@sema-agent/server 7.43.0 → 7.44.0

package/dist/leader/merge.js

@@ -1,29 +1,18 @@
 import { delimitUntrusted } from "@sema-agent/core";
 import { applyAndGrade, changedFilesOutOfAllowlist } from "./grader-env-factory.js";
 import { shellQuote as Q } from "../plugins/remote-shell.js";
-/** Integrate completed workers' branches. Never throws — failures are typed MergeResult. */
 export async function mergeBranches(reports, baseSha, deps) {
     const repo = deps.repoDir ?? "/repo";
     const mergeable = reports.filter((r) => r.status === "completed");
     if (mergeable.length === 0) {
         return { ok: false, phase: "no-workers", reason: "no completed workers to merge", quarantine: reports.map((r) => r.workerId) };
     }
-    // The whole pipeline is wrapped so this function honours its "never throws" contract AND never leaks the
-    // integration sandbox: provisioning (which connects+seeds a billable VM) and pullWorkerDiff used to run
-    // OUTSIDE the try, so a throw there (e.g. seed failure) escaped as an exception and — worse — left a
-    // connected sandbox with no `destroy` ever called. `destroy` is captured the instant provisioning resolves,
-    // and the finally tears it down on every path (success / typed failure / thrown error).
     let destroy;
-    // Track the current stage so a THROWN error is attributed to the right phase (not always "provision").
     let phase = "diff-out";
-    // [4953]② declared OUTSIDE the try (same pattern as `phase`) so the catch-all can still disclose them:
-    // spend/repair/measure that already HAPPENED must ride the thrown-failure return too — the leader folds
-    // conflictResolverCostUsd into the next round's budget, and a throw doesn't un-spend it.
-    let conflictResolverCostUsd = 0; // 🔴 capture the bounded conflict-resolver agent's spend (was dropped → S1 TEAM-cost undercount)
+    let conflictResolverCostUsd = 0;
     let repairMeta;
     let measure;
     try {
-        // 1. pull each worker's diff OUT of its container (M2). A failed diff quarantines that worker, aborts merge.
         const patches = [];
         for (const r of mergeable) {
             const d = await deps.pullWorkerDiff(r);
@@ -32,17 +21,11 @@ export async function mergeBranches(reports, baseSha, deps) {
             }
             patches.push({ workerId: r.workerId, patch: d.patch });
         }
-        // 2. ephemeral no-creds integration sandbox (destroyed in finally — council#15).
         phase = "provision";
         const integ = await deps.provisionIntegrationSandbox();
         destroy = integ.destroy;
         const { env } = integ;
-        // The sandbox's base commit ≠ the durable remote's `baseSha` (different repos). Capture the sandbox's
-        // pre-apply HEAD so `format-patch <integBase>..HEAD` captures the integration commit even though the
-        // commit advances the sandbox's branch (dogfood-surfaced: `main..HEAD` was empty). `baseSha` is used
-        // ONLY for the durable push CAS below.
         const integBase = (await env.exec("git rev-parse HEAD", { cwd: repo })).stdout.trim();
-        // 3. apply each patch --3way (council#3: keeps conflict context; capture .rej on failure, quarantine).
         phase = "apply";
         const conflictsResolved = [];
         for (const p of patches) {
@@ -51,15 +34,10 @@ export async function mergeBranches(reports, baseSha, deps) {
             const ap = await env.exec(`git apply --3way --whitespace=nowarn ${Q(patchPath)}`, { cwd: repo });
             if (ap.exitCode !== 0) {
                 const rej = await env.exec(`find . -name '*.rej' -print -exec cat {} +`, { cwd: repo }).catch(() => ({ stdout: "", stderr: "", exitCode: -1 }));
-                // Bounded conflict-resolution (search 2026-06-16): a --3way conflict left markers/.rej in the tree. Instead
-                // of discarding ALL fan-out work + redoing single (leader collapseToSingle), run a bounded agent IN this
-                // sandbox to integrate THIS worker's patch (siblings already applied clean), gated by a marker/.rej re-check
-                // and the downstream test gate. Symmetric with integration-repair; OFF unless a conflictResolver is wired;
-                // degrades to the original apply-failure (collapse) on any leftover/agent-error — never worse than baseline.
                 const cr = integ.conflictResolver && integ.conflictResolver.maxRounds > 0
                     ? await resolveApplyConflict(env, repo, p, rej.stdout, ap.stderr, integ.conflictResolver, deps)
                     : { resolved: false, costUsd: 0 };
-                conflictResolverCostUsd += cr.costUsd; // count the spend even when resolution failed (tokens were spent)
+                conflictResolverCostUsd += cr.costUsd;
                 if (!cr.resolved) {
                     deps.logger?.warn?.("merge_apply_failed", { workerId: p.workerId, exitCode: ap.exitCode });
                     return { ok: false, phase: "apply", reason: `git apply --3way failed for ${p.workerId} (conflict)`, quarantine: [p.workerId], rej: rej.stdout, details: ap.stderr.slice(0, 800), ...(conflictResolverCostUsd > 0 ? { conflictResolverCostUsd } : {}) };
@@ -67,15 +45,8 @@ export async function mergeBranches(reports, baseSha, deps) {
                 conflictsResolved.push(p.workerId);
             }
         }
-        // 4. full test suite IN the sandbox = the merge gate (untrusted diff stays sandboxed — [26]§16).
-        // testCmd is a caller-provided COMMAND LINE (e.g. "cd x && pytest"), run verbatim by design — NOT a single
-        // arg, so it is intentionally not Q()-quoted (council round-2 noted the asymmetry). Blast radius = the
-        // ephemeral no-creds sandbox; the caller owns the command (trusted control-plane config).
         phase = "test";
         let test = await env.exec(deps.testCmd, { cwd: repo });
-        // Bounded integration-repair (search 2026-06-14): a clean-merge-but-failing-build used to be terminal.
-        // If the sandbox supplied a `repair`, run the repair agent IN this merged tree (it edits the working tree;
-        // the squash commit below captures worker patches + repair together), then re-run testCmd. Up to maxRounds.
         if (test.exitCode !== 0 && integ.repair && integ.repair.maxRounds > 0) {
             let cost = 0;
             let round = 0;
@@ -88,7 +59,7 @@ export async function mergeBranches(reports, baseSha, deps) {
                 }
                 catch (e) {
                     deps.logger?.warn?.("integration_repair_error", { round: round + 1, err: e instanceof Error ? e.message : String(e) });
-                    break; // a thrown repair agent → stop repairing; fall through to the (still-failing) terminal return
+                    break;
                 }
                 test = await env.exec(deps.testCmd, { cwd: repo });
             }
@@ -98,28 +69,13 @@ export async function mergeBranches(reports, baseSha, deps) {
         if (test.exitCode !== 0) {
             return { ok: false, phase: "test", reason: `integration test failed (exit ${test.exitCode})`, details: (test.stdout + "\n" + test.stderr).slice(-2000), ...(repairMeta ? { repair: repairMeta } : {}), ...(conflictResolverCostUsd > 0 ? { conflictResolverCostUsd } : {}) };
         }
-        // 4b. truecorrect MEASURE (design/59) — run the thorough hidden oracle IN this sandbox (E2B), where the merged
-        // code already lives, NOT on the CPU-contended control plane (fixes the frontier-multi oracle spawn-timeout
-        // that thinned n). Pure observation: never gates `ok`, just reports into MergeResult.measure.
         if (deps.measureCmd) {
             const mr = await env.exec(deps.measureCmd, { cwd: repo });
             measure = mr.exitCode === 0 ? { pass: true } : { pass: false, reason: (mr.stdout + " " + mr.stderr).slice(-200) };
         }
-        // 5. produce the integrated patch over base, hand to the Coordinator's credentialed push (council#1).
-        // Check the commit's exit code: if `git add -A`/commit fails, HEAD doesn't advance and `format-patch`
-        // still exits 0 with EMPTY output — pushing an empty patch would no-op or corrupt the merge silently.
         phase = "push";
-        // If integration-repair ran, a repair agent may have created commits despite the instruction not to. Flatten
-        // any such commits back to the working tree (Codex review #2) so the single `commit` below squashes worker
-        // patches + repair edits into ONE integration commit — otherwise format-patch would emit the repair commit
-        // PLUS an empty leader commit, and the Coordinator's `git am` can choke on the empty patch. No-op when no
-        // repair commits exist (HEAD already == integBase).
         if (repairMeta)
             await env.exec(`git reset --soft ${Q(integBase)}`, { cwd: repo });
-        // Cost legs that MUST ride EVERY push-phase failure return (wq64gmm5e HIGH: TEAM C1 undercount). A
-        // conflictResolver and/or integration-repair may already have spent real tokens BEFORE any push-phase
-        // failure; dropping these on the commit/format-patch/empty/race/push-fail returns made captureTeamC1
-        // undercount the arm. Mirror the success/hold/test-fail returns exactly.
         const costTail = { ...(repairMeta ? { repair: repairMeta } : {}), ...(conflictResolverCostUsd > 0 ? { conflictResolverCostUsd } : {}) };
         const commit = await env.exec(`git add -A && git -c user.email=leader@local -c user.name=leader commit -m ${Q(`merge: integrate ${mergeable.map((r) => r.workerId).join("+")}`)} --allow-empty`, { cwd: repo });
         if (commit.exitCode !== 0) {
@@ -132,17 +88,9 @@ export async function mergeBranches(reports, baseSha, deps) {
         if (!integrated.stdout.trim()) {
             return { ok: false, phase: "push", reason: "integrated patch is empty (nothing applied over base) — refusing to push", quarantine: mergeable.map((r) => r.workerId), ...costTail };
         }
-        // ── §10.6 THE PUSH CHOKEPOINT + §10.3 push-hold-on-signal + §10.4 measure-drives-repair ──
-        // A single gate covering EVERY push path by construction (collapse `leader.ts:451` + N=1 `leader.ts:508`):
-        // the credentialed push fires ONLY when (a) no mergeable report carries a non-auto-accepting
-        // `repairTerminal` (§10.6 — the SAFE-tier `candidate_only` that the status collapse to "completed" would
-        // otherwise hide), AND (b) under `LEADER_MEASURE_GATES`, every configured strong oracle signal is GREEN
-        // (§10.3). When any of these HOLDS, the push is withheld and the held, DELIMITED candidate is surfaced for
-        // human acceptance (a candidate is never a silent push and never a silent drop — §5 invariant). With
-        // `measureGates` OFF and no report carrying a `repairTerminal`, this whole block is inert → byte-identical.
         const evald = await evaluatePushHold(env, repo, mergeable, measure, integrated.stdout, deps);
         if (evald.measure !== undefined)
-            measure = evald.measure; // §10.4: the out-of-process re-measure supersedes the observe-only one
+            measure = evald.measure;
         if (evald.hold) {
             const h = evald.hold;
             deps.logger?.warn?.("merge_push_held", { terminal: h.terminal, reason: h.reason.slice(0, 200) });
@@ -165,9 +113,6 @@ export async function mergeBranches(reports, baseSha, deps) {
         return { ok: true, ref: push.ref, merged: mergeable.map((r) => r.workerId), ...(measure ? { measure } : {}), ...(repairMeta ? { repair: repairMeta } : {}), ...(conflictsResolved.length > 0 ? { conflictsResolved } : {}), ...(conflictResolverCostUsd > 0 ? { conflictResolverCostUsd } : {}) };
     }
     catch (e) {
-        // Honour the "never throws" contract: a thrown pullWorkerDiff/provision/exec becomes a typed failure,
-        // attributed to the stage it threw in (not a blanket "provision"). [4953]②: spend/repair/measure that
-        // already happened before the throw ride this return too (same tail as every explicit failure return).
         return {
             ok: false, phase, reason: `merge aborted in ${phase}: ${e instanceof Error ? e.message : String(e)}`,
             quarantine: mergeable.map((r) => r.workerId),
@@ -177,98 +122,48 @@ export async function mergeBranches(reports, baseSha, deps) {
         };
     }
     finally {
-        // council#15: destroy the sandbox on EVERY exit path. Guarded because we may bail (diff-out) or throw
-        // BEFORE provisioning — `destroy` is only set once provisionIntegrationSandbox has resolved.
         if (destroy)
             await destroy().catch(() => { });
     }
 }
-/**
- * §10.6 + §10.3 + §10.4 — the push chokepoint decision (pure-ish: reads the reports + the optional measure grader;
- * never throws — a grader error falls back to a HOLD, never a silent push). Returns `{ hold }` to WITHHOLD the
- * credentialed push, surfacing the held candidate; `{}` to allow it. Three independent hold triggers:
- *
- *   §10.6 — any mergeable report carries a `repairTerminal ∉ {undefined, "fixed"}`. A SAFE-tier `candidate_only`
- *           maps to core verdict "PASS" → the report status collapses to "completed", so WITHOUT this gate the
- *           merge would push `testCmd`-green-but-strong-oracle-UNCONFIRMED work. This fires regardless of
- *           `measureGates` (the single-agent repair loop is itself OFF-by-default behind LEADER_REPAIR_LOOP — once
- *           a report carries a repairTerminal, the operator opted in; the candidate MUST be held). Covers the
- *           collapse-to-single and N=1 leader paths by construction.
- *
- *   §10.3 — under `measureGates` ONLY: a configured STRONG oracle that is not GREEN holds the push. The hold keys
- *           on the SIGNAL not a caller field: (`strongOracleSeeded`) OR (`measureCmd` present AND the measure did
- *           not pass). Absent BOTH strong signals → no §10.3 hold (legacy compile-only auto-push). With
- *           `measureGates` OFF this trigger is inert (today's observe-only measure).
- *
- *   §10.4 — under `measureGates` AND `measureDrivesRepair`: re-seed the SINGLE out-of-process grader, mechanically
- *           check the integrated patch's changed files against the allowlist (out-of-allowlist / build-config →
- *           downgrade to `needs_human_oracle`), then re-measure THERE (never the repair-poisoned merge sandbox).
- *           A still-failing re-measure holds (`candidate_only`); a passing re-measure clears the §10.3 measure
- *           signal (so the §10.3 trigger no longer holds on it).
- */
 async function evaluatePushHold(env, repo, mergeable, observeMeasure, integratedPatch, deps) {
-    // §10.7 — the integrated patch is worker-authored code reaching a human-read HTTP body / durable-approval row.
     const heldCandidate = () => delimitUntrusted("CANDIDATE PATCH (untrusted worker code)", integratedPatch);
-    // §10.6 — a non-auto-accepting single-agent repair terminal rode in on a report (status collapsed to
-    // "completed"). The strongest non-fixed terminal wins the label (it's the WHY surfaced to the human).
     const carried = mergeable.map((r) => r.repairTerminal).filter((t) => t !== undefined && t !== "fixed");
     if (carried.length > 0) {
-        const terminal = carried[0]; // every mergeable solo report shares one repairTerminal (N=1 / collapse-solo)
+        const terminal = carried[0];
         return { hold: { reason: `single-agent repair terminal '${terminal}' — strong oracle unconfirmed, push held for human acceptance (§10.6)`, terminal, candidatePatch: heldCandidate() } };
     }
-    // §10.3/§10.4 are OFF unless the master measure-gates flag is on → byte-identical default path.
     if (!deps.measureGates)
         return {};
     let measure = observeMeasure;
-    // §10.4 measure-drives-repair: re-measure the integrated patch in a FRESH-seeded out-of-process grader, with the
-    // mechanical changed-files allowlist guard. Runs only when configured AND there is a measure to re-confirm.
     if (deps.measureDrivesRepair && deps.measureCmd) {
         const mdr = deps.measureDrivesRepair;
         try {
-            // §10.4(ii) — mechanical allowlist FIRST (a fresh sandbox is necessary-not-sufficient: poison can ride
-            // INSIDE the integrated patch). An out-of-allowlist / build-config touch → downgrade to needs_human_oracle.
             const changed = await mdr.changedFiles(integratedPatch);
             const offending = changedFilesOutOfAllowlist(changed, mdr.allowlist);
             if (offending.length > 0) {
                 deps.logger?.warn?.("merge_measure_allowlist_denied", { offending: offending.slice(0, 20) });
                 return { hold: { reason: `integrated patch touches out-of-allowlist / build-config paths (${offending.slice(0, 5).join(", ")}) — needs_human_oracle (§10.4(ii))`, terminal: "needs_human_oracle", candidatePatch: heldCandidate() }, measure };
             }
-            // Re-seed the SINGLE grader + re-measure THERE (never the repair-edited merge sandbox — §10.4(i)). The
-            // existing in-sandbox `repair` agent already ran in `mergeBranches`; the grader re-measure is the
-            // authoritative correctness signal. (Bounded measure-repair rounds beyond the existing integration-repair
-            // are a future enable; v1 re-measures once.)
             const grade = await applyAndGrade(mdr.grader, integratedPatch, mdr.measureSteps);
             measure = grade.passed ? { pass: true } : { pass: false, reason: (grade.trace ?? "measure failed in out-of-process grader").slice(-200) };
             deps.logger?.info?.("merge_measure_grader", { passed: grade.passed, applied: grade.applied });
         }
         catch (e) {
-            // Fail-CLOSED (never a silent push): a grader transport/exec error holds the push as needs_human_oracle.
             deps.logger?.warn?.("merge_measure_grader_error", { err: e instanceof Error ? e.message : String(e) });
-            // §10.7 — surfaced reason is a trusted constant; the untrusted error detail is in the warn log above.
             return { hold: { reason: `measure grader errored — needs_human_oracle (§10.4)`, terminal: "needs_human_oracle", candidatePatch: heldCandidate() }, measure };
         }
     }
-    // §10.3 — push-hold on the SIGNAL. Auto-push only when every configured strong signal is GREEN.
     const measureFailing = deps.measureCmd !== undefined && measure?.pass !== true;
-    const strongOracleUnconfirmed = deps.strongOracleSeeded === true; // a hidden held-out oracle was seeded but only testCmd cleared
+    const strongOracleUnconfirmed = deps.strongOracleSeeded === true;
     if (measureFailing || strongOracleUnconfirmed) {
-        // §10.7 — the surfaced `reason` reaches a human-read HTTP body / durable-approval row, so it is built from
-        // TRUSTED constants ONLY; the untrusted measure output tail (`measure.reason`) stays in the logs, NEVER
-        // interpolated into a human-/LLM-reachable string.
         const why = measureFailing ? "measure did not pass" : "hidden held-out oracle seeded but only the compile gate cleared";
         deps.logger?.warn?.("merge_push_held_signal", { why, measureReason: (measure?.reason ?? "").slice(0, 200) });
         return { hold: { reason: `strong oracle unconfirmed: ${why} — candidate_only, push held (§10.3)`, terminal: "candidate_only", candidatePatch: heldCandidate() }, measure };
     }
     return { measure };
 }
-/** Bounded resolution of a `git apply --3way` conflict (search 2026-06-16). The failed apply left conflict markers
- *  in-tree and/or `.rej` files. Run the resolver agent up to maxRounds, then VERIFY the tree is conflict-free (no
- *  `<<<<<<<`/`>>>>>>>` markers, no `*.rej`). Returns true iff clean → the patch is treated as applied and the merge
- *  continues, KEEPING every other worker's clean work. Any agent error / leftover marker → false → the caller falls
- *  back to today's apply-failure (collapse-to-single). Never worse than the baseline. */
 async function resolveApplyConflict(env, repo, p, rejText, applyStderr, resolver, deps) {
-    // 🔴 Accumulate + RETURN the resolver's spend (it used to return only a boolean → the cost was dropped, the S1
-    // TEAM-cost-undercount bug). Counts every round, including the round that throws (the tokens were spent).
     let costUsd = 0;
     const conflictText = `git apply --3way could not cleanly apply worker '${p.workerId}'.\n--- apply stderr ---\n${applyStderr.slice(0, 1500)}\n--- reject hunks (*.rej) ---\n${rejText.slice(0, 3000)}`;
     for (let round = 0; round < resolver.maxRounds; round++) {
@@ -279,10 +174,8 @@ async function resolveApplyConflict(env, repo, p, rejText, applyStderr, resolver
         }
         catch (e) {
             deps.logger?.warn?.("merge_conflict_repair_error", { workerId: p.workerId, err: e instanceof Error ? e.message : String(e) });
-            return { resolved: false, costUsd }; // a thrown resolver → give up, fall back to collapse
+            return { resolved: false, costUsd };
         }
-        // Resolved iff NO conflict markers and NO .rej files remain under the repo. `grep -rIlE` LEADS the command so a
-        // mock/impl can distinguish this verify from the `.rej` CAPTURE in mergeBranches; non-empty stdout = still dirty.
         const check = await env
             .exec(`grep -rIlE '^(<<<<<<<|>>>>>>>)' . 2>/dev/null; find . -name '*.rej' 2>/dev/null | head -20`, { cwd: repo })
             .catch(() => ({ exitCode: -1, stdout: "DIRTY", stderr: "" }));
@@ -292,6 +185,6 @@ async function resolveApplyConflict(env, repo, p, rejText, applyStderr, resolver
             return { resolved: true, costUsd };
         }
     }
-    return { resolved: false, costUsd }; // still conflicted after maxRounds
+    return { resolved: false, costUsd };
 }
 //# sourceMappingURL=merge.js.map

package/dist/leader/planner.js

@@ -1,9 +1,3 @@
-/**
- * Deterministic economic 防灾 guard (design/68 §7 / §11 D2, search [83] ruling (b)): the asymmetry is that a
- * false fan-out is the -98% disaster while a false single merely runs slower — so every case decidable WITHOUT
- * the model resolves to single, for free. Pure function (unit-testable); the semantic judgments (sequential/
- * coupled/uncertain) stay with the router LLM, and "估不准回 single" is the collapse fallback (B3).
- */
 export function economicGuard(objective, opts = {}) {
     if (opts.fanoutEnabled === false)
         return { single: true, reason: "fan-out disabled by deployment (A6)" };
@@ -14,12 +8,9 @@ export function economicGuard(objective, opts = {}) {
     }
     return { single: false };
 }
-/** The deterministic SINGLE route: one sub-task owning the whole objective (the same shape the router emits
- *  for its single decision — N=1 runs through the identical leader pipeline). */
 export function singleRoute(objective) {
     return [{ workerId: "main", branch: "worker/main", files: ["."], spec: { objective } }];
 }
-/** The planning prompt: asks for a strict JSON array of disjoint-file sub-tasks. */
 export function planPrompt(objective, opts = {}) {
     const max = opts.maxSubtasks ?? 6;
     return [
@@ -33,7 +24,6 @@ export function planPrompt(objective, opts = {}) {
         `Rules: workerId unique + url-safe; files non-empty + disjoint across ALL sub-tasks; objective self-contained.`,
     ].filter(Boolean).join(" ");
 }
-/** Extract a JSON array from a model completion (tolerates ```json fences / surrounding prose). */
 function extractJsonArray(raw) {
     const fenced = raw.match(/```(?:json)?\s*([\s\S]*?)```/i);
     const candidate = (fenced ? fenced[1] : raw).trim();
@@ -48,20 +38,11 @@ function extractJsonArray(raw) {
         throw new Error("planner output is not valid JSON");
     }
 }
-/** Parse + VALIDATE a planner completion into SubtaskSpec[]. Throws on any violation (disjointness etc.). */
 export function parsePlan(raw, opts = {}) {
     return validateSubtasks(extractJsonArray(raw), opts);
 }
-/**
- * Deterministically validate an array of sub-tasks (the trust boundary — see file header). Used both for the
- * LLM planner output AND for caller-supplied `body.subtasks`, which would otherwise skip every invariant: the
- * `branch` is interpolated into a worker-container shell command (`git checkout -b <branch>`), so an
- * unvalidated branch (`x; curl …|sh`, `` `reboot` ``, `--upload-pack=…`) would inject; and the disjoint-file /
- * unique-id invariants are what the Coordinator's parallel-merge depends on. Throws on any violation.
- */
 export function validateSubtasks(arr, opts = {}) {
     const max = opts.maxSubtasks ?? 6;
-    // "plan" not "planner" — this also validates caller-supplied body.subtasks, not just LLM output.
     if (!Array.isArray(arr) || arr.length === 0)
         throw new Error("plan must be a non-empty array of sub-tasks");
     if (arr.length > max)
@@ -89,15 +70,6 @@ export function validateSubtasks(arr, opts = {}) {
             seenFiles.add(norm);
         }
         const branch = typeof e.branch === "string" && e.branch.trim() ? e.branch.trim() : `worker/${workerId}`;
-        // Reject a leading "-" (would be parsed as an option by `git checkout -b <branch>`), ".." (ref escape), and
-        // an over-long ref (git rejects it anyway; cap keeps the value tidy). The char set is shell-safe.
-        //
-        // 🔗 近亲判据(2026-08-08,#176 二轮扫描 finding):`leader/diffout.ts` 的 `safeRev` 用**同一套**字符
-        // 类 `[A-Za-z0-9._/-]`、**同一个** 200 长度上限、**同样**拒前导 `-`。唯一的真差异在 `..`:safeRev 只拒
-        // `..--`(rev 要支持 `A..B` 区间形),这里全拒 `..`(branch **名**里 `..` 无合法用途,git 自己也拒)
-        // —— 是**有意收紧**,不是抄漏。两处此前零互指、无共享基元、无跨处钉;单边加一个字符类成员时另一边
-        // 不会有任何提示。是否抽一个共享基元(比如 `refToken(s, { allowRange })`)属结构面决定,候裁;本批
-        // 只把「近亲关系 + 差异所在」两侧成文。
         if (branch.length > 200 || !/^[A-Za-z0-9._/-]+$/.test(branch) || branch.startsWith("-") || branch.includes("..")) {
             throw new Error(`sub-task ${workerId}: invalid branch`);
         }
@@ -106,19 +78,10 @@ export function validateSubtasks(arr, opts = {}) {
     }
     return subs;
 }
-/** Run the planner: one model completion → validated disjoint-file sub-tasks. */
 export async function llmPlan(objective, runPlan, opts = {}) {
     const raw = await runPlan(planPrompt(objective, opts));
     return parsePlan(raw, opts);
 }
-/**
- * The DIFFICULTY-ROUTER prompt (search [43], planner-light). Same disjoint-subtask contract as `planPrompt`,
- * but the model FIRST routes: default to a SINGLE agent (one sub-task owning the whole task) and only fan out
- * when the objective is CLEARLY + ECONOMICALLY decomposable (disjoint files, independent/non-sequential, each
- * part buildable without most of the same context). The campaign proved forcing fan-out on a sequential/coupled
- * task is a -98% disaster, so the bias is firmly toward single. The output is still a plain disjoint-file
- * sub-task array — a 1-element array IS the single route (the leader runs N=1 through the same pipeline).
- */
 export function routePrompt(objective, opts = {}) {
     const max = opts.maxSubtasks ?? 6;
     return [
@@ -141,39 +104,25 @@ export function routePrompt(objective, opts = {}) {
         `Rules: always a JSON ARRAY (SINGLE = one element, not a bare object); workerId unique + url-safe; files non-empty + DISJOINT across ALL elements; each objective self-contained.`,
     ].filter(Boolean).join(" ");
 }
-/** Run the difficulty router: one model completion → a routed plan (1 sub-task = single route, N = fan-out),
- *  validated by `parsePlan` (the same disjointness/shape invariants the Coordinator depends on). */
 export async function routePlan(objective, runRoute, opts = {}) {
     if (opts.fanoutEnabled === false)
-        return singleRoute(objective); // A6: deploy-disabled fan-out → no router call
+        return singleRoute(objective);
     const raw = await runRoute(routePrompt(objective, opts));
     return parsePlan(raw, opts);
 }
-/**
- * Decomposer quality gate (design/68 §5/§11 B1-B3): run the router, and on a rejected/unparseable plan retry
- * the LLM AT MOST ONCE, then COLLAPSE TO SINGLE (never fail the task on a bad plan — single is almost always
- * the right fallback, and a false fan-out is the -98% disaster; a plan failure must not be louder than that).
- * `collapsed` carries the reason (observability: a collapse is a router-quality signal, not silent).
- */
 export async function routePlanWithFallback(objective, runRoute, opts = {}) {
-    const guard = economicGuard(objective, opts); // deterministic 防灾经济 cases never pay for a router call
+    const guard = economicGuard(objective, opts);
     if (guard.single)
         return { subs: singleRoute(objective) };
     let firstErr;
-    let firstRaw = ""; // capture the raw completion of the FIRST failed attempt for diagnosis (see below)
+    let firstRaw = "";
     for (let attempt = 0; attempt < 2; attempt++) {
-        // §5: no more than ONE LLM re-plan
         const raw = await runRoute(routePrompt(objective, opts));
         try {
             return { subs: parsePlan(raw, opts) };
         }
         catch (e) {
             firstErr ??= e;
-            // Capturing the raw output on collapse is load-bearing for diagnosis: a collapse logs only "not valid
-            // JSON", and the router runs on an in-memory (non-durable) session, so the raw completion is otherwise
-            // GONE — task#2d's flaky collapse could not be root-caused because nothing recorded the bad output. Keep
-            // a bounded head+tail so the next collapse is diagnosable (truncated/unterminated vs unescaped-quote vs
-            // prose) without dumping a 32k-token runaway in full.
             if (!firstRaw)
                 firstRaw = raw.length > 600 ? `${raw.slice(0, 300)}…[${raw.length}ch]…${raw.slice(-150)}` : raw;
         }

package/dist/leader/repair-oracle.js

@@ -1,37 +1,7 @@
-/**
- * The PROFILE-injected `RepairOracle` closure for the leader's single-agent self-repair loop
- * (`runRepairLoop`, core design/78 / D1). See `sema-internal server/docs/LEADER-REPAIRLOOP-INTEGRATION.md` (§3.1 + the authoritative
- * §10 corrected layer). The closure GRADES a worker's candidate in an ISOLATED grader env (the reused
- * integration sandbox, distinct from the worker env) and maps the result to a core `OracleResult`. core only
- * fixes the `OracleResult` shape + the read-only/identity contract; the composition lives HERE so the core type
- * never grows a discriminated union.
- *
- * Hardened by the adversarial round (§10):
- *  - §10.1 HERMETIC grade: the grader tree is reset to a clean base (`git reset --hard <integBase> && git clean
- *    -fdx`) BEFORE applying the worker's LATEST full `base..HEAD` diff each call — so a 2nd/3rd attempt never
- *    applies cumulatively onto an already-applied tree (the BROKEN finding). The diff is recomputed fresh every
- *    call (never a stale cached diff — verify.ts:328 BUG5).
- *  - flaky: the gate is re-isolated K times on a green-looking verdict; a disagreement is reported `flaky:true`
- *    and core's `terminalForTier` provably refuses to project it to a passing terminal.
- *  - §10.9 DE-CORRELATION: the L3 judge can only contribute a CLEARING tier when the verifier model is PROVABLY
- *    distinct from the generator — and the closure CANNOT resolve roles→models itself (that happens inside
- *    `Runner.runTask` after the closure returns), so the WIRE resolves both ids and passes them in; the closure
- *    downgrades to `l3_judge_advisory` when they are equal. v1 ships L3 OFF (`cfg.l3` unset) → L2 `trusted_hidden`
- *    is the sole clearer and `terminalForTier` caps every PASS at `candidate_only`. Wiring the actual
- *    `verifyCompleted` invocation is a future enable: it needs the worker's `TaskResult` threaded to the oracle
- *    (core passes only the report `evidence` today), so it is deliberately NOT invoked here.
- *
- * The grader topology (graderEnv = the reused integration sandbox, oracle seeded ONLY there, worker env distinct)
- * means the worker can never read the oracle; for SAFE-tier `candidate_only` the bare `graderEnv !== workerEnv`
- * identity check is sufficient, so the caller OMITS `immutableOraclePaths` (the structural bash write-probe is
- * vacuous across distinct sandboxes and matters only for the mandate-OFF auto-accept path — §10.2).
- */
 import { runExecGate, } from "@sema-agent/core";
 import { createHash } from "node:crypto";
 import { shellQuote as sq } from "../plugins/remote-shell.js";
-/** A short, stable content hash for the stale-diff guard (fork2.1) + the graded-bytes binding (fork2.2). */
 const sha = (s) => createHash("sha256").update(s).digest("hex").slice(0, 16);
-/** Parse the changed file paths from a unified diff — the `diff --git a/X b/X` headers (both old + new path). */
 function changedFilesOf(patch) {
     const out = new Set();
     for (const m of patch.matchAll(/^diff --git a\/(.+?) b\/(.+)$/gm)) {
@@ -41,8 +11,6 @@ function changedFilesOf(patch) {
     return [...out];
 }
 const normP = (p) => p.replace(/^\.?\/+/, "").replace(/\/+$/, "");
-/** fork1.2 — the first changed file that touches a protected oracle path (exact, or a subtree either way), else
- *  undefined. A patch that edits the grader's hidden-oracle/test path is refused (test-tampering guard). */
 function touchesOraclePath(changed, oraclePaths) {
     const ops = oraclePaths.map(normP).filter((p) => p !== "");
     for (const f of changed.map(normP)) {
@@ -53,35 +21,23 @@ function touchesOraclePath(changed, oraclePaths) {
     }
     return undefined;
 }
-/**
- * Build the `RepairOracle` closure. The returned `(graderEnv, evidence) => OracleResult` is what the leader
- * passes as `RepairLoopConfig.oracle`. `evidence` (the worker's report text) is intentionally unused — the
- * closure recomputes the candidate diff from the worker env each call (§10.1).
- */
 export function mkRepairOracle(cfg) {
     const repo = cfg.graderRepoDir;
     const K = Math.max(1, Math.floor(cfg.flakyK ?? 2));
-    let lastGradedHash; // fork2.1 stale-diff guard — per-loop state across the engine's attempts.
+    let lastGradedHash;
     return async (graderEnv, _evidence) => {
-        // §10.1 — materialize the worker's LATEST code in a CLEAN grader tree. Pull fresh (never a stale diff).
         const diff = await cfg.pullWorkerDiff();
         if (!diff.ok) {
             cfg.log?.("repair_oracle_pull_failed", { error: diff.error });
             return { tier: cfg.passTier, passed: false, flaky: false, retries: 0, trace: `pull worker diff failed: ${diff.error}` };
         }
         const diffHash = sha(diff.patch);
-        // fork1.2 — refuse a candidate that edits a seeded oracle/test path: applied into the grader it
-        // could tamper the very oracle that grades it. Surface as `needs_human_oracle` (tier "none" → terminalForTier),
-        // never a silent candidate_only. (The §10.2 factory lane OMITs the engine path-probe, so this is the fence.)
         const tampered = cfg.oraclePaths && cfg.oraclePaths.length > 0 ? touchesOraclePath(changedFilesOf(diff.patch), cfg.oraclePaths) : undefined;
         if (tampered) {
             cfg.log?.("repair_oracle_tampering_guard", { path: tampered });
             cfg.onGraded?.({ diff: diff.patch, hash: diffHash, passed: false });
             return { tier: "none", passed: false, flaky: false, retries: 0, trace: `candidate patch touches oracle/test path '${tampered}' — refusing to grade (fork1.2 test-tampering guard)` };
         }
-        // fork2.1 — a repair attempt that produced NO new diff (byte-identical to the prior graded one)
-        // made no progress → never grade stale bytes as a fresh PASS: report no-progress (the loop gives up rather
-        // than re-passing a stale artifact). With fork2.2 this guarantees the SURFACED candidate == the graded bytes.
         if (lastGradedHash !== undefined && diffHash === lastGradedHash) {
             cfg.log?.("repair_oracle_stale_diff", { hash: diffHash });
             cfg.onGraded?.({ diff: diff.patch, hash: diffHash, passed: false });
@@ -90,8 +46,6 @@ export function mkRepairOracle(cfg) {
         lastGradedHash = diffHash;
         const patchPath = `/tmp/candidate-${Date.now()}.patch`;
         await cfg.graderWriteFile(patchPath, diff.patch);
-        // Hermetic prep: reset the grader to its clean base, then apply the FULL base→latest diff. `--whitespace=nowarn`
-        // matches the merge path (merge.ts:144). A prep failure (e.g. an apply conflict) is a non-flaky failed grade.
         const prep = await runExecGate(graderEnv, [
             { command: `git -C ${sq(repo)} reset --hard ${sq(cfg.integBase)} && git -C ${sq(repo)} clean -fdx`, label: "grader-reset" },
             { command: `git -C ${sq(repo)} apply --whitespace=nowarn ${sq(patchPath)}`, label: "grader-apply" },
@@ -102,15 +56,8 @@ export function mkRepairOracle(cfg) {
             cfg.onGraded?.({ diff: diff.patch, hash: diffHash, passed: false });
             return { tier: cfg.passTier, passed: false, flaky: false, retries: 0, trace: `grader prep failed:\n${trace}` };
         }
-        // 🔴 council 2026-06-17 — the hermetic `clean -fdx` above DELETED the seeded hidden oracle (untracked/ignored,
-        // never committed at integBase). RE-INJECT it AFTER applying the worker patch, so (a) the gate runs against the
-        // REAL oracle the clean wiped (else `trusted_hidden` is a false label), and (b) any file the patch placed at an
-        // oracle path is OVERWRITTEN by the trusted content (defence-in-depth with the fork1.2 path guard above).
         for (const f of cfg.oracleFiles ?? [])
             await cfg.graderWriteFile(f.path, f.content);
-        // L2 mechanical gate (the trusted hidden oracle), re-isolated K times to settle flakiness. A clear FIRST
-        // failure short-circuits (no point re-running a definite fail); a green verdict is re-run to detect a flaky
-        // (nondeterministic) test — a disagreement is reported flaky and core refuses to project it to a pass.
         const verdicts = [];
         let lastTrace = "";
         for (let k = 0; k < K; k++) {
@@ -123,18 +70,12 @@ export function mkRepairOracle(cfg) {
         }
         const passed = verdicts.length > 0 && verdicts.every(Boolean);
         const flaky = new Set(verdicts).size > 1;
-        // §10.9 — a self-certifying verifier (no distinct model) cannot CLEAR: a PASS downgrades to advisory. v1 has
-        // `cfg.l3` unset (L3 off) → the L2 `passTier` stands and `terminalForTier` caps the PASS at candidate_only.
         let tier = cfg.passTier;
         if (cfg.l3 && passed && !flaky && cfg.l3.verifierModelId === cfg.l3.generatorModelId) {
             cfg.log?.("repair_oracle_l3_decorrelation_failed", { model: cfg.l3.generatorModelId });
             tier = "l3_judge_advisory";
         }
-        // fork2.2 — bind the EXACT graded bytes (the diff that produced this verdict) so the caller surfaces the
-        // candidate the human reviews == the bytes that were graded (not a later re-pull that may differ).
         cfg.onGraded?.({ diff: diff.patch, hash: diffHash, passed });
-        // [4953]① `retries` = how many re-isolations actually RAN (the cross-repo contract's wording) — the
-        // first-clear-fail short-circuit means this can be < K, and reporting the configured cap was a lie.
         cfg.log?.("repair_oracle_verdict", { tier, passed, flaky, retries: verdicts.length });
         return { tier, passed, flaky, retries: verdicts.length, ...(passed && !flaky ? {} : { trace: lastTrace || "oracle rejected the candidate" }) };
     };