two harness fixes (seed origin carriage, read/write
+  provenance mode mismatch) — measurement only, no engine behavior change.
+
 ## 5.57.0 — 2026-08-23
 
 ### Added

package/dist/agents/cascade.d.ts

@@ -105,7 +105,7 @@ export interface CascadeAttempt {
     index: number;
     model: ModelRef;
     passed: boolean;
-    /** This rung's OWN+nested spend. ABSENT when the rung ran unpriced (RB-368 knownness, codex batch-4
+    /** This rung's OWN+nested spend. ABSENT when the rung ran unpriced (RB-368 knownness batch-4
      *  F4) — a fabricated 0 here both misreported the attempt and let escalation ride under a finite
      *  ceiling the engine could not actually enforce. */
     costMicroUsd?: number;

package/dist/agents/cumulative-stats.d.ts

@@ -58,7 +58,7 @@ export interface CumulativeStatsAccumulator {
     /**
      * TRUE when ANY contributing leg published no `costMicroUsd`, i.e. it ran on a model with neither a
      * `RunnerDeps.pricing` entry nor a `Model.cost` declaration (`stats.costMicroUsd` is contractually
-     * ABSENT there — types.ts / RB-368 [2076]).
+     * ABSENT there — types.ts / RB-368).
      *
      * Accumulating such a leg as `?? 0` publishes a total that is not one: the operation's real cost is
      * unknown, and reporting the priced legs' partial sum makes "no price table" indistinguishable from

package/dist/agents/observer.d.ts

@@ -257,12 +257,12 @@ export declare class ObserverPairing {
     retire(state: Exclude<ObserverPairingState, "armed">): void;
 }
 export declare function markObserverTaskId(taskId: string): void;
-/** codex OBS-2 F3 — lifecycle revocation: the wiring unmarks at observed-run settle (after the final
+/** lifecycle revocation: the wiring unmarks at observed-run settle (after the final
  *  drain + session release), so the set tracks LIVE observers only instead of growing per delegation
  *  forever (and a long-dead observer id no longer trips the SendMessage target refusal). */
 export declare function unmarkObserverTaskId(taskId: string): void;
 export declare function isObserverTaskId(taskId: string): boolean;
-/** Diagnostic face (codex OBS-2b F-08): how many observer identities are currently LIVE — a test's
+/** Diagnostic face: how many observer identities are currently LIVE — a test's
  *  lifecycle assertion ("armed here, revoked after settle") without exposing the ids themselves. */
 export declare function observerTaskIdCount(): number;
 /** CC @18371202 — SendMessage refusal when the SENDER is an observer run. */

package/dist/agents/peer-admission.d.ts

@@ -127,7 +127,7 @@ export interface PeerAdmissionOptions {
 export declare function createPeerAdmission(options?: PeerAdmissionOptions): PeerAdmission;
 export declare function peerAdmissionFor(scope: string | undefined, recipientKey: string, config: PeerAdmissionConfig, options?: PeerAdmissionOptions): PeerAdmission;
 /**
- * The delivery legs' ONE admission entry (codex 176-r2): registry seat-commit follows the SAME
+ * The delivery legs' ONE admission entry: registry seat-commit follows the SAME
  * refusal-is-side-effect-free rule as the sender table inside `admit` — the instance is looked up
  * WITHOUT an LRU touch (a detached fresh one serves a first-contact recipient), judged, and only an
  * ADMITTED message commits the seat (insert + touch + bounded eviction). A refusal to a

package/dist/agents/retain-ledger.d.ts

@@ -96,7 +96,7 @@ export interface RetainLedgerHooks {
  * `prepareTask` when the spec opts in, threaded to delegation tools as the TRUSTED `ctx.subagentRetain`,
  * and disposed by the Runner in the task's terminal `finally` (D4: abort in-flight resumes + unpin +
  * release every retained session — retain is NOT durable; resume is reachable only while the parent run
- * lives, codex-B3). Leaks are double-bounded by `max` + `ttlMs` (codex-B2).
+ * lives). Leaks are double-bounded by `max` + `ttlMs`.
  */
 export declare class SubagentRetainLedger {
     readonly ttlMs: number;
@@ -159,7 +159,7 @@ export declare class SubagentRetainLedger {
     get size(): number;
     get(parentToolCallId: string): SubagentRetainEntry | undefined;
     wasEvicted(parentToolCallId: string): boolean;
-    /** codex impl-review MAJOR-1 — LAZY TTL sweep: evict every settled idle entry whose retain TTL
+    /** LAZY TTL sweep: evict every settled idle entry whose retain TTL
      *  elapsed (unpin + release + tombstone), so an expired session is freed at the NEXT ledger touch
      *  (every spawn-registration and resume entry call this) rather than only when its own resume is tried.
      *  fidelity R4-1: no longer the only reaper — `markSettled` also arms a per-entry ACTIVE timer, so

package/dist/agents/roster-store.d.ts

@@ -8,7 +8,7 @@ export interface RosterEntry {
     sessionId?: string;
     /** The spawn's parent tool-call id (retain-ledger key), when known. */
     toolUseId?: string;
-    /** δ 批 [1498]⑦ — the ROOT host session of the delegation tree at spawn (recovery-face grouping
+    /** the ROOT host session of the delegation tree at spawn (recovery-face grouping
      *  key; equals the spawner's session at depth 1). Stored verbatim; no predicate arm consumes it
      *  yet (enumeration/recovery is the reader). */
     rootSessionId?: string;
@@ -19,11 +19,11 @@ export interface RosterEntry {
      *  inherited default. Closed set, single member today; absent = bound normally (or no word). */
     modelFallback?: "inherit_no_tier_binding";
     /** Spawn owner (task/session id) — consumers re-apply access checks against these two axes.
-     *  β 批 A-2: REQUIRED (default-deny predicate; an axis-less row would be unreachable). */
+     *  A-2: REQUIRED (default-deny predicate; an axis-less row would be unreachable). */
     owner: string;
-    /** Spawn principal scope. β 批 A-2: REQUIRED (`"default"` is the single-tenant spelling). */
+    /** Spawn principal scope. A-2: REQUIRED (`"default"` is the single-tenant spelling). */
     scope: string;
-    /** codex R3 — mirrors the live registry's explicit session-scoping flag: session-ID owner matching
+    /** mirrors the live registry's explicit session-scoping flag: session-ID owner matching
      *  is permitted ONLY when the spawn was session-scoped (TaskRegistry.canAccess parity — without
      *  the flag, a task-scoped agent that fell out of the live registry would become visible through
      *  the durable fallback to same-session callers the registry itself rejects). */
@@ -33,7 +33,7 @@ export interface RosterEntry {
 }
 /**
  * The caller's access axes for a roster read — the SAME predicate the live task registry applies
- * (`canAccess`): scope mismatch = invisible; then owner match, or session match. codex F3 (S1
+ * (`canAccess`): scope mismatch = invisible; then owner match, or session match. (S1
  * review): resolution MUST filter the candidate pool by access BEFORE the latest-wins reduce —
  * reduce-then-check lets one tenant's newer same-name entry shadow (and thereby suppress) another
  * tenant's older authorized binding. Implementations (incl. pg/tidb) apply this in the query.
@@ -43,7 +43,7 @@ export interface RosterAccess {
     scope?: string;
     sessionId?: string;
 }
-/** β 批 A-2 (clay 裁定 2026-07-22): DEFAULT-DENY both axes (TaskRegistry.canAccess byte-parity —
+/** Ruled 2026-07-22: DEFAULT-DENY both axes (TaskRegistry.canAccess byte-parity —
  *  the polarity split was the defect). Entries are written with both axes (spawn chain guarantees
  *  it; {@link RosterEntry} requires them), so a missing axis is a broken row, answered with a miss. */
 export declare function entryAccessible(e: RosterEntry, access: RosterAccess): boolean;
@@ -77,7 +77,7 @@ export interface RosterStore {
     /** Record (or supersede — latest-wins per normalized name is applied at READ time) a binding. */
     record(entry: RosterEntry): void | Promise<void>;
     /** Resolve a name for a CALLER: filter by {@link RosterAccess} FIRST, then latest `createdAt`
-     *  wins within the authorized pool (codex F3 filter-before-reduce). Undefined = miss. */
+     *  wins within the authorized pool (filter-before-reduce). Undefined = miss. */
     resolve(name: string, access: RosterAccess): RosterEntry | undefined | Promise<RosterEntry | undefined>;
     /** All live entries (diagnostics / deployment listing; order unspecified). */
     list(): RosterEntry[] | Promise<RosterEntry[]>;
@@ -148,7 +148,7 @@ export declare class FileRosterStore implements RosterStore {
      *  miss on resolve/list — advisory layer), but it is no longer SILENT: an IO failure or corrupt
      *  document was indistinguishable from an honestly empty roster. Never fires on plain ENOENT. */
     private discloseCorrupt;
-    /** codex F4 — two read grades: MISSING file (ENOENT) is an honest empty roster, but a corrupt or
+    /** two read grades: MISSING file (ENOENT) is an honest empty roster, but a corrupt or
      *  transiently unreadable file must THROW on the mutation path — treating it as empty would let
      *  the next `record` atomically REPLACE the existing file with just one row (silent data loss).
      *  Read paths (resolve/list) degrade the throw to a miss via `lenient`. */

package/dist/agents/send-message-tool.d.ts

@@ -59,7 +59,7 @@ export interface SendMessageToolOptions {
     senderName?: string;
     /** design/147 S1c — the deployment's durable roster, consulted after the live registry misses. */
     roster?: import("./roster-store.js").RosterStore;
-    /** design/147 S3a (codex F2) — the PARENT run's retain ledger (RunInternals.parentRetainLedger):
+    /** design/147 S3a — the PARENT run's retain ledger (RunInternals.parentRetainLedger):
      *  the sibling leg's retain entries live there. Consulted AFTER the own-run and session ledgers. */
     siblingRetain?: SubagentRetainLedger;
     /** RB-390 — the SPAWNING run's taskId when THIS run is a delegated child (RunInternals.parentTaskId,
@@ -78,7 +78,7 @@ export interface SendMessageToolOptions {
      *  session-scoped sibling registers with owner = the parent's sessionId, which the parent's
      *  taskId alone cannot satisfy when the two differ (same rationale as ToolExecuteContext.parentSessionId). */
     parentSessionId?: string;
-    /** [1358] the process-level background-child observer (RunnerDeps.onBackgroundChildEvent) — the
+    /** the process-level background-child observer (RunnerDeps.onBackgroundChildEvent) — the
      *  mount fills this so a SendMessage resume re-emits the spawn→tick→terminal family (fleet row
      *  revival). Rides the OPTS closure like notify; RB-409's {@link enrichCtx} feeds the ctx twin. */
     onBackgroundChildEvent?: (event: import("../core/types.js").BackgroundChildEvent) => void;

package/dist/agents/subagent-steps.d.ts

@@ -84,7 +84,7 @@ export declare class SubagentStepRecorder {
     editedFiles(): SubagentEditedFile[] | undefined;
     /** The child's most recent tool intent as one human line ("Bash npm test", "Edit src/x.ts"); undefined if none. */
     currentAction(): string | undefined;
-    /** [1828] (server cross-repo): {@link currentAction} pre-formatted into a fleet-view Progress-section
+    /** {@link currentAction} pre-formatted into a fleet-view Progress-section
      *  shape — the SAME `{tool, target}` pair `currentAction` already concatenates into one line, exposed
      *  separately so a consumer can look the tool up in its own registry instead of parsing prose.
      *  Undefined if none observed (mirrors {@link currentAction}'s own undefined case exactly). */

package/dist/agents/subagent.d.ts

@@ -335,8 +335,8 @@ export interface SubagentSteerHandle {
     /**
      * design/122 D1 — the retained child session id; present ONLY when the parent run enabled
      * {@link import("../core/types.js").TaskSpec.retainSubagentSessions} AND this child was actually
-     * retained. ⚠️ Control-plane only (codex-B6): this is a continuation CAPABILITY — never expose it to
-     * clients; target children by the opaque `parentToolCallId` instead (codex-m3).
+     * retained. ⚠️ Control-plane only: this is a continuation CAPABILITY — never expose it to
+     * clients; target children by the opaque `parentToolCallId` instead.
      */
     childSessionId?: string;
     /**
@@ -385,7 +385,7 @@ export declare function createSubagentResume(deps: {
      *  apply to EVERY stop cycle, spawn and resume alike). Absent ⇒ honest ungated degradation (no
      *  registry to count against — the pre-C1 immediate send). */
     registry?: import("../core/task-registry.js").TaskRegistry;
-    /** design/147 S1a (codex F1) — the RESUMING caller's live injection entry: overrides the retained
+    /** design/147 S1a — the RESUMING caller's live injection entry: overrides the retained
      *  snapshot's spawn-turn `parentNotify` (that lane is torn down with its turn — uplinks through it
      *  would PARK instead of reaching the currently active parent turn, behind a success receipt). */
     currentParentNotify?: (n: TaskNotificationPayload, opts?: {
@@ -442,7 +442,7 @@ export declare function createSubagentResume(deps: {
     taskId?: string;
     /** S2b RB-27② — the resuming caller's resolved registry access (pairs with taskId). */
     taskAccess?: import("../core/task-registry.js").TaskAccess;
-    /** [1358] the process-level background-child observer (ctx.onBackgroundChildEvent, Runner-filled).
+    /** the process-level background-child observer (ctx.onBackgroundChildEvent, Runner-filled).
      *  When present TOGETHER with a revived registry row (taskId + successful revive), the resume cycle
      *  re-emits the SAME spawn→tick→terminal event family as a first spawn — a fleet view's row revives
      *  on the spawn frame (server treats spawn-after-tombstone as row revival). The spawn frame is
@@ -450,11 +450,11 @@ export declare function createSubagentResume(deps: {
      *  tick — the observer's tombstone-period tick rejection depends on that order). No revived row ⇒
      *  no frames (the steer-handle resume path has no a*-domain row to project). */
     bgSink?: (event: import("../core/types.js").BackgroundChildEvent) => void;
-    /** [1358] row lifetime class echoed onto the revive frames (mirrors the registry row). */
+    /** row lifetime class echoed onto the revive frames (mirrors the registry row). */
     sessionScoped?: boolean;
-    /** [1358] the row's display description, echoed onto the revive spawn frame (resume-marked). */
+    /** the row's display description, echoed onto the revive spawn frame (resume-marked). */
     rowDescription?: string;
-    /** [1358]/codex 1351 F3 — the row's original observer metadata, reproduced on the revive frames so
+    /** the row's original observer metadata, reproduced on the revive frames so
      *  a consumer rebuilding a tombstoned row gets its TYPE/name/ancestry back (never a blank row). */
     rowName?: string;
     rowAgentType?: string;
@@ -516,10 +516,10 @@ export interface SubagentToolOptions {
      */
     background?: {
         registry: import("../core/task-registry.js").TaskRegistry;
-        /** β 批 A-2 (BREAKING 1.365.0): REQUIRED — the registry is default-deny on both axes, so a
+        /** A-2 (BREAKING 1.365.0): REQUIRED — the registry is default-deny on both axes, so a
          *  background registration without a declared owner would be unreachable by every caller. */
         owner: string;
-        /** β 批 A-2 (BREAKING 1.365.0): REQUIRED — `"default"` is the single-tenant spelling (explicit,
+        /** A-2 (BREAKING 1.365.0): REQUIRED — `"default"` is the single-tenant spelling (explicit,
          *  matching the engine chain's `principal ?? "default"`), never implied by omission. */
         scope: string;
         /**
@@ -559,7 +559,7 @@ export interface SubagentToolOptions {
          * vetoes the park: the child settles failed exactly as pre-153, and the already-minted
          * checkpoint is expired (no orphans). Never called for sync children or non-suspending runs.
          *
-         * ⚠️ Implementation obligation (blackboard [1593]/[1594], field-proven): "migrates it here"
+         * ⚠️ Implementation obligation (field-proven): "migrates it here"
          * means ACTIVELY PROMOTE — a check-only implementation that merely LOOKS UP the host durable
          * store rejects every child whose session lives in a split/transient tier (a subRunner's
          * private TTL store), and the veto fires on EVERY park: the checkpoint expires within
@@ -658,7 +658,7 @@ export interface SubagentToolOptions {
      * agent is selected) govern them verbatim: an explicit allowlist must NAME an injected tool for the
      * child to see it; `"*"`/absent allowlist = all. Nested delegation threads the SAME factory down
      * (`createSubagentToolNode(opts, depth+1)` carries it), so a grandchild spawn re-evaluates it — per-spawn,
-     * at every level; each child gets its own instances bound to its own spawn moment ([797]: the
+     * at every level; each child gets its own instances bound to its own spawn moment (the
      * server-side factory is execute-time late-bound, so per-spawn evaluation is the confirmed shape).
      * A THROWING/rejecting factory degrades THAT spawn to zero injected tools (the child still runs)
      * with a FIXED generic `note:` disclosure on the report/async card (same lane as the model-override
@@ -793,7 +793,7 @@ export declare function asyncLaunchedReceipt(p: {
     taskId: string;
     /** The lane's own "what is running" opener — the Agent lane and the fork lane say different things. */
     workingLine: string;
-    /** Whether a real notification sink is wired (codex R4: the receipt speaks the RUNTIME sink truth). */
+    /** Whether a real notification sink is wired (the receipt speaks the RUNTIME sink truth). */
     notify: boolean;
     /**
      * RB-220 — mirrors {@link import("../core/types.js").ToolExecuteContext.oneShot}: this run has no
@@ -821,7 +821,7 @@ export declare function createSubagentTool(opts: SubagentToolOptions): ToolSpec;
  * "All tools except …"; neither ⇒ "All tools". sema delta: `allowTools: ["*"]` is the documented
  * allow-everything sentinel (AgentDefinition.allowTools) — treated as NO allowlist, not a literal list.
  *
- * [901] deliberate: this renders the AUTHORED list raw — upstream's listing does too (gHm reads the
+ * deliberate: this renders the AUTHORED list raw — upstream's listing does too (gHm reads the
  * definition; the unknown-item split happens later, at spawn, in its resolveAgentTools). It is the
  * DECLARED boundary, NOT the effective child roster: an unknown entry may appear here while the
  * spawn-time filter (resolveToolSubset — the authority) drops it, and an alias-form divergence can

package/dist/agents/team.d.ts

@@ -45,7 +45,7 @@ export type TeamEvent = {
     role: string;
     text: string;
 }
-/** [571]③ budget axes: the cumulative team budget was exhausted after this member's turn settled —
+/** budget axes: the cumulative team budget was exhausted after this member's turn settled —
  *  remaining rounds/members are skipped and the discussion goes straight to synthesis. */
  | {
     type: "budget_stop";
@@ -113,7 +113,7 @@ export interface TeamDiscussionOptions {
     /**
      * `maxWalltimeMs`/`maxTurns` are PER-RUN caps forwarded to every member/summary/synthesizer run.
      *
-     * `maxTokens`/`maxCostUsd` ([571]③, CollabTemplate.budget mid-flight enforcement) are CUMULATIVE
+     * `maxTokens`/`maxCostUsd` (CollabTemplate.budget mid-flight enforcement) are CUMULATIVE
      * team budgets over member + summary + synthesizer spend (nested/delegated spend included, same
      * coordinate as the `stats` totals). Enforcement is checked after each member turn settles and is
      * booked — the crossing member is never killed in flight — and once a budget is exhausted
@@ -176,7 +176,7 @@ export interface TeamResult {
      *  conclusion — so callers can tell a junk conclusion from a legitimate one. */
     conclusionValid: boolean;
     transcript: TeamTurn[];
-    /** `costMicroUsd` ([571]③): cumulative team LLM spend in integer micro-USD (member + summary +
+    /** `costMicroUsd`: cumulative team LLM spend in integer micro-USD (member + summary +
      *  synthesizer, nested included) — the same engine coordinate as `TaskResult.stats.costMicroUsd`.
      *  Always set (0 when no run reported cost); optional only for type-level back-compat. */
     stats: {
@@ -185,7 +185,7 @@ export interface TeamResult {
         costMicroUsd?: number;
     };
     /**
-     * [571]③ budget-stop attribution: set when a cumulative budget axis was exhausted and the
+     * budget-stop attribution: set when a cumulative budget axis was exhausted and the
      * discussion stopped dispatching further members/rounds early. `round`/`role`/`memberIndex`
      * identify the LAST member turn that ran (the one whose settled totals crossed the budget);
      * everything scheduled after it was skipped and the transcript went straight to synthesis.
@@ -202,7 +202,7 @@ export interface TeamResult {
     failures: number;
     /** How many times the shared transcript was summarized to stay under maxTranscriptTokens. */
     transcriptCompactions: number;
-    /** design/80 D-B (codex review): set when a member durably PAUSED (suspended/needs_review) on a HITL gate —
+    /** design/80 D-B: set when a member durably PAUSED (suspended/needs_review) on a HITL gate —
      *  the discussion STOPS (no synthesis on a half-done team) and surfaces the resume capability so the caller
      *  can resume the paused member via the token, then re-run. `conclusionValid` is false in this case. */
     durablePause?: boolean;

package/dist/agents/tool-filter.d.ts

@@ -13,10 +13,10 @@ import type { ToolSpec } from "../core/types.js";
  * newly-added sensitive tool to every agent. Names not present in the pool are ignored (no error) — an
  * allow/deny list is a filter over what's available, not an assertion that those tools exist.
  *
- * [901] anchor ruling (dual-leg verified, adversarially reviewed): this spawn-time item-level filter IS
+ * anchor ruling (dual-leg verified, adversarially reviewed): this spawn-time item-level filter IS
  * the upstream shape for allow entries — CC's resolveAgentTools partitions unknown names into an
  * `invalidTools` bucket nobody consumes at runtime (88 readable source), and a live 2.1.207 probe shows
- * the agent stays listed/delegable with the unknown item silently dropped, zero warnings. The [876]
+ * the agent stays listed/delegable with the unknown item silently dropped, zero warnings. The
  * "rejected at startup" posture this replaced had no verbatim anchor and did not survive verification.
  * The asymmetric prepare-time fail-loud for `TaskSpec.agents` DENY entries is a deliberate sema
  * extension (no upstream deny-list exists): an allow-typo silently narrows (safe direction), a

package/dist/agents/verify.d.ts

@@ -25,7 +25,7 @@ import type { ModelRef, TaskResult, TaskSpec, ToolSpec } from "../core/types.js"
  * orthogonal to and composable with the Stop hook (wire the verdict into a stop() hook to make it a
  * hard completion gate).
  *
- * DEPLOYMENT POSTURE (clay 裁定 2026-07-14): opt-in library primitive ONLY — never a scenario default,
+ * DEPLOYMENT POSTURE (ruled 2026-07-14): opt-in library primitive ONLY — never a scenario default,
  * never deployed implicitly. It is a **thin composition** over existing core seams — a verifier subtask
  * (own model role), a read-only tool set (via tool `effect`), {@link TaskSpec.outputSchema} for the
  * verdict, and the teacher-style fix loop — so it adds no Runner-core surface. Off by default; opt in

package/dist/bench/metrics.d.ts

@@ -71,7 +71,7 @@ export interface DeliveryDecision {
 }
 /**
  * design/95 §3.2 — the lifecycle status of a run, so INFRA noise never poisons the mode signal
- * (codex BLOCKER B4 / design/89 §3.3 Beatsep red line). The Beatsep task#2b 9% pass-rate was infra
+ * (design/89 §3.3 Beatsep red line). The Beatsep task#2b 9% pass-rate was infra
  * death (OOM / K8S passthrough / nested-root), NOT a mode signal — feeding such runs into the
  * numerator turns them into spurious DELIVERED-WRONG / zero datapoints and reproduces the very noise
  * the design claims to have isolated. `buildReport` SCORES only `scored`; `infra-failed` / `excluded`
@@ -94,7 +94,7 @@ export interface RunRecord {
     /** Repeat/seed index within the cell (design/89 §3.4 N-repeat). */
     seed?: number | string;
     /**
-     * design/95 §3.2 / codex B4 — lifecycle status. Only "scored" runs reach the numerator / cost /
+     * design/95 §3.2 — lifecycle status. Only "scored" runs reach the numerator / cost /
      * Pareto. Absent ⇒ "scored" (back-compat). See {@link RunStatus}.
      */
     runStatus?: RunStatus;
@@ -313,7 +313,7 @@ export interface ArmCell {
     /** Avoided-loss rate = CORRECTLY-WITHHELD / n. The supervisor's §2.2.1 value, single-listed. */
     correctlyWithheldRate: number;
     /**
-     * codex MINOR / design/95 M10 — withhold treated as a binary detector of would-be-wrong delivery
+     * design/95 M10 — withhold treated as a binary detector of would-be-wrong delivery
      * (positive = withheld; ground truth = would-be-wrong, established by the §2.4 counterfactual). Reported
      * as precision/recall — NOT just the raw correctly-withheld count — so an arm cannot look good by
      * withholding indiscriminately (high count, low precision) or by rarely withholding (high precision,
@@ -420,10 +420,10 @@ export declare function riskTransferDisclosure(cells: ArmCell[]): {
     };
 };
 /**
- * codex B2 — a paired-binary comparison of two arms on the SAME tasks/seeds. The two arms' truly-
+ * a paired-binary comparison of two arms on the SAME tasks/seeds. The two arms' truly-
  * correct flags are paired row-by-row (paired-seed, design/89 §3.4). For binary paired data the
  * RIGHT tests are McNemar (discordant pairs) and a paired-bootstrap difference interval — NOT two
- * independent proportions with "CI non-overlap" (that ignores the pairing and is under-powered, codex B2).
+ * independent proportions with "CI non-overlap" (that ignores the pairing and is under-powered).
  */
 export interface PairedBinaryComparison {
     /** Arm A (e.g. "sup") vs arm B (e.g. "solo"). pDiff = P(A) − P(B). */
@@ -440,12 +440,12 @@ export interface PairedBinaryComparison {
      *  b+c large). */
     mcnemarP: number;
     /** Bootstrap percentile 95% CI for the paired difference (lo, hi) — a percentile CI on the seeded
-     *  paired-bootstrap distribution, NOT Newcombe's analytic interval (codex MAJOR-B). Crosses 0 ⇒ not significant. */
+     *  paired-bootstrap distribution, NOT Newcombe's analytic interval. Crosses 0 ⇒ not significant. */
     ci95: [number, number];
     /** TRUE iff the difference is statistically significant at α=0.05 (CI excludes 0 AND McNemar p<0.05). */
     significant: boolean;
     /**
-     * codex B2 — pre-registered Minimum Detectable Effect at the observed nPairs (the difference this
+     * pre-registered Minimum Detectable Effect at the observed nPairs (the difference this
      * comparison COULD have detected at 80% power). When |pDiff| is below this AND not significant, the
      * verdict is "not powered" — NOT "no difference". This is the field that stops "N≥15 is an assertion".
      */
@@ -456,8 +456,8 @@ export interface PairedBinaryComparison {
     verdict: "A-better" | "B-better" | "no-detectable-difference" | "not-powered";
 }
 /**
- * codex B2 — compare two arms' delivered truly-correct as PAIRED binary. Pairs runs by the COMPOSITE
- * `(taskId, seed)` key (codex MAJOR-A: a bare `seed` collides across tasks — the same repeat index
+ * compare two arms' delivered truly-correct as PAIRED binary. Pairs runs by the COMPOSITE
+ * `(taskId, seed)` key (a bare `seed` collides across tasks — the same repeat index
  * recurs per task — so cross-task input would overwrite pairs and contaminate the McNemar sample);
  * only rows where BOTH arms delivered (not withheld, both scored) form a pair — a
  * withheld run has no delivered binary to pair (it is scored in the withhold/avoided-loss axis, not
@@ -469,7 +469,7 @@ export declare function pairedBinaryCompare(scoredRuns: RunRecord[], armA: Arm,
     bootstrapIters?: number;
 }): PairedBinaryComparison;
 /**
- * codex B3 — the pre-registered C2 exchange rate(s): how many human-review SECONDS we are willing to
+ * the pre-registered C2 exchange rate(s): how many human-review SECONDS we are willing to
  * pay to buy one unit of supervisor value. Without these, "higher P / more withholds ⇒ worth it" is
  * unfalsifiable (the "helpful but too expensive" counter-thesis cannot be observed). Declared BEFORE
  * the run (design/95 §9), not fit after.
@@ -482,20 +482,20 @@ export interface C2Thresholds {
 }
 export interface ParetoVerdict {
     arm: Arm;
-    /** Non-dominated on (C1, C2.sec, P) — necessary condition to be considered at all (codex B3). */
+    /** Non-dominated on (C1, C2.sec, P) — necessary condition to be considered at all. */
     nonDominated: boolean;
     /** The pre-registered exchange-rate check: does the arm's extra C2 buy enough avoided-loss / saved
      *  decisions to clear the declared threshold? Undefined when the arm has no extra C2 over baseline. */
     clearsC2Threshold?: boolean;
     /**
-     * codex B3 — the label. An arm may ONLY be "worth-it" when it is non-dominated AND clears the C2
+     * the label. An arm may ONLY be "worth-it" when it is non-dominated AND clears the C2
      * threshold. A non-dominated but threshold-failing arm is "quality-tradeoff" (higher quality, but the
      * cost is not bought back) — NEVER "worth-it". A dominated arm is "dominated".
      */
     label: "worth-it" | "quality-tradeoff" | "dominated";
 }
 /**
- * codex B3 — classify each arm against the SUP/TEAM-vs-baseline value question with a pre-registered
+ * classify each arm against the SUP/TEAM-vs-baseline value question with a pre-registered
  * exchange rate. `baselineArm` is the cost floor to compare extra C2 against (default "solo").
  * `avoidedWrong` / `savedDecisions` per arm come from the cells / campaign report.
  *
@@ -518,31 +518,31 @@ export declare function paretoValueVerdict(cells: ArmCell[], thresholds: C2Thres
  * design/95 §7.1 — V1 (免重复劳动): campaign-level human-decision delta. The ONLY authoritative V1
  * mechanism (design/95 reconcile, MAJOR#2): cross-task reuse of a decided strategy. Semantics:
  *   - `soloHumanDecisions` is the V1 BASELINE — the operator's actual up-front decision count when
- *     running solo across the campaign (codex M7: NOT 0, NOT synthetic — measured from real operator
+ *     running solo across the campaign (NOT 0, NOT synthetic — measured from real operator
  *     prep across runs). `0` is only valid when the campaign genuinely needed no human decision.
  *   - `repeatedDecisionsSaved = soloHumanDecisions − supHumanDecisions` (may be negative = SUP cost
  *     MORE human decisions; reported honestly, not floored).
  */
 export interface CampaignV1Saved {
     decisionKind: string;
-    /** V1 baseline (codex M7): operator's measured up-front decisions when running SOLO. Provenance MUST
+    /** V1 baseline: operator's measured up-front decisions when running SOLO. Provenance MUST
      *  be recorded in the stamp (real prep, not 0/synthetic). */
     soloHumanDecisions: number;
     /** SUP arm's actual human-review decision count for this decision kind. */
     supHumanDecisions: number;
     /** = soloHumanDecisions − supHumanDecisions. Positive ⇒ SUP saved repeated labour (V1 evidence). */
     repeatedDecisionsSaved: number;
-    /** Whether the baseline is a real measurement vs absent (codex M7 honesty gate). */
+    /** Whether the baseline is a real measurement vs absent (honesty gate). */
     baselineProvenance: "measured-operator-baseline" | "absent-not-claimable";
 }
 /**
- * design/95 §7.2 — V2 (蓝图清晰度) THREE-arm ablation (codex BLOCKER#1 + MAJOR#3 / M8). All three are
+ * design/95 §7.2 — V2 (蓝图清晰度) THREE-arm ablation. All three are
  * paired on the SAME seeds (paired===true ⇒ the three pX arrays/values are over the same n seeds).
  * INVARIANT: `n` is the paired-seed count common to all three sub-arms; the three deltas are computed
  * over those n pairs.
  *   - pSoloRaw            — only the original brief (no blueprint baseline).
  *   - pSoloSupGenerated   — the SUP-arm-GENERATED blueprint (attributable to supervisor; gen cost charged).
- *   - pSoloExperimenterIdeal — the experimenter "ideal" blueprint. codex M8: this is a CONSTRAINED upper
+ *   - pSoloExperimenterIdeal — the experimenter "ideal" blueprint. this is a CONSTRAINED upper
  *     bound on "better-prompt help", NOT "supervisor's mechanistic ceiling", UNLESS the ideal blueprint
  *     was generated under the {@link IdealBlueprintConstraints} (run-time, visible-brief-only, no oracle
  *     access, same info budget, leak-reviewed). `idealConstraintsSatisfied` records which it is.
@@ -557,16 +557,16 @@ export interface BlueprintAblationTriple {
     pSoloExperimenterIdeal: number;
     /** = pSoloSupGenerated − pSoloRaw (supervisor blueprint's real net value). */
     deltaSupVsRaw: number;
-    /** = pSoloExperimenterIdeal − pSoloRaw. LABELLED per `idealConstraintsSatisfied` (codex M8). */
+    /** = pSoloExperimenterIdeal − pSoloRaw. LABELLED per `idealConstraintsSatisfied`. */
     deltaIdealVsRaw: number;
-    /** codex M8 — when false, deltaIdealVsRaw is "manual-prompt upper bound", NOT "supervisor potential". */
+    /** when false, deltaIdealVsRaw is "manual-prompt upper bound", NOT "supervisor potential". */
     idealConstraintsSatisfied: boolean;
-    /** codex M3 — blueprint generation cost charged to the sup-generated arm (budget-match red line). */
+    /** blueprint generation cost charged to the sup-generated arm (budget-match red line). */
     blueprintGenC1MicroUsd: number;
     blueprintGenC2Count: number;
     blueprintGenC2Sec: number;
 }
-/** codex M8 — the constraints under which an "ideal" blueprint may be read as a supervisor-mechanism
+/** the constraints under which an "ideal" blueprint may be read as a supervisor-mechanism
  *  upper bound rather than a generic "better prompt helps" result. Recorded per ablation. */
 export interface IdealBlueprintConstraints {
     generatedBeforeRun: boolean;
@@ -575,10 +575,10 @@ export interface IdealBlueprintConstraints {
     sameInfoBudget: boolean;
     solutionLeakReviewed: boolean;
 }
-/** True iff ALL ideal-blueprint constraints hold (codex M8 gate). */
+/** True iff ALL ideal-blueprint constraints hold. */
 export declare function idealConstraintsSatisfied(c: IdealBlueprintConstraints): boolean;
 /**
- * design/95 §7.3 — V3 (无关性隔离) contamination probe (canary, mechanical, zero LLM-judge). codex M9:
+ * design/95 §7.3 — V3 (无关性隔离) contamination probe (canary, mechanical, zero LLM-judge).
  * the isolated-vs-shared P delta CONFOUNDS execution order / context size / worker count / budget; the
  * PRIMARY signal must be per-subgoal oracle failure + explicit wrong-use of a sibling artifact (the
  * canary leak), with the P delta kept as a DIAGNOSTIC only.
@@ -590,12 +590,12 @@ export interface IsolationContamination {
     isolatedSubgoalP: number[];
     /** Per-factor P under shared context. length === factorCount. */
     sharedSubgoalP: number[];
-    /** PRIMARY mechanical signal (codex M9): cross-factor canary leak rate (explicit token bleed). */
+    /** PRIMARY mechanical signal: cross-factor canary leak rate (explicit token bleed). */
     canaryLeakRate: number;
-    /** PRIMARY mechanical signal (codex M9): count of factors that failed their oracle AND demonstrably
+    /** PRIMARY mechanical signal: count of factors that failed their oracle AND demonstrably
      *  used a sibling factor's artifact (the controlled-ablation harm signal). */
     wrongSiblingArtifactUses: number;
-    /** DIAGNOSTIC ONLY (codex M9 confound): mean(isolated P) − mean(shared P). Not the primary signal. */
+    /** DIAGNOSTIC ONLY (confound): mean(isolated P) − mean(shared P). Not the primary signal. */
     contaminationRateDiag: number;
     /** Extra C1 the isolation cost (multi-worker / repeated context load). */
     isolationOverheadC1: number;
@@ -614,7 +614,7 @@ export interface CampaignReport {
     implementedAxes: ImplementedAxes;
 }
 /**
- * design/95 §2 / codex B1 — one heterogeneity CELL: a `(suiteVersion, taskId, archetype, valueDimension,
+ * design/95 §2 — one heterogeneity CELL: a `(suiteVersion, taskId, archetype, valueDimension,
  * arm)` group with its folded {@link ArmCell}. The decision surface is the per-cell vector — NOT the
  * arm mean (the Simpson's-paradox guard). `groupKey` is the stable join key.
  */
@@ -648,7 +648,7 @@ export interface ComparisonCell {
     pareto: ParetoResult;
 }
 /**
- * codex MINOR11 / council Q1 — capability metadata: which of the four §7/Pareto value axes are actually
+ * council Q1 — capability metadata: which of the four §7/Pareto value axes are actually
  * IMPLEMENTED in this report. Consumers must read this before claiming a V1/V2/V3 result; an unset axis
  * is NOT a null result, it is "not measured here". (The T1 structures above are types + pure helpers;
  * the report-level V1/V2/V3 fields are populated by the harness, not synthesized in `buildReport`.)
@@ -660,7 +660,7 @@ export interface ImplementedAxes {
     v3: boolean;
 }
 export interface ValueJudgmentReport {
-    /** codex B1 — per-arm cells grouped by full heterogeneity key (incl. arm). Single-arm; use for cell
+    /** per-arm cells grouped by full heterogeneity key (incl. arm). Single-arm; use for cell
      *  inspection / `pairedBinaryCompare` inputs. NOT directly a cross-arm verdict surface (each is one arm). */
     groupedCells: GroupedCell[];
     /**
@@ -671,7 +671,7 @@ export interface ValueJudgmentReport {
      */
     comparisons: ComparisonCell[];
     /**
-     * codex B1 — suite-level rollup: per-arm cells folded over ALL scored runs. A WEIGHTED summary for
+     * suite-level rollup: per-arm cells folded over ALL scored runs. A WEIGHTED summary for
      * dashboards ONLY — NOT a decision surface (folding heterogeneous tasks can flip a verdict, Simpson).
      * Consumers MUST decide on `comparisons`; this is convenience aggregation.
      */
@@ -687,7 +687,7 @@ export interface ValueJudgmentReport {
     /** design/89 §3.4: cells with n<8 are directional-only, not verdict-grade. Flagged, not dropped. */
     directionalOnly: Arm[];
     /**
-     * codex B4 — the exclusion ledger: runs dropped from scoring (infra-failed / excluded) with reasons.
+     * the exclusion ledger: runs dropped from scoring (infra-failed / excluded) with reasons.
      * A regression-grade invariant: these never reach `cells` / `pareto` (no infra noise in the verdict).
      */
     excluded: Array<{
@@ -696,16 +696,16 @@ export interface ValueJudgmentReport {
         seed?: number | string;
         reason: RunStatus;
     }>;
-    /** codex MINOR11 — which value axes this report actually measured. */
+    /** which value axes this report actually measured. */
     implementedAxes: ImplementedAxes;
 }
 /**
- * Top-level (codex B1+B4): SCORE only `scored` runs (B4 — drop infra-failed/excluded with reasons),
+ * Top-level: SCORE only `scored` runs (B4 — drop infra-failed/excluded with reasons),
  * group by `(suiteVersion, taskId, archetype, valueDimension, arm)` (B1 — the per-cell decision surface,
  * Simpson's-paradox guard), fold each group, AND provide a suite-level per-arm rollup for dashboards
  * (explicitly NOT a decision surface). Deterministic; no model.
  *
- * `opts.implementedAxes` lets the harness declare which §7 axes it populated (codex MINOR11); default
+ * `opts.implementedAxes` lets the harness declare which §7 axes it populated; default
  * = only Pareto (the V1/V2/V3 structures are T1 net-new, not synthesized here).
  */
 export declare function buildReport(runs: RunRecord[], opts?: {