@tangle-network/agent-runtime 0.102.0 → 0.102.1

package/dist/{chunk-MAONWP4R.js → chunk-KPHTCHQ4.js}

@@ -7,18 +7,33 @@ import {
   createExecutor,
   createExecutorRegistry,
   createSandboxLineage,
-  createSupervisor,
   createWorktreeCliExecutor,
   defaultSelectWinner,
   gateOnDeliverable,
-  notifyRuntimeHookEvent,
   probeSandboxCapabilities,
-  routerToolLoop,
   runLoop,
+  supervise
+} from "./chunk-6MR4IJRW.js";
+import {
+  observe,
+  refine,
+  runAgentic,
+  sample,
+  sampleThenRefine,
+  strategyAuthorMethod
+} from "./chunk-ROILMKDL.js";
+import {
+  redactProtectedReason,
+  redactProtectedValue
+} from "./chunk-UPWGXKXB.js";
+import {
+  createSupervisor,
+  notifyRuntimeHookEvent,
+  routerBrain,
+  runBrainLoop,
   settledToIteration,
-  supervise,
   withDriverExecutor
-} from "./chunk-KVJQV342.js";
+} from "./chunk-SQ3ZJH3Y.js";
 import {
   InMemoryResultBlobStore,
   InMemorySpawnJournal
@@ -44,7 +59,7 @@ import {
 } from "./chunk-YEJR7IXO.js";
 
 // src/runtime/index.ts
-import { computeFindingId, makeFinding as makeFinding2 } from "@tangle-network/agent-eval";
+import { computeFindingId, makeFinding } from "@tangle-network/agent-eval";
 
 // src/runtime/anytime.ts
 var median = (xs) => {
@@ -769,6 +784,472 @@ function inlineSandboxClient(factory) {
   };
 }
 
+// src/runtime/local-sandbox-client.ts
+import {
+  canonicalCandidateDigest
+} from "@tangle-network/agent-interface";
+
+// src/runtime/stdio-mcp-client.ts
+import { spawn } from "child_process";
+import { createInterface } from "readline";
+import {
+  validateAgentProfileSecurity
+} from "@tangle-network/agent-interface";
+
+// src/runtime/key-provider.ts
+function envKeyProvider(env = process.env) {
+  return {
+    async get(name) {
+      const value = env[name];
+      return value !== void 0 && value.trim().length > 0 ? value : void 0;
+    }
+  };
+}
+var mcpSecretEnvMetadataKey = "secretEnv";
+function secretEnvOfMcpServer(server) {
+  const raw = server.metadata?.[mcpSecretEnvMetadataKey];
+  if (raw === void 0 || raw === null) return void 0;
+  if (typeof raw !== "object" || Array.isArray(raw)) {
+    throw new ValidationError(
+      `secretEnvOfMcpServer: metadata.${mcpSecretEnvMetadataKey} must be an object mapping env var name -> key name`
+    );
+  }
+  const entries = Object.entries(raw);
+  if (entries.length === 0) return void 0;
+  for (const [envName, keyName] of entries) {
+    if (!envName.trim() || typeof keyName !== "string" || !keyName.trim()) {
+      throw new ValidationError(
+        `secretEnvOfMcpServer: metadata.${mcpSecretEnvMetadataKey}['${envName}'] must name a non-empty provider key`
+      );
+    }
+  }
+  return raw;
+}
+async function resolveSecretEnv(secretEnv, keys, label) {
+  const entries = Object.entries(secretEnv);
+  if (entries.length === 0) return {};
+  if (!keys) {
+    throw new ValidationError(
+      `${label} declares secret env (${entries.map(([e]) => e).join(", ")}) but no KeyProvider was supplied \u2014 refusing to boot an external server keyless`
+    );
+  }
+  const resolved = {};
+  for (const [envName, keyName] of entries) {
+    const value = await keys.get(keyName);
+    if (value === void 0) {
+      throw new ValidationError(
+        `${label}: the KeyProvider holds no value for '${keyName}' (wanted for env ${envName}) \u2014 provision the key or drop the grant`
+      );
+    }
+    resolved[envName] = value;
+  }
+  return resolved;
+}
+
+// src/runtime/mcp-environment.ts
+async function rpc(endpoint, body) {
+  let lastErr;
+  for (let attempt = 0; attempt < 4; attempt += 1) {
+    try {
+      const r = await fetch(endpoint.url, {
+        method: "POST",
+        headers: { "content-type": "application/json", ...endpoint.headers ?? {} },
+        body: JSON.stringify(body)
+      });
+      const text = await r.text();
+      const dataLines = text.split("\n").filter((l) => l.startsWith("data:")).map((l) => l.slice(5).trim());
+      const payload = dataLines.length ? dataLines[dataLines.length - 1] : text;
+      try {
+        return { status: r.status, json: JSON.parse(payload ?? "null") };
+      } catch {
+        return { status: r.status, json: text };
+      }
+    } catch (err) {
+      lastErr = err;
+      await new Promise((res) => setTimeout(res, 1e3 * (attempt + 1)));
+    }
+  }
+  throw new Error(
+    `mcp rpc ${endpoint.url} failed after 4 attempts: ${lastErr instanceof Error ? lastErr.message : String(lastErr)}`
+  );
+}
+function sanitizeMcpToolSchema(s) {
+  const o = s && typeof s === "object" ? s : {};
+  const banned = o.oneOf || o.anyOf || o.allOf || o.not || o.enum;
+  if (o.type === "object" && !banned && o.properties && typeof o.properties === "object") {
+    return {
+      type: "object",
+      properties: o.properties,
+      ...Array.isArray(o.required) ? { required: o.required } : {}
+    };
+  }
+  return { type: "object", properties: {} };
+}
+function createMcpEnvironment(opts) {
+  const endpoints = /* @__PURE__ */ new Map();
+  const maxChars = opts.maxResultChars ?? 1500;
+  return {
+    name: opts.name,
+    async open(task) {
+      const { handle, endpoint } = await opts.open(task);
+      endpoints.set(handle.id, endpoint);
+      return handle;
+    },
+    async tools(task, handle) {
+      const endpoint = endpoints.get(handle.id);
+      if (!endpoint) throw new Error(`${opts.name}: tools() before open() for ${handle.id}`);
+      const { json } = await rpc(endpoint, {
+        jsonrpc: "2.0",
+        id: 1,
+        method: "tools/list",
+        params: {}
+      });
+      const all = (json.result?.tools ?? []).map(
+        (t) => ({
+          type: "function",
+          function: {
+            name: t.name,
+            description: (t.description ?? "").slice(0, 1e3),
+            parameters: sanitizeMcpToolSchema(t.inputSchema)
+          }
+        })
+      );
+      return opts.selectTools ? opts.selectTools(task, all) : all;
+    },
+    async call(handle, name, args) {
+      const endpoint = endpoints.get(handle.id);
+      if (!endpoint) return "ERROR: workspace closed";
+      const { json } = await rpc(endpoint, {
+        jsonrpc: "2.0",
+        id: 2,
+        method: "tools/call",
+        params: { name, arguments: args }
+      });
+      const result = json ?? {};
+      if (result.error) return `ERROR: ${JSON.stringify(result.error).slice(0, 300)}`;
+      const text = result.result?.content?.map((c) => c.text ?? "").join("\n") ?? JSON.stringify(result.result ?? json);
+      return text.slice(0, maxChars);
+    },
+    score: (task, handle) => opts.score(task, handle),
+    async close(handle) {
+      endpoints.delete(handle.id);
+      await opts.close?.(handle);
+    }
+  };
+}
+
+// src/runtime/stdio-mcp-client.ts
+var PROTOCOL_VERSION = "2024-11-05";
+var SAFE_INHERITED_ENV_NAMES = [
+  "PATH",
+  "LANG",
+  "LC_ALL",
+  "LC_CTYPE",
+  "TZ",
+  "SYSTEMROOT",
+  "WINDIR",
+  "COMSPEC",
+  "PATHEXT"
+];
+function inheritedStdioEnv(source = process.env) {
+  const env = {};
+  for (const name of SAFE_INHERITED_ENV_NAMES) {
+    const value = source[name];
+    if (value !== void 0) env[name] = value;
+  }
+  return env;
+}
+var McpSpawnFault = class extends Error {
+};
+async function connectStdioMcp(spec) {
+  const timeoutMs = spec.timeoutMs ?? 3e4;
+  const protectedValues = Object.values(spec.protectedEnv ?? {});
+  const redactReason = (value) => redactProtectedReason(value, protectedValues);
+  const child = spawn(spec.command, spec.args ?? [], {
+    ...spec.cwd ? { cwd: spec.cwd } : {},
+    stdio: ["pipe", "pipe", "pipe"],
+    env: { ...inheritedStdioEnv(), ...spec.env, ...spec.protectedEnv }
+  });
+  const stderr = [];
+  child.stderr.on("data", (d) => stderr.push(String(d)));
+  const stderrTail = () => stderr.length > 0 ? `
+stderr:
+${redactReason(stderr.join("")).slice(-2e3)}` : "";
+  let nextId = 1;
+  let spawnFault;
+  let closed = false;
+  const pending = /* @__PURE__ */ new Map();
+  const failAllPending = (err) => {
+    for (const p of pending.values()) {
+      clearTimeout(p.timer);
+      p.reject(err);
+    }
+    pending.clear();
+  };
+  child.on("error", (err) => {
+    const code = err.code;
+    spawnFault = code === "ENOENT" ? new McpSpawnFault(
+      `'${spec.command}' not found in PATH (setup bug, not a failed candidate)`
+    ) : new McpSpawnFault(`'${spec.command}' failed to spawn: ${err.message}`);
+    failAllPending(spawnFault);
+  });
+  child.stdin.on("error", (err) => {
+    failAllPending(
+      new Error(redactReason(`writing to MCP server stdin failed: ${err.message}${stderrTail()}`))
+    );
+  });
+  child.on("close", (code, signal) => {
+    failAllPending(
+      spawnFault ?? new Error(
+        redactReason(
+          `MCP server exited (code ${code}, signal ${signal}) before serving${stderrTail()}`
+        )
+      )
+    );
+  });
+  const rl = createInterface({ input: child.stdout });
+  rl.on("line", (line) => {
+    let msg;
+    try {
+      msg = JSON.parse(line);
+    } catch {
+      return;
+    }
+    if (!msg || typeof msg !== "object" || typeof msg.id !== "number") return;
+    const p = pending.get(msg.id);
+    if (!p) return;
+    pending.delete(msg.id);
+    clearTimeout(p.timer);
+    p.resolve(msg);
+  });
+  const send = (msg) => {
+    child.stdin.write(`${JSON.stringify(msg)}
+`);
+  };
+  const request = (method, params, timeoutMessage = `MCP server did not answer '${method}' within ${timeoutMs}ms`) => new Promise((resolve, reject) => {
+    if (spawnFault) return reject(spawnFault);
+    if (closed) return reject(new Error("MCP connection closed"));
+    const id = nextId++;
+    const timer = setTimeout(() => {
+      pending.delete(id);
+      reject(new Error(redactReason(`${timeoutMessage}${stderrTail()}`)));
+    }, timeoutMs);
+    pending.set(id, { resolve, reject, timer });
+    try {
+      send({ jsonrpc: "2.0", id, method, ...params ? { params } : {} });
+    } catch (err) {
+      pending.delete(id);
+      clearTimeout(timer);
+      reject(
+        new Error(
+          redactReason(
+            `writing to MCP server stdin failed: ${err instanceof Error ? err.message : String(err)}${stderrTail()}`
+          )
+        )
+      );
+    }
+  });
+  const close = async () => {
+    if (closed) return;
+    closed = true;
+    rl.close();
+    failAllPending(new Error("MCP connection closed"));
+    child.kill("SIGKILL");
+  };
+  const handshakeTimeout = `MCP server did not complete the handshake within ${timeoutMs}ms`;
+  try {
+    const init = await request(
+      "initialize",
+      {
+        protocolVersion: PROTOCOL_VERSION,
+        capabilities: {},
+        clientInfo: { name: "agent-runtime-local-mcp", version: "0" }
+      },
+      handshakeTimeout
+    );
+    if (init.error)
+      throw new Error(
+        redactReason(`initialize errored: ${JSON.stringify(init.error)}${stderrTail()}`)
+      );
+    send({ jsonrpc: "2.0", method: "notifications/initialized" });
+    const list = await request("tools/list", void 0, handshakeTimeout);
+    if (list.error)
+      throw new Error(
+        redactReason(`tools/list errored: ${JSON.stringify(list.error)}${stderrTail()}`)
+      );
+    const rawTools = list.result?.tools;
+    if (!Array.isArray(rawTools))
+      throw new Error(`tools/list result has no tools array${stderrTail()}`);
+    const tools = redactProtectedValue(rawTools, protectedValues).value;
+    const callTool = async (name, args) => {
+      const res = await request("tools/call", { name, arguments: args });
+      if (res.error) return `ERROR: ${redactReason(JSON.stringify(res.error)).slice(0, 300)}`;
+      const result = res.result;
+      const chunks = result?.content?.map((c) => c.text ?? "");
+      const joined = chunks?.join("\n") ?? JSON.stringify(result ?? null);
+      const collapsed = chunks?.join("");
+      let text = joined;
+      if (collapsed !== void 0) {
+        const collapsedRedacted = redactReason(collapsed);
+        if (collapsedRedacted !== collapsed) text = collapsedRedacted;
+      }
+      return redactReason(result?.isError ? `ERROR: ${text}` : text);
+    };
+    return { tools, callTool, close };
+  } catch (err) {
+    await close();
+    throw err;
+  }
+}
+async function materializeLocalMcp(profile, opts = {}) {
+  const security = validateAgentProfileSecurity(profile, opts.profileSecurityPolicy);
+  if (!security.ok) {
+    const reasons = security.issues.filter((issue) => issue.level === "error").map((issue) => issue.message).join("; ");
+    throw new ValidationError(`materializeLocalMcp: profile host execution refused: ${reasons}`);
+  }
+  const maxResultChars = opts.maxResultChars ?? 2e3;
+  const connections = [];
+  const routes = /* @__PURE__ */ new Map();
+  const tools = [];
+  const close = async () => {
+    await Promise.all(connections.map((c) => c.close()));
+  };
+  try {
+    for (const [key, server] of Object.entries(profile.mcp ?? {})) {
+      if (server.enabled === false) continue;
+      const transport = server.transport ?? "stdio";
+      if (transport !== "stdio") {
+        throw new ValidationError(
+          `materializeLocalMcp: profile.mcp['${key}'] has transport '${transport}' \u2014 the same-host client only spawns stdio servers; a remote (http/sse) server needs an http MCP client (not yet built here) or the sandbox backend. Failing loud: scoring this profile without its declared server would fake the with/without ablation`
+        );
+      }
+      if (!server.command || server.command.trim().length === 0) {
+        throw new ValidationError(
+          `materializeLocalMcp: profile.mcp['${key}'] declares a stdio server with no command`
+        );
+      }
+      const secretRefs = secretEnvOfMcpServer(server);
+      const provisioned = secretRefs ? await resolveSecretEnv(
+        secretRefs,
+        opts.keys,
+        `materializeLocalMcp: profile.mcp['${key}']`
+      ) : void 0;
+      const conn = await connectStdioMcp({
+        command: server.command,
+        ...server.args ? { args: server.args } : {},
+        ...server.cwd ? { cwd: server.cwd } : {},
+        ...server.env ? { env: server.env } : {},
+        ...provisioned ? { protectedEnv: provisioned } : {},
+        ...opts.timeoutMs !== void 0 ? { timeoutMs: opts.timeoutMs } : {}
+      });
+      connections.push(conn);
+      const prefix = key.replace(/[^a-zA-Z0-9_-]/g, "_");
+      for (const t of conn.tools) {
+        const name = `${prefix}__${t.name.replace(/[^a-zA-Z0-9_-]/g, "_")}`;
+        if (routes.has(name)) {
+          throw new ValidationError(
+            `materializeLocalMcp: namespaced tool '${name}' collides across servers \u2014 rename the profile.mcp keys`
+          );
+        }
+        routes.set(name, { conn, tool: t.name });
+        tools.push({
+          type: "function",
+          function: {
+            name,
+            description: (t.description ?? "").slice(0, 1e3),
+            parameters: sanitizeMcpToolSchema(t.inputSchema)
+          }
+        });
+      }
+    }
+  } catch (err) {
+    await close();
+    throw err;
+  }
+  return {
+    tools,
+    owns: (name) => routes.has(name),
+    call: async (name, args) => {
+      const route = routes.get(name);
+      if (!route) throw new Error(`materializeLocalMcp: unknown tool '${name}'`);
+      const out = await route.conn.callTool(route.tool, args);
+      return out.length > maxResultChars ? out.slice(0, maxResultChars) : out;
+    },
+    close
+  };
+}
+
+// src/runtime/local-sandbox-client.ts
+function localSandboxClient(opts) {
+  if (opts.profileSecurityPolicy?.allowLocalMcp && opts.profile === void 0) {
+    throw new ValidationError(
+      "localSandboxClient: allowLocalMcp requires a fixed author-controlled profile; dynamic profiles need a real sandbox"
+    );
+  }
+  const trustedProfileDigest = opts.profileSecurityPolicy?.allowLocalMcp && opts.profile !== void 0 ? canonicalCandidateDigest(opts.profile) : void 0;
+  const maxTurns = opts.maxTurns ?? 8;
+  let seq = 0;
+  return {
+    async create(options) {
+      const profile = options?.backend?.profile ?? opts.profile ?? {};
+      const policyApplies = opts.profileSecurityPolicy !== void 0 && (!opts.profileSecurityPolicy.allowLocalMcp || trustedProfileDigest !== void 0 && canonicalCandidateDigest(profile) === trustedProfileDigest);
+      const mcp = await materializeLocalMcp(profile, {
+        ...opts.keys ? { keys: opts.keys } : {},
+        ...policyApplies ? { profileSecurityPolicy: opts.profileSecurityPolicy } : {}
+      });
+      const brain = routerBrain(
+        {
+          routerBaseUrl: opts.router.baseUrl,
+          routerKey: opts.router.key,
+          model: opts.router.model
+        },
+        opts.temperature !== void 0 ? { temperature: opts.temperature } : {}
+      );
+      const system = [profile.prompt?.systemPrompt, ...profile.prompt?.instructions ?? []].filter((s) => typeof s === "string" && s.trim().length > 0).join("\n\n");
+      const id = `local-${seq++}`;
+      return {
+        id,
+        async *streamPrompt(message, popts) {
+          let costUsd = 0;
+          const chat = async (messages, tools) => {
+            const r2 = await brain(messages, tools);
+            if (r2.costUsd) costUsd += r2.costUsd;
+            return r2;
+          };
+          const r = await runBrainLoop({
+            chat,
+            tools: mcp.tools,
+            execute: (name, args) => mcp.call(name, args),
+            initialMessages: [
+              ...system ? [{ role: "system", content: system }] : [],
+              { role: "user", content: message }
+            ],
+            maxTurns,
+            hooks: { stopBefore: () => popts?.signal?.aborted === true }
+          });
+          if (r.usage.input || r.usage.output || costUsd) {
+            yield {
+              type: "llm_call",
+              data: { tokensIn: r.usage.input, tokensOut: r.usage.output, costUsd }
+            };
+          }
+          yield {
+            type: "result",
+            data: {
+              finalText: r.final,
+              tokenUsage: { inputTokens: r.usage.input, outputTokens: r.usage.output },
+              costUsd
+            }
+          };
+        },
+        async delete() {
+          await mcp.close();
+        }
+      };
+    }
+  };
+}
+
 // src/runtime/resolve-sandbox-client.ts
 function resolveSandboxClient(opts) {
   switch (opts.backend) {
@@ -811,6 +1292,15 @@ function resolveSandboxClient(opts) {
         })
       );
     }
+    case "local": {
+      const local = opts.local;
+      if (!local?.router?.baseUrl || !local.router.key || !local.router.model) {
+        throw new Error(
+          "resolveSandboxClient: backend 'local' requires local.router.baseUrl, local.router.key and local.router.model"
+        );
+      }
+      return localSandboxClient(local);
+    }
   }
 }
 
@@ -1159,163 +1649,6 @@ function defineLeaderboard(spec) {
   return { run, toBenchmarkAdapter };
 }
 
-// src/runtime/observe.ts
-import { makeFinding } from "@tangle-network/agent-eval";
-var observerId = "observe/trace";
-var defaultAnalystInstruction = "You are a third-person OBSERVER watching an AI agent work. You see its TRACE (what it did), not its grader. From the trace, name SPECIFIC, behavior-grounded findings: wasted/duplicated tool calls, thrash/retries, token/cost waste, missing verification, failure patterns. For each, a concrete recommended_action, and whether the AGENT (fix its skills/prompt/tools) or the OPERATOR (fix framing/decomposition/config) should act. Only claim what the trace shows. No findings if the run was clean.";
-function summarizeTrace(trace, maxLines) {
-  const lines = [];
-  for (const ev of trace) {
-    const e = ev;
-    const t = (e.type ?? "").toLowerCase();
-    const d = e.data ?? {};
-    const part = d.part ?? {};
-    if (part.type === "tool")
-      lines.push(`tool:${part.tool}${part.state?.status ? `(${part.state.status})` : ""}`);
-    else if (t.includes("error"))
-      lines.push(`ERROR: ${String(d.message ?? d.detail ?? "").slice(0, 200)}`);
-    else if (t === "status" && typeof d.status === "string") lines.push(`status:${d.status}`);
-    else if (t.includes("tool")) lines.push(`tool-event:${t}`);
-  }
-  const out = [];
-  for (const ln of lines) {
-    const prev = out[out.length - 1];
-    const m = prev?.match(/^(.*?)(?: x(\d+))?$/);
-    if (m && m[1] === ln) out[out.length - 1] = `${ln} x${(Number(m[2]) || 1) + 1}`;
-    else out.push(ln);
-  }
-  return out.slice(0, maxLines).join("\n") || "(no tool/error events in trace)";
-}
-var findingsSchema = {
-  name: "observer_findings",
-  schema: {
-    type: "object",
-    additionalProperties: false,
-    properties: {
-      findings: {
-        type: "array",
-        items: {
-          type: "object",
-          additionalProperties: false,
-          properties: {
-            area: {
-              type: "string",
-              description: "tool-use | cost | verification | process | failure | latency"
-            },
-            severity: { type: "string", enum: ["critical", "high", "medium", "low", "info"] },
-            claim: {
-              type: "string",
-              description: "what you OBSERVED in the trace (a fact, with the evidence)"
-            },
-            recommended_action: {
-              type: "string",
-              description: "the concrete change for the agent or operator"
-            },
-            audience: {
-              type: "string",
-              enum: ["agent", "operator"],
-              description: "who should act on this"
-            },
-            confidence: { type: "number" }
-          },
-          required: ["area", "severity", "claim", "recommended_action", "audience", "confidence"]
-        }
-      }
-    },
-    required: ["findings"]
-  }
-};
-async function observe(input, opts) {
-  const traceSummary = summarizeTrace(input.trace, opts.maxTraceLines ?? 80);
-  const res = await opts.chat.chat(
-    {
-      ...opts.model ? { model: opts.model } : {},
-      jsonSchema: findingsSchema,
-      messages: [
-        {
-          role: "system",
-          content: opts.analystInstruction ?? defaultAnalystInstruction
-        },
-        {
-          role: "user",
-          content: `TASK: ${input.task}
-
-OUTCOME: ${input.outcome ?? "unknown"}
-
-FINAL OUTPUT (truncated):
-${input.output.slice(0, 1200)}
-
-TRACE (in order; "xN" = repeated):
-${traceSummary}`
-        }
-      ]
-    },
-    { ...opts.signal ? { signal: opts.signal } : {} }
-  );
-  const parsed = parseFindings(res.content);
-  const producedAt = input.runId ? `${input.runId}` : observerId;
-  const findings = parsed.map(
-    (f) => makeFinding({
-      analyst_id: observerId,
-      area: `${f.area}`,
-      severity: f.severity,
-      claim: f.claim,
-      recommended_action: f.recommended_action,
-      confidence: typeof f.confidence === "number" ? f.confidence : 0.5,
-      evidence_refs: [],
-      // The observer reads BEHAVIOR, never the judge verdict — firewall provenance.
-      derived_from_judge: false,
-      metadata: { audience: f.audience },
-      ...input.runId ? { subject: input.runId } : {}
-    })
-  );
-  const learned = [];
-  if (opts.corpus) {
-    for (const f of findings) {
-      const record = {
-        schemaVersion: "1.0.0",
-        id: f.finding_id,
-        runId: input.runId ?? observerId,
-        producedAt: f.produced_at ?? producedAt,
-        area: f.area,
-        claim: f.recommended_action ?? f.claim,
-        ...f.claim ? { rationale: f.claim } : {},
-        tags: [...opts.tags ?? [], `audience:${f.metadata?.audience ?? "agent"}`],
-        confidence: f.confidence,
-        evidence: [{ kind: "finding", uri: f.finding_id }]
-      };
-      const r = await opts.corpus.append(record);
-      if (r.succeeded) learned.push(record);
-    }
-  }
-  return { findings, learned, report: renderReport(findings) };
-}
-function parseFindings(content) {
-  let obj2;
-  try {
-    obj2 = JSON.parse(content);
-  } catch {
-    const m = content.match(/\{[\s\S]*\}/);
-    obj2 = m ? JSON.parse(m[0]) : { findings: [] };
-  }
-  const arr = obj2.findings;
-  return Array.isArray(arr) ? arr : [];
-}
-function renderReport(findings) {
-  if (findings.length === 0) return "\u2713 clean run \u2014 the observer found nothing to change.";
-  const audience = (f) => f.metadata?.audience ?? "agent";
-  const forAgent = findings.filter((f) => audience(f) === "agent");
-  const forOperator = findings.filter((f) => audience(f) === "operator");
-  const block = (title, fs) => fs.length === 0 ? "" : `**${title}**
-${fs.map((f) => `- [${f.severity}] ${f.claim}
-  \u2192 ${f.recommended_action ?? ""}`).join("\n")}
-`;
-  return [
-    block("For the agent (fix skills / prompt / tools)", forAgent),
-    block("For you (the operator)", forOperator)
-  ].filter(Boolean).join("\n");
-}
-
 // src/runtime/harvest-corpus.ts
 async function harvestCorpus(opts) {
   const concurrency = Math.max(1, opts.concurrency ?? 4);
@@ -1454,98 +1787,6 @@ function inProcessSandboxClient(options) {
   };
 }
 
-// src/runtime/mcp-environment.ts
-async function rpc(endpoint, body) {
-  let lastErr;
-  for (let attempt = 0; attempt < 4; attempt += 1) {
-    try {
-      const r = await fetch(endpoint.url, {
-        method: "POST",
-        headers: { "content-type": "application/json", ...endpoint.headers ?? {} },
-        body: JSON.stringify(body)
-      });
-      const text = await r.text();
-      const dataLines = text.split("\n").filter((l) => l.startsWith("data:")).map((l) => l.slice(5).trim());
-      const payload = dataLines.length ? dataLines[dataLines.length - 1] : text;
-      try {
-        return { status: r.status, json: JSON.parse(payload ?? "null") };
-      } catch {
-        return { status: r.status, json: text };
-      }
-    } catch (err) {
-      lastErr = err;
-      await new Promise((res) => setTimeout(res, 1e3 * (attempt + 1)));
-    }
-  }
-  throw new Error(
-    `mcp rpc ${endpoint.url} failed after 4 attempts: ${lastErr instanceof Error ? lastErr.message : String(lastErr)}`
-  );
-}
-function sanitizeSchema(s) {
-  const o = s && typeof s === "object" ? s : {};
-  const banned = o.oneOf || o.anyOf || o.allOf || o.not || o.enum;
-  if (o.type === "object" && !banned && o.properties && typeof o.properties === "object") {
-    return {
-      type: "object",
-      properties: o.properties,
-      ...Array.isArray(o.required) ? { required: o.required } : {}
-    };
-  }
-  return { type: "object", properties: {} };
-}
-function createMcpEnvironment(opts) {
-  const endpoints = /* @__PURE__ */ new Map();
-  const maxChars = opts.maxResultChars ?? 1500;
-  return {
-    name: opts.name,
-    async open(task) {
-      const { handle, endpoint } = await opts.open(task);
-      endpoints.set(handle.id, endpoint);
-      return handle;
-    },
-    async tools(task, handle) {
-      const endpoint = endpoints.get(handle.id);
-      if (!endpoint) throw new Error(`${opts.name}: tools() before open() for ${handle.id}`);
-      const { json } = await rpc(endpoint, {
-        jsonrpc: "2.0",
-        id: 1,
-        method: "tools/list",
-        params: {}
-      });
-      const all = (json.result?.tools ?? []).map(
-        (t) => ({
-          type: "function",
-          function: {
-            name: t.name,
-            description: (t.description ?? "").slice(0, 1e3),
-            parameters: sanitizeSchema(t.inputSchema)
-          }
-        })
-      );
-      return opts.selectTools ? opts.selectTools(task, all) : all;
-    },
-    async call(handle, name, args) {
-      const endpoint = endpoints.get(handle.id);
-      if (!endpoint) return "ERROR: workspace closed";
-      const { json } = await rpc(endpoint, {
-        jsonrpc: "2.0",
-        id: 2,
-        method: "tools/call",
-        params: { name, arguments: args }
-      });
-      const result = json ?? {};
-      if (result.error) return `ERROR: ${JSON.stringify(result.error).slice(0, 300)}`;
-      const text = result.result?.content?.map((c) => c.text ?? "").join("\n") ?? JSON.stringify(result.result ?? json);
-      return text.slice(0, maxChars);
-    },
-    score: (task, handle) => opts.score(task, handle),
-    async close(handle) {
-      endpoints.delete(handle.id);
-      await opts.close?.(handle);
-    }
-  };
-}
-
 // src/runtime/personify/analyst.ts
 var judgeEvidenceUri = /^(verdict|judge|score)\b/i;
 var assertTraceDerivedFindings = (findings) => {
@@ -2302,13 +2543,13 @@ function shapeName(shape, _resolved) {
 }
 function resolveShapeBudget(root, over) {
   const fanout2 = over?.fanout ?? defaultFanout;
-  const perChild2 = over?.perChild ?? {
+  const perChild = over?.perChild ?? {
     maxIterations: Math.max(1, Math.floor(root.maxIterations / fanout2)),
     maxTokens: Math.max(1, Math.floor(root.maxTokens / fanout2)),
     ...root.maxUsd !== void 0 ? { maxUsd: root.maxUsd / fanout2 } : {},
     ...root.deadlineMs !== void 0 ? { deadlineMs: root.deadlineMs } : {}
   };
-  return { perChild: perChild2, fanout: fanout2 };
+  return { perChild, fanout: fanout2 };
 }
 var defaultFanout = 3;
 function personaRegistry(persona) {
@@ -2594,777 +2835,115 @@ function promotionGate(opts) {
     candMs.push(cand.ms);
     cellIds.push(row.taskId);
   }
-  if (before.length === 0) {
-    throw new Error(
-      `promotionGate: no holdout task carried cells for both "${opts.incumbent}" and "${opts.candidate}" \u2014 the report must come from a run that included both strategies`
-    );
-  }
-  const sig = heldoutSignificance(
-    { before, after, cellIds },
-    {
-      deltaThreshold: opts.deltaThreshold ?? 0,
-      minProductiveRuns: opts.minPairedTasks ?? 6,
-      statistic: opts.statistic ?? "mean",
-      ...opts.seed !== void 0 ? { seed: opts.seed } : {},
-      ...opts.resamples !== void 0 ? { resamples: opts.resamples } : {}
-    }
-  );
-  const lift = {
-    mean: sig.bootstrap.mean,
-    median: sig.bootstrap.median,
-    low: sig.bootstrap.low,
-    high: sig.bootstrap.high
-  };
-  const latSig = heldoutSignificance(
-    { before: incMs, after: candMs, cellIds },
-    {
-      deltaThreshold: 0,
-      minProductiveRuns: 1,
-      statistic: opts.statistic ?? "mean",
-      ...opts.seed !== void 0 ? { seed: opts.seed } : {},
-      ...opts.resamples !== void 0 ? { resamples: opts.resamples } : {}
-    }
-  );
-  const latency = {
-    mean: latSig.bootstrap.mean,
-    median: latSig.bootstrap.median,
-    low: latSig.bootstrap.low,
-    high: latSig.bootstrap.high
-  };
-  if (mode === "superiority") {
-    if (sig.fewRuns) return { promoted: false, reason: "few-tasks", mode, n: sig.n, lift, latency };
-    return sig.significant ? { promoted: true, reason: "significant", mode, n: sig.n, lift, latency } : { promoted: false, reason: "no-margin", mode, n: sig.n, lift, latency };
-  }
-  const tolerance = opts.scoreTolerance ?? 0.05;
-  const scoreSig = heldoutSignificance(
-    { before, after, cellIds },
-    {
-      deltaThreshold: -tolerance,
-      minProductiveRuns: opts.minPairedTasks ?? 6,
-      statistic: opts.statistic ?? "mean",
-      ...opts.seed !== void 0 ? { seed: opts.seed } : {},
-      ...opts.resamples !== void 0 ? { resamples: opts.resamples } : {}
-    }
-  );
-  const costSig = heldoutSignificance(
-    { before: candUsd, after: incUsd, cellIds },
-    {
-      deltaThreshold: 0,
-      minProductiveRuns: opts.minPairedTasks ?? 6,
-      statistic: opts.statistic ?? "mean",
-      ...opts.seed !== void 0 ? { seed: opts.seed } : {},
-      ...opts.resamples !== void 0 ? { resamples: opts.resamples } : {}
-    }
-  );
-  const costSavings = {
-    mean: costSig.bootstrap.mean,
-    median: costSig.bootstrap.median,
-    low: costSig.bootstrap.low,
-    high: costSig.bootstrap.high
-  };
-  if (scoreSig.fewRuns)
-    return { promoted: false, reason: "few-tasks", mode, n: scoreSig.n, lift, costSavings, latency };
-  if (!scoreSig.significant)
-    return {
-      promoted: false,
-      reason: "non-inferiority-unproven",
-      mode,
-      n: scoreSig.n,
-      lift,
-      costSavings,
-      latency
-    };
-  if (!costSig.significant)
-    return {
-      promoted: false,
-      reason: "not-cheaper",
-      mode,
-      n: scoreSig.n,
-      lift,
-      costSavings,
-      latency
-    };
-  return {
-    promoted: true,
-    reason: "non-inferior-and-cheaper",
-    mode,
-    n: scoreSig.n,
-    lift,
-    costSavings,
-    latency
-  };
-}
-
-// src/runtime/report-usage.ts
-function reportLoopUsage(cost, result, source = "loop") {
-  cost.observe(result.costUsd, source);
-  cost.observeTokens(result.tokenUsage);
-}
-
-// src/runtime/run-benchmark.ts
-import { pairedBootstrap as pairedBootstrap2, paretoFrontier } from "@tangle-network/agent-eval";
-
-// src/runtime/strategy.ts
-import { createChatClient, estimateCost, isModelPriced } from "@tangle-network/agent-eval";
-var taskNudge = "Use the available tools to bring the artifact to the required final state. Address EVERY distinct change the request implies. After each tool result, check what remains and continue. Re-read the values you set to confirm they took. Reply DONE only once every required change is made and verified.";
-async function runShot(surface, _task, handle, tools, messages, opts, modelOverride) {
-  let toolErrors = 0;
-  const execute = async (name, args) => {
-    try {
-      const out = await surface.call(handle, name, args);
-      if (out.startsWith("ERROR:")) toolErrors += 1;
-      return out;
-    } catch (e) {
-      toolErrors += 1;
-      return `ERROR: ${e instanceof Error ? e.message : String(e)}`;
-    }
-  };
-  const r = await routerToolLoop(
-    {
-      routerBaseUrl: opts.routerBaseUrl,
-      routerKey: opts.routerKey,
-      model: modelOverride ?? opts.model,
-      ...opts.complete ? { complete: opts.complete } : {}
-    },
-    "",
-    "",
-    tools,
-    execute,
-    {
-      maxTurns: opts.innerTurns ?? 4,
-      temperature: opts.temperature ?? 0.7,
-      initialMessages: messages,
-      ...opts.maxTokens ? { maxTokens: opts.maxTokens } : {}
-    }
-  );
-  return {
-    messages: r.messages,
-    completions: r.turns,
-    toolCalls: r.toolCalls,
-    toolErrors,
-    tokens: r.usage
-  };
-}
-function compactTrajectory(messages) {
-  return messages.filter((m) => m.role === "assistant" || m.role === "tool").map((m) => {
-    if (m.role === "tool") return `RESULT ${String(m.content).slice(0, 280)}`;
-    const calls = m.tool_calls?.map((c) => `${c.function.name}(${c.function.arguments})`).join(", ");
-    return calls ? `CALL ${calls}` : `SAY ${String(m.content).slice(0, 200)}`;
-  }).join("\n").slice(0, 7e3);
-}
-function analystChat(opts, defaultModel) {
-  if (!opts.complete) {
-    return createChatClient({
-      transport: "router",
-      apiKey: opts.routerKey,
-      baseUrl: opts.routerBaseUrl,
-      defaultModel
-    });
-  }
-  const complete = opts.complete;
-  return createChatClient({
-    transport: "mock",
-    defaultModel,
-    handler: async (req) => {
-      const raw = await complete({
-        model: req.model ?? defaultModel,
-        messages: req.messages,
-        ...req.temperature !== void 0 ? { temperature: req.temperature } : {},
-        ...req.maxTokens !== void 0 ? { max_tokens: req.maxTokens } : {}
-      });
-      const content = raw.choices?.[0]?.message?.content ?? "";
-      const promptTokens = raw.usage?.prompt_tokens ?? 0;
-      const completionTokens = raw.usage?.completion_tokens ?? 0;
-      return {
-        content,
-        usage: {
-          promptTokens,
-          completionTokens,
-          totalTokens: promptTokens + completionTokens
-        },
-        costUsd: null,
-        model: req.model ?? defaultModel,
-        durationMs: 0,
-        finishReason: raw.choices?.[0]?.finish_reason ?? null,
-        contentEmpty: content.trim().length === 0,
-        raw
-      };
-    }
-  });
-}
-async function consultAnalyst(task, messages, instruction, opts) {
-  const trajectory = compactTrajectory(messages);
-  const analystModel = opts.analystModel ?? opts.model;
-  const chat = analystChat(opts, analystModel);
-  const consultMessages = trajectory ? [
-    { role: "system", content: instruction },
-    {
-      role: "user",
-      content: `TASK: ${task.userPrompt.slice(0, 1500)}
-
-TRAJECTORY:
-${trajectory}`
-    }
-  ] : [
-    {
-      role: "user",
-      content: `${instruction}
-
-TASK:
-${task.userPrompt.slice(0, 1500)}`
-    }
-  ];
-  const res = await chat.chat({
-    model: analystModel,
-    temperature: 0.2,
-    maxTokens: 1024,
-    messages: consultMessages
-  });
-  const usage = res.usage;
-  return {
-    steer: res.content.trim(),
-    tokens: {
-      input: usage?.promptTokens ?? usage?.prompt_tokens ?? 0,
-      output: usage?.completionTokens ?? usage?.completion_tokens ?? 0
-    }
-  };
-}
-async function analyze(task, messages, opts) {
-  const trajectory = compactTrajectory(messages);
-  const analystModel = opts.analystModel ?? opts.model;
-  const inner = analystChat(opts, analystModel);
-  const tokens = { input: 0, output: 0 };
-  const chat = {
-    ...inner,
-    chat: async (req, callOpts) => {
-      const res = await inner.chat(req, callOpts);
-      const u = res.usage;
-      if (u) {
-        tokens.input += u.promptTokens ?? u.prompt_tokens ?? 0;
-        tokens.output += u.completionTokens ?? u.completion_tokens ?? 0;
-      }
-      return res;
-    }
-  };
-  const obs = await observe(
-    {
-      task: task.userPrompt,
-      output: trajectory,
-      trace: messages,
-      outcome: "failed",
-      runId: task.id
-    },
-    {
-      chat,
-      model: analystModel,
-      ...opts.analystInstruction ? { analystInstruction: opts.analystInstruction } : {},
-      ...opts.corpus ? { corpus: opts.corpus, tags: opts.corpusTags ?? [] } : {}
-    }
-  );
-  const steer = obs.findings.map((f) => f.recommended_action).filter((a) => typeof a === "string" && a.trim().length > 0).join("\n").trim();
-  return { steer: steer || "COMPLETE", tokens };
-}
-async function renderCorpusReadback(opts) {
-  if (!opts.corpus || !opts.corpusReadback) return "";
-  const maxFacts = opts.corpusReadback.maxFacts ?? 3;
-  if (!Number.isInteger(maxFacts) || maxFacts < 0) {
-    throw new Error(`corpusReadback.maxFacts must be a non-negative integer, got ${maxFacts}`);
-  }
-  if (maxFacts === 0) return "";
-  const tags = [
-    ...opts.corpusTags ?? [],
-    ...opts.corpusReadback.tags ?? [],
-    ...opts.corpusReadback.includeOperatorFacts ? [] : ["audience:agent"]
-  ];
-  const facts = await opts.corpus.query({
-    ...tags.length > 0 ? { tags } : {},
-    minConfidence: opts.corpusReadback.minConfidence ?? 0.7,
-    limit: maxFacts
-  });
-  if (facts.length === 0) return "";
-  const rendered = facts.map(
-    (fact) => fact.rationale ? `- ${fact.claim} (${fact.rationale})` : `- ${fact.claim}`
-  );
-  return `Relevant learned facts from prior attempts:
-${rendered.join("\n")}`;
-}
-function shotExecutor(surface, opts) {
-  let artifact;
-  return {
-    runtime: "agentic-shot",
-    async execute(task) {
-      const t = task;
-      const own = !t.handle;
-      const handle = t.handle ?? await surface.open(t.task);
-      try {
-        const allTools = await surface.tools(t.task, handle);
-        let tools = allTools;
-        if (t.tools) {
-          const known = new Set(allTools.map((tool) => tool.function.name));
-          const unknown = t.tools.filter((name) => !known.has(name));
-          if (unknown.length > 0) {
-            throw new Error(
-              `shot tools: unknown tool name(s) ${unknown.join(", ")} \u2014 domain offers: ${[...known].join(", ")}`
-            );
-          }
-          const want = new Set(t.tools);
-          tools = allTools.filter((tool) => want.has(tool.function.name));
-        }
-        const messages = t.messages?.length ? t.messages : [
-          { role: "system", content: t.persona?.systemPrompt ?? t.task.systemPrompt },
-          { role: "user", content: `${t.task.userPrompt}
-
-${taskNudge}` }
-        ];
-        if (t.messages?.length && t.persona?.systemPrompt) {
-          messages.push({
-            role: "user",
-            content: `[hand-off] You are now acting as: ${t.persona.systemPrompt}`
-          });
-        }
-        if (t.steer) messages.push({ role: "user", content: t.steer });
-        const shot = await runShot(surface, t.task, handle, tools, messages, opts, t.persona?.model);
-        const s = await surface.score(t.task, handle);
-        const score = s.total > 0 ? s.passes / s.total : 0;
-        const out = {
-          messages: shot.messages,
-          score,
-          passes: s.passes,
-          total: s.total,
-          completions: shot.completions,
-          toolErrors: shot.toolErrors
-        };
-        artifact = {
-          outRef: `shot:${handle.id}:${shot.completions}:${s.passes}/${s.total}`,
-          out,
-          verdict: { valid: s.total > 0 && s.passes === s.total, score },
-          // Real usage to the conserved pool: tokens from the router responses; usd only
-          // when the model is in the price table (never a fabricated number).
-          spent: {
-            iterations: shot.completions,
-            tokens: shot.tokens,
-            usd: isModelPriced(opts.model) ? estimateCost(shot.tokens.input, shot.tokens.output, opts.model) : 0,
-            ms: 0
-          }
-        };
-        return artifact;
-      } finally {
-        if (own) await surface.close(handle);
-      }
-    },
-    teardown: () => Promise.resolve({ destroyed: true }),
-    resultArtifact() {
-      if (!artifact) throw new Error("shotExecutor: resultArtifact before execute");
-      return artifact;
-    }
-  };
-}
-function analystExecutor(opts) {
-  let artifact;
-  return {
-    runtime: "agentic-analyst",
-    async execute(task) {
-      const t = task;
-      const { steer, tokens } = t.rawInstruction ? await consultAnalyst(t.task, t.messages, t.rawInstruction, opts) : await analyze(t.task, t.messages, opts);
-      const analystModel = opts.analystModel ?? opts.model;
-      artifact = {
-        outRef: `analyst:${steer.length}`,
-        out: steer,
-        spent: {
-          iterations: 1,
-          tokens,
-          usd: isModelPriced(analystModel) ? estimateCost(tokens.input, tokens.output, analystModel) : 0,
-          ms: 0
-        }
-      };
-      return artifact;
-    },
-    teardown: () => Promise.resolve({ destroyed: true }),
-    resultArtifact() {
-      if (!artifact) throw new Error("analystExecutor: resultArtifact before execute");
-      return artifact;
-    }
-  };
-}
-function agenticRegistry(surface, opts) {
-  const leaves = {
-    register() {
-      throw new Error("agenticRegistry: register unsupported");
-    },
-    resolve(spec) {
-      const role = spec.profile.metadata?.role;
-      const factory = (_s, _ctx) => role === "analyst" ? analystExecutor(opts) : shotExecutor(surface, opts);
-      return { succeeded: true, value: factory };
+  if (before.length === 0) {
+    throw new Error(
+      `promotionGate: no holdout task carried cells for both "${opts.incumbent}" and "${opts.candidate}" \u2014 the report must come from a run that included both strategies`
+    );
+  }
+  const sig = heldoutSignificance(
+    { before, after, cellIds },
+    {
+      deltaThreshold: opts.deltaThreshold ?? 0,
+      minProductiveRuns: opts.minPairedTasks ?? 6,
+      statistic: opts.statistic ?? "mean",
+      ...opts.seed !== void 0 ? { seed: opts.seed } : {},
+      ...opts.resamples !== void 0 ? { resamples: opts.resamples } : {}
     }
+  );
+  const lift = {
+    mean: sig.bootstrap.mean,
+    median: sig.bootstrap.median,
+    low: sig.bootstrap.low,
+    high: sig.bootstrap.high
   };
-  return withDriverExecutor(leaves);
-}
-function leaf(name, role) {
-  const agent = {
-    name,
-    executorSpec: { profile: { name, metadata: { role } }, harness: null },
-    act() {
-      throw new Error(`agentic: spawned child "${name}" was run directly (the executor drives it)`);
+  const latSig = heldoutSignificance(
+    { before: incMs, after: candMs, cellIds },
+    {
+      deltaThreshold: 0,
+      minProductiveRuns: 1,
+      statistic: opts.statistic ?? "mean",
+      ...opts.seed !== void 0 ? { seed: opts.seed } : {},
+      ...opts.resamples !== void 0 ? { resamples: opts.resamples } : {}
     }
+  );
+  const latency = {
+    mean: latSig.bootstrap.mean,
+    median: latSig.bootstrap.median,
+    low: latSig.bootstrap.low,
+    high: latSig.bootstrap.high
   };
-  return agent;
-}
-async function drainOne2(scope) {
-  const s = await scope.next();
-  if (!s) throw new Error("agentic: spawned child never settled");
-  return s;
-}
-var perChild = (innerTurns) => ({
-  maxIterations: innerTurns + 1,
-  maxTokens: 1e6
-});
-function depthStrategy(surface, task, opts, cfg) {
-  const innerTurns = opts.innerTurns ?? 4;
-  let pendingSteer;
-  return {
-    name: "depth",
-    async act(_t, scope) {
-      const handle = await surface.open(task);
-      const progression = [];
-      let messages;
-      let completions = 0;
-      let shots = 0;
-      try {
-        for (shots = 0; shots < cfg.maxShots; shots += 1) {
-          const child = leaf(`shot:${shots}`, "shot");
-          const memorySteer = await renderCorpusReadback(opts);
-          const steer = [shots === 0 ? void 0 : pendingSteer, memorySteer].filter((part) => typeof part === "string" && part.trim().length > 0).join("\n\n");
-          const res = scope.spawn(child, { task, handle, messages, steer }, {
-            budget: perChild(innerTurns),
-            label: `shot:${shots}`
-          });
-          if (!res.ok) break;
-          const settled = await drainOne2(scope);
-          if (settled.kind === "down") break;
-          const out = settled.out;
-          messages = out.messages;
-          completions += out.completions;
-          progression.push(out.score);
-          if (out.score >= 1 || shots === cfg.maxShots - 1) break;
-          const aChild = leaf(`analyst:${shots}`, "analyst");
-          const aRes = scope.spawn(
-            aChild,
-            { task, messages },
-            { budget: perChild(1), label: `analyst:${shots}` }
-          );
-          if (!aRes.ok) break;
-          const aSettled = await drainOne2(scope);
-          completions += 1;
-          if (aSettled.kind === "down") break;
-          const findings = aSettled.out;
-          if (/^\s*COMPLETE\b/i.test(findings)) break;
-          pendingSteer = `A reviewer flagged unfinished items:
-${findings}
-
-Address each with the tools, verify they took, then continue.`;
-        }
-        const final = await surface.score(task, handle);
-        const score = final.total > 0 ? final.passes / final.total : 0;
-        return {
-          kind: "done",
-          deliverable: {
-            mode: "depth",
-            score,
-            resolved: final.total > 0 && final.passes === final.total,
-            completions,
-            progression,
-            shots: shots + 1
-          }
-        };
-      } finally {
-        await surface.close(handle);
-      }
+  if (mode === "superiority") {
+    if (sig.fewRuns) return { promoted: false, reason: "few-tasks", mode, n: sig.n, lift, latency };
+    return sig.significant ? { promoted: true, reason: "significant", mode, n: sig.n, lift, latency } : { promoted: false, reason: "no-margin", mode, n: sig.n, lift, latency };
+  }
+  const tolerance = opts.scoreTolerance ?? 0.05;
+  const scoreSig = heldoutSignificance(
+    { before, after, cellIds },
+    {
+      deltaThreshold: -tolerance,
+      minProductiveRuns: opts.minPairedTasks ?? 6,
+      statistic: opts.statistic ?? "mean",
+      ...opts.seed !== void 0 ? { seed: opts.seed } : {},
+      ...opts.resamples !== void 0 ? { resamples: opts.resamples } : {}
     }
-  };
-}
-function breadthStrategy(_surface, task, opts, cfg) {
-  const innerTurns = opts.innerTurns ?? 4;
-  return {
-    name: "breadth",
-    async act(_t, scope) {
-      let opened = 0;
-      for (let k = 0; k < cfg.width; k += 1) {
-        const res = scope.spawn(leaf(`rollout:${k}`, "shot"), { task }, {
-          budget: perChild(innerTurns),
-          label: `rollout:${k}`
-        });
-        if (res.ok) opened += 1;
-      }
-      if (opened === 0) return { kind: "blocked", blockers: ["breadth: pool admitted no rollout"] };
-      let best = -1;
-      let bestResolved = false;
-      let completions = 0;
-      const progression = [];
-      for (let s = await scope.next(); s !== null; s = await scope.next()) {
-        if (s.kind === "down") continue;
-        const out = s.out;
-        completions += out.completions;
-        if (out.score > best) best = out.score;
-        if (out.total > 0 && out.passes === out.total) bestResolved = true;
-        progression.push(best);
-      }
-      if (best < 0) return { kind: "blocked", blockers: ["breadth: every rollout went down"] };
-      return {
-        kind: "done",
-        deliverable: {
-          mode: "breadth",
-          score: best,
-          resolved: bestResolved,
-          completions,
-          progression,
-          shots: opened
-        }
-      };
+  );
+  const costSig = heldoutSignificance(
+    { before: candUsd, after: incUsd, cellIds },
+    {
+      deltaThreshold: 0,
+      minProductiveRuns: opts.minPairedTasks ?? 6,
+      statistic: opts.statistic ?? "mean",
+      ...opts.seed !== void 0 ? { seed: opts.seed } : {},
+      ...opts.resamples !== void 0 ? { resamples: opts.resamples } : {}
     }
+  );
+  const costSavings = {
+    mean: costSig.bootstrap.mean,
+    median: costSig.bootstrap.median,
+    low: costSig.bootstrap.low,
+    high: costSig.bootstrap.high
   };
-}
-var sample = {
-  name: "sample",
-  driver: (surface, task, opts, budget) => breadthStrategy(surface, task, opts, { width: budget })
-};
-var refine = {
-  name: "refine",
-  driver: (surface, task, opts, budget) => depthStrategy(surface, task, opts, { maxShots: budget })
-};
-function defineStrategy(name, run) {
+  if (scoreSig.fewRuns)
+    return { promoted: false, reason: "few-tasks", mode, n: scoreSig.n, lift, costSavings, latency };
+  if (!scoreSig.significant)
+    return {
+      promoted: false,
+      reason: "non-inferiority-unproven",
+      mode,
+      n: scoreSig.n,
+      lift,
+      costSavings,
+      latency
+    };
+  if (!costSig.significant)
+    return {
+      promoted: false,
+      reason: "not-cheaper",
+      mode,
+      n: scoreSig.n,
+      lift,
+      costSavings,
+      latency
+    };
   return {
-    name,
-    driver: (surface, task, opts, budget) => ({
-      name,
-      async act(_t, scope) {
-        let seq = 0;
-        const innerTurns = opts.innerTurns ?? 4;
-        let verifiedBest = 0;
-        let verifiedResolved = false;
-        const openHandles = /* @__PURE__ */ new Set();
-        const ctx = {
-          // Narrowed to open/close — the body gets no raw call()/score() access.
-          surface: {
-            name: surface.name,
-            open: async (t) => {
-              const h = await surface.open(t);
-              openHandles.add(h.id);
-              return h;
-            },
-            close: async (h) => {
-              if (!h || !openHandles.has(h.id)) return;
-              openHandles.delete(h.id);
-              await surface.close(h);
-            }
-          },
-          task,
-          opts,
-          budget,
-          scope,
-          async shot(spec) {
-            const child = leaf(`shot:${seq}`, "shot");
-            seq += 1;
-            const res = scope.spawn(
-              child,
-              {
-                task,
-                handle: spec?.handle,
-                messages: spec?.messages,
-                steer: spec?.steer,
-                persona: spec?.persona,
-                tools: spec?.tools
-              },
-              { budget: perChild(innerTurns), label: child.name }
-            );
-            if (!res.ok) return null;
-            const settled = await drainOne2(scope);
-            if (settled.kind === "down") return null;
-            const out = settled.out;
-            if (out.score > verifiedBest) verifiedBest = out.score;
-            if (out.total > 0 && out.passes === out.total) verifiedResolved = true;
-            return out;
-          },
-          async listTools(handle) {
-            const tools = await surface.tools(task, handle);
-            return tools.map((t) => ({
-              name: t.function.name,
-              ...t.function.description ? { description: t.function.description } : {}
-            }));
-          },
-          async critique(messages) {
-            const child = leaf(`analyst:${seq}`, "analyst");
-            seq += 1;
-            const res = scope.spawn(
-              child,
-              { task, messages },
-              { budget: perChild(1), label: child.name }
-            );
-            if (!res.ok) return null;
-            const settled = await drainOne2(scope);
-            if (settled.kind === "down") return null;
-            const findings = settled.out;
-            return /^\s*COMPLETE\b/i.test(findings) ? null : findings;
-          },
-          async consult(messages, instruction) {
-            const child = leaf(`analyst:${seq}`, "analyst");
-            seq += 1;
-            const res = scope.spawn(
-              child,
-              { task, messages, rawInstruction: instruction },
-              { budget: perChild(1), label: child.name }
-            );
-            if (!res.ok) return null;
-            const settled = await drainOne2(scope);
-            if (settled.kind === "down") return null;
-            return settled.out;
-          }
-        };
-        const r = await run(ctx);
-        return {
-          kind: "done",
-          deliverable: {
-            mode: name,
-            ...r,
-            progression: Array.isArray(r.progression) ? r.progression : [],
-            completions: typeof r.completions === "number" ? r.completions : 0,
-            shots: typeof r.shots === "number" ? r.shots : 0,
-            score: verifiedBest,
-            resolved: verifiedResolved
-          }
-        };
-      }
-    })
+    promoted: true,
+    reason: "non-inferior-and-cheaper",
+    mode,
+    n: scoreSig.n,
+    lift,
+    costSavings,
+    latency
   };
 }
-var adaptiveRefine = defineStrategy(
-  "adaptiveRefine",
-  async ({ surface, task, budget, shot, critique }) => {
-    let handle = await surface.open(task);
-    const progression = [];
-    let messages;
-    let steer;
-    let completions = 0;
-    let best = -1;
-    let shots = 0;
-    try {
-      for (shots = 0; shots < budget; shots += 1) {
-        const out = await shot({ handle, messages, steer });
-        if (!out) break;
-        completions += out.completions;
-        progression.push(out.score);
-        if (out.score >= 1) break;
-        if (out.score <= best) {
-          await surface.close(handle);
-          handle = await surface.open(task);
-          messages = void 0;
-          steer = void 0;
-          continue;
-        }
-        best = out.score;
-        messages = out.messages;
-        const findings = await critique(out.messages);
-        completions += 1;
-        if (!findings) break;
-        steer = `A reviewer flagged unfinished items:
-${findings}
-
-Address each with the tools, verify they took, then continue.`;
-      }
-      const score = progression.length ? Math.max(...progression) : 0;
-      return { score, resolved: score >= 1, completions, progression, shots };
-    } finally {
-      await surface.close(handle);
-    }
-  }
-);
-var sampleThenRefine = defineStrategy(
-  "sampleThenRefine",
-  async ({ surface, task, budget, shot, critique }) => {
-    const explore = Math.max(1, Math.ceil(budget / 2));
-    const open = /* @__PURE__ */ new Set();
-    const progression = [];
-    let completions = 0;
-    let shots = 0;
-    try {
-      let best;
-      for (let i = 0; i < explore; i += 1) {
-        const handle = await surface.open(task);
-        open.add(handle);
-        const out = await shot({ handle });
-        if (!out) continue;
-        shots += 1;
-        completions += out.completions;
-        progression.push(out.score);
-        if (!best || out.score > best.out.score) best = { handle, out };
-        if (out.score >= 1) break;
-      }
-      if (!best) return { score: 0, resolved: false, completions, progression, shots };
-      for (const h of [...open]) {
-        if (h !== best.handle) {
-          await surface.close(h);
-          open.delete(h);
-        }
-      }
-      let messages = best.out.messages;
-      let topScore = best.out.score;
-      for (let i = explore; i < budget && topScore < 1; i += 1) {
-        const findings = await critique(messages);
-        completions += 1;
-        if (!findings) break;
-        const out = await shot({
-          handle: best.handle,
-          messages,
-          steer: `A reviewer flagged unfinished items:
-${findings}
 
-Address each with the tools, verify they took, then continue.`
-        });
-        if (!out) break;
-        shots += 1;
-        completions += out.completions;
-        progression.push(out.score);
-        messages = out.messages;
-        if (out.score > topScore) topScore = out.score;
-      }
-      const score = progression.length ? Math.max(...progression) : 0;
-      return { score, resolved: score >= 1, completions, progression, shots };
-    } finally {
-      for (const h of open) await surface.close(h);
-    }
-  }
-);
-async function runAgentic(opts) {
-  const strategy = opts.strategy ?? (opts.mode === "breadth" ? sample : refine);
-  const driver = strategy.driver(opts.surface, opts.task, opts, opts.budget);
-  const supervisor = createSupervisor();
-  const root = opts.rootBudget ?? {
-    maxIterations: opts.budget * ((opts.innerTurns ?? 4) + 2),
-    maxTokens: 1e9
-  };
-  const started = Date.now();
-  const result = await supervisor.run(driver, void 0, {
-    budget: root,
-    runId: `agentic:${strategy.name}:${opts.task.id}`,
-    journal: new InMemorySpawnJournal(),
-    blobs: new InMemoryResultBlobStore(),
-    executors: agenticRegistry(opts.surface, opts),
-    maxDepth: 3,
-    ...opts.hooks ? { hooks: opts.hooks } : {}
-  });
-  if (result.kind !== "winner" || result.out.kind !== "done") {
-    const reason = result.kind === "winner" ? `blocked: ${result.out.blockers?.join("; ")}` : `no-winner: ${result.reason}`;
-    throw new Error(`runAgentic(${strategy.name}) produced no result \u2014 ${reason}`);
-  }
-  const core = result.out.deliverable;
-  return {
-    ...core,
-    usd: result.spentTotal.usd,
-    tokens: result.spentTotal.tokens,
-    ms: Date.now() - started
-  };
+// src/runtime/report-usage.ts
+function reportLoopUsage(cost, result, source = "loop") {
+  cost.observe(result.costUsd, source);
+  cost.observeTokens(result.tokenUsage);
 }
 
 // src/runtime/run-benchmark.ts
+import { pairedBootstrap as pairedBootstrap2, paretoFrontier } from "@tangle-network/agent-eval";
 async function pool(items, limit, fn) {
   const out = new Array(items.length);
   let next = 0;
@@ -3831,16 +3410,19 @@ async function requestAuthoredCode(opts, model) {
       messages: [
         {
           role: "system",
-          content: "You are a senior engineer authoring optimization strategies for agent loops. Output exactly one fenced ```ts code block and nothing else."
+          content: "You are a senior researcher authoring optimization strategies for agent loops: you read per-task losses like experimental data, form a mechanism-level hypothesis, and author the one composition that tests it. Output exactly one fenced ```ts code block and nothing else."
         },
         {
           role: "user",
           content: `${opts.contract ?? strategyAuthorContract}
 
-BASELINE RESULTS on the "${opts.environmentName}" environment (budget=${opts.budget}):
+BASELINE RESULTS on the "${opts.environmentName}" environment (budget=${opts.budget}) \u2014 the per-task losses are your gradient:
 ${opts.lossesJson}
 
-Author ONE new strategy that you expect to beat the baselines on THIS environment at the same budget. Use the losses to target the observed failure mode. Output only the module code block.`
+Author ONE new strategy that you expect to beat the baselines on THIS environment at the same budget.
+${strategyAuthorMethod}
+
+Output only the module code block.`
         }
       ]
     },
@@ -4470,381 +4052,6 @@ function deriveTurnSignal(callerSignal, timeoutMs) {
   };
 }
 
-// src/runtime/structural-rollout.ts
-import { randomBytes } from "crypto";
-var defaultStructuralRolloutPolicy = {
-  k: 5,
-  repairRounds: 2,
-  testgen: 6
-};
-function resolvePolicy(overrides) {
-  const policy = { ...defaultStructuralRolloutPolicy, ...overrides };
-  if (!Number.isInteger(policy.k) || policy.k < 1) {
-    throw new Error(`structuralRollout: policy.k must be an integer >= 1, got ${policy.k}`);
-  }
-  if (!Number.isInteger(policy.repairRounds) || policy.repairRounds < 0) {
-    throw new Error(
-      `structuralRollout: policy.repairRounds must be an integer >= 0, got ${policy.repairRounds}`
-    );
-  }
-  if (!Number.isInteger(policy.testgen) || policy.testgen < 0) {
-    throw new Error(
-      `structuralRollout: policy.testgen must be an integer >= 0, got ${policy.testgen}`
-    );
-  }
-  return policy;
-}
-var authorInstruction = (count, entry) => `Read the task below. Write exactly ${count} single-line assert statements that test the function \`${entry}\`, based ONLY on the behavior the task itself describes. Each assert must be one physical line of the form \`assert ${entry}(...) == expected\` (or a True/False check). Do NOT implement the function. Do NOT copy shown examples verbatim if you can test other cases too. Output ONLY the assert lines inside a single \`\`\`python code block.`;
-function filterAuthoredAsserts(reply, entrySymbol, count) {
-  const fences = [...reply.matchAll(/```(?:python|py)?\s*\n([\s\S]*?)```/gi)].map(
-    (m) => (m[1] ?? "").trim()
-  );
-  const block = fences.length > 0 ? fences.join("\n") : reply;
-  const balanced = (s) => {
-    let d = 0;
-    for (const ch of s) {
-      if (ch === "(" || ch === "[" || ch === "{") d += 1;
-      else if (ch === ")" || ch === "]" || ch === "}") d -= 1;
-      if (d < 0) return false;
-    }
-    return d === 0;
-  };
-  return block.split("\n").map((l) => l.trim()).filter((l) => l.startsWith("assert ") && l.includes(entrySymbol) && balanced(l)).slice(0, count);
-}
-function modelAuthoredChecks(overrides = {}) {
-  return {
-    async generate(_task, ctx) {
-      const count = overrides.count ?? ctx.count;
-      if (count <= 0 || !ctx.entrySymbol) return [];
-      const entry = ctx.entrySymbol;
-      const reply = await ctx.consult(authorInstruction(count, entry));
-      if (!reply) return [];
-      return filterAuthoredAsserts(reply, entry, count).map((code) => ({
-        code,
-        kind: "authored"
-      }));
-    }
-  };
-}
-function officialChecksFromMeta(key = "visibleChecks") {
-  return {
-    async generate(task) {
-      const raw = task.meta?.[key];
-      if (!Array.isArray(raw)) return [];
-      return raw.filter((c) => typeof c === "string" && c.trim().length > 0).map((code) => ({ code, kind: "official" }));
-    }
-  };
-}
-function composeCheckSources(...sources) {
-  return {
-    async generate(task, ctx) {
-      const all = [];
-      for (const source of sources) all.push(...await source.generate(task, ctx));
-      return all;
-    }
-  };
-}
-function resolveEntrySymbol(task) {
-  const meta = task.meta?.entryPoint;
-  if (typeof meta === "string" && meta.trim().length > 0) return meta.trim();
-  const defs = [...task.userPrompt.matchAll(/(?:^|\n)\s*def\s+([A-Za-z_]\w*)\s*\(/g)];
-  const last = defs[defs.length - 1];
-  return last?.[1];
-}
-function buildCheckProgram(candidate, official, authored, nonce) {
-  const officialB64 = Buffer.from(JSON.stringify(official), "utf8").toString("base64");
-  const authoredB64 = Buffer.from(JSON.stringify(authored), "utf8").toString("base64");
-  return `${candidate}
-
-import base64 as _b64, json as _json, sys as _sys
-_official = _json.loads(_b64.b64decode("${officialB64}").decode("utf8"))
-_authored = _json.loads(_b64.b64decode("${authoredB64}").decode("utf8"))
-_lines = []
-def _run(_tests):
-    _att, _fail = 0, 0
-    for _t in _tests:
-        _att += 1
-        try:
-            exec(_t, dict(globals()))
-        except Exception as _e:
-            _fail += 1
-            _lines.append("CHECK FAILED: %s -> %s: %s" % (_t.strip()[:200], type(_e).__name__, str(_e)[:200]))
-    return _att, _fail
-_o_att, _o_fail = _run(_official)
-_a_att, _a_fail = _run(_authored)
-print("SRCK-${nonce} official=%d/%d authored=%d/%d" % (_o_att - _o_fail, _o_att, _a_att - _a_fail, _a_att))
-_sys.stdout.write("\\n".join(_lines)[-1500:])
-_sys.exit(0 if (_o_fail + _a_fail) == 0 and (_o_att + _a_att) > 0 else 1)
-`;
-}
-function sandboxCheckRunner(options = {}) {
-  const python = options.python ?? "python3";
-  const timeoutMs = options.timeoutMs ?? 2e4;
-  return {
-    async run(candidate, checks, ctx) {
-      if (checks.length === 0) {
-        return {
-          passedOfficial: 0,
-          totalOfficial: 0,
-          passedAuthored: 0,
-          totalAuthored: 0,
-          failureOutput: ""
-        };
-      }
-      const box = ctx.box ?? options.box;
-      if (!box) {
-        throw new Error(
-          "sandboxCheckRunner: no execution channel \u2014 bind one via sandboxCheckRunner({ box }) or CheckRunContext.box (ValidationCtx.box / a sandbox instance). Refusing to score without executing: a silent 0 would poison selection."
-        );
-      }
-      const nonce = randomBytes(8).toString("hex");
-      const official = checks.filter((c) => c.kind === "official").map((c) => c.code);
-      const authored = checks.filter((c) => c.kind === "authored").map((c) => c.code);
-      const program = buildCheckProgram(candidate, official, authored, nonce);
-      const b64 = Buffer.from(program, "utf8").toString("base64");
-      const r = await box.exec(`printf '%s' '${b64}' | base64 -d | ${python} -`, { timeoutMs });
-      const summary = new RegExp(
-        `SRCK-${nonce} official=(\\d+)/(\\d+) authored=(\\d+)/(\\d+)`
-      ).exec(r.stdout);
-      if (!summary) {
-        const detail = (r.stderr || r.stdout).slice(-1500) || "no output (crashed or timed out before the checks could run)";
-        return {
-          passedOfficial: 0,
-          totalOfficial: 0,
-          passedAuthored: 0,
-          totalAuthored: 0,
-          failureOutput: detail,
-          crashed: true
-        };
-      }
-      const failureOutput = r.stdout.replace(summary[0], "").slice(-1500).trim();
-      return {
-        passedOfficial: Number(summary[1]),
-        totalOfficial: Number(summary[2]),
-        passedAuthored: Number(summary[3]),
-        totalAuthored: Number(summary[4]),
-        failureOutput
-      };
-    }
-  };
-}
-var frac = (passed, total) => total > 0 ? passed / total : 0;
-function compareCheckOutcomes(a, b) {
-  const aCrashed = a.crashed === true;
-  const bCrashed = b.crashed === true;
-  if (aCrashed !== bCrashed) return aCrashed ? -1 : 1;
-  if (aCrashed) return 0;
-  const official = frac(a.passedOfficial, a.totalOfficial) - frac(b.passedOfficial, b.totalOfficial);
-  if (official !== 0) return official;
-  return frac(a.passedAuthored, a.totalAuthored) - frac(b.passedAuthored, b.totalAuthored);
-}
-function visibleCheckScore(o) {
-  if (o.crashed) return -1;
-  return frac(o.passedOfficial, o.totalOfficial) + 1e-3 * frac(o.passedAuthored, o.totalAuthored);
-}
-function selectBestIndex(outcomes) {
-  let best = 0;
-  for (let i = 1; i < outcomes.length; i += 1) {
-    if (compareCheckOutcomes(outcomes[i], outcomes[best]) > 0) {
-      best = i;
-    }
-  }
-  return best;
-}
-function canDisplace(challenger, incumbent) {
-  if (challenger.crashed === true) return false;
-  if (challenger.passedOfficial < incumbent.passedOfficial) return false;
-  return compareCheckOutcomes(challenger, incumbent) > 0;
-}
-var totalChecks = (o) => o.totalOfficial + o.totalAuthored;
-var passesAllChecks = (o) => o.crashed !== true && totalChecks(o) > 0 && o.passedOfficial === o.totalOfficial && o.passedAuthored === o.totalAuthored;
-function defaultExtractCandidate(messages) {
-  for (let i = messages.length - 1; i >= 0; i -= 1) {
-    const calls = messages[i]?.tool_calls;
-    if (!calls) continue;
-    for (let j = calls.length - 1; j >= 0; j -= 1) {
-      const call = calls[j];
-      if (call?.function?.name !== "submit_answer") continue;
-      try {
-        const args = JSON.parse(call.function.arguments ?? "{}");
-        if (typeof args.answer === "string" && args.answer.trim()) return args.answer.trim();
-      } catch {
-      }
-    }
-  }
-  const contents = [];
-  for (const m of messages) {
-    if (m.role === "assistant" && typeof m.content === "string" && m.content.trim()) {
-      contents.push(m.content);
-    }
-  }
-  const fencesOf = (text) => [...text.matchAll(/```(?:python|py)?\s*\n([\s\S]*?)```/gi)].map((m) => (m[1] ?? "").trim());
-  for (let i = contents.length - 1; i >= 0; i -= 1) {
-    const fences = fencesOf(contents[i]);
-    for (let j = fences.length - 1; j >= 0; j -= 1) {
-      if (/(^|\n)\s*def\s+\w+/.test(fences[j])) return fences[j];
-    }
-  }
-  for (let i = contents.length - 1; i >= 0; i -= 1) {
-    const fences = fencesOf(contents[i]);
-    if (fences.length > 0) return fences[fences.length - 1];
-  }
-  return (contents[contents.length - 1] ?? "").trim();
-}
-var DIVERSE_LENSES = [
-  "Answer directly and decisively from what you already know. State the single best answer without hedging.",
-  "Decompose the question into the sub-facts it depends on. Establish each sub-fact explicitly, then compose them into the answer.",
-  "Reason from first principles. Ignore the most obvious or popular guess; derive the answer from underlying facts and relationships.",
-  "Name the most plausible WRONG answer and the trap that makes it tempting. Rule it out, then commit to the answer that survives."
-];
-function slotLens(slot) {
-  const lens = DIVERSE_LENSES[slot % DIVERSE_LENSES.length];
-  const tag = slot < DIVERSE_LENSES.length ? "" : ` (variant ${Math.floor(slot / DIVERSE_LENSES.length) + 1})`;
-  return `${lens}${tag}`;
-}
-function repairSteer(outcome) {
-  return [
-    "Your latest solution failed some of the task-visible checks.",
-    "Result of running the visible checks against it:",
-    "```",
-    outcome.failureOutput.trim() || "(the code crashed before the checks could run)",
-    "```",
-    "Fix the solution so the visible checks pass. Provide the COMPLETE corrected solution the",
-    "same way you provided the original (same tool or format) \u2014 not a fragment or a diff."
-  ].join("\n");
-}
-function describeOutcome(label, o) {
-  if (o.crashed) return `${label}: crashed before the checks could run`;
-  return `${label}: official ${o.passedOfficial}/${o.totalOfficial}, authored ${o.passedAuthored}/${o.totalAuthored}`;
-}
-function structuralRollout(config = {}) {
-  const policy = resolvePolicy(config.policy);
-  const checkSource = config.checkSource ?? composeCheckSources(officialChecksFromMeta(), modelAuthoredChecks());
-  const checkRunner = config.checkRunner ?? sandboxCheckRunner();
-  const extract = config.extractCandidate ?? defaultExtractCandidate;
-  const inner = defineStrategy(
-    "structuralRollout",
-    async (ctx) => {
-      const { task, shot } = ctx;
-      const progression = [];
-      const receipts = [];
-      let completions = 0;
-      let shots = 0;
-      const consult = async (instruction) => {
-        const reply = await ctx.consult([], instruction);
-        completions += 1;
-        return reply;
-      };
-      const entrySymbol = resolveEntrySymbol(task);
-      const checks = await checkSource.generate(task, {
-        count: policy.testgen,
-        ...entrySymbol ? { entrySymbol } : {},
-        consult
-      });
-      const officialChecks = checks.filter((c) => c.kind === "official").length;
-      const authoredChecks = checks.length - officialChecks;
-      const runCtx = { task, ...config.box ? { box: config.box } : {} };
-      const candidates = [];
-      for (let i = 0; i < policy.k; i += 1) {
-        const out = await shot(policy.diverse ? { steer: slotLens(i) } : void 0);
-        if (!out) break;
-        shots += 1;
-        completions += out.completions;
-        progression.push(out.score);
-        const outcome = await checkRunner.run(extract(out.messages), checks, runCtx);
-        candidates.push({
-          index: candidates.length,
-          messages: out.messages,
-          outcome,
-          shotScore: out.score,
-          shotResolved: out.total > 0 && out.passes === out.total
-        });
-      }
-      if (candidates.length === 0) {
-        return {
-          score: 0,
-          resolved: false,
-          completions,
-          progression,
-          shots,
-          selection: receipts,
-          repairStop: "no-candidates",
-          officialChecks,
-          authoredChecks
-        };
-      }
-      let best = candidates[selectBestIndex(candidates.map((c) => c.outcome))];
-      for (const c of candidates) {
-        receipts.push({
-          candidateIndex: c.index,
-          selected: false,
-          score: visibleCheckScore(c.outcome),
-          reason: describeOutcome("sample", c.outcome),
-          selector: "driver"
-        });
-      }
-      let seq = candidates.length;
-      let repairStop = "already-passing";
-      if (!passesAllChecks(best.outcome)) {
-        if (best.outcome.crashed !== true && totalChecks(best.outcome) === 0) {
-          repairStop = "no-signal";
-        } else {
-          repairStop = "rounds-exhausted";
-          for (let r = 0; r < policy.repairRounds; r += 1) {
-            const out = await shot({ messages: best.messages, steer: repairSteer(best.outcome) });
-            if (!out) break;
-            shots += 1;
-            completions += out.completions;
-            progression.push(out.score);
-            const outcome = await checkRunner.run(extract(out.messages), checks, runCtx);
-            const displaced = canDisplace(outcome, best.outcome);
-            const label = displaced ? "repair (displaced the incumbent)" : outcome.crashed !== true && outcome.passedOfficial < best.outcome.passedOfficial ? "repair (held out: passes fewer official checks than the incumbent)" : "repair (held out: no improvement)";
-            receipts.push({
-              candidateIndex: seq,
-              selected: false,
-              score: visibleCheckScore(outcome),
-              reason: describeOutcome(label, outcome),
-              selector: "driver"
-            });
-            if (displaced) {
-              best = {
-                index: seq,
-                messages: out.messages,
-                outcome,
-                shotScore: out.score,
-                shotResolved: out.total > 0 && out.passes === out.total
-              };
-            }
-            seq += 1;
-            if (passesAllChecks(best.outcome)) {
-              repairStop = "repaired-pass";
-              break;
-            }
-          }
-        }
-      }
-      const winner = receipts.find((r) => r.candidateIndex === best.index);
-      if (winner) winner.selected = true;
-      return {
-        score: best.shotScore,
-        resolved: best.shotResolved,
-        completions,
-        progression,
-        shots,
-        selection: receipts,
-        repairStop,
-        officialChecks,
-        authoredChecks
-      };
-    }
-  );
-  if (policy.temperature === void 0) return inner;
-  return {
-    name: inner.name,
-    driver: (surface, task, opts, budget) => inner.driver(surface, task, { ...opts, temperature: policy.temperature }, budget)
-  };
-}
-
 // src/runtime/supervise/detector-monitor.ts
 import {
   argHash,
@@ -5683,6 +4890,15 @@ function tail(s) {
 }
 
 export {
+  envKeyProvider,
+  mcpSecretEnvMetadataKey,
+  secretEnvOfMcpServer,
+  resolveSecretEnv,
+  sanitizeMcpToolSchema,
+  createMcpEnvironment,
+  McpSpawnFault,
+  connectStdioMcp,
+  materializeLocalMcp,
   anytimeReport,
   renderAnytimeTable,
   defaultAuditorInstruction,
@@ -5700,16 +4916,13 @@ export {
   loopCampaignDispatch,
   loopDispatch,
   inlineSandboxClient,
+  localSandboxClient,
   resolveSandboxClient,
   naiveDriver,
   dumbDriver,
   defineLeaderboard,
-  defaultAnalystInstruction,
-  observe,
-  renderReport,
   harvestCorpus,
   inProcessSandboxClient,
-  createMcpEnvironment,
   assertTraceDerivedFindings,
   createScopeAnalyst,
   registryScopeAnalyst,
@@ -5734,14 +4947,6 @@ export {
   equalKOnCost,
   promotionGate,
   reportLoopUsage,
-  depthStrategy,
-  breadthStrategy,
-  sample,
-  refine,
-  defineStrategy,
-  adaptiveRefine,
-  sampleThenRefine,
-  runAgentic,
   runBenchmark,
   printBenchmarkReport,
   SandboxRunAbortError,
@@ -5755,19 +4960,6 @@ export {
   runStrategyEvolution,
   streamAgentTurn,
   collectAgentTurn,
-  defaultStructuralRolloutPolicy,
-  filterAuthoredAsserts,
-  modelAuthoredChecks,
-  officialChecksFromMeta,
-  composeCheckSources,
-  resolveEntrySymbol,
-  sandboxCheckRunner,
-  compareCheckOutcomes,
-  visibleCheckScore,
-  selectBestIndex,
-  canDisplace,
-  defaultExtractCandidate,
-  structuralRollout,
   defaultToolDetectors,
   watchTrace,
   runCoderChecks,
@@ -5786,6 +4978,6 @@ export {
   jjWorkspace,
   runInWorkspace,
   computeFindingId,
-  makeFinding2 as makeFinding
+  makeFinding
 };
-//# sourceMappingURL=chunk-MAONWP4R.js.map
+//# sourceMappingURL=chunk-KPHTCHQ4.js.map