@tachikomagundam/abathur 0.2.4 → 0.2.6

package/config/genomes/historian.example.jsonc

@@ -56,7 +56,7 @@
     "resetCommand": "bash ${ABATHUR_REPO}/graders/historian/reset-sandbox.sh",
     "runCommand": "bash ${ABATHUR_REPO}/graders/historian/run-scenario.sh {unit.id} {repoRoot}/{unit.path}",
     "graderCommand": "node ${ABATHUR_REPO}/graders/historian/grader.mjs {unit.id} {repoRoot}/{unit.path} ${ABATHUR_WIKI_BASE}",
-    "agentModel": "<provider>/<model-id>", // "<provider>/<model-id> as registered in your opencode config"
+    "agentModel": "replace-me/provider/model", // operator: substitute the real <provider>/<model> when copying
     // Real agent runs, not unit tests: 1200s caps one stuck scenario without
     // poisoning the generation (timeout => unscored/inconclusive, excluded by
     // the stats layer). seed+reset hooks share a FIXED 60s adapter budget

package/dist/commands/genome.js

@@ -53,7 +53,7 @@ function genomeSeals(configDir, label) {
     for (const warning of scan.warnings)
         writeStdout(`warning: ${warning}`);
     for (const entry of scan.entries) {
-        writeStdout(`# effective seal globs for '${entry.label}' (${entry.fingerprint}) under ${entry.spec.repoPath}`);
+        writeStdout(`# effective seal globs for '${entry.label}' (${entry.fingerprint}) under ${entry.spec.repoPath}`); // raw-repoPath: display string only; no FS access
         for (const glob of entry.spec.kernel.immutableGlobs)
             writeStdout(glob);
     }
@@ -61,7 +61,7 @@ function genomeSeals(configDir, label) {
 }
 function genomeRm(configDir, label) {
     const entry = resolveUniqueEntry(configDir, label, "genome rm");
-    const file = ledgerPath(entry.spec.repoPath);
+    const file = ledgerPath(entry.spec.repoPath); // raw-repoPath: ledgerPath() resolves env literals at the FS seam (ledger.ts)
     if (existsSync(file) && readFileSync(file, "utf8").trim().length > 0) {
         blocked(`genome rm refused: '${entry.label}' (${entry.fingerprint}) has ledger history — archive instead`, `lineage lives in ${file}; unregistering a lived genome would orphan its evidence. Keep it registered or move the repo aside.`);
     }

package/dist/commands/graft.js

@@ -43,7 +43,7 @@ function entryForLabel(configDir, label) {
     const matches = readRegistry(configDir).entries.filter((entry) => entry.label === label);
     if (matches.length > 1) {
         cannotAnswer(`graft: label '${label}' is ambiguous — ${String(matches.length)} genomes share it: ${matches
-            .map((e) => `${e.fingerprint} @ ${e.spec.repoPath}`)
+            .map((e) => `${e.fingerprint} @ ${e.spec.repoPath}`) // raw-repoPath: display string only; no FS access
             .join(", ")}`, "give the specs distinct labels; the fingerprint is the identity");
     }
     return matches[0] ?? null;

package/dist/commands/run.js

@@ -69,7 +69,7 @@ export function resolveUniqueEntry(configDir, label, who = "run") {
     const scan = requireGenomesByLabel(configDir, label);
     if (scan.entries.length > 1) {
         cannotAnswer(`${who}: label '${label}' is ambiguous — ${String(scan.entries.length)} genomes share it: ${scan.entries
-            .map((e) => `${e.fingerprint} @ ${e.spec.repoPath}`)
+            .map((e) => `${e.fingerprint} @ ${e.spec.repoPath}`) // raw-repoPath: display string only; no FS access
             .join(", ")}`, "give the specs distinct labels; the fingerprint is the identity");
     }
     const entry = scan.entries[0];

package/dist/commands/self-eval.js

@@ -110,7 +110,7 @@ async function selfEvalHandler(context) {
     for (const warning of readRegistry(configDir).warnings)
         writeStdout(`warning: ${warning}`);
     const entry = resolveUniqueEntry(configDir, flags.label, "self-eval");
-    if (!isEnvRepoLiteral(entry.spec.repoPath)) {
+    if (!isEnvRepoLiteral(entry.spec.repoPath)) { // raw-repoPath: self-mode detection must inspect the STORED literal, not the resolved path
         cannotAnswer(`self-eval: '${entry.spec.label}' is not a self genome — repoPath must be the \${ABATHUR_SELF_REPO} literal`, "self-eval grades the harness against its own sealed kernel; see genomes/abathur-self.jsonc");
     }
     const audit = auditKernel(entry, configDir);

package/dist/commands/tombstone.js

@@ -4,6 +4,7 @@
 // bytes) but NEVER echoed raw — the confirmation line is sanitized like todo-8's
 // sealMessage so untrusted text cannot forge terminal output.
 import { Ledger } from "../core/ledger.js";
+import { effectiveRepoPath } from "../core/spec.js";
 import { resolveConfigDir } from "../config.js";
 import { EXIT_OK, blocked, cannotAnswer } from "../exit.js";
 import { writeStdout } from "../out.js";
@@ -48,7 +49,7 @@ function runTombstone(args) {
     const { label, genId, reason } = parseArgs(args);
     const configDir = resolveConfigDir();
     const entry = resolveUniqueEntry(configDir, label, "tombstone");
-    const ledger = Ledger.open(entry.spec.repoPath);
+    const ledger = Ledger.open(effectiveRepoPath(entry.spec.repoPath));
     const records = ledger.readAll();
     if (!records.some((r) => r.kind === "generation_complete" && r.genId === genId)) {
         blocked(`tombstone: no generation_complete ledger row for gen '${genId}' of '${label}' — nothing to bury`);

package/dist/core/evolve/run-bench.js

@@ -16,10 +16,11 @@ export function cloneMatrixRow(u) {
 export function copyProvenance(p) {
     return { benchType: p.benchType, versions: p.versions.map((v) => ({ bin: v.bin, version: v.version })) };
 }
-// Unscored units (run timeout/infra_failed, inconclusive grader, budget cut) must be
-// excluded before stats.evaluate — empty replicate lists poison aggregateScore with NaN.
+// Invariant: unscored units (timeout/infra_failed/budget cut) stay in the matrix —
+// dropping them asymmetrically shifts one arm's aggregate pool (campaign-6 artifact);
+// evaluate() fail-closes any arm's n<2 as indeterminate before any aggregation.
 export function asReplicates(rows) {
-    return rows.filter((u) => u.scores.length > 0).map((u) => ({ unitId: u.unitId, split: u.split, scores: u.scores }));
+    return rows.map((u) => ({ unitId: u.unitId, split: u.split, scores: u.scores }));
 }
 export * from "./run-rows.js";
 /** toy ⇒ stateless adapter; fixture ⇒ ctor acquires the fingerprint lock immediately. */

package/dist/core/evolve/run-loop.js

@@ -32,12 +32,13 @@ import { compactUtc, fingerprint, genId } from "../ids.js";
 import { LEDGER_KIND_GENERATION_COMPLETE, acquireGenomeLock, Ledger } from "../ledger.js";
 import { openGenome } from "../worktree.js";
 import { clampReps, evaluate, needsExit } from "../stats.js";
-import { effectiveRepoPath, isEnvRepoLiteral } from "../spec.js";
+import { effectiveRepoPath, envRepoName, isEnvRepoLiteral } from "../spec.js";
 import { ChildTracker, reapOrphans } from "./child-track.js";
 import { buildBrief } from "./brief.js";
 import { startRunFriction } from "./run-friction.js";
 import { runMutatorSession } from "./reflect.js";
 import { asReplicates, benchTarget, cloneMatrixRow, copyProvenance } from "./run-bench.js";
+import { loadScoreBank } from "./score-bank.js";
 import { selfGuardVerdict } from "./self-snapshot.js";
 import { effectiveCaps, planLines } from "./run-plan.js";
 import { addCounters, readResume, } from "./run-rows.js";
@@ -101,7 +102,13 @@ async function evolve(opts, mutatorCommand, ledger, caps, reps, env, now) {
     const spec = opts.entry.spec;
     const lines = [];
     const genomeRepo = effectiveRepoPath(spec.repoPath);
-    const selfMode = isEnvRepoLiteral(spec.repoPath);
+    // Engine-self ONLY: a `${VAR}` literal is a path-injection convenience any
+    // harness repo may use (campaign-1 misroute pin: selfmode-literal.test.ts).
+    const selfMode = envRepoName(spec.repoPath) === "ABATHUR_SELF_REPO";
+    // Env-literals resolve to concrete paths exactly once, here at the FS
+    // boundary; bench/reflect drivers below never see the raw literal.
+    // Concrete repoPaths flow through byte-identical to before.
+    const loopSpec = isEnvRepoLiteral(spec.repoPath) ? { ...spec, repoPath: genomeRepo } : spec;
     const fric = opts.friction === undefined ? null : startRunFriction(opts.friction);
     // Reap only under the genome lock: every remaining log entry belongs to a dead run.
     const reap = reapOrphans(genomeRepo);
@@ -131,7 +138,7 @@ async function evolve(opts, mutatorCommand, ledger, caps, reps, env, now) {
     else {
         const gen = genId(fingerprint({ incumbent: opened.headCommit, at: now().getTime() }), now());
         const out = await benchTarget({
-            spec,
+            spec: loopSpec,
             genId: gen,
             reps,
             caps,
@@ -161,6 +168,18 @@ async function evolve(opts, mutatorCommand, ledger, caps, reps, env, now) {
         incUnits = out.units;
         lines.push(`incumbent baseline: ${String(out.units.length)} units x ${String(reps)} reps${out.complete ? "" : " (BUDGET-TRUNCATED)"}`);
     }
+    // ---- score bank for acceptance-semantics gates (loaded after the incumbent
+    // row commit so this campaign's baseline reps price the bank — gate-time view;
+    // candidate rows land only after evaluate, never feeding their own verdict).
+    const scoreBank = loadScoreBank(genomeRepo);
+    if (scoreBank === null) {
+        lines.push("score bank: none — legacy cross-arm gate");
+    }
+    else {
+        lines.push(`score bank: ${String(scoreBank.units.size)} unit(s), prior sigma ${scoreBank.priorSigma.toFixed(4)}, pooled df ${String(scoreBank.totalDf)}`);
+        for (const notice of scoreBank.notices)
+            lines.push(`score bank: ${notice}`);
+    }
     // ---- candidate generation session
     const remaining = caps.maxCandidates - counters.candidates;
     const considered = [];
@@ -181,7 +200,7 @@ async function evolve(opts, mutatorCommand, ledger, caps, reps, env, now) {
         const brief = buildBrief(spec, evidence, counters);
         tracker.phase(`mutator-${invId}`, "mutator-session");
         const session = await runMutatorSession({
-            spec: selfMode ? { ...spec, repoPath: genomeRepo } : spec,
+            spec: loopSpec,
             brief,
             mutatorCommand,
             ...(opts.opencodeBin === undefined ? {} : { opencodeBin: opts.opencodeBin }),
@@ -236,6 +255,7 @@ async function evolve(opts, mutatorCommand, ledger, caps, reps, env, now) {
                 stats: spec.bench.stats,
                 budgetCaps: caps,
                 nPairs,
+                ...(scoreBank === null ? {} : { bank: scoreBank.units }),
             });
             const guarded = selfMode ? selfGuardVerdict(out.failures, verdict.verdict) : verdict.verdict;
             const finalVerdict = guarded;

package/dist/core/evolve/run-plan.js

@@ -1,7 +1,7 @@
 // --dry-run plan rendering + budget-cap resolution (todo 9). Presentation of
 // the resolved startup state only — the dry-run gate in run-loop.ts calls this
 // AFTER the kernel audit and BEFORE any ledger/lock/spawn touch.
-import path from "node:path";
+import { effectiveRepoPath } from "../spec.js";
 import { peekPlanState } from "./run-rows.js";
 /** `--max-candidates` clamps DOWN to the genome's own cap, never above. */
 export function effectiveCaps(spec, clamp) {
@@ -15,12 +15,16 @@ export function effectiveCaps(spec, clamp) {
 }
 export function planLines(req) {
     const spec = req.entry.spec;
-    const peek = peekPlanState(spec.repoPath);
+    // `${VAR}` literals resolve through the same FS-boundary contract as every
+    // other consumer; the plan line + resume peek must never join the raw
+    // literal against cwd.
+    const genomeRepo = effectiveRepoPath(spec.repoPath);
+    const peek = peekPlanState(genomeRepo);
     const specMax = spec.budget.maxCandidates;
     const unitList = spec.bench.units.map((u) => `${u.id}(${u.split})`).join(" ");
     return [
         `run plan — genome '${spec.label}' (${req.entry.fingerprint})`,
-        `  repo: ${path.resolve(spec.repoPath)}`,
+        `  repo: ${genomeRepo}`,
         `  bench: ${spec.bench.type} — timeoutS=${String(spec.bench.timeoutS)} stats minEffect=${String(spec.bench.stats.minEffect)} halfWidth=${String(spec.bench.stats.halfWidth)}`,
         `  units: ${unitList}`,
         ...(req.requiresProbed === undefined

package/dist/core/evolve/score-bank.js

@@ -0,0 +1,214 @@
+// Historical per-unit variance bank for the acceptance-semantics gate
+// (engine redesign 2026-09-24; the design doc + power analysis live in the
+// target genome repo's evidence folder, not shipped here).
+//
+// WHAT IT IS: for every unit, σ pooled from the within-group replicate scatter
+// of ALL generation_complete rows in <genomeRepo>/.state/abathur/ledger*.jsonl
+// (live ledger + campaign archives + pilot). A group = one bench event on one
+// arm (one row's scores array for that unit), so its mean is that doc's mean:
+// pooling mean-removed sums of squares across doc lineages is the classical
+// ANOVA pooled within-group variance — champion-doc changes (the campaign-3
+// promote at 7ca80d7 moved the incumbent head 6ca3ff68→556e1350→062a9fdb→
+// 8fe7e34a→de607dab) shift group MEANS, never this estimate. Pooling raw
+// scores/means across lineages would poison the bank and is what the per-group
+// mean removal exists to prevent.
+//
+// SHIELDING: σ² = (df·σ̂² + ν₀·σ²_glob)/(df+ν₀) with ν₀ = BANK_PRIOR_DF = 2 —
+// [0.5, 0.5] is two reps that failed to observe noise, not proof of σ=0. Thin
+// history (df < BANK_THIN_DF) additionally floors σ at BANK_QUANTUM = 0.125/√2:
+// unit scores are fractions of checklist items on a ~1/8 grid, so two reps one
+// flipped item apart differ by exactly 0.125 and a one-step-pair has sd
+// 0.125/√2; a unit quieter than that has only been lucky, not measured.
+// Proven-quiet units (df ≥ BANK_THIN_DF, e.g. the guards with 12–14 zero-SS
+// df) keep their tight shrunk σ — earned across independent benches.
+//
+// READ-ONLY AND FAIL-CLOSED: never Ledger.open (that mkdirs .state — the same
+// discipline as peekPlanState in run-rows.ts), never writes, never exits the
+// process. A row that fails schema validation contributes nothing and only
+// adds a notice (archives may legitimately predate schema evolutions). No
+// files / no readable rows / zero pooled df ⇒ null ⇒ the caller must run the
+// legacy cross-arm gate verbatim: the bank can only inform, absence can never
+// invent a nomination or a cull.
+//
+// ACTIVATION REQUIRES A ROTATED ARCHIVE: with only the live ledger.jsonl
+// present the bank stays null. A lone live file may be one campaign young
+// (gate-time df=1 per unit — zero cross-doc information) or, worse, the fresh
+// .state of any toy/fixture genome whose very first run would silently switch
+// gates mid-test. Rotation (ledger.campaign<N>-*.jsonl) is the operator's own
+// mark that a genome has earned lifetime history, so it is also the mark that
+// entitles the acceptance gate to override the proven legacy default.
+import { readFileSync, readdirSync } from "node:fs";
+import path from "node:path";
+import { z } from "zod";
+import { LEDGER_KIND_GENERATION_COMPLETE, ledgerPath, ledgerRecordSchema } from "../ledger.js";
+import { generationRowDataSchema } from "./run-rows.js";
+// ------------------------------------------------------------- bank epoch
+// Lineage-restart quarantine (institutional addition 2026-09-25, born of the
+// s19 pin era + the s16 churn window): an operator-ruled epoch start for a
+// unit voids every bank group whose row.ts predates it — a broken or polluted
+// measurement era must not teach the gate the wrong noise level. The LEDGER
+// FILES STAY IMMUTABLE (doctrine): the verdict on which rows count lives in
+// this sidecar, beside its prose provenance (rotation NOTEs / evidence pages).
+// FAIL-CLOSED IN BOTH DIRECTIONS: absent sidecar ⇒ no quarantine; present but
+// malformed/unreadable/unparsable-dates ⇒ the WHOLE bank returns null and the
+// caller runs the legacy gate verbatim — a quarantine we cannot read honestly
+// is a quarantine we cannot silently ignore.
+const BANK_EPOCH_FILE = "bank-epoch.json";
+const bankEpochSchema = z.record(z.string().min(1), z
+    .object({ sinceIso: z.string().min(1), why: z.string().optional() })
+    .strict());
+function loadBankEpoch(dir, note) {
+    let raw;
+    try {
+        raw = readFileSync(path.join(dir, BANK_EPOCH_FILE), "utf8");
+    }
+    catch (cause) {
+        const code = cause?.code;
+        if (code === "ENOENT")
+            return undefined; // absent: nothing quarantined
+        note(`${BANK_EPOCH_FILE}: unreadable (${String(cause)}) — bank disabled, legacy gate`);
+        return null;
+    }
+    let doc;
+    try {
+        doc = JSON.parse(raw);
+    }
+    catch (cause) {
+        note(`${BANK_EPOCH_FILE}: invalid JSON (${String(cause)}) — bank disabled, legacy gate`);
+        return null;
+    }
+    const parsed = bankEpochSchema.safeParse(doc);
+    if (!parsed.success) {
+        note(`${BANK_EPOCH_FILE}: schema violation (${parsed.error.issues[0]?.message ?? "?"}) — bank disabled, legacy gate`);
+        return null;
+    }
+    const out = new Map();
+    for (const [unitId, rule] of Object.entries(parsed.data)) {
+        const sinceMs = Date.parse(rule.sinceIso);
+        if (!Number.isFinite(sinceMs)) {
+            note(`${BANK_EPOCH_FILE}: bad sinceIso for '${unitId}' — bank disabled, legacy gate`);
+            return null;
+        }
+        out.set(unitId, { sinceIso: rule.sinceIso, sinceMs, why: rule.why ?? "" });
+    }
+    return out;
+}
+/** Half of one 1/8-grid checklist step between two reps — the sd of that pair. */
+export const BANK_QUANTUM = 0.125 / Math.SQRT2;
+/** Phantom df of the bank-wide pooled prior used to shrink each unit's σ̂². */
+export const BANK_PRIOR_DF = 2;
+/** Below this pooled df a unit's history counts as thin and the quantum floor binds. */
+export const BANK_THIN_DF = 6;
+/** Notices stop accumulating past this many lines (a corrupt archive must not flood run output). */
+const NOTICE_CAP = 20;
+/** One group = one row × unit; a multi-rep scores array contributes n−1 df of within-mean scatter. */
+function accumulate(acc, unitId, scores) {
+    const n = scores.length;
+    if (n < 2)
+        return;
+    let sum = 0;
+    for (const s of scores)
+        sum += s;
+    const mean = sum / n;
+    let ss = 0;
+    for (const s of scores) {
+        const d = s - mean;
+        ss += d * d;
+    }
+    const cur = acc.get(unitId) ?? { df: 0, ss: 0 };
+    acc.set(unitId, { df: cur.df + (n - 1), ss: cur.ss + ss });
+}
+const LIVE_LEDGER = "ledger.jsonl";
+function isRotatedArchive(name) {
+    return name.startsWith("ledger.") && name.endsWith(".jsonl") && name !== LIVE_LEDGER && !name.startsWith("ledger.corrupt-");
+}
+export function loadScoreBank(genomeRepo, opts = {}) {
+    const dir = path.dirname(ledgerPath(genomeRepo));
+    let names;
+    try {
+        names = readdirSync(dir);
+    }
+    catch {
+        return null; // no .state/abathur at all — fresh genome, legacy gate
+    }
+    const excluded = new Set(opts.excludeCandidateTrees ?? []);
+    const excludedFiles = new Set(opts.excludeFiles ?? []);
+    const files = names.filter((n) => (n === LIVE_LEDGER || isRotatedArchive(n)) && !excludedFiles.has(n)).sort();
+    if (!files.some(isRotatedArchive))
+        return null; // activation law: rotated history or legacy gate
+    const notices = [];
+    const note = (line) => {
+        if (notices.length < NOTICE_CAP)
+            notices.push(line);
+        else if (notices.length === NOTICE_CAP)
+            notices.push("score bank: further notices suppressed");
+    };
+    const bankEpoch = loadBankEpoch(dir, note);
+    if (bankEpoch === null)
+        return null; // malformed quarantine ⇒ legacy gate, never a silently ignored one
+    const quarantined = new Map();
+    const acc = new Map();
+    for (const file of files) {
+        let text;
+        try {
+            text = readFileSync(path.join(dir, file), "utf8");
+        }
+        catch {
+            note(`${file}: unreadable — archive skipped`);
+            continue;
+        }
+        const lines = text.split("\n");
+        lines.forEach((raw, index) => {
+            const line = raw.trim();
+            if (line.length === 0)
+                return;
+            let record;
+            try {
+                record = JSON.parse(line);
+            }
+            catch {
+                note(`${file}:${String(index + 1)}: not JSON — row skipped`);
+                return;
+            }
+            const parsed = ledgerRecordSchema.safeParse(record);
+            if (!parsed.success || parsed.data.kind !== LEDGER_KIND_GENERATION_COMPLETE)
+                return;
+            const row = generationRowDataSchema.safeParse(parsed.data.data);
+            if (!row.success) {
+                note(`${file}:${String(index + 1)}: generation_complete row unreadable — row skipped`);
+                return;
+            }
+            if (row.data.source === "candidate" && row.data.treeSha !== undefined && excluded.has(row.data.treeSha))
+                return;
+            const rowMs = Date.parse(parsed.data.ts);
+            for (const u of row.data.units) {
+                const rule = bankEpoch?.get(u.unitId);
+                if (rule !== undefined && !(Number.isFinite(rowMs) && rowMs >= rule.sinceMs)) {
+                    quarantined.set(u.unitId, (quarantined.get(u.unitId) ?? 0) + 1);
+                    continue; // only rows provably at/after the epoch start count; unreadable ts fails closed
+                }
+                accumulate(acc, u.unitId, u.scores);
+            }
+        });
+    }
+    for (const [unitId, rule] of [...(bankEpoch ?? new Map()).entries()].sort((a, b) => (a[0] < b[0] ? -1 : 1))) {
+        note(`bank-epoch '${unitId}' since ${rule.sinceIso}: ${String(quarantined.get(unitId) ?? 0)} group(s) quarantined${rule.why === "" ? "" : ` — ${rule.why}`}`);
+    }
+    let totalDf = 0;
+    let totalSs = 0;
+    for (const { df, ss } of acc.values()) {
+        totalDf += df;
+        totalSs += ss;
+    }
+    if (totalDf === 0)
+        return null;
+    const priorVar = totalSs / totalDf;
+    const units = new Map();
+    for (const [unitId, { df, ss }] of [...acc.entries()].sort((a, b) => (a[0] < b[0] ? -1 : 1))) {
+        const within = ss / df;
+        const shrunk = (df * within + BANK_PRIOR_DF * priorVar) / (df + BANK_PRIOR_DF);
+        const sigma = Math.sqrt(shrunk);
+        units.set(unitId, { sigma: df >= BANK_THIN_DF ? sigma : Math.max(sigma, BANK_QUANTUM), df });
+    }
+    return { units, priorSigma: Math.sqrt(priorVar), totalDf, notices };
+}

package/dist/core/graft-rebench.js

@@ -13,6 +13,7 @@ import { LEDGER_KIND_GENERATION_COMPLETE } from "./ledger.js";
 import { newGeneration, openGenome, sealGeneration, snapshotCommit } from "./worktree.js";
 import { git, tryGit } from "../util/git.js";
 import { asReplicates, benchTarget, cloneMatrixRow, copyProvenance } from "./evolve/run-bench.js";
+import { loadScoreBank } from "./evolve/score-bank.js";
 import { addCounters, readResume } from "./evolve/run-rows.js";
 import { ChildTracker, reapOrphans } from "./evolve/child-track.js";
 import { clampReps, evaluate, VERDICT_EXIT } from "./stats.js";
@@ -82,6 +83,7 @@ export async function graftAndBench(req, ctx) {
         ledger.append({ kind: LEDGER_KIND_GENERATION_COMPLETE, genId: incGen, data });
         incUnits = out.units;
     }
+    const scoreBank = loadScoreBank(spec.repoPath);
     const out = await benchTarget({
         spec: { ...spec, repoPath: gen.worktreePath },
         genId: graftGenId,
@@ -103,6 +105,7 @@ export async function graftAndBench(req, ctx) {
         stats: spec.bench.stats,
         budgetCaps: caps,
         nPairs: 1,
+        ...(scoreBank === null ? {} : { bank: scoreBank.units }),
     });
     // EXACTLY ONE graft_import decision row lands BEFORE any further writes.
     ctx.recordDecision(gate.verdict, localScoreReason(gate, manifest, reps), { graftGenId, ...sealed });

package/dist/core/ledger.js

@@ -9,6 +9,7 @@ import { closeSync, mkdirSync, openSync, readFileSync, renameSync, writeFileSync
 import path from "node:path";
 import { z } from "zod";
 import { canonicalJson, compactUtc } from "./ids.js";
+import { effectiveRepoPath } from "./spec.js";
 import { acquireLock } from "./locks.js";
 export { acquireLock, lockDirFor } from "./locks.js";
 export const LEDGER_KIND_LOCK_TAKEOVER = "lock_takeover";
@@ -30,7 +31,11 @@ export class LedgerError extends Error {
     }
 }
 export function ledgerPath(genomeRepo) {
-    return path.join(genomeRepo, ".state", "abathur", "ledger.jsonl");
+    // FS-seam rule: the stored repoPath may be an unresolved `${VAR}` literal
+    // (0.2.x convention; see 4997618 / 863e6c2). Resolve HERE at the single
+    // ledger seam so no caller can ever read an empty ledger under a literal
+    // path and report a misleading downstream error again.
+    return path.join(effectiveRepoPath(genomeRepo), ".state", "abathur", "ledger.jsonl");
 }
 function buildRecord(input, now) {
     const candidate = {

package/dist/core/promote.js

@@ -9,6 +9,7 @@ import path from "node:path";
 import { ExitSignal, blocked, cannotAnswer } from "../exit.js";
 import { compileGlob } from "./glob.js";
 import { fastForwardIncumbent } from "./incumbent.js";
+import { effectiveRepoPath } from "./spec.js";
 import { buildManifest, kernelsDirOf, manifestPathFor, readManifestFile, serializeManifest, } from "./kernel.js";
 import { Ledger, ledgerPath } from "./ledger.js";
 import { gitOpts, requireSha } from "./genome-paths.js";
@@ -65,7 +66,7 @@ async function sealedPathCheck(genId, nom, matchers, sealedPaths, cwd, opts) {
 }
 export async function promoteGeneration(req) {
     const { entry, configDir } = req;
-    const repo = entry.spec.repoPath;
+    const repo = effectiveRepoPath(entry.spec.repoPath);
     const shown = display(req.genId);
     const opts = req.env === undefined ? {} : { env: req.env };
     const ledger = Ledger.open(repo);

package/dist/core/spec.js

@@ -126,7 +126,11 @@ export function errorText(cause) {
  * resolved ONLY at FS boundaries, never inside the spec.
  */
 const ENV_REPO_LITERAL = /^\$\{([A-Za-z_][A-Za-z0-9_]*)\}$/;
-/** True when the spec stores an unresolved `${VAR}` env literal (self-genome marker). */
+/**
+ * True when the spec stores an unresolved `${VAR}` env literal — a path-
+ * injection convenience ANY genome may use, NOT an engine-self discriminator
+ * (for that compare envRepoName against ABATHUR_SELF_REPO).
+ */
 export function isEnvRepoLiteral(repoPath) {
     return ENV_REPO_LITERAL.test(repoPath);
 }

package/dist/core/stats-math.js

@@ -74,6 +74,45 @@ function betai(a, b, x) {
         return (front * betacf(a, b, x)) / a;
     return 1 - (front * betacf(b, a, 1 - x)) / b;
 }
+/**
+ * Standard normal CDF Φ(x): Abramowitz-Stegun 7.1.26 erf approximation,
+ * |error| < 1.5e-7 — far tighter than the 4-decimal P values the acceptance
+ * gate reports. ±∞ map to 1/0; NaN maps to NaN (callers branch on se===0
+ * before dividing, so 0/0 NaN never reaches here by design).
+ */
+export function normalCdf(x) {
+    if (Number.isNaN(x))
+        return Number.NaN;
+    if (x === Number.POSITIVE_INFINITY)
+        return 1;
+    if (x === Number.NEGATIVE_INFINITY)
+        return 0;
+    const z = Math.abs(x) / Math.SQRT2;
+    const t = 1 / (1 + 0.3275911 * z);
+    const poly = t * (0.254829592 + t * (-0.284496736 + t * (1.421413741 + t * (-1.453152027 + t * 1.061405429))));
+    const erf = 1 - poly * Math.exp(-z * z);
+    return 0.5 * (1 + (x < 0 ? -erf : erf));
+}
+/**
+ * Inverse standard normal Φ⁻¹(p), bisection against normalCdf above — the two
+ * are mutually consistent by construction (a band built from normalQuantile(q)
+ * and tested through normalCdf lands exactly at probability q). Same shape as
+ * studentTQuantile's bisection; |error| < 1e-13.
+ */
+export function normalQuantile(p) {
+    if (!(p > 0 && p < 1))
+        throw new RangeError(`normalQuantile: p=${String(p)} must be in (0, 1)`);
+    let lo = -40;
+    let hi = 40;
+    for (let i = 0; i < 80; i += 1) {
+        const mid = (lo + hi) / 2;
+        if (normalCdf(mid) < p)
+            lo = mid;
+        else
+            hi = mid;
+    }
+    return (lo + hi) / 2;
+}
 /**
  * Two-sided Student-t critical value: the t such that P(|T| ≤ t) = 1 − alpha
  * with T ~ t(df). Planned accuracy: matches t-table values to < 1e-3 for the