@tangle-network/agent-runtime 0.102.0 → 0.102.2

package/dist/loops.d.ts

@@ -2,29 +2,31 @@ import { ChatClient, RunRecord, HarnessType, AgentProfile, MaximumCharge, Analys
 export { AnalystFinding, DefaultVerdict, computeFindingId, makeFinding } from '@tangle-network/agent-eval';
 import { SandboxEvent, SandboxInstance, CreateSandboxOptions, PromptOptions, TaskOptions } from '@tangle-network/sandbox';
 export { AgentProfile, CreateSandboxOptions, SandboxEvent, SandboxInstance } from '@tangle-network/sandbox';
-import { a as ResultBlobStore, f as SpawnJournal, N as NodeId, j as SpawnEvent, E as ExecutorFactory, A as Agent, B as Budget, S as Scope, h as Settled, b as SupervisedResult, i as Spend, U as UsageEvent, e as ExecutorRegistry, k as Supervisor } from './types-CmnA2iL3.js';
-export { d as AgentSpec, c as Executor, l as ExecutorContext, m as ExecutorResult, R as Runtime, n as SupervisorOpts, T as TreeView, W as WidenGate } from './types-CmnA2iL3.js';
-import { M as MakeWorkerAgent, A as AnalystRegistry, o as CoordinationTools, n as CoordinationEvent, as as QuestionPolicy, E as ExecutorConfig } from './coordination-BFE3Den7.js';
-export { bh as BusEvent, bi as BusRecord, bj as BusStats, bk as EventBus, bl as ProviderSeam, bm as PublishOptions, bn as cliWorktreeExecutor, bo as createEventBus, bp as createExecutor, bq as createExecutorRegistry } from './coordination-BFE3Den7.js';
-import { R as RuntimeHooks, I as Iteration, S as SandboxClient, D as Driver, A as AgentRunSpec, O as OutputAdapter, V as Validator, E as ExecCtx, t as LoopWinner, u as LoopLineageOptions, v as LoopResult, L as LoopTokenUsage, M as MountRecorder, w as SelectionReceipt } from './types-B3vAW0Oq.js';
-export { x as LoopDecisionPayload, y as LoopEndedPayload, z as LoopIterationDispatchPayload, B as LoopIterationEndedPayload, C as LoopIterationStartedPayload, F as LoopPlanDescription, G as LoopPlanPayload, a as LoopSandboxPlacement, H as LoopStartedPayload, J as LoopTeardownFailedPayload, r as LoopTraceEmitter, b as LoopTraceEvent, K as MountManifestEntry, N as RunProvenance, P as ValidationCtx } from './types-B3vAW0Oq.js';
+import { a as ResultBlobStore, g as SpawnJournal, N as NodeId, j as SpawnEvent, E as ExecutorFactory, A as Agent, B as Budget, d as Settled, S as Scope, b as SupervisedResult, e as Spend, U as UsageEvent, h as ExecutorRegistry, k as Supervisor } from './types-D870JlH0.js';
+export { f as AgentSpec, c as Executor, l as ExecutorContext, m as ExecutorResult, R as Runtime, n as SupervisorOpts, T as TreeView, W as WidenGate } from './types-D870JlH0.js';
+import { M as MakeWorkerAgent, A as AnalystRegistry, o as CoordinationTools, n as CoordinationEvent, as as QuestionPolicy, E as ExecutorConfig } from './coordination-D9l_YmwW.js';
+export { bh as BusEvent, bi as BusRecord, bj as BusStats, bk as EventBus, bl as ProviderSeam, bm as PublishOptions, bn as cliWorktreeExecutor, bo as createEventBus, bp as createExecutor, bq as createExecutorRegistry } from './coordination-D9l_YmwW.js';
+import { R as RuntimeHooks, I as Iteration, S as SandboxClient, D as Driver, A as AgentRunSpec, O as OutputAdapter, V as Validator, E as ExecCtx, u as LoopWinner, v as LoopLineageOptions, w as LoopResult, L as LoopTokenUsage, M as MountRecorder } from './types-CLat4bT9.js';
+export { x as LoopDecisionPayload, y as LoopEndedPayload, z as LoopIterationDispatchPayload, B as LoopIterationEndedPayload, C as LoopIterationStartedPayload, F as LoopPlanDescription, G as LoopPlanPayload, b as LoopSandboxPlacement, H as LoopStartedPayload, J as LoopTeardownFailedPayload, d as LoopTraceEmitter, c as LoopTraceEvent, K as MountManifestEntry, N as RunProvenance, a as SelectionReceipt, P as ValidationCtx } from './types-CLat4bT9.js';
 import { RunProfileMatrixResult, Scenario, ProfileDispatchFn, JudgeConfig, RunProfileMatrixOptions, DispatchFn } from '@tangle-network/agent-eval/campaign';
 export { AgentEnvironmentProviderRef, AgentEnvironmentProviderRegistry, ProviderAsSandboxClientOptions, ProviderExecutorOptions, SandboxClientProviderOptions, createAgentEnvironmentProviderRegistry, providerAsExecutor, providerAsSandboxClient, resolveAgentEnvironmentProvider, sandboxClientAsProvider } from './environment-provider.js';
-import { C as CorpusRecord, c as Corpus, O as Outcome, S as ScopeAnalyzeInput, d as AssertTraceDerivedFindings, e as SteerContext, f as ScopeAnalyst, F as FanoutOptions, g as CombinatorShape, h as ScopeWidenGate, L as LoopUntilSpec, P as PanelSpec, i as PipelineStage, W as WinnerStrategy, j as FanoutWinnerSelector, V as VerifySpec, k as WidenSpec, l as CorpusFilter, R as RenderCorpusToInstructionsOptions, D as DefinePersonaInput, m as Persona, n as RunPersonifiedOptions, o as ShapeRegistry, p as LoopShape, E as EqualKArm, q as EqualKOnCostOptions, r as EqualKVerdict, T as TrajectoryReportOptions, s as TrajectoryReport } from './worktree-fanout-DCA3G4bO.js';
-export { A as AuthoredHarness, t as DefinePersona, u as EqualKOnCost, v as Fanout, w as FanoutSynthesis, x as FlatWidenGate, y as LoopUntil, z as LoopUntilState, B as Panel, G as PanelJudge, H as PanelVerdict, I as PatchDeliverableOptions, J as PersonaContext, K as PersonaExecutors, M as Pipeline, N as RenderCorpusToInstructions, Q as RunPersonified, U as ShapeBudget, X as ShapeContext, Y as TrajectoryNode, Z as TrajectoryReportFn, _ as Verify, $ as Widen, a0 as WidenDecision, a1 as WidenLineage, a2 as WorktreeCliExecutorOptions, a as WorktreeFanoutOptions, b as WorktreePatchArtifact, a3 as createWorktreeCliExecutor, a4 as patchDelivered, a5 as worktreeFanout } from './worktree-fanout-DCA3G4bO.js';
+import { c as CorpusRecord, C as Corpus, S as ScopeAnalyzeInput, d as AssertTraceDerivedFindings, O as Outcome, e as SteerContext, f as ScopeAnalyst, F as FanoutOptions, g as CombinatorShape, h as ScopeWidenGate, L as LoopUntilSpec, P as PanelSpec, i as PipelineStage, W as WinnerStrategy, j as FanoutWinnerSelector, V as VerifySpec, k as WidenSpec, l as CorpusFilter, R as RenderCorpusToInstructionsOptions, D as DefinePersonaInput, m as Persona, n as RunPersonifiedOptions, o as ShapeRegistry, p as LoopShape, E as EqualKArm, q as EqualKOnCostOptions, r as EqualKVerdict, T as TrajectoryReportOptions, s as TrajectoryReport } from './worktree-fanout-DsIR4d6w.js';
+export { A as AuthoredHarness, t as DefinePersona, u as EqualKOnCost, v as Fanout, w as FanoutSynthesis, x as FlatWidenGate, y as LoopUntil, z as LoopUntilState, B as Panel, G as PanelJudge, H as PanelVerdict, I as PatchDeliverableOptions, J as PersonaContext, K as PersonaExecutors, M as Pipeline, N as RenderCorpusToInstructions, Q as RunPersonified, U as ShapeBudget, X as ShapeContext, Y as TrajectoryNode, Z as TrajectoryReportFn, _ as Verify, $ as Widen, a0 as WidenDecision, a1 as WidenLineage, a2 as WorktreeCliExecutorOptions, a as WorktreeFanoutOptions, b as WorktreePatchArtifact, a3 as createWorktreeCliExecutor, a4 as patchDelivered, a5 as worktreeFanout } from './worktree-fanout-DsIR4d6w.js';
+import { AgentProfileMcpServer, AgentProfile as AgentProfile$1, AgentProfileSecurityPolicy } from '@tangle-network/agent-interface';
+import { A as AgenticSurface, a as AgenticTask, b as AgenticOptions, c as Strategy, d as ArtifactHandle, e as SurfaceScore, f as AgenticTool } from './structural-rollout-D7xik9XR.js';
+export { g as AgenticRunResult, C as CheckExecChannel, h as CheckOutcome, i as CheckRunContext, j as CheckRunner, k as CheckSource, l as CheckSourceCtx, m as CorpusReadbackOptions, R as RepairStop, n as RunAgenticOptions, o as ShotPersona, p as ShotSpec, q as StrategyCtx, r as StrategyResult, s as StructuralRolloutConfig, S as StructuralRolloutPolicy, t as StructuralRolloutResult, V as VisibleCheck, u as adaptiveRefine, v as breadthStrategy, w as canDisplace, x as compareCheckOutcomes, y as composeCheckSources, z as defaultExtractCandidate, B as defaultStructuralRolloutPolicy, D as defineStrategy, E as depthStrategy, F as filterAuthoredAsserts, G as modelAuthoredChecks, H as officialChecksFromMeta, I as refine, J as resolveEntrySymbol, K as runAgentic, L as sample, M as sampleThenRefine, N as sandboxCheckRunner, O as selectBestIndex, P as structuralRollout, Q as visibleCheckScore } from './structural-rollout-D7xik9XR.js';
 import { b as AnalystRegistryLike } from './types-CmYCMbFT.js';
-import { AgentProfile as AgentProfile$1 } from '@tangle-network/agent-interface';
-import { R as RouterConfig, T as ToolLoopChat, a as ToolLoopCompactionOptions } from './sanitize-BTSsdBXw.js';
-export { j as RouterChatResult, k as RouterChatToolsResult, l as RouterToolCall, m as RouterToolLoopResult, n as ToolLoopCompaction, b as ToolSpec, r as routerBrain, o as routerChatWithTools, p as routerChatWithUsage, q as routerToolLoop } from './sanitize-BTSsdBXw.js';
+import { R as RouterConfig, T as ToolLoopChat, a as ToolLoopCompactionOptions } from './sanitize-DEbPNtyI.js';
+export { j as RouterChatResult, k as RouterChatToolsResult, l as RouterToolCall, m as RouterToolLoopResult, n as ToolLoopCompaction, b as ToolSpec, r as routerBrain, o as routerChatWithTools, p as routerChatWithUsage, q as routerToolLoop } from './sanitize-DEbPNtyI.js';
 import { R as RuntimeStreamEvent, c as AgentExecutionBackend, f as AgentTaskStatus, B as BackendErrorDetail } from './types-BwoZWq-i.js';
-import { D as DeliverableSpec } from './completion-gate-C80jiRfN.js';
-export { g as WorktreeCommandResult, h as WorktreeProfileMaterializationReceipt, i as gateOnDeliverable } from './completion-gate-C80jiRfN.js';
-import { S as SupervisorProfile } from './supervise-BLPI50-w.js';
-export { D as DriveHarness, a as SuperviseOptions, b as SupervisorAgentDeps, s as supervise, c as supervisorAgent, w as workerFromBackend } from './supervise-BLPI50-w.js';
+import { D as DeliverableSpec } from './completion-gate-C6dhVN-N.js';
+export { g as WorktreeCommandResult, h as WorktreeProfileMaterializationReceipt, i as gateOnDeliverable } from './completion-gate-C6dhVN-N.js';
+import { S as SupervisorProfile } from './supervise-BQdNAXtK.js';
+export { D as DriveHarness, a as SuperviseOptions, b as SupervisorAgentDeps, s as supervise, c as supervisorAgent, w as workerFromBackend } from './supervise-BQdNAXtK.js';
 import { stuckLoopView, toolWasteView } from '@tangle-network/agent-eval/pipelines';
 export { AgentEnvironment, AgentEnvironmentCapabilities, AgentEnvironmentEvent, AgentEnvironmentProvider, AgentEnvironmentQuery, AgentEnvironmentStatus, AgentEnvironmentSummary, AgentProfileRef, AgentSession, AgentSessionRef, AgentSessionStatus, AgentTurnInput, AgentTurnResult, CheckpointRef, CheckpointRequest, CreateAgentEnvironmentInput, ExecRequest, ExecResult, ForkRequest, PlacementInfo, ResourceRequest, WorkspaceRequest } from '@tangle-network/agent-interface/environment-provider';
-import './substrate-DO2GHNg2.js';
-import './local-harness-ZqCx51u7.js';
+import './substrate-Dyiqmd3o.js';
+import './local-harness-CtK9dSny.js';
 import 'node:child_process';
 import '@tangle-network/agent-profile-materialize';
 
@@ -885,6 +887,103 @@ declare function inProcessSandboxClient(options: InProcessSandboxClientOptions):
  */
 declare function inlineSandboxClient(factory: ExecutorFactory<unknown>): SandboxClient;
 
+/**
+ * `KeyProvider` — API-key provisioning for adopted external MCP servers.
+ *
+ * An adopted server (a `connection` artifact, or a `buildableGenerator` remote
+ * emit) usually needs a credential. The credential must never ride the profile
+ * or the artifact — both are logged, diffed, and stored as audit records — so
+ * the profile carries only a DECLARATIVE reference:
+ *
+ *   `profile.mcp[key].metadata[mcpSecretEnvMetadataKey]`
+ *     = { ENV_VAR_NAME: 'PROVIDER_KEY_NAME', … }
+ *
+ * and the VALUE is resolved at materialize time (`materializeLocalMcp`'s
+ * `keys` option) and injected straight into the spawned server child's env.
+ * Values exist only in the child process env — never in the profile, the
+ * artifact registry, an error message, or a log line (errors name the KEY
+ * NAME only).
+ *
+ * Fail-closed at every hop: a declared secret with no provider, or a provider
+ * that does not hold the named key, THROWS — booting an external server
+ * keyless would fail opaquely mid-eval or silently score a broken candidate.
+ *
+ * `envKeyProvider` is the same-host default: it reads the process env, which
+ * the operator loads via dotenvx (the secrets files never touch the repo).
+ *
+ * >>> REAL SECRET STORES PLUG IN HERE (flagged): the sandbox SDK's
+ * `client.secrets` (`SecretsManager.get(name)`) and the platform hub's
+ * short-lived capability tokens (`PlatformHubClient.mintToken` →
+ * `{ ENV: token }`) both satisfy `KeyProvider` with a one-line adapter; both
+ * need a live service, so neither is constructed here.
+ */
+
+/** Resolve named secrets. The ONE seam every secret store adapts to. */
+interface KeyProvider {
+    /** The value for `name`, or `undefined` when this provider does not hold it. */
+    get(name: string): Promise<string | undefined>;
+}
+/** The env-backed provider: reads the (dotenvx-loaded) process env. Empty /
+ *  whitespace-only values count as absent — fail loud, not with a blank key. */
+declare function envKeyProvider(env?: Record<string, string | undefined>): KeyProvider;
+/** The `AgentProfileMcpServer.metadata` key the declarative secret-env map
+ *  rides under: `{ ENV_VAR_NAME: 'PROVIDER_KEY_NAME' }`. Names only — values
+ *  are resolved at materialize time and never stored. */
+declare const mcpSecretEnvMetadataKey = "secretEnv";
+/** Read (and validate) a server entry's declared secret-env map, if any.
+ *  Malformed metadata throws — a half-declared secret must never half-boot. */
+declare function secretEnvOfMcpServer(server: AgentProfileMcpServer): Record<string, string> | undefined;
+/**
+ * Resolve a declared secret-env map into the real env entries for a server
+ * spawn. Fail-closed: no provider or a missing key throws, naming the KEY
+ * NAME only (the value never appears in any message). `label` names the
+ * server for the error (e.g. `profile.mcp['exa']`).
+ */
+declare function resolveSecretEnv(secretEnv: Record<string, string>, keys: KeyProvider | undefined, label: string): Promise<Record<string, string>>;
+
+/**
+ * `localSandboxClient` — the SAME-HOST pseudo-box: a `SandboxClient` whose
+ * `create()` MATERIALIZES the profile's stdio MCP servers as local child
+ * processes (`materializeLocalMcp`) and whose `streamPrompt` drives a real
+ * tool loop (`runBrainLoop` over the router brain) with those live tools.
+ *
+ * Despite the interface name, this does NOT isolate processes. It is only for
+ * author-controlled profiles whose local MCP commands a caller explicitly
+ * trusts; user- or model-authored code belongs in a real sandbox. `delete()`
+ * kills the children.
+ *
+ * A per-create profile may change the prompt surface. Permission to start a
+ * local MCP process applies only when its full canonical bytes match the fixed
+ * constructor profile; a different generated profile is refused.
+ *
+ * Event protocol matches `inlineSandboxClient`: one `llm_call` metering event
+ * + one terminal `result` event with finalText/tokenUsage/costUsd.
+ */
+
+interface LocalSandboxClientOptions {
+    /** The worker brain: router chat-completions with tool-calling. All three required. */
+    router: {
+        baseUrl: string;
+        key: string;
+        model: string;
+    };
+    /** Tool-loop turns per prompt. Default 8. */
+    maxTurns?: number;
+    /** Brain sampling temperature. Default: `routerBrain`'s (0.4). */
+    temperature?: number;
+    /** Fallback profile when `create(options)` carries none on `backend.profile`. */
+    profile?: AgentProfile$1;
+    /** Resolves profile-declared MCP secret names at child-process spawn time. */
+    keys?: KeyProvider;
+    /** Explicit trust decision for the exact `profile` bytes supplied here.
+     * Omit to refuse local processes. A permissive policy never transfers to a
+     * different per-create profile and provides no host isolation. */
+    profileSecurityPolicy?: AgentProfileSecurityPolicy;
+}
+/** A same-host `SandboxClient` adapter with no process isolation. Local MCP is
+ * refused unless the caller explicitly supplies a policy that allows it. */
+declare function localSandboxClient(opts: LocalSandboxClientOptions): SandboxClient;
+
 /**
  *
  * `runLoop` — the topology-agnostic kernel built atop the sandbox SDK.
@@ -1074,248 +1173,6 @@ declare function loopCampaignDispatch<Task, Output, Decision, TScenario extends
  */
 declare function loopDispatch<Task, Output, Decision, TScenario extends Scenario, TArtifact>(opts: LoopDispatchOptions<Task, Output, Decision, TScenario, TArtifact>): ProfileDispatchFn<TScenario, TArtifact>;
 
-/**
- * The general agentic primitive — sequential (depth) and parallel (breadth) over a shared,
- * checkable artifact, driven through the keystone Supervisor as one recursive `Agent.act`.
- *
- * The domain lives behind ONE seam — `AgenticSurface` (open an artifact, list tools, call a tool,
- * score the artifact, close it). EnterpriseOps implements it (seed a gym DB, MCP tools, SQL
- * verifier); Commit0/AppWorld/terminal-bench implement it the same way (a repo workspace, shell
- * tools, the test suite). The drivers below are domain-blind: they run over any surface.
- *
- * Two shapes, the agent's POMDP rollout as the unit:
- *  - DEPTH   one persistent artifact carried across shots. Each shot the agent works the tool loop;
- *            between shots a trace-analyst (selector≠judge: reads the trajectory, never the score)
- *            steers the resumed session toward what's unfinished. shot n stands on shot n-1's
- *            artifact state + history. This is continuation — long-horizon, same artifact.
- *  - BREADTH K independent artifacts, each a fresh rollout, the deployable verifier picks the best.
- *
- * Both are an `Agent` whose `act` spawns leaf shots through `scope.spawn` and reacts via
- * `scope.next()` — so the conserved budget pool meters them (equal-k by construction), the journal
- * records the tree, and the same primitive nests. `runAgentic` runs the chosen driver through
- * `createSupervisor().run`. The leaf (one shot over a handle) is resolved per-spawn from a
- * surface-closed registry — the open `Executor` seam, not bespoke per-benchmark glue.
- */
-
-interface AgenticTask {
-    readonly id: string;
-    readonly systemPrompt: string;
-    readonly userPrompt: string;
-    /** Opaque domain payload the surface reads (EOPS: servers/verifiers/tools). Drivers never read it. */
-    readonly meta?: Record<string, unknown>;
-}
-interface ArtifactHandle {
-    readonly id: string;
-    readonly surface: string;
-    /** Opaque per-artifact context the surface stashes (EOPS: the seeded gym server + db id). */
-    readonly ctx?: unknown;
-}
-interface AgenticTool {
-    readonly type: 'function';
-    readonly function: {
-        name: string;
-        description?: string;
-        parameters: Record<string, unknown>;
-    };
-}
-interface SurfaceScore {
-    passes: number;
-    total: number;
-    /** Checks excluded as malformed (data defect, not the agent). `total === 0` ⇒ unscoreable. */
-    errored: number;
-}
-/** A stateful, checkable environment an agent operates over with tools. Open behind one interface. */
-interface AgenticSurface {
-    readonly name: string;
-    open(task: AgenticTask): Promise<ArtifactHandle>;
-    tools(task: AgenticTask, handle: ArtifactHandle): Promise<AgenticTool[]>;
-    call(handle: ArtifactHandle, name: string, args: Record<string, unknown>): Promise<string>;
-    score(task: AgenticTask, handle: ArtifactHandle): Promise<SurfaceScore>;
-    close(handle: ArtifactHandle): Promise<void>;
-}
-interface AgenticOptions {
-    routerBaseUrl: string;
-    routerKey: string;
-    model: string;
-    /** Optional completion transport (see `RouterConfig.complete`): when set, BOTH legs of an
-     *  offline run use it instead of `fetch`-ing the router — the worker's tool loop (threaded into
-     *  its `routerToolLoop` cfg) AND the analyst's critic (its `ChatClient` is bound to this same
-     *  transport). One injected responder serves both, as a localhost mock endpoint would. Absent ⇒
-     *  the live router fetch path (the default). */
-    complete?: (body: Record<string, unknown>) => Promise<unknown>;
-    temperature?: number;
-    /** Completion cap per worker turn — REQUIRED for thinking models (they burn unbounded
-     *  budgets on reasoning and return empty content without it). Omitted ⇒ provider default. */
-    maxTokens?: number;
-    /** Turns the agent may take within ONE shot before the driver intervenes. */
-    innerTurns?: number;
-    /** The depth STEERER's analyst instruction (observe()'s system prompt). The knob a
-     *  prompt optimizer (GEPA) tunes — the analyst IS the steerer. Omitted ⇒ the default. */
-    analystInstruction?: string;
-    /** The critic's model — lets the analyst be a stronger (or cheaper) model than the
-     *  worker. Omitted ⇒ the worker's `model`. */
-    analystModel?: string;
-    /** Across-run learning: when set, the analyst's observe() pass appends trace-derived
-     *  facts here (the flywheel write side). Read-back is opt-in via `corpusReadback`
-     *  because unconditional priming can pollute context on some domains. */
-    corpus?: Corpus;
-    /** Tags written onto learned facts (and used by the caller's priming query). */
-    corpusTags?: string[];
-    /** In-context learning: when set, query `corpus` before each depth shot and inject
-     *  the top trace-derived facts as guidance for the active run. No corpus means no read-back. */
-    corpusReadback?: CorpusReadbackOptions;
-}
-interface CorpusReadbackOptions {
-    /** Minimum confidence for a fact to be injected. Default 0.7. */
-    minConfidence?: number;
-    /** Extra tags a fact must carry, in addition to `corpusTags`. */
-    tags?: ReadonlyArray<string>;
-    /** Max facts injected per shot. Default 3. */
-    maxFacts?: number;
-    /** Default false: only facts tagged `audience:agent` are injected into the worker. */
-    includeOperatorFacts?: boolean;
-}
-type Msg$1 = Record<string, unknown>;
-interface ShotResult {
-    messages: Msg$1[];
-    score: number;
-    passes: number;
-    total: number;
-    completions: number;
-    toolErrors: number;
-}
-interface AgenticRunResult {
-    /** The strategy name (built-in 'depth'/'breadth' or a custom strategy's name). */
-    mode: string;
-    score: number;
-    resolved: boolean;
-    completions: number;
-    /** DEPTH: score after each shot — the progress-over-rounds curve. BREADTH: best-so-far per rollout. */
-    progression: number[];
-    shots: number;
-    /** The cost vector, stamped by `runAgentic` from the Supervisor's conserved pool: real
-     *  router tokens, priced usd (0 when the model is unpriced — never fabricated), wall ms. */
-    usd: number;
-    ms: number;
-    tokens: {
-        input: number;
-        output: number;
-    };
-}
-/** DEPTH: one persistent artifact, carried across analyst-steered shots. */
-declare function depthStrategy(surface: AgenticSurface, task: AgenticTask, opts: AgenticOptions, cfg: {
-    maxShots: number;
-}): Agent<unknown, Outcome<unknown>>;
-/** BREADTH: K independent rollouts (each own artifact), verifier picks the best. */
-declare function breadthStrategy(_surface: AgenticSurface, task: AgenticTask, opts: AgenticOptions, cfg: {
-    width: number;
-}): Agent<unknown, Outcome<unknown>>;
-/**
- * A Strategy is HOW you spend the compute budget to beat the Environment's check — it
- * builds the driver `Agent` the Supervisor runs. This is the OPEN extension point: a dev
- * authors their own by implementing `driver()` to return an Agent whose `act()` spawns
- * shots/analysts via `scope.spawn` / `scope.next` / `scope.send`. The two built-ins are
- * the reference implementations to copy:
- *   sample — K INDEPENDENT attempts, keep the best-verifying (best-of-N / resample).
- *   refine — attempt → observe() reads the trace → steer the next → repeat (iterate).
- * (A multi-agent "team" is just a Strategy whose driver spawns several different agents.)
- */
-interface Strategy {
-    readonly name: string;
-    driver(surface: AgenticSurface, task: AgenticTask, opts: AgenticOptions, budget: number): Agent<unknown, Outcome<unknown>>;
-}
-/** Built-in `Strategy`: K independent attempts, keep the best-verifying (best-of-N / resample). */
-declare const sample: Strategy;
-/** Built-in `Strategy`: attempt → `observe()` reads the trace → steer the next attempt → repeat (deepen one lineage). */
-declare const refine: Strategy;
-/** A role for one shot — multi-agent loops (researcher + engineer, a panel of k
- *  researchers) give each shot its own system prompt and optionally its own model. */
-interface ShotPersona {
-    /** Replaces the task's systemPrompt for a FRESH shot; on a carried conversation it is
-     *  injected as a hand-off message (the transcript's earlier roles stay intact). */
-    systemPrompt?: string;
-    /** Per-shot model override (e.g. a stronger model for the engineer shot). */
-    model?: string;
-}
-interface ShotSpec {
-    /** present ⇒ continue this artifact (depth); absent ⇒ the shot opens a fresh one (sample/restart). */
-    handle?: ArtifactHandle;
-    messages?: Msg$1[];
-    steer?: string;
-    persona?: ShotPersona;
-    /** Restrict THIS shot to a subset of the domain's tools (by name) — focus a shot on
-     *  the relevant capabilities. Restriction-only; unknown names throw. Omitted ⇒ all. */
-    tools?: string[];
-}
-interface StrategyResult {
-    score: number;
-    resolved: boolean;
-    completions: number;
-    progression: number[];
-    shots: number;
-}
-/** Artifact lifecycle a strategy may manage itself — open/close ONLY. Raw `call`/`score`
- *  are withheld: scores reach the body solely through `shot()`'s ShotResult (the
- *  harness-verified channel), so a body cannot peek the check or fabricate around it. */
-interface StrategyArtifacts {
-    readonly name: string;
-    open(task: AgenticTask): Promise<ArtifactHandle>;
-    close(handle: ArtifactHandle): Promise<void>;
-}
-/** What a strategy body composes with: the artifact lifecycle, the budget, and the two steps. */
-interface StrategyCtx {
-    /** Open/close artifacts the body manages itself (e.g. one persistent handle for depth). */
-    readonly surface: StrategyArtifacts;
-    readonly task: AgenticTask;
-    readonly opts: AgenticOptions;
-    readonly budget: number;
-    readonly scope: Scope<Outcome<unknown>>;
-    /** Run ONE worker shot; its harness-scored result, or null if it went down. */
-    shot(spec?: ShotSpec): Promise<ShotResult | null>;
-    /** The firewalled critic reads the trajectory → a steer string, or null on COMPLETE/down. */
-    critique(messages: Msg$1[]): Promise<string | null>;
-    /** The RAW analyst channel: the firewalled critic answers `instruction` over the
-     *  trajectory verbatim — no findings extraction, so verdict-shaped formats
-     *  (CONTINUE/STOP decisions, calibrated predictions) survive. Same firewall:
-     *  trajectory in, never scores. Null when the analyst went down. */
-    consult(messages: Msg$1[], instruction: string): Promise<string | null>;
-    /** The tools THIS artifact's task actually offers (names + descriptions only — never
-     *  the implementations). Tool sets vary per task on heterogeneous domains; a strategy
-     *  that restricts shots MUST select from this list, never from hardcoded names. */
-    listTools(handle: ArtifactHandle): Promise<Array<{
-        name: string;
-        description?: string;
-    }>>;
-}
-/** Author a Strategy from the composable steps — the open, compact way. */
-declare function defineStrategy(name: string, run: (ctx: StrategyCtx) => Promise<StrategyResult>): Strategy;
-/** A NEW strategy, authored from the steps (~20 lines): refine, but when a steered shot
- *  fails to improve the score it ABANDONS that line and restarts fresh (branch-when-stuck)
- *  — the widen/MCTS idea the depth-stuck failure motivated. Scored keep-best (the best
- *  checkpoint across all lines), the deployable metric. This is the "experts build BETTER
- *  optimizations" path: a new technique, compact, with zero Supervisor ceremony. */
-declare const adaptiveRefine: Strategy;
-/** The explore-then-exploit MIX: spend ⌈budget/2⌉ on independent samples (kept open),
- *  then refine the best-verifying line with the remaining budget. Sample's basin escape +
- *  refine's accumulation — the third built-in, authored from the public steps. */
-declare const sampleThenRefine: Strategy;
-interface RunAgenticOptions extends AgenticOptions {
-    surface: AgenticSurface;
-    task: AgenticTask;
-    /** Lifecycle observability — every spawn/settle (shots, analysts) streams here live.
-     *  The seam online watchdogs/route-auditors subscribe to. */
-    hooks?: RuntimeHooks;
-    /** A Strategy (the open way) — author/pass your own. Overrides `mode` when present. */
-    strategy?: Strategy;
-    /** Built-in shorthand: 'depth'→refine, 'breadth'→sample. Default 'depth'. */
-    mode?: 'depth' | 'breadth';
-    /** budget: refine→max shots; sample→rollout width. */
-    budget: number;
-    rootBudget?: Budget;
-}
-/** Run a Strategy through the keystone Supervisor — `Agent.act` over a conserved-budget Scope. */
-declare function runAgentic(opts: RunAgenticOptions): Promise<AgenticRunResult>;
-
 /**
  * runBenchmark — the packaged optimization suite. Define a domain by implementing an
  * `Environment` (open / tools / call / score / close); get the optimization strategies
@@ -1458,6 +1315,10 @@ interface McpEnvironmentOptions {
     /** Cap on a tool result's text fed back to the worker. Default 1500 chars. */
     maxResultChars?: number;
 }
+/** Coerce an MCP inputSchema to an OpenAI-tool-valid top-level object schema.
+ *  Shared with the same-host stdio client (`materializeLocalMcp`) — one coercion
+ *  rule for every MCP tool a worker sees, regardless of transport. */
+declare function sanitizeMcpToolSchema(s: unknown): Record<string, unknown>;
 /** Wrap any MCP server as an `Environment`: `tools/list` becomes `AgenticTool[]` with provider-safe schemas; the domain supplies only the artifact lifecycle hooks. */
 declare function createMcpEnvironment(opts: McpEnvironmentOptions): Environment;
 
@@ -1948,11 +1809,15 @@ declare function reportLoopUsage<Task, Output, Decision>(cost: UsageSink, result
  *                            through the resumable `bridgeExecutor`.
  *   - `backend: 'router'`  → OFF-BOX: a router chat-completion as the leaf executor,
  *                            presented as a `SandboxClient` (no sandbox dependency).
+ *   - `backend: 'local'`   → SAME-HOST: a router-brain tool loop with the
+ *                            profile's stdio MCP servers spawned as LOCAL child
+ *                            processes — the only backend that can reach an MCP
+ *                            server built into a host worktree.
  */
 
 interface ResolveSandboxClientOptions {
     /** The execution transport for the driven loop. */
-    backend: 'sandbox' | 'bridge' | 'router';
+    backend: 'sandbox' | 'bridge' | 'router' | 'local';
     /** `sandbox` backend: the caller's real Sandbox-backed client. Required for that backend. */
     sandboxClient?: SandboxClient;
     /** `bridge` backend: local cli-bridge transport. `bearer` + `model` required. */
@@ -1971,6 +1836,9 @@ interface ResolveSandboxClientOptions {
         key: string;
         model: string;
     };
+    /** `local` backend: same-host pseudo-box — the router brain drives a tool loop
+     *  with the profile's stdio MCP servers spawned as local children. */
+    local?: LocalSandboxClientOptions;
 }
 /**
  * Resolve a `SandboxClient` for the chosen backend. The generic, dep-light core
@@ -2504,6 +2372,108 @@ interface OpenSandboxRunOptions {
  */
 declare function openSandboxRun<Out>(client: SandboxClient, options: OpenSandboxRunOptions, deliverable: Deliverable<Out>): Promise<SandboxRun<Out>>;
 
+/**
+ * Same-host stdio MCP: the ONE persistent newline-delimited JSON-RPC 2.0
+ * connection to a spawned MCP server child process. This is the handshake
+ * `mcpServeVerifier` boots for its probe (`initialize` →
+ * `notifications/initialized` → `tools/list`), extracted so a trusted
+ * same-host consumer can keep the server running and route `tools/call` to it.
+ * This module does not isolate the child: callers must use a real sandbox for
+ * user- or model-authored code.
+ *
+ * Two layers:
+ *   - `connectStdioMcp`     — spawn ONE server at its cwd, run the real MCP
+ *     handshake, return a live connection: the listed tools, `callTool`, `close`.
+ *   - `materializeLocalMcp` — spawn EVERY enabled stdio server in
+ *     `profile.mcp`, namespace each server's tools as `<server>__<tool>` so
+ *     they can share a worker's tool list with a domain surface's tools, and
+ *     expose one route/close facade over the set. Fail-CLOSED: a declared
+ *     server that cannot boot throws — silently scoring the profile as if it
+ *     had no MCP surface would fake the with/without ablation.
+ *
+ * Failure taxonomy (mirrors `commandVerifier`/`mcpServeVerifier`): a missing
+ * start binary or spawn fault is a SETUP bug (`McpSpawnFault` — candidate
+ * graders must rethrow it, never score it); a server that crashes, errors the
+ * handshake, or times out is an ordinary `Error` carrying the stderr tail; a
+ * JSON-RPC error on `tools/call` is the AGENT's outcome — returned as an
+ * `ERROR: …` string, never thrown (the `createMcpEnvironment` convention).
+ *
+ * Protocol matches the runtime's own stdio MCP server (src/mcp/server.ts):
+ * newline-delimited JSON-RPC 2.0, protocol version 2024-11-05.
+ */
+
+interface StdioMcpServerSpec {
+    /** Command that starts the MCP server (stdio transport). */
+    command: string;
+    args?: string[];
+    /** Working directory the server starts in (a built candidate's worktree, typically). */
+    cwd?: string;
+    /** Declared public env for the server process. Only a minimal non-sensitive
+     * subset of the parent env is inherited. */
+    env?: Record<string, string>;
+    /** Sensitive env for the server process. These values override `env` and are
+     * redacted from child-supplied errors, tool metadata, and tool results. */
+    protectedEnv?: Record<string, string>;
+    /** Handshake AND per-request timeout (ms). Default 30s. */
+    timeoutMs?: number;
+}
+/** A missing start binary / spawn fault: a SETUP bug, never a failed candidate.
+ *  Graders (the serve verifier) must rethrow this instead of scoring it. */
+declare class McpSpawnFault extends Error {
+}
+interface McpToolDescriptor {
+    name: string;
+    description?: string;
+    inputSchema?: unknown;
+}
+interface StdioMcpConnection {
+    /** The tools the server exposed at connect time (`tools/list`). */
+    readonly tools: readonly McpToolDescriptor[];
+    /** `tools/call` → the result's text content. A JSON-RPC error / `isError`
+     *  result becomes an `ERROR: …` string (the agent's outcome); a dead
+     *  transport or timeout throws (an infra fault). */
+    callTool(name: string, args: Record<string, unknown>): Promise<string>;
+    /** Kill the server child. Idempotent. */
+    close(): Promise<void>;
+}
+/** Spawn a trusted host command, complete the stdio MCP handshake, and return
+ * the live connection. This low-level function provides no process isolation. */
+declare function connectStdioMcp(spec: StdioMcpServerSpec): Promise<StdioMcpConnection>;
+interface MaterializeLocalMcpOptions {
+    /** Handshake / per-request timeout per server (ms). Default 30s. */
+    timeoutMs?: number;
+    /** Cap on a tool result's text fed back to the worker. Default 2000 chars. */
+    maxResultChars?: number;
+    /** Resolves a server's DECLARED secrets (`metadata.secretEnv`: env var name →
+     *  provider key name) at spawn time. The resolved values reach ONLY the child
+     *  process env — never the profile, the logs, or an error message. Fail-closed:
+     *  a server declaring secrets without a provider (or with a missing key)
+     *  throws instead of booting keyless. */
+    keys?: KeyProvider;
+    /** Required trust decision for profiles that declare local MCP processes.
+     * Omit to refuse all profile-controlled host execution. Passing
+     * `allowLocalMcp: true` is only safe for an author-controlled profile: the
+     * process receives this Runtime's filesystem and network privileges. */
+    profileSecurityPolicy?: AgentProfileSecurityPolicy;
+}
+/** The live same-host materialization of a profile's `mcp` surface. */
+interface LocalMcpMaterialization {
+    /** Worker-facing tool specs: namespaced `<server>__<tool>`, provider-safe schemas. */
+    tools: AgenticTool[];
+    /** Whether `name` is one of this materialization's namespaced tools. */
+    owns(name: string): boolean;
+    /** Route a namespaced call to its server's live stdio child. */
+    call(name: string, args: Record<string, unknown>): Promise<string>;
+    /** Kill every spawned server. Idempotent. */
+    close(): Promise<void>;
+}
+/**
+ * Spawn every explicitly trusted stdio server in `profile.mcp` as a same-host
+ * child and expose its tools under `<server>__<tool>` names. The default policy
+ * refuses local processes. A profile with no MCP surface returns zero tools.
+ */
+declare function materializeLocalMcp(profile: AgentProfile$1, opts?: MaterializeLocalMcpOptions): Promise<LocalMcpMaterialization>;
+
 /**
  *
  * Leak-free steering drivers — the non-LLM controls for the driven loop.
@@ -3097,205 +3067,6 @@ declare function streamAgentTurn(backend: AgentTurnBackend, prompt: string, opts
  */
 declare function collectAgentTurn(stream: AsyncIterable<RuntimeStreamEvent>): Promise<CollectedAgentTurn>;
 
-/**
- * structuralRollout — the measured structural lever as a fourth member of the
- * sample/refine/sampleThenRefine strategy family: k independent samples, selection by
- * TASK-VISIBLE checks only, then a guarded self-repair loop steered by the checks'
- * failure output. Design: docs/design/structural-rollout-integration.md; measured basis
- * (bench/src/hev-structural.mts, bench/src/mbpp-structural.mts): +8.5..+21.3pp hidden-test
- * lift across Llama-3-8B/Qwen2.5-7B × HumanEval/MBPP, null only at saturation.
- *
- * Honesty invariants carried over from the proven rigs:
- *  - Visible checks are generated from task-visible information only, BEFORE any
- *    candidate exists, and FROZEN for every sample and repair round of the task.
- *  - OFFICIAL checks (shown in the task itself) rank lexicographically above
- *    model-AUTHORED guesses. This ordering is measured, not stylistic: authored guesses
- *    run 17–70% wrong depending on model × spec richness, and unweighted they flipped
- *    selection NEGATIVE on MBPP (6 noisy guesses outvoting the one reliable check).
- *  - A candidate that crashed before the checks could run ranks below one that ran and
- *    failed everything.
- *  - Repair sees ONLY the checks' failure output, and never displaces a candidate that
- *    passes more official checks with one that passes fewer (wrong visible examples
- *    poison repair at saturation — the glm /47,/116 regressions).
- *
- * Placement rule: this is an INFERENCE-TIME capability (it wraps the model call via the
- * strategy seam). It does not belong in improve()/selfImprove (training-time); improve()
- * may later tune `StructuralRolloutPolicy` as an optimizable surface.
- */
-
-type Msg = Record<string, unknown>;
-/** The rollout's compute recipe — promoted from the proven rigs' env vars (K/REPAIRS/
- *  TESTGEN/DIVERSE/TEMPERATURE). Defaults are the measured sweet spot: repair value
- *  concentrates at low k (~+12pp at k=1, +1–3pp at k=5), so `k=5, repairRounds=2` is the
- *  full recipe and `k=1, repairRounds=2` the low-compute preset. */
-interface StructuralRolloutPolicy {
-    /** Independent samples per task (selection breadth). */
-    k: number;
-    /** Repair shots after selection, each steered by the checks' failure output. */
-    repairRounds: number;
-    /** Model-authored visible checks requested per task; 0 disables authoring. */
-    testgen: number;
-    /** Per-slot strategy-lens prefixes on the k samples (attacks the all-k-fail bucket).
-     *  Measured as a paired null (+0.6pp) — kept as an optional knob, off by default. */
-    diverse?: boolean;
-    /** Sampling temperature for every shot of this strategy; omitted ⇒ the worker default. */
-    temperature?: number;
-}
-/** The measured default recipe: 5 samples, 2 guarded repair rounds, 6 authored checks. */
-declare const defaultStructuralRolloutPolicy: StructuralRolloutPolicy;
-/** One task-visible executable check (e.g. a single-line Python assert). */
-interface VisibleCheck {
-    code: string;
-    /** 'official' = shown in the task itself (docstring example, shown assert);
-     *  'authored' = the model's own guess. Official outranks authored in selection. */
-    kind: 'official' | 'authored';
-}
-/** What a CheckSource composes with. `consult` is the strategy family's raw analyst
- *  channel (metered by the conserved pool, offline-injectable via `opts.complete`) —
- *  check authoring goes through it rather than a bespoke model client. */
-interface CheckSourceCtx {
-    /** Authored-check budget for this task (`policy.testgen`). */
-    count: number;
-    /** The symbol authored checks must reference; undefined ⇒ authoring is skipped
-     *  (no guesses beats guesses pinned to nothing). */
-    entrySymbol?: string;
-    /** One metered LLM call: instruction in, reply text out, null when the channel went
-     *  down. The task's visible prompt is included by the channel itself. */
-    consult(instruction: string): Promise<string | null>;
-}
-/** Produces the task's visible checks. MUST derive them from agent-visible information
- *  only, before any candidate exists — the strategy freezes the returned set for every
- *  sample and repair round of the task. */
-interface CheckSource {
-    generate(task: AgenticTask, ctx: CheckSourceCtx): Promise<VisibleCheck[]>;
-}
-/** The proven authored-assert filter (lifted from the rigs' generateTests): keep only
- *  single-line, paren-balanced asserts that reference the entry symbol — malformed lines
- *  are dropped here rather than poisoning every candidate's score identically. */
-declare function filterAuthoredAsserts(reply: string, entrySymbol: string, count: number): string[];
-/** Default authored-check source: one metered LLM call per task, before sampling,
- *  filtered through `filterAuthoredAsserts`. Returns [] (no signal, never a fabricated
- *  check) when the budget is 0, no entry symbol resolves, or the channel went down. */
-declare function modelAuthoredChecks(overrides?: {
-    count?: number;
-}): CheckSource;
-/** Official checks the surface stashed on the task (e.g. MBPP's shown assert). Reads
- *  `task.meta[key]` as a string array; anything else means no official checks. */
-declare function officialChecksFromMeta(key?: string): CheckSource;
-/** Concatenate check sources (official first by convention — ordering does not affect
- *  scoring, which reads each check's `kind`). */
-declare function composeCheckSources(...sources: CheckSource[]): CheckSource;
-/** The symbol authored checks are pinned to: `task.meta.entryPoint` when the surface
- *  provides it, else the LAST `def name(` in the visible prompt (a code-completion stub
- *  lists helpers first, the entry stub last). Undefined ⇒ authoring is skipped. */
-declare function resolveEntrySymbol(task: AgenticTask): string | undefined;
-/** How one candidate fared against the frozen visible checks, split by check kind. */
-interface CheckOutcome {
-    passedOfficial: number;
-    totalOfficial: number;
-    passedAuthored: number;
-    totalAuthored: number;
-    /** The checks' failure report — the ONLY feedback the repair loop may see. */
-    failureOutput: string;
-    /** True when the candidate crashed before any check could run — ranks below a
-     *  candidate that ran and failed everything. */
-    crashed?: boolean;
-}
-/** Minimal exec channel the default runner needs. `SandboxInstance` (and therefore
- *  `ValidationCtx.box`) satisfies it structurally. */
-interface CheckExecChannel {
-    exec(command: string, options?: {
-        timeoutMs?: number;
-    }): Promise<{
-        exitCode: number;
-        stdout: string;
-        stderr: string;
-    }>;
-}
-interface CheckRunContext {
-    task: AgenticTask;
-    /** Live exec channel for this run (`ValidationCtx.box` / a sandbox instance). */
-    box?: CheckExecChannel;
-    signal?: AbortSignal;
-}
-/** Executes the frozen checks against one candidate. Implementations MUST fail loud
- *  (throw) when they cannot execute — a silent zero poisons selection. */
-interface CheckRunner {
-    run(candidate: string, checks: VisibleCheck[], ctx: CheckRunContext): Promise<CheckOutcome>;
-}
-/** Default CheckRunner backend: pipes the check program into `python3` over the sandbox
- *  exec channel (`ctx.box`, or one bound at construction). Never shells out to docker
- *  itself — the jail is the sandbox's concern. No channel ⇒ throws; it must never
- *  silently score 0. Empty check sets short-circuit to a no-signal outcome (nothing to
- *  execute, so no channel is required). */
-declare function sandboxCheckRunner(options?: {
-    box?: CheckExecChannel;
-    python?: string;
-    timeoutMs?: number;
-}): CheckRunner;
-/** The selection order: crash < ran; then official pass-fraction; authored guesses only
- *  break ties. Returns > 0 when `a` outranks `b`. Strictly lexicographic — on MBPP,
- *  letting 6 noisy guesses outvote the one official check flipped selection negative. */
-declare function compareCheckOutcomes(a: CheckOutcome, b: CheckOutcome): number;
-/** Display scalar for receipts/reports (the rigs' `visibleScore` shape): crash = -1,
- *  else official fraction + 0.001 × authored fraction. Selection itself uses the exact
- *  lexicographic comparator, never this scalar. */
-declare function visibleCheckScore(o: CheckOutcome): number;
-/** Argmax by `compareCheckOutcomes`, FIRST index wins ties (deterministic; with zero
- *  visible coverage every candidate ties at no-signal and index 0 is the blind pick). */
-declare function selectBestIndex(outcomes: ReadonlyArray<CheckOutcome>): number;
-/** The repair keep-best guard: a challenger displaces the incumbent only when it is
- *  strictly better in the selection order AND passes at least as many official checks.
- *  The raw-count clause is deliberate belt-and-braces over the comparator (a custom
- *  runner can report shifted totals): repair must NEVER replace a candidate that passes
- *  more official checks with one that passes fewer. */
-declare function canDisplace(challenger: CheckOutcome, incumbent: CheckOutcome): boolean;
-/** The candidate a shot produced, read from its conversation: the LAST `submit_answer`
- *  tool-call argument (verifier environments submit the artifact explicitly), else the
- *  latest assistant reply's fenced code block — preferring a block containing a `def`,
- *  because repair replies echo the failure report in a bare fence BEFORE the fixed code
- *  (the rigs' extractRepairCode lesson) — else the latest non-empty assistant text. */
-declare function defaultExtractCandidate(messages: ReadonlyArray<Msg>): string;
-type RepairStop = 'already-passing' | 'no-signal' | 'repaired-pass' | 'rounds-exhausted' | 'no-candidates';
-/** The body's deliverable — a `StrategyResult` plus selection provenance. The extra
- *  fields ride through `defineStrategy`'s deliverable spread onto `AgenticRunResult`
- *  (score/resolved stay harness-verified, exactly as for every authored strategy). */
-interface StructuralRolloutResult extends StrategyResult {
-    /** One receipt per scored candidate (k samples, then repairs), `SelectionReceipt`
-     *  shaped like the kernel's (`types.ts`), selector 'driver'. */
-    selection: SelectionReceipt[];
-    repairStop: RepairStop;
-    officialChecks: number;
-    authoredChecks: number;
-}
-interface StructuralRolloutConfig {
-    /** Knobs; missing fields take the measured defaults (k=5, repairRounds=2, testgen=6). */
-    policy?: Partial<StructuralRolloutPolicy>;
-    /** Where the visible checks come from. Default: official checks from
-     *  `task.meta.visibleChecks` composed with `modelAuthoredChecks()`. */
-    checkSource?: CheckSource;
-    /** How candidates are measured. Default `sandboxCheckRunner()` — it needs an exec
-     *  channel (bind one to the runner, or pass `box` here) and fails loud without one. */
-    checkRunner?: CheckRunner;
-    /** Exec channel threaded into every check run of this strategy (a sandbox instance /
-     *  `ValidationCtx.box`). The strategy seam itself carries no sandbox, so the caller
-     *  who owns one supplies it here or binds it into the runner. */
-    box?: CheckExecChannel;
-    /** Candidate extraction from a shot's conversation. Default `defaultExtractCandidate`. */
-    extractCandidate?: (messages: ReadonlyArray<Msg>) => string;
-}
-/**
- * Build the structuralRollout `Strategy`: k shots → score each by the frozen visible
- * checks (official above authored, crash lowest) → argmax with first-index tie-break →
- * up to `repairRounds` repair shots steered by the failure output, keep-best under the
- * official-check guard. Authored via `defineStrategy`, so the deliverable score stays
- * harness-verified and every shot is metered by the conserved pool.
- *
- * Budget note: `runAgentic`'s `budget` sizes the pool — pass at least
- * `k + repairRounds + 1` so the samples, repairs, and the check-author consult all admit.
- */
-declare function structuralRollout(config?: StructuralRolloutConfig): Strategy;
-
 /**
  *
  * The supervisor's intelligence is AUTHORING the agents it spawns — not pressing buttons.
@@ -4208,4 +3979,4 @@ declare function runInWorkspace<T>(ws: Workspace, body: (cwd: string) => Promise
     commitOnInvalid?: boolean;
 }): Promise<WorkspaceRun<T>>;
 
-export { Agent, AgentRunSpec, type AgentTurnBackend, type AgentTurnUsage, type AgenticOptions, type AgenticRunResult, type AgenticSurface, type AgenticTask, type AgenticTool, AnalystRegistry, type AnytimeReport, type AnytimeStrategySummary, type AnytimeTaskCurve, type ApplyContinuation, type ArtifactHandle, AssertTraceDerivedFindings, type AuditIntentInput, type AuditIntentOptions, type AuthorStrategyOptions, type AuthoredProfile, type AuthoredStrategy, type BenchmarkCell, type BenchmarkConfig, type BenchmarkLift, type BenchmarkReport, type BenchmarkStrategySummary, type BenchmarkTaskRow, Budget, type BudgetPool, type BudgetReadout, type ChampionPick, type ChampionPolicy, type CheckExecChannel, type CheckOutcome, type CheckRunContext, type CheckRunner, type CheckSource, type CheckSourceCtx, type CheckpointCapableBox, type CollectedAgentTurn, CombinatorShape, type CompletionAnalyst, type CompletionEvidence, type CompletionPolicy, type CompletionVerdict, CoordinationEvent, type CoordinationMcpHandle, Corpus, CorpusFilter, type CorpusReadbackOptions, CorpusRecord, type CreateScopeAnalystOptions, type CriuCapableClient, DefinePersonaInput, type DefinedLeaderboard, type DelegateOptions, type Deliverable, DeliverableSpec, Driver, type DriverAgentOptions, type DumbDriverOptions, type Environment, EqualKArm, EqualKOnCostOptions, EqualKVerdict, type EvolutionArchiveNode, type EvolutionAuthor, type EvolutionBandInfo, type EvolutionCandidate, type EvolutionGeneration, type EvolutionReport, ExecCtx, ExecutorConfig, ExecutorFactory, ExecutorRegistry, FanoutOptions, FanoutWinnerSelector, FileCorpus, type ForkCapableBox, type GitWorkspaceOptions, type HarvestCorpusOptions, type HarvestFailure, type HarvestReport, InMemoryCorpus, InMemoryResultBlobStore, type InMemoryRunContext, type InMemoryRunContextOptions, InMemorySpawnJournal, type InProcessOnPrompt, type InProcessPromptCtx, type InProcessSandboxClientOptions, type Inbox, type InboxMessage, type IntentAudit, type Interval, Iteration, type Leaderboard, type LeaderboardBenchScore, type LeaderboardBenchTask, type LeaderboardBenchmarkAdapter, type LeaderboardFlagSpec, type LeaderboardIterationInfo, type LeaderboardOptions, type LeaderboardRow, type LeaderboardRunContext, type LeaderboardScenario, type LeaderboardScore, type LeaderboardSpec, type LoopCampaignDispatchOptions, type LoopDispatchOptions, LoopLineageOptions, type LoopOptionsForDispatch, LoopResult, LoopShape, LoopTokenUsage, LoopUntilSpec, LoopWinner, MakeWorkerAgent, type McpEndpoint, type McpEnvironmentOptions, MountRecorder, type NaiveDriverOptions, type Observation, type ObserveInput, type ObserveOptions, type OpenSandboxRunBeforeStartContext, type OpenSandboxRunOptions, type OpenSandboxRunPromptOptions, Outcome, OutputAdapter, type PairwiseOptions, type PairwiseVerdict, PanelSpec, Persona, PipelineStage, type ProfileRichness, type ProfileRichnessThresholds, type PromotionGateOptions, type PromotionVerdict, type RegistryAnalyzeProjection, RenderCorpusToInstructionsOptions, type RepairStop, type ReservationTicket, type ResolveSandboxClientOptions, ResultBlobStore, RouterConfig, type RunAgenticOptions, RunPersonifiedOptions, type SandboxCapabilities, SandboxClient, type SandboxLineage, type SandboxLineageHandle, type SandboxRun, SandboxRunAbortError, type SandboxToolPartState, Scope, ScopeAnalyst, ScopeAnalyzeInput, ScopeWidenGate, SelectionReceipt, type SessionCapableBox, type SessionTraceBox, Settled, ShapeRegistry, type Shell, type ShotPersona, type ShotSpec, Spend, SteerContext, type SteeringDecision, type Strategy, type StrategyCtx, type StrategyEvolutionConfig, type StrategyResult, type StreamAgentTurnOptions, type StructuralRolloutConfig, type StructuralRolloutPolicy, type StructuralRolloutResult, type SuperviseSurfaceOptions, type SuperviseSurfaceResult, SupervisedResult, Supervisor, SupervisorProfile, type SurfaceScore, type SurfaceWorkerConfig, type SurfaceWorkerOut, ToolLoopChat, ToolLoopCompactionOptions, type TraceSource, type TrajectoryAnalysis, TrajectoryReport, TrajectoryReportOptions, type TurnResult, UsageEvent, type UsageSink, Validator, type VerifierEnvironmentOptions, VerifySpec, type VisibleCheck, type WatchTraceOptions, type WaterfallCollector, type WaterfallReport, type WaterfallSpan, WidenSpec, WinnerStrategy, type Workspace, type WorkspaceCommit, type WorkspaceRun, acquireSandbox, adaptiveRefine, analyzeTrace, anytimeReport, asAuthoredProfile, assertModelAllowed, assertStrategyContract, assertTraceDerivedFindings, assessAuthoredProfile, auditIntent, authorStrategy, authoredWorker, breadthStrategy, buildSteerContext, builtinShapes, canDisplace, collectAgentTurn, compareCheckOutcomes, completionAuthorizes, composeCheckSources, contentAddress, createBudgetPool, createInMemoryRunContext, createInbox, createMcpEnvironment, createPushTraceSource, createSandboxLineage, createSandboxToolPartState, createScope, createScopeAnalyst, createShapeRegistry, createSupervisor, createVerifierEnvironment, createWaterfallCollector, decodeToolPart, defaultAnalystInstruction, defaultAuditorInstruction, defaultDelegateBudget, defaultExtractCandidate, defaultProfileRichnessThresholds, defaultSelectWinner, defaultStructuralRolloutPolicy, defaultToolDetectors, defineLeaderboard, definePersona, defineStrategy, delegate, depthStrategy, deterministicCompletion, discriminatingMeans, driverAgent, dumbDriver, equalKOnCost, extractLlmCallEvent, failuresAnalyst, fanout, filterAuthoredAsserts, finalizeBestDelivered, flatWidenGate, gitWorkspace, harvestCorpus, inProcessSandboxClient, inlineSandboxClient, jjWorkspace, leaderboard, localShell, loopCampaignDispatch, loopDispatch, loopUntil, mapSandboxEvent, mapSandboxToolEvent, modelAuthoredChecks, naiveDriver, observe, officialChecksFromMeta, openSandboxRun, pairwiseSignificance, panel, pickChampion, pipeline, printBenchmarkReport, probeSandboxCapabilities, profileRichnessFinding, promotionGate, refine, registerShape, registryScopeAnalyst, renderAnytimeTable, renderCorpusToInstructions, renderLeaderboardHtml, renderLeaderboardMarkdown, renderLeaderboardSvg, renderPairwiseMarkdown, renderReport, reportLoopUsage, resolveEntrySymbol, resolveSandboxClient, runAgentic, runBenchmark, runInWorkspace, runLoop, runPersonified, runStrategyEvolution, sample, sampleThenRefine, sandboxCheckRunner, sandboxSessionTraceSource, selectBestIndex, selectChampion, selectValidWinner, sentinelCompletion, serveCoordinationMcp, settledToIteration, spendFromUsageEvents, stopSentinel, strategyAuthorContract, streamAgentTurn, structuralRollout, sumSandboxUsage, superviseSurface, supervisorInstructions, trajectoryReport, verify, visibleCheckScore, watchTrace, widen };
+export { Agent, AgentRunSpec, type AgentTurnBackend, type AgentTurnUsage, AgenticOptions, AgenticSurface, AgenticTask, AgenticTool, AnalystRegistry, type AnytimeReport, type AnytimeStrategySummary, type AnytimeTaskCurve, type ApplyContinuation, ArtifactHandle, AssertTraceDerivedFindings, type AuditIntentInput, type AuditIntentOptions, type AuthorStrategyOptions, type AuthoredProfile, type AuthoredStrategy, type BenchmarkCell, type BenchmarkConfig, type BenchmarkLift, type BenchmarkReport, type BenchmarkStrategySummary, type BenchmarkTaskRow, Budget, type BudgetPool, type BudgetReadout, type ChampionPick, type ChampionPolicy, type CheckpointCapableBox, type CollectedAgentTurn, CombinatorShape, type CompletionAnalyst, type CompletionEvidence, type CompletionPolicy, type CompletionVerdict, CoordinationEvent, type CoordinationMcpHandle, Corpus, CorpusFilter, CorpusRecord, type CreateScopeAnalystOptions, type CriuCapableClient, DefinePersonaInput, type DefinedLeaderboard, type DelegateOptions, type Deliverable, DeliverableSpec, Driver, type DriverAgentOptions, type DumbDriverOptions, type Environment, EqualKArm, EqualKOnCostOptions, EqualKVerdict, type EvolutionArchiveNode, type EvolutionAuthor, type EvolutionBandInfo, type EvolutionCandidate, type EvolutionGeneration, type EvolutionReport, ExecCtx, ExecutorConfig, ExecutorFactory, ExecutorRegistry, FanoutOptions, FanoutWinnerSelector, FileCorpus, type ForkCapableBox, type GitWorkspaceOptions, type HarvestCorpusOptions, type HarvestFailure, type HarvestReport, InMemoryCorpus, InMemoryResultBlobStore, type InMemoryRunContext, type InMemoryRunContextOptions, InMemorySpawnJournal, type InProcessOnPrompt, type InProcessPromptCtx, type InProcessSandboxClientOptions, type Inbox, type InboxMessage, type IntentAudit, type Interval, Iteration, type KeyProvider, type Leaderboard, type LeaderboardBenchScore, type LeaderboardBenchTask, type LeaderboardBenchmarkAdapter, type LeaderboardFlagSpec, type LeaderboardIterationInfo, type LeaderboardOptions, type LeaderboardRow, type LeaderboardRunContext, type LeaderboardScenario, type LeaderboardScore, type LeaderboardSpec, type LocalMcpMaterialization, type LocalSandboxClientOptions, type LoopCampaignDispatchOptions, type LoopDispatchOptions, LoopLineageOptions, type LoopOptionsForDispatch, LoopResult, LoopShape, LoopTokenUsage, LoopUntilSpec, LoopWinner, MakeWorkerAgent, type MaterializeLocalMcpOptions, type McpEndpoint, type McpEnvironmentOptions, McpSpawnFault, type McpToolDescriptor, MountRecorder, type NaiveDriverOptions, type Observation, type ObserveInput, type ObserveOptions, type OpenSandboxRunBeforeStartContext, type OpenSandboxRunOptions, type OpenSandboxRunPromptOptions, Outcome, OutputAdapter, type PairwiseOptions, type PairwiseVerdict, PanelSpec, Persona, PipelineStage, type ProfileRichness, type ProfileRichnessThresholds, type PromotionGateOptions, type PromotionVerdict, type RegistryAnalyzeProjection, RenderCorpusToInstructionsOptions, type ReservationTicket, type ResolveSandboxClientOptions, ResultBlobStore, RouterConfig, RunPersonifiedOptions, type SandboxCapabilities, SandboxClient, type SandboxLineage, type SandboxLineageHandle, type SandboxRun, SandboxRunAbortError, type SandboxToolPartState, Scope, ScopeAnalyst, ScopeAnalyzeInput, ScopeWidenGate, type SessionCapableBox, type SessionTraceBox, Settled, ShapeRegistry, type Shell, Spend, type StdioMcpConnection, type StdioMcpServerSpec, SteerContext, type SteeringDecision, Strategy, type StrategyEvolutionConfig, type StreamAgentTurnOptions, type SuperviseSurfaceOptions, type SuperviseSurfaceResult, SupervisedResult, Supervisor, SupervisorProfile, SurfaceScore, type SurfaceWorkerConfig, type SurfaceWorkerOut, ToolLoopChat, ToolLoopCompactionOptions, type TraceSource, type TrajectoryAnalysis, TrajectoryReport, TrajectoryReportOptions, type TurnResult, UsageEvent, type UsageSink, Validator, type VerifierEnvironmentOptions, VerifySpec, type WatchTraceOptions, type WaterfallCollector, type WaterfallReport, type WaterfallSpan, WidenSpec, WinnerStrategy, type Workspace, type WorkspaceCommit, type WorkspaceRun, acquireSandbox, analyzeTrace, anytimeReport, asAuthoredProfile, assertModelAllowed, assertStrategyContract, assertTraceDerivedFindings, assessAuthoredProfile, auditIntent, authorStrategy, authoredWorker, buildSteerContext, builtinShapes, collectAgentTurn, completionAuthorizes, connectStdioMcp, contentAddress, createBudgetPool, createInMemoryRunContext, createInbox, createMcpEnvironment, createPushTraceSource, createSandboxLineage, createSandboxToolPartState, createScope, createScopeAnalyst, createShapeRegistry, createSupervisor, createVerifierEnvironment, createWaterfallCollector, decodeToolPart, defaultAnalystInstruction, defaultAuditorInstruction, defaultDelegateBudget, defaultProfileRichnessThresholds, defaultSelectWinner, defaultToolDetectors, defineLeaderboard, definePersona, delegate, deterministicCompletion, discriminatingMeans, driverAgent, dumbDriver, envKeyProvider, equalKOnCost, extractLlmCallEvent, failuresAnalyst, fanout, finalizeBestDelivered, flatWidenGate, gitWorkspace, harvestCorpus, inProcessSandboxClient, inlineSandboxClient, jjWorkspace, leaderboard, localSandboxClient, localShell, loopCampaignDispatch, loopDispatch, loopUntil, mapSandboxEvent, mapSandboxToolEvent, materializeLocalMcp, mcpSecretEnvMetadataKey, naiveDriver, observe, openSandboxRun, pairwiseSignificance, panel, pickChampion, pipeline, printBenchmarkReport, probeSandboxCapabilities, profileRichnessFinding, promotionGate, registerShape, registryScopeAnalyst, renderAnytimeTable, renderCorpusToInstructions, renderLeaderboardHtml, renderLeaderboardMarkdown, renderLeaderboardSvg, renderPairwiseMarkdown, renderReport, reportLoopUsage, resolveSandboxClient, resolveSecretEnv, runBenchmark, runInWorkspace, runLoop, runPersonified, runStrategyEvolution, sandboxSessionTraceSource, sanitizeMcpToolSchema, secretEnvOfMcpServer, selectChampion, selectValidWinner, sentinelCompletion, serveCoordinationMcp, settledToIteration, spendFromUsageEvents, stopSentinel, strategyAuthorContract, streamAgentTurn, sumSandboxUsage, superviseSurface, supervisorInstructions, trajectoryReport, verify, watchTrace, widen };