@tangle-network/agent-runtime 0.266.0 → 0.273.3

package/dist/{runtime-hOLlAc1i.js → runtime-CHxXrUeZ.js}

@@ -1,24 +1,24 @@
-import { $i as cloneSpend, An as routerBrain, Bn as sandboxClientAsProvider, Dt as insideCursorNamespace, En as probeSandboxCapabilities, Et as InMemorySpawnJournal, Fi as detachedFrozen, Fn as LEAF_CONTINUATION_TASK, Hn as unavailableSignalOfFailure, Hr as harnessInvocation, M as settledToIteration, Mn as canonicalObservedModelParts, Ni as executableAgentProfileSnapshot, On as assertBoxlessPromptOptions, Pi as executableAgentSpecSnapshot, Pt as isTraceAnalysisStore, Qi as chargedTokens, Sn as defaultSelectWinner, Tn as createSandboxLineage, Tt as InMemoryResultBlobStore, Un as createPushTraceSource, Vn as unavailablePauseMs, Zi as addSpend, _t as createExecutorRegistry, aa as sleep, b as withDriverExecutor, da as zeroSpend, dt as rollingDispatch, fi as prepareJsonlAppend, fr as contentAddress, gt as createExecutor, ia as randomSuffix, jn as runBrainLoop, kn as readPromptOptions, mi as writeAllBytes, na as isAbortError, oa as stringifySafe, pi as readCommittedJsonLines, qi as notifySandboxEventObserver, r as createSupervisor, ta as hasCompleteCacheBreakdown, wn as runAgentRounds, ya as armDeadlineTimer, yt as createWorktreeCliExecutor } from "./supervisor-B8UMAXya.js";
+import { $i as detachedSnapshot, Ai as readCommittedJsonLines, Bn as runAgentRounds, Bt as SpawnEventIndex, Ca as stringifySafe, Ct as rollingDispatch, Gn as readPromptOptions, Hn as probeSandboxCapabilities, Ht as encodeResultBlob, Ia as armDeadlineTimer, Jn as canonicalObservedModelParts, Kn as routerBrain, M as withDriverExecutor, O as verdictFromJudgeScore, Oa as zeroSpend, Ot as createExecutor, Qi as detachedFrozen, Rn as defaultSelectWinner, Rt as InMemoryResultBlobStore, Sa as sleep, Ut as insideCursorNamespace, Vn as createSandboxLineage, Vt as assertContentAddress, W as settledToIteration, Wn as assertBoxlessPromptOptions, Xi as executableAgentProfileSnapshot, Xt as isTraceAnalysisStore, Zi as executableAgentSpecSnapshot, Zn as LEAF_CONTINUATION_TASK, _ as CheckUnavailableError, ai as harnessInvocation, ar as createPushTraceSource, ga as cloneSpend, ha as chargedTokens, ir as unavailableSignalOfFailure, ji as writeAllBytes, jt as createWorktreeCliExecutor, ki as prepareJsonlAppend, kr as contentAddress, kt as createExecutorRegistry, ma as addSpend, nr as sandboxClientAsProvider, qn as runBrainLoop, r as createSupervisor, rr as unavailablePauseMs, ua as notifySandboxEventObserver, va as hasCompleteCacheBreakdown, xa as randomSuffix, ya as isAbortError, zt as InMemorySpawnJournal } from "./supervisor-DdKPGluv.js";
 import { m as ValidationError, n as AnalystError, s as PlannerError } from "./errors-DodWX-cb.js";
-import { E as profileChatClient, S as ObservationError, T as renderReport, b as sample, k as strategyAuthorMethod, v as refine, w as observe, x as sampleThenRefine, y as runAgentic } from "./structural-rollout-DV9YoQF6.js";
+import { E as profileChatClient, S as ObservationError, T as renderReport, b as sample, k as strategyAuthorMethod, v as refine, w as observe, x as sampleThenRefine, y as runAgentic } from "./structural-rollout-DCUprNpH.js";
 import { a as concreteProfileModel, c as profileModelExecutionSettings, i as concreteModelId, l as profileProviderModel, o as enforceTokenLimits, t as assertExecutableAgentProfile } from "./model-policy-BbSCSak0.js";
 import { C as canonicalCandidateDigest$1, D as immutableCandidateValue, k as sha256Bytes$1, m as captureMaterializedWorkspace } from "./workspace-archive-C9lgf77y.js";
 import { i as notifyRuntimeHookEvent } from "./runtime-hooks-tXpAarhW.js";
-import { i as redactProtectedValue, r as redactProtectedReason } from "./protected-redaction--F3v1oo8.js";
-import "./coordination-driver-DdZ-nh_4.js";
-import { C as gateOnDeliverable, r as supervise, w as mapExecutorResult } from "./supervise--njTtSL3.js";
+import { i as redactProtectedValue, r as redactProtectedReason } from "./protected-redaction-DylCC_ot.js";
+import { S as foldCoordinationRecords, y as createInMemoryRunContext } from "./coordination-driver-CkcW4dxU.js";
+import { C as gateOnDeliverable, r as supervise, w as mapExecutorResult } from "./supervise-Dej5aSDa.js";
 import "./run-layout-vwd4SwX_.js";
-import "./provision-supervisor-Bf_bPaCv.js";
-import "./delegate-Ajx_PVyu.js";
-import "./graph-CK50N9vG.js";
-import { agentProfileSchema, canonicalAgentProfileDigest, canonicalCandidateDigest, validateAgentProfileSecurity } from "@tangle-network/agent-interface";
+import "./provision-supervisor-BKAvsDtP.js";
+import "./delegate-Dvb1-mE-.js";
+import "./graph-C69Uxtzt.js";
+import { agentProfileSchema, canonicalAgentProfileDigest, canonicalCandidateDigest, sha256Bytes, validateAgentProfileSecurity } from "@tangle-network/agent-interface";
 import { CODING_HARNESSES, DEFAULT_TRACE_ANALYST_KINDS, InMemoryTraceStore, OUTPUT_VALUE, benjaminiHochberg, buildTrajectory, computeFindingId as computeFindingId$1, confidenceInterval, createTraceAnalyst, expandProfileAxes, makeFinding as makeFinding$1, pairedBootstrap, paretoFrontier, wilcoxonSignedRank, wilson } from "@tangle-network/agent-eval";
 import { createAgentRunOutcomeTracker } from "@tangle-network/sandbox/runtime";
 import { createHash, randomUUID } from "node:crypto";
 import { execFile, execFileSync, spawn, spawnSync } from "node:child_process";
 import { appendFileSync, chmodSync, constants, copyFileSync, existsSync, lstatSync, mkdirSync, mkdtempSync, readFileSync, readlinkSync, rmSync, symlinkSync, writeFileSync } from "node:fs";
 import { dirname, isAbsolute, join, relative, resolve, sep } from "node:path";
-import { cp, mkdir, mkdtemp, readFile, realpath, stat, writeFile } from "node:fs/promises";
+import { cp, mkdir, mkdtemp, readFile, readdir, realpath, rm, stat, writeFile } from "node:fs/promises";
 import { materializeProfile } from "@tangle-network/agent-profile-materialize";
 import { tmpdir } from "node:os";
 import { isDeepStrictEqual, promisify } from "node:util";
@@ -848,6 +848,433 @@ async function materializeLocalMcp(profile, opts = {}) {
 	};
 }
 //#endregion
+//#region src/durable/spawn-journal-sql.ts
+/**
+* SQL-backed durable stores for supervised runs — `SqlSpawnJournal` and `SqlResultBlobStore`
+* over the same minimal statement seam `SqlConversationJournal` uses (D1, postgres, sqlite,
+* libSQL; positional `?` placeholders). This closes the orchestration-durability gap recorded in
+* `conformance/durability/STATUS.md`: until now the spawn layer was file-only.
+*
+* Parity with the JSONL file stores, by construction:
+*   • same corruption guards — `beginTree` precedes events (enforced by the schema: an event row
+*     names a tree row), duplicate cursor seqs and duplicate materialization receipts are refused
+*     by the same `SpawnEventIndex` the file journal replays through, on both append and load;
+*   • same content-address law for blobs — a `put` whose ref does not hash to the artifact is
+*     refused, a re-put of the same ref asserts the identical bytes;
+*   • load order is insertion order (`INTEGER PRIMARY KEY AUTOINCREMENT`), the SQL analogue of
+*     the JSONL append-only spine.
+*
+* Durability note: this suite and its process-kill test run against `node:sqlite`, whose
+* autocommit commits survive SIGKILL (process death, not OS crash). A deployment that must
+* survive power loss sets its driver's synchronous mode (`PRAGMA synchronous=FULL` + WAL) at the
+* adapter; agent-runtime takes no opinion.
+*
+* @experimental — draft: cross-process ownership is single-writer by convention (the same
+* limitation `createFileRunContext` documents); a machine-visible ownership lease is follow-up.
+*/
+const TREES_DDL = (table) => `
+  CREATE TABLE IF NOT EXISTS ${table}_trees (
+    root TEXT PRIMARY KEY,
+    begun_at TEXT NOT NULL
+  )
+`;
+const EVENTS_DDL = (table) => `
+  CREATE TABLE IF NOT EXISTS ${table}_events (
+    id INTEGER PRIMARY KEY AUTOINCREMENT,
+    root TEXT NOT NULL REFERENCES ${table}_trees (root),
+    body TEXT NOT NULL
+  )
+`;
+const BLOBS_DDL = (table) => `
+  CREATE TABLE IF NOT EXISTS ${table}_blobs (
+    ref TEXT PRIMARY KEY,
+    body TEXT NOT NULL
+  )
+`;
+/** SQL-backed `SpawnJournal`. One row per event; insertion order is replay order. */
+var SqlSpawnJournal = class {
+	db;
+	table;
+	cache = /* @__PURE__ */ new Map();
+	appendTail = Promise.resolve();
+	constructor(db, table = "runtime_spawn_journal") {
+		this.db = db;
+		this.table = table;
+	}
+	/** Create the journal's tables if absent. Idempotent. */
+	async migrate() {
+		await this.db.exec(TREES_DDL(this.table));
+		await this.db.exec(EVENTS_DDL(this.table));
+	}
+	async loadTree(root) {
+		if ((await this.db.query(`SELECT begun_at FROM ${this.table}_trees WHERE root = ?`, [root])).length === 0) return void 0;
+		const rows = await this.db.query(`SELECT id, body FROM ${this.table}_events WHERE root = ? ORDER BY id`, [root]);
+		const index = new SpawnEventIndex(root);
+		const events = [];
+		for (const row of rows) {
+			const event = JSON.parse(row.body);
+			index.assert(event);
+			index.add(event);
+			events.push(event);
+		}
+		return events;
+	}
+	async beginTree(root, at) {
+		return this.serializeAppend(async () => {
+			await this.ensureMigrated();
+			const existing = await this.db.query(`SELECT begun_at FROM ${this.table}_trees WHERE root = ?`, [root]);
+			if (existing.length > 0) {
+				const begunAt = existing[0]?.begun_at;
+				if (begunAt !== at) throw new Error(`spawn tree '${root}' already begun in SQL at ${begunAt}; refusing to overwrite with ${at}`);
+				return;
+			}
+			await this.db.exec(`INSERT INTO ${this.table}_trees (root, begun_at) VALUES (?, ?)`, [root, at]);
+			this.cache.set(root, {
+				maxId: 0,
+				index: new SpawnEventIndex(root)
+			});
+		});
+	}
+	async appendEvent(root, ev) {
+		const event = detachedSnapshot(ev, "spawn event");
+		return this.serializeAppend(async () => {
+			await this.ensureMigrated();
+			const state = await this.validationIndex(root);
+			state.index.assert(event);
+			if ((await this.db.exec(`INSERT INTO ${this.table}_events (root, body) VALUES (?, ?)`, [root, JSON.stringify(event)])).rowsAffected !== 1) throw new Error(`spawn journal SQL: append of an event for tree '${root}' affected no rows`);
+			state.index.add(event);
+			state.maxId = await this.maxEventId(root);
+		});
+	}
+	async validationIndex(root) {
+		if ((await this.db.query(`SELECT begun_at FROM ${this.table}_trees WHERE root = ?`, [root])).length === 0) throw new Error(`appendEvent called for unknown spawn tree '${root}'; call beginTree first`);
+		const max = await this.maxEventId(root);
+		const cached = this.cache.get(root);
+		if (cached && cached.maxId === max) return cached;
+		const index = new SpawnEventIndex(root);
+		if (max > 0) {
+			const rows = await this.db.query(`SELECT body FROM ${this.table}_events WHERE root = ? ORDER BY id`, [root]);
+			for (const row of rows) {
+				const event = JSON.parse(row.body);
+				index.assert(event);
+				index.add(event);
+			}
+		}
+		const state = {
+			maxId: max,
+			index
+		};
+		this.cache.set(root, state);
+		return state;
+	}
+	async maxEventId(root) {
+		return (await this.db.query(`SELECT MAX(id) AS max FROM ${this.table}_events WHERE root = ?`, [root]))[0]?.max ?? 0;
+	}
+	migrated = false;
+	async ensureMigrated() {
+		if (this.migrated) return;
+		await this.migrate();
+		this.migrated = true;
+	}
+	serializeAppend(operation) {
+		const append = this.appendTail.then(operation);
+		this.appendTail = append.catch(() => void 0);
+		return append;
+	}
+};
+/** SQL-backed `ResultBlobStore`. One content-addressed row per settled result. */
+var SqlResultBlobStore = class {
+	db;
+	table;
+	migrated = false;
+	constructor(db, table = "runtime_result_blobs") {
+		this.db = db;
+		this.table = table;
+	}
+	async migrate() {
+		await this.db.exec(BLOBS_DDL(this.table));
+	}
+	async put(outRef, artifact) {
+		await this.ensureMigrated();
+		const { text } = encodeResultBlob(outRef, artifact);
+		if ((await this.db.exec(`INSERT OR IGNORE INTO ${this.table}_blobs (ref, body) VALUES (?, ?)`, [outRef, text])).rowsAffected === 1) return;
+		assertContentAddress(outRef, await this.get(outRef));
+	}
+	async get(outRef) {
+		await this.ensureMigrated();
+		const rows = await this.db.query(`SELECT body FROM ${this.table}_blobs WHERE ref = ?`, [outRef]);
+		if (rows.length === 0) return void 0;
+		const artifact = JSON.parse(rows[0]?.body ?? "null");
+		assertContentAddress(outRef, artifact);
+		return artifact;
+	}
+	async ensureMigrated() {
+		if (this.migrated) return;
+		await this.migrate();
+		this.migrated = true;
+	}
+};
+//#endregion
+//#region src/durable/sql-run-store.ts
+/** Refuses a competing or stale SQL run owner before it can publish new work. */
+var SqlRunOwnershipError = class extends Error {
+	constructor(message) {
+		super(message);
+		this.name = "SqlRunOwnershipError";
+	}
+};
+/**
+* Append-only immutable records, published by ONE compare-and-set of the run's head.
+*
+* SqlAdapter has no pinned-connection transaction API. INSERT ... SELECT owner is NOT a
+* fence on MVCC databases: its snapshot can outlive a takeover. Here both publication and
+* takeover UPDATE the SAME row. Unpublished records are harmless, unreachable staging.
+* Healthy appends write only their new payload and one fixed-size head, never the history.
+*
+* Liveness uses a persisted progress counter, not incomparable host clocks. A contender must
+* observe the SAME generation/counter for leaseMs before replacing it with a CAS. Every
+* heartbeat and publication advances that counter. The interval is stored per run so a
+* differently configured contender cannot shorten an existing owner's lease.
+* @internal
+*/
+async function openSqlRunStore(db, runId, options = {}) {
+	const prefix = options.tablePrefix ?? "agent_run";
+	const leaseMs = options.leaseMs ?? 3e4;
+	const heartbeatMs = options.heartbeatMs ?? Math.floor(leaseMs / 3);
+	if (!/^[A-Za-z_][A-Za-z0-9_]{0,39}$/.test(prefix)) throw new Error("SQL run context tablePrefix must be a SQL identifier of at most 40 characters");
+	if (typeof runId !== "string" || runId.length === 0) throw new Error("SQL runId must be nonempty");
+	if (!Number.isSafeInteger(leaseMs) || leaseMs < 100 || leaseMs > 2147483647) throw new Error("SQL leaseMs must be an integer between 100 and 2147483647");
+	if (!Number.isSafeInteger(heartbeatMs) || heartbeatMs < 1 || heartbeatMs > leaseMs / 3) throw new Error("SQL heartbeatMs must be a positive integer no greater than leaseMs / 3");
+	const heads = `${prefix}_heads`;
+	const records = `${prefix}_records`;
+	await db.exec(`CREATE TABLE IF NOT EXISTS ${heads} (
+    run_id TEXT PRIMARY KEY,
+    owner TEXT NOT NULL,
+    generation INTEGER NOT NULL,
+    pulse INTEGER NOT NULL,
+    head TEXT NOT NULL,
+    revision INTEGER NOT NULL,
+    lease_ms INTEGER NOT NULL,
+    namespace TEXT NOT NULL
+  )`);
+	await db.exec(`CREATE TABLE IF NOT EXISTS ${records} (
+    run_id TEXT NOT NULL,
+    id TEXT NOT NULL,
+    parent TEXT NOT NULL,
+    revision INTEGER NOT NULL,
+    payload TEXT NOT NULL,
+    PRIMARY KEY (run_id, id)
+  )`);
+	await db.exec(`INSERT INTO ${heads} (run_id, owner, generation, pulse, head, revision, lease_ms, namespace)
+     VALUES (?, '', 0, 0, '', 0, ?, ?) ON CONFLICT (run_id) DO NOTHING`, [
+		runId,
+		leaseMs,
+		randomUUID()
+	]);
+	async function readHead() {
+		const [row] = await db.query(`SELECT * FROM ${heads} WHERE run_id = ?`, [runId]);
+		if (!row) throw new Error(`SQL run '${runId}' has no head`);
+		for (const key of [
+			"generation",
+			"pulse",
+			"revision",
+			"lease_ms"
+		]) {
+			row[key] = Number(row[key]);
+			if (!Number.isSafeInteger(row[key]) || row[key] < 0) throw new Error(`SQL run '${runId}' has an invalid ${key}`);
+		}
+		if (typeof row.namespace !== "string" || row.namespace.length === 0 || typeof row.head !== "string" || typeof row.owner !== "string" || row.head === "" !== (row.revision === 0)) throw new Error(`SQL run '${runId}' has an invalid head`);
+		if (row.lease_ms !== leaseMs) throw new Error(`SQL run '${runId}' lease configuration differs: recorded ${row.lease_ms}ms, requested ${leaseMs}ms`);
+		return row;
+	}
+	async function load(head) {
+		if (head.revision === 0) return [];
+		const rows = await db.query(`SELECT id, parent, revision, payload FROM ${records} WHERE run_id = ? AND revision <= ?`, [runId, head.revision]);
+		const byId = new Map(rows.map((row) => [row.id, row]));
+		const history = [];
+		let id = head.head;
+		for (let revision = head.revision; revision > 0; revision -= 1) {
+			const row = byId.get(id);
+			if (!row || Number(row.revision) !== revision || recordId(row.parent, revision, row.payload) !== id) throw new Error(`SQL run '${runId}' has a missing or corrupt committed record at revision ${revision}`);
+			history.push(JSON.parse(row.payload));
+			id = row.parent;
+		}
+		if (id !== "") throw new Error(`SQL run '${runId}' has an invalid history origin`);
+		return history.reverse();
+	}
+	return {
+		namespace: (await readHead()).namespace,
+		async read() {
+			return load(await readHead());
+		},
+		async acquire(signal) {
+			signal?.throwIfAborted();
+			const observed = await readHead();
+			if (observed.owner !== "") await wait(leaseMs, signal);
+			signal?.throwIfAborted();
+			const owner = randomUUID();
+			let claimed = false;
+			try {
+				claimed = (await db.exec(`UPDATE ${heads} SET owner = ?, generation = generation + 1, pulse = pulse + 1
+           WHERE run_id = ? AND owner = ? AND generation = ? AND pulse = ?`, [
+					owner,
+					runId,
+					observed.owner,
+					observed.generation,
+					observed.pulse
+				])).rowsAffected === 1;
+			} catch (error) {
+				if ((await readHead().catch(() => void 0))?.owner !== owner) throw error;
+				claimed = true;
+			}
+			if (!claimed) throw new SqlRunOwnershipError(`SQL run '${runId}' is owned by another live process`);
+			const generation = observed.generation + 1;
+			const controller = new AbortController();
+			let accepting = true;
+			let released;
+			let tail = Promise.resolve();
+			let heartbeat;
+			let progressAt = performance.now();
+			let head = observed.head;
+			let revision = observed.revision;
+			let history = [];
+			const lose = (error) => {
+				accepting = false;
+				clearInterval(timer);
+				controller.abort(error);
+			};
+			const timer = setInterval(() => {
+				if (controller.signal.aborted) return;
+				if (performance.now() - progressAt >= leaseMs) {
+					lose(new SqlRunOwnershipError(`SQL run '${runId}' lease heartbeat expired`));
+					return;
+				}
+				if (heartbeat) return;
+				heartbeat = db.exec(`UPDATE ${heads} SET pulse = pulse + 1 WHERE run_id = ? AND owner = ? AND generation = ?`, [
+					runId,
+					owner,
+					generation
+				]).then((result) => {
+					if (result.rowsAffected !== 1) throw new SqlRunOwnershipError(`SQL run '${runId}' lease was replaced`);
+					progressAt = performance.now();
+				}).catch(lose).finally(() => {
+					heartbeat = void 0;
+				});
+			}, heartbeatMs);
+			timer.unref();
+			const lease = {
+				signal: controller.signal,
+				get records() {
+					return JSON.parse(JSON.stringify(history));
+				},
+				append(payload) {
+					if (!accepting) return Promise.reject(controller.signal.reason ?? new SqlRunOwnershipError(`SQL run '${runId}' lease is released`));
+					let encoded;
+					try {
+						encoded = JSON.stringify(payload);
+						if (encoded === void 0) throw new Error("SQL run records must be JSON serializable");
+					} catch (error) {
+						return Promise.reject(error);
+					}
+					const write = tail.then(async () => {
+						controller.signal.throwIfAborted();
+						const nextRevision = revision + 1;
+						const id = recordId(head, nextRevision, encoded);
+						try {
+							await db.exec(`INSERT INTO ${records} (run_id, id, parent, revision, payload) VALUES (?, ?, ?, ?, ?)
+                 ON CONFLICT (run_id, id) DO NOTHING`, [
+								runId,
+								id,
+								head,
+								nextRevision,
+								encoded
+							]);
+						} catch (error) {
+							const [staged] = await db.query(`SELECT id, parent, revision, payload FROM ${records} WHERE run_id = ? AND id = ?`, [runId, id]).catch(() => []);
+							if (!staged || staged.payload !== encoded || staged.parent !== head || Number(staged.revision) !== nextRevision) throw error;
+						}
+						controller.signal.throwIfAborted();
+						let published = false;
+						let failure;
+						try {
+							published = (await db.exec(`UPDATE ${heads} SET head = ?, revision = ?, pulse = pulse + 1
+                 WHERE run_id = ? AND owner = ? AND generation = ? AND head = ? AND revision = ?`, [
+								id,
+								nextRevision,
+								runId,
+								owner,
+								generation,
+								head,
+								revision
+							])).rowsAffected === 1;
+						} catch (error) {
+							failure = error;
+						}
+						if (!published) {
+							const current = await readHead();
+							if (current.owner !== owner || current.generation !== generation) throw new SqlRunOwnershipError(`SQL run '${runId}' lease was replaced before publication`);
+							if (current.head !== id || current.revision !== nextRevision) throw failure ?? new SqlRunOwnershipError(`SQL run '${runId}' publication conflicted`);
+						}
+						controller.signal.throwIfAborted();
+						head = id;
+						revision = nextRevision;
+						history.push(JSON.parse(encoded));
+						progressAt = performance.now();
+					});
+					tail = write.catch(lose);
+					return write;
+				},
+				release() {
+					if (released) return released;
+					accepting = false;
+					released = (async () => {
+						await tail;
+						clearInterval(timer);
+						try {
+							await db.exec(`UPDATE ${heads} SET owner = '', pulse = pulse + 1 WHERE run_id = ? AND owner = ? AND generation = ?`, [
+								runId,
+								owner,
+								generation
+							]);
+						} finally {
+							controller.abort(new SqlRunOwnershipError(`SQL run '${runId}' lease is released`));
+						}
+					})();
+					return released;
+				}
+			};
+			try {
+				history = await load(observed);
+				signal?.throwIfAborted();
+				controller.signal.throwIfAborted();
+				return lease;
+			} catch (error) {
+				await lease.release().catch(() => void 0);
+				throw error;
+			}
+		}
+	};
+}
+function recordId(parent, revision, payload) {
+	return createHash("sha256").update(`${revision}\0${parent}\0${payload}`).digest("hex");
+}
+function wait(ms, signal) {
+	return new Promise((resolve, reject) => {
+		const cleanup = () => signal?.removeEventListener("abort", abort);
+		const timer = setTimeout(() => {
+			cleanup();
+			resolve();
+		}, ms);
+		const abort = () => {
+			clearTimeout(timer);
+			cleanup();
+			reject(signal?.reason);
+		};
+		if (signal?.aborted) abort();
+		else signal?.addEventListener("abort", abort, { once: true });
+	});
+}
+//#endregion
 //#region src/runtime/audit-intent.ts
 /** Default system instruction for intent-auditor agents: diagnose diverged/drifting trajectories. */
 const defaultAuditorInstruction = "You audit whether an AI agent is on the RIGHT ROUTE — not whether it works hard, but whether its actions serve the stated intents. Infer the REVEALED intent from the action pattern (what the trajectory is actually optimizing). Compare against the declared task intent, the user intent when given, and the meta-intent when given. Flawless execution down the wrong route is DIVERGED. Busy-work that neither advances nor harms is DRIFTING. Judge only from the trajectory — be specific about which actions ground your verdict. Recommend abort only when continuing cannot serve the intent.";
@@ -1361,256 +1788,909 @@ function deterministicCompletion(check) {
 	} };
 }
 //#endregion
-//#region src/runtime/loop-dispatch.ts
-/** Bridge a campaign `DispatchContext.trace` to a `LoopTraceEmitter` so every
-*  `loop.*` event lands as a span under the cell's scoped trace. */
-function campaignTraceToLoopEmitter(trace) {
-	return { emit(event) {
-		trace.span(event.kind, {
-			runId: event.runId,
-			timestamp: event.timestamp,
-			...event.payload
-		}).end();
-	} };
-}
-async function runLoopForCell(opts, scenario, profile, ctx) {
-	const loopOptions = opts.toLoopOptions(scenario, profile);
-	return runLoopWithCampaignContext(opts, loopOptions, ctx, {
-		model: profile.model?.default ?? modelFromLoopOptions(loopOptions),
-		maximumCharge: typeof opts.maximumCharge === "function" ? opts.maximumCharge(scenario, profile) : opts.maximumCharge,
-		resolveModel: opts.resolveCostModel ? (result) => opts.resolveCostModel?.(result, scenario, profile) : void 0
-	});
-}
-async function runLoopWithCampaignContext(opts, loopOptions, ctx, cost) {
-	const paid = await ctx.cost.runPaidCall({
-		channel: "agent",
-		actor: opts.costSource ?? "loop",
-		model: cost.model,
-		signal: ctx.signal,
-		...cost.maximumCharge ? { maximumCharge: cost.maximumCharge } : {},
-		execute: (executionSignal) => runAgentRounds({
-			...loopOptions,
-			ctx: {
-				sandboxClient: opts.sandboxClient,
-				...opts.promptOptions === void 0 ? {} : { promptOptions: opts.promptOptions },
-				signal: executionSignal,
-				traceEmitter: opts.forwardTrace === false ? void 0 : campaignTraceToLoopEmitter(ctx.trace)
+//#region src/runtime/isolated-checker.ts
+const toolchains = [
+	"/usr",
+	"/bin",
+	"/lib",
+	"/lib64"
+];
+const contains = (parent, child) => {
+	const path = relative(parent, child);
+	return path === "" || path !== ".." && !path.startsWith(`..${sep}`) && !path.startsWith(sep);
+};
+/**
+* Run an untrusted check in Linux Bubblewrap, or in its own Sandbox box when `box` is set.
+* Never falls back to host execution.
+*
+* Bubblewrap requires /usr/bin/bwrap and permission to create Linux namespaces.
+* Only trusted system toolchains, private proc/dev/tmp, and the writable copy are mounted.
+* The canonical input path remains the working directory; copy writes are discarded.
+* Limits bound command time and captured output, not copy size or memory consumption.
+* Callers must keep the input and trusted toolchains stable while preparing the check.
+*
+* A box check creates one fresh box with no owner secrets and blocked egress (or strict egress to
+* the placement's named domains), delivers the tree's regular files verified by sha256, runs the
+* command there with only the environment `env` names, and deletes the box.
+*/
+async function runIsolatedCheck(options) {
+	if (options.box) return runInBox(options, options.box);
+	let scratch;
+	let result;
+	try {
+		if (process.platform !== "linux") throw new Error("Linux Bubblewrap namespaces are required");
+		const { timeoutMs, maxOutputBytes } = checkLimits(options);
+		if (options.signal?.aborted) return {
+			succeeded: false,
+			reason: "cancelled",
+			diagnostic: "Check cancelled"
+		};
+		const { workspace, tree } = await protectedTree(options);
+		const binds = [];
+		for (const path of toolchains) {
+			let actual;
+			try {
+				actual = await realpath(path);
+			} catch (error) {
+				if (error.code === "ENOENT") continue;
+				throw error;
 			}
-		}),
-		receipt: (result) => loopCostReceipt(result, cost.resolveModel?.(result) ?? cost.model)
-	});
-	if (!paid.succeeded) throw paid.error;
-	const result = paid.value;
-	return (opts.toArtifact ?? ((r) => r.winner?.output))(result);
+			for (const mount of [path, actual]) if (contains(mount, workspace) || contains(workspace, mount) || contains(mount, tree) || contains(tree, mount)) throw new Error(`Toolchain overlaps protected workspace: ${path}`);
+			binds.push("--ro-bind", actual, path);
+		}
+		if (["/proc", "/dev"].some((path) => contains(path, tree) || contains(tree, path))) throw new Error("Tree overlaps a reserved namespace mount");
+		scratch = await mkdtemp(join(tmpdir(), "runtime-check-"));
+		if (contains(tree, scratch)) throw new Error("Temporary storage must be outside the input tree");
+		const copy = join(scratch, "tree");
+		await cp(tree, copy, {
+			recursive: true,
+			dereference: false,
+			verbatimSymlinks: true
+		});
+		result = await execute([
+			"--unshare-all",
+			"--die-with-parent",
+			"--new-session",
+			"--cap-drop",
+			"ALL",
+			"--clearenv",
+			"--setenv",
+			"PATH",
+			"/usr/bin:/bin",
+			"--setenv",
+			"HOME",
+			"/tmp",
+			"--setenv",
+			"LANG",
+			"C",
+			...Object.entries(options.env ?? {}).flatMap(([name, value]) => [
+				"--setenv",
+				name,
+				value
+			]),
+			...binds,
+			"--proc",
+			"/proc",
+			"--dev",
+			"/dev",
+			"--tmpfs",
+			"/tmp",
+			"--bind",
+			copy,
+			tree,
+			"--chdir",
+			tree,
+			"--",
+			...options.command
+		], timeoutMs, maxOutputBytes, options.signal);
+	} catch (error) {
+		result = {
+			succeeded: false,
+			reason: "refused",
+			diagnostic: String(error)
+		};
+	}
+	if (scratch) try {
+		await removeScratch(scratch);
+	} catch (error) {
+		const cleanupDiagnostic = String(error);
+		result = result.succeeded ? {
+			succeeded: false,
+			reason: "cleanup-failed",
+			diagnostic: cleanupDiagnostic,
+			stdout: result.value.stdout,
+			stderr: result.value.stderr,
+			exitCode: 0
+		} : {
+			...result,
+			cleanupDiagnostic
+		};
+	}
+	return result;
 }
-function loopCostReceipt(result, model) {
-	return costReceiptFromUsage(result.tokenUsage, model, {
-		usageUnknown: result.tokenUsage.tokensKnown === false,
-		actualCostUsd: result.costUsdKnown !== false ? result.costUsd : void 0,
-		costUnknown: result.costUsdKnown === false,
-		estimatedCostUsd: result.estimatedCostUsd
-	});
+function checkLimits(options) {
+	const timeoutMs = options.timeoutMs ?? 3e4;
+	const maxOutputBytes = options.maxOutputBytes ?? 1048576;
+	if (!Number.isSafeInteger(timeoutMs) || timeoutMs < 1 || timeoutMs > 2147483647 || !Number.isSafeInteger(maxOutputBytes) || maxOutputBytes < 1) throw new Error("Invalid execution limits");
+	if (!options.command.length || !options.command[0]) throw new Error("A command is required");
+	return {
+		timeoutMs,
+		maxOutputBytes
+	};
 }
-/** Map Runtime usage into Eval's canonical paid-call receipt without inventing cache classes. */
-function costReceiptFromUsage(usage, model, cost) {
-	const cacheComplete = hasCompleteCacheBreakdown(usage) && (usage.freshInput !== void 0 || usage.cacheRead !== void 0 || usage.cacheWrite !== void 0);
-	const cacheRead = cacheComplete ? usage.cacheRead ?? 0 : void 0;
-	const cacheWrite = cacheComplete ? usage.cacheWrite ?? 0 : void 0;
-	const classified = (cacheRead ?? 0) + (cacheWrite ?? 0);
+async function protectedTree(options) {
+	const workspace = await realpath(options.workspaceRoot);
+	const tree = await realpath(options.tree);
+	if (!contains(workspace, tree) || !(await stat(tree)).isDirectory()) throw new Error("Tree must be a directory inside the workspace");
 	return {
-		model,
-		inputTokens: cacheComplete ? usage.input - classified : usage.input,
-		outputTokens: usage.output,
-		...cacheComplete ? {
-			cachedTokens: cacheRead,
-			cacheWriteTokens: cacheWrite
-		} : {},
-		...usage.tokensKnown === false || cost.usageUnknown ? { usageUnknown: true } : {},
-		...cost.actualCostUsd !== void 0 ? { actualCostUsd: cost.actualCostUsd } : {},
-		...cost.costUnknown ? { costUnknown: true } : {},
-		...cost.estimatedCostUsd !== void 0 ? { estimatedCostUsd: cost.estimatedCostUsd } : {}
-	};
-}
-/** Eval has one pre-admitted paid call for this dispatch. A tree can settle that call only when
-* Runtime has provider-served identity for every inference attempt that actually started. Plan
-* materialization is deliberately ignored: it describes what Runtime requested, not what the
-* provider served. Every visible terminal child must carry provider attempt evidence; a missing
-* evidence record stays unknown, including zero-valued or incomplete spend.
-* @internal Testable identity projection used by superviseDispatch. */
-function supervisedTreeModelForDispatch(result, rootProfile) {
-	const canonicalModels = /* @__PURE__ */ new Set();
-	const observedModels = [];
-	const wholeTreeEvidence = result.providerModel;
-	if (wholeTreeEvidence === void 0 || wholeTreeEvidence.status !== "known" && wholeTreeEvidence.reason !== "provider-model-conflict" || wholeTreeEvidence.attempts.length === 0) return { kind: "unknown" };
-	const wholeTreeIdentity = collectProviderModels(wholeTreeEvidence, () => true);
-	if (wholeTreeIdentity.kind !== "known") return wholeTreeIdentity;
-	for (const model of wholeTreeIdentity.observed) {
-		observedModels.push(model.raw);
-		canonicalModels.add(model.canonical);
-	}
-	if (canonicalModels.size === 0) return { kind: "unknown" };
-	if (canonicalModels.size !== 1) return {
-		kind: "mixed",
-		models: [...canonicalModels].sort()
-	};
-	return {
-		kind: "known",
-		model: observedModels[0]
+		workspace,
+		tree
 	};
 }
-function collectProviderModels(evidence, validate) {
-	if (evidence.status !== "known" && evidence.reason !== "provider-model-conflict" || !Array.isArray(evidence.attempts) || evidence.attempts.length === 0 || !Array.isArray(evidence.models)) return { kind: "unknown" };
-	const observed = [];
-	const canonical = /* @__PURE__ */ new Set();
-	const observedRaw = /* @__PURE__ */ new Set();
-	for (const attempt of evidence.attempts) {
-		if (attempt.providerDispatch === "not_started") {
-			if (attempt.observations.length > 0 || attempt.identityConflict === true) return { kind: "unknown" };
-			continue;
-		}
-		if (attempt === null || typeof attempt !== "object" || !Array.isArray(attempt.observations) || attempt.observations.length === 0 || attempt.identityConflict === true) return { kind: "unknown" };
-		let attemptBase;
-		let attemptSnapshot;
-		let attemptSnapshotKind;
-		let representative;
-		for (const model of attempt.observations) {
-			if (typeof model !== "string" || !validate(model)) return { kind: "unknown" };
-			const identity = canonicalObservedModelParts(model);
-			if (identity === void 0) return { kind: "unknown" };
-			const base = identity.base;
-			const snapshot = identity.snapshot;
-			if (attemptBase !== void 0 && attemptBase !== base) return {
-				kind: "mixed",
-				models: [.../* @__PURE__ */ new Set([...attemptBase ? [attemptBase] : [], identity.canonical])]
-			};
-			if (attemptSnapshot !== void 0 && snapshot !== void 0 && (attemptSnapshot !== snapshot || attemptSnapshotKind !== identity.snapshotKind)) {
-				if (attemptBase === void 0 || attemptSnapshotKind === void 0) return { kind: "unknown" };
-				return {
-					kind: "mixed",
-					models: [attemptIdentityText(attemptBase, attemptSnapshot, attemptSnapshotKind), identity.canonical]
-				};
+/** Box-workspace-relative directory that receives the tree and is the command's cwd. */
+const BOX_TREE = "tree";
+/** Bound on provisioning, delivery, and deletion; the box expires even if this process dies. */
+const BOX_SETUP_SECONDS = 900;
+/** The box's own process timeout is a backstop behind this module's deadline. */
+const BOX_PROCESS_BACKSTOP_MS = 3e4;
+/** Concurrent file deliveries into one check box. */
+const BOX_UPLOADS = 4;
+/** The box's process supervisor prefixes this to stderr when it cannot start the executable. */
+const BOX_EXEC_FAILURE = "process-supervisor: exec failed";
+async function runInBox(options, placement) {
+	let box;
+	let evidence;
+	let result;
+	try {
+		const { timeoutMs, maxOutputBytes } = checkLimits(options);
+		if (options.signal?.aborted) return {
+			succeeded: false,
+			reason: "cancelled",
+			diagnostic: "Check cancelled"
+		};
+		const { tree } = await protectedTree(options);
+		const captured = await captureMaterializedWorkspace(tree);
+		if (placement.builderAccounts.length === 0 || placement.builderAccounts.some((id) => !id)) throw new Error("builderAccounts must name the account of every key the judged run holds");
+		const account = (await placement.client.getIdentity()).customerId;
+		if (!account) throw new Error("Sandbox returned no account for the check key");
+		if (placement.builderAccounts.includes(account)) throw new Error(`Check account ${account} is an account the judged run holds a key to, so the run can reach the check box`);
+		options.signal?.throwIfAborted();
+		box = await placement.client.createIsolated({
+			environment: placement.environment,
+			agent: false,
+			bare: false,
+			ephemeral: true,
+			egressPolicy: egressFor(placement),
+			...placement.resources ? { resources: placement.resources } : {},
+			maxLifetimeSeconds: Math.ceil(timeoutMs / 1e3) + BOX_SETUP_SECONDS,
+			idempotencyKey: `agent-runtime-check-${randomUUID()}`
+		}, options.signal ? { signal: options.signal } : void 0);
+		const receipt = box.createReceipt();
+		if (receipt?.outcome !== "created" || receipt.ownerContext !== "isolated" || !Array.isArray(receipt.injectedSecrets) || receipt.injectedSecrets.length !== 0) throw new Error("Sandbox did not confirm a fresh box with no owner secrets");
+		const egress = (await box.egress.get()).policy;
+		const wanted = egressFor(placement);
+		if (egress.mode !== wanted.mode || wanted.mode === "strict" && (egress.includeImplicitDomains === true || [...egress.allowDomains ?? []].sort().join(",") !== [...wanted.allowDomains ?? []].sort().join(","))) throw new Error(`Check box egress is ${egress.mode} ${JSON.stringify(egress.allowDomains ?? [])}, not ${wanted.mode} ${JSON.stringify(wanted.allowDomains ?? [])}`);
+		await box.fs.mkdir(BOX_TREE, { recursive: true });
+		const digests = new Map(captured.manifest.files.map((entry) => [entry.path, entry.sha256]));
+		const target = box;
+		const pending = [...captured.files];
+		const deliver = async () => {
+			try {
+				for (let file = pending.shift(); file; file = pending.shift()) {
+					options.signal?.throwIfAborted();
+					const received = await target.fs.uploadData(`${BOX_TREE}/${file.path}`, file.bytes, { mode: file.mode });
+					if (`sha256:${received.hash.replace(/^sha256:/, "").toLowerCase()}` !== digests.get(file.path) || received.size !== file.bytes.byteLength) throw new Error(`Check box received different bytes for ${file.path}`);
+				}
+			} catch (error) {
+				pending.length = 0;
+				throw error;
 			}
-			attemptBase = base;
-			attemptSnapshot ??= snapshot;
-			attemptSnapshotKind ??= identity.snapshotKind;
-			if (snapshot !== void 0) representative = model;
-			observedRaw.add(model);
-		}
-		if (attemptBase === void 0 || attemptSnapshot === void 0 || attemptSnapshotKind === void 0 || representative === void 0) return { kind: "unknown" };
-		const attemptIdentity = attemptIdentityText(attemptBase, attemptSnapshot, attemptSnapshotKind);
-		observed.push({
-			raw: representative,
-			canonical: attemptIdentity
-		});
-		canonical.add(attemptIdentity);
+		};
+		await Promise.all(Array.from({ length: BOX_UPLOADS }, deliver));
+		evidence = {
+			sandboxId: box.id,
+			account,
+			input: captured.manifest,
+			inputDigest: canonicalCandidateDigest(captured.manifest)
+		};
+		result = await executeInBox(box, options.command, timeoutMs, maxOutputBytes, options.env ?? {}, options.signal);
+	} catch (error) {
+		result = {
+			succeeded: false,
+			reason: options.signal?.aborted ? "cancelled" : "refused",
+			diagnostic: String(error)
+		};
 	}
-	if (observed.length === 0) return { kind: "unknown" };
-	const declaredRaw = /* @__PURE__ */ new Set();
-	for (const model of evidence.models) {
-		if (typeof model !== "string") return { kind: "unknown" };
-		declaredRaw.add(model);
+	if (box) try {
+		await box.delete();
+	} catch (error) {
+		const cleanupDiagnostic = `Check box ${box.id} was not deleted: ${String(error)}`;
+		result = result.succeeded ? {
+			succeeded: false,
+			reason: "cleanup-failed",
+			diagnostic: cleanupDiagnostic,
+			stdout: result.value.stdout,
+			stderr: result.value.stderr,
+			exitCode: 0
+		} : {
+			...result,
+			cleanupDiagnostic
+		};
 	}
-	if (declaredRaw.size !== observedRaw.size || [...declaredRaw].some((model) => !observedRaw.has(model))) return { kind: "unknown" };
-	return canonical.size > 1 ? {
-		kind: "mixed",
-		models: [...canonical].sort()
-	} : {
-		kind: "known",
-		observed
-	};
+	return evidence ? {
+		...result,
+		box: evidence
+	} : result;
 }
-function attemptIdentityText(base, snapshot, kind) {
-	return kind === "date" ? `${base}-${snapshot}` : `${base}@${snapshot}`;
+/** Blocked unless the placement names domains; then strict, with no implicit domain list. */
+function egressFor(placement) {
+	const domains = [...new Set(placement.egress ?? [])].filter((domain) => domain.trim() !== "");
+	return domains.length === 0 ? { mode: "blocked" } : {
+		mode: "strict",
+		allowDomains: domains,
+		includeImplicitDomains: false
+	};
 }
-/** The Eval receipt surface has no pre-admitted per-model recursive-tree receipt bundle yet. */
-var SupervisedTreeModelIdentityError = class extends Error {
-	constructor(identity) {
-		const detail = identity.kind === "mixed" ? `multiple models (${identity.models.join(", ")})` : "an unknown materialized model";
-		super(`superviseDispatch: cannot settle one Eval paid-call receipt for a tree with ${detail}`);
-		this.name = "SupervisedTreeModelIdentityError";
+async function executeInBox(box, command, timeoutMs, limit, env, signal) {
+	const [executable, ...args] = command;
+	const child = await box.process.spawnExact(executable, args, {
+		cwd: BOX_TREE,
+		env: {
+			PATH: "/usr/bin:/bin",
+			HOME: "/tmp",
+			LANG: "C",
+			...env
+		},
+		inheritEnv: false,
+		timeoutMs: timeoutMs + BOX_PROCESS_BACKSTOP_MS
+	});
+	const stdout = [];
+	const stderr = [];
+	let bytes = 0;
+	let failure;
+	let stopping;
+	const stop = (reason) => {
+		failure ??= reason;
+		stopping ??= child.kill("SIGKILL", { tree: true }).catch(() => void 0);
+	};
+	const clearTimer = armDeadlineTimer(timeoutMs, () => stop("timeout"), true);
+	const cancel = () => stop("cancelled");
+	signal?.addEventListener("abort", cancel, { once: true });
+	if (signal?.aborted) cancel();
+	const capture = async (stream, target) => {
+		for await (const text of stream) {
+			const chunk = Buffer.from(text);
+			const remaining = Math.max(0, limit - bytes);
+			bytes += chunk.length;
+			if (remaining) target.push(chunk.subarray(0, remaining));
+			if (bytes > limit) stop("output-limit");
+		}
+	};
+	let exitCode;
+	let exitSignal;
+	try {
+		await Promise.all([capture(child.stdout(), stdout), capture(child.stderr(), stderr)]);
+		exitCode = await child.wait();
+		exitSignal = (await child.status()).exitSignal;
+	} finally {
+		clearTimer();
+		signal?.removeEventListener("abort", cancel);
+		await stopping;
 	}
-};
-function unknownSupervisedTreeReceipt() {
-	return {
-		model: "unknown",
-		inputTokens: 0,
-		outputTokens: 0,
-		usageUnknown: true,
-		costUnknown: true
+	const out = Buffer.concat(stdout).toString();
+	const err = Buffer.concat(stderr).toString();
+	const evidence = {
+		stdout: out,
+		stderr: err,
+		exitCode: exitSignal ? null : exitCode
 	};
-}
-/** Run one recursive supervised tree inside Eval's pre-execution paid-call lifecycle. */
-function superviseDispatch(opts) {
-	return async (profile, scenario, ctx) => {
-		const superviseOptions = opts.toSuperviseOptions(scenario, profile);
-		const task = opts.toTask(scenario, profile);
-		const maximumCharge = typeof opts.maximumCharge === "function" ? opts.maximumCharge(scenario, profile) : opts.maximumCharge;
-		const paid = await ctx.cost.runPaidCall({
-			channel: "agent",
-			actor: opts.costSource ?? "supervise",
-			model: "unknown",
-			signal: ctx.signal,
-			...maximumCharge ? { maximumCharge } : {},
-			execute: async (executionSignal) => {
-				const result = await supervise(profile, task, {
-					...superviseOptions,
-					signal: executionSignal
-				});
-				const identity = supervisedTreeModelForDispatch(result, profile);
-				if (identity.kind !== "known") throw new SupervisedTreeModelIdentityError(identity);
-				return result;
-			},
-			receipt: (result) => {
-				const identity = supervisedTreeModelForDispatch(result, profile);
-				if (identity.kind !== "known") throw new SupervisedTreeModelIdentityError(identity);
-				return costReceiptFromUsage(result.spentTotal.tokens, identity.model, {
-					usageUnknown: result.spentTotal.tokensKnown === false,
-					actualCostUsd: result.spentTotal.usdKnown !== false ? result.spentTotal.usd : void 0,
-					costUnknown: result.spentTotal.usdKnown === false
-				});
-			},
-			receiptFromError: (error) => error instanceof SupervisedTreeModelIdentityError ? unknownSupervisedTreeReceipt() : void 0
+	if (failure) return {
+		succeeded: false,
+		reason: failure,
+		diagnostic: err || failure,
+		...evidence
+	};
+	if (exitCode === 127 && err.startsWith(BOX_EXEC_FAILURE)) return {
+		succeeded: false,
+		reason: "refused",
+		diagnostic: err,
+		...evidence
+	};
+	if (exitSignal) return {
+		succeeded: false,
+		reason: "failed",
+		diagnostic: err || `Check killed by ${exitSignal}`,
+		...evidence
+	};
+	if (exitCode !== 0) return {
+		succeeded: false,
+		reason: "failed",
+		diagnostic: err || out || `Check exited ${exitCode}`,
+		...evidence
+	};
+	return {
+		succeeded: true,
+		value: {
+			stdout: out,
+			stderr: err
+		}
+	};
+}
+function execute(args, timeoutMs, limit, signal) {
+	return new Promise((done) => {
+		const child = spawn("/usr/bin/bwrap", [
+			"--json-status-fd",
+			"3",
+			...args
+		], {
+			env: {},
+			stdio: [
+				"ignore",
+				"pipe",
+				"pipe",
+				"pipe"
+			],
+			detached: true
 		});
-		if (!paid.succeeded) throw paid.error;
-		return (opts.toArtifact ?? ((result) => {
-			if (result.kind !== "winner") throw new Error(`superviseDispatch: supervised tree ended without a winner (${result.reason})`);
-			return result.out;
-		}))(paid.value);
+		const stdout = [];
+		const stderr = [];
+		let bytes = 0;
+		let status = "";
+		let failure;
+		const stop = (reason) => {
+			failure ??= reason;
+			if (child.pid) try {
+				process.kill(-child.pid, "SIGKILL");
+			} catch (error) {
+				if (error.code !== "ESRCH") child.kill("SIGKILL");
+			}
+		};
+		const clearTimer = armDeadlineTimer(timeoutMs, () => stop("timeout"), true);
+		const cancel = () => stop("cancelled");
+		signal?.addEventListener("abort", cancel, { once: true });
+		if (signal?.aborted) cancel();
+		const capture = (target) => (chunk) => {
+			const remaining = Math.max(0, limit - bytes);
+			bytes += chunk.length;
+			if (remaining) target.push(chunk.subarray(0, remaining));
+			if (bytes > limit) stop("output-limit");
+		};
+		child.stdio[3]?.on("data", (chunk) => {
+			if (status.length + chunk.length > 16384) {
+				stop("output-limit");
+				return;
+			}
+			status += chunk.toString();
+		});
+		child.stdout.on("data", capture(stdout));
+		child.stderr.on("data", capture(stderr));
+		let spawnError;
+		child.on("error", (error) => {
+			spawnError = error;
+		});
+		child.on("close", (code) => {
+			clearTimer();
+			signal?.removeEventListener("abort", cancel);
+			const out = Buffer.concat(stdout).toString();
+			const err = Buffer.concat(stderr).toString();
+			const evidence = {
+				stdout: out,
+				stderr: err,
+				exitCode: code
+			};
+			const executed = status.split("\n").some((line) => {
+				try {
+					const record = JSON.parse(line);
+					return record !== null && typeof record === "object" && "exit-code" in record && typeof record["exit-code"] === "number" && record["exit-code"] === code;
+				} catch {
+					return false;
+				}
+			});
+			if (failure) done({
+				succeeded: false,
+				reason: failure,
+				diagnostic: err || failure,
+				...evidence
+			});
+			else if (spawnError) done({
+				succeeded: false,
+				reason: "refused",
+				diagnostic: String(spawnError),
+				...evidence
+			});
+			else if (!executed) done({
+				succeeded: false,
+				reason: "refused",
+				diagnostic: err || "Bubblewrap did not confirm command execution",
+				...evidence
+			});
+			else if (code !== 0) done({
+				succeeded: false,
+				reason: "failed",
+				diagnostic: err || out || `Check exited ${code}`,
+				...evidence
+			});
+			else done({
+				succeeded: true,
+				value: {
+					stdout: out,
+					stderr: err
+				}
+			});
+		});
+	});
+}
+const executeFile = promisify(execFile);
+/** GNU tools traverse relative to open directories, including trees deeper than PATH_MAX.
+* Recursive chmod ignores encountered symlinks; rm never follows their targets. */
+async function removeScratch(path) {
+	const options = {
+		env: {},
+		timeout: 1e4,
+		maxBuffer: 16384
 	};
+	let permissionError;
+	try {
+		await executeFile("/bin/chmod", [
+			"--recursive",
+			"--preserve-root",
+			"u+rwX",
+			"--",
+			path
+		], options);
+	} catch (error) {
+		permissionError = error;
+	}
+	try {
+		await executeFile("/bin/rm", [
+			"--recursive",
+			"--force",
+			"--one-file-system",
+			"--",
+			path
+		], options);
+	} catch (error) {
+		throw new Error([permissionError, error].filter((value) => value !== void 0).map(String).join("; "));
+	}
 }
-function modelFromLoopOptions(options) {
-	const profiles = options.agentRun ? [options.agentRun.profile] : options.agentRuns?.map((run) => run.profile) ?? [];
-	const models = new Set(profiles.map((profile) => profile.model?.default).filter((model) => !!model));
-	if (models.size === 1) return [...models][0];
-	return models.size > 1 ? "mixed" : "unknown";
+//#endregion
+//#region src/runtime/declared-check.ts
+/**
+* A declared check: the one frozen evaluator program that decides "done" for a run, named by
+* digest, run by Runtime in a fresh box on the check account.
+*
+* The same program is read three times (discovery `docs/38-one-loop-and-continuation.md`, section
+* 1): inside the run on every `submit_result` and at a turn end with no accepted result, after the
+* run to score it, and after each version to rank versions. Before this, each play wrote its own
+* check as Lab code in a method bundle — an exact-check judge, a sealed-cases judge, a product
+* judge — and the in-run check was a separate, weaker "shape and persistence" test, so 22 directors
+* passed their own check and then failed the outside one.
+*
+* The program prints one agent-eval `JudgeScore` as JSON on its last line of stdout: each checked
+* item is a dimension, `composite` is the score, and `notes` holds one `FAIL <item> <where>:
+* <reason>` line per failed item. The record states the pass threshold. A program that does not
+* run, or prints no score, gives no verdict: it is {@link CheckUnavailableError}, and the loop
+* pauses instead of blaming the director.
+*
+* The box receives the program's files at its working directory, the submitted result at
+* `_input/result.json` when there is one, and the sealed cases at `_sealed/` only when the read
+* scores a run or a version. `CHECK_SET` is `development` or `sealed`; `CHECK_RESULT` names the
+* result file when present. Sealed cases never reach an in-run read, so their lines never reach
+* the director.
+*/
+const INPUT_DIR = "_input";
+const SEALED_DIR = "_sealed";
+const DEFAULT_TIMEOUT_MS = 15 * 6e4;
+/** Refuse a malformed declaration before any compute. */
+function assertDeclaredCheck(check, context) {
+	const fail = (message) => {
+		throw new ValidationError(`${context}: check ${message}`);
+	};
+	if (typeof check !== "object" || check === null) fail("must be an object");
+	if (typeof check.program?.dir !== "string" || check.program.dir.trim() === "") fail("program.dir must name the evaluator directory");
+	if (!/^sha256:[0-9a-f]{64}$/u.test(check.program?.digest ?? "")) fail("program.digest must be a sha256 digest");
+	if (!Array.isArray(check.command) || check.command.length === 0 || !check.command[0]) fail("command must name an executable");
+	if (typeof check.environment !== "string" || check.environment.trim() === "") fail("environment must name the box image");
+	if (typeof check.pass !== "number" || !Number.isFinite(check.pass)) fail("pass must be a finite threshold on the composite");
+	if (check.feedback !== "verbatim" && check.feedback !== "pass-only") fail("feedback must be 'verbatim' or 'pass-only'");
+	if (check.sealed !== void 0 && !/^sha256:[0-9a-f]{64}$/u.test(check.sealed.digest ?? "")) fail("sealed.digest must be a sha256 digest");
+	for (const name of check.secrets ?? []) if (!/^[A-Z_][A-Z0-9_]*$/u.test(name)) fail(`secret name ${JSON.stringify(name)} is not an env name`);
+}
+/** The canonical digest of a directory's files: the digest a record names a program by. */
+async function checkProgramDigest(dir) {
+	return canonicalCandidateDigest((await captureMaterializedWorkspace(dir)).manifest);
+}
+/** The digest a version judge records: the program, the sealed cases, and how they are run. */
+function declaredCheckDigest(check) {
+	return sha256Bytes(Buffer.from(JSON.stringify({
+		program: check.program.digest,
+		sealed: check.sealed?.digest ?? null,
+		command: check.command,
+		environment: check.environment,
+		pass: check.pass
+	})));
 }
 /**
-* Adapter for plain `runCampaign` scenarios. This is the Runtime-side pair for
-* agent-eval fixture scenarios: load fixtures in `agent-eval/campaign`, build
-* the Runtime cell here, and keep paid-call admission, receipts, and traces
-* automatic.
+* Read the check once. `result` is the submitted result, absent for a read of the run's state.
+* `set: 'sealed'` adds the sealed cases. Throws {@link CheckUnavailableError} when the program
+* could not run or printed no score.
 */
-function loopCampaignDispatch(opts) {
-	return (scenario, ctx) => {
-		const loopOptions = opts.toLoopOptions(scenario);
-		return runLoopWithCampaignContext(opts, loopOptions, ctx, {
-			model: modelFromLoopOptions(loopOptions),
-			maximumCharge: typeof opts.maximumCharge === "function" ? opts.maximumCharge(scenario) : opts.maximumCharge,
-			resolveModel: opts.resolveCostModel ? (result) => opts.resolveCostModel?.(result, scenario) : void 0
+async function readDeclaredCheck(check, placement, read) {
+	if (read.set === "sealed" && check.sealed === void 0) throw new ValidationError("readDeclaredCheck: a sealed read needs check.sealed");
+	const environment = placement.env ?? process.env;
+	const secrets = {};
+	for (const name of check.secrets ?? []) {
+		const value = environment[name];
+		if (value === void 0 || value === "") throw new CheckUnavailableError(`the check's secret ${name} is not set on this host`);
+		secrets[name] = value;
+	}
+	const workspace = await mkdtemp(join(tmpdir(), "declared-check-"));
+	try {
+		const tree = join(workspace, "tree");
+		await copyVerified(check.program.dir, check.program.digest, tree, "program");
+		const entries = await readdir(tree);
+		if (entries.includes(INPUT_DIR) || entries.includes(SEALED_DIR)) throw new ValidationError(`readDeclaredCheck: the program may not hold ${INPUT_DIR}/ or ${SEALED_DIR}/; Runtime mounts them`);
+		const env = {
+			...secrets,
+			CHECK_SET: read.set
+		};
+		if (read.result !== void 0) {
+			await mkdir(join(tree, INPUT_DIR));
+			await writeFile(join(tree, INPUT_DIR, "result.json"), `${JSON.stringify(read.result)}\n`);
+			env.CHECK_RESULT = `${INPUT_DIR}/result.json`;
+		}
+		if (read.set === "sealed" && check.sealed !== void 0) await copyVerified(check.sealed.dir, check.sealed.digest, join(tree, SEALED_DIR), "sealed cases");
+		return verdictOf(await runIsolatedCheck({
+			workspaceRoot: workspace,
+			tree,
+			command: check.command,
+			timeoutMs: check.timeoutMs ?? DEFAULT_TIMEOUT_MS,
+			env,
+			...read.signal === void 0 ? {} : { signal: read.signal },
+			box: {
+				client: placement.client,
+				builderAccounts: placement.builderAccounts,
+				environment: check.environment,
+				...check.egress === void 0 ? {} : { egress: check.egress },
+				...check.resources === void 0 ? {} : { resources: check.resources }
+			}
+		}), check.pass);
+	} finally {
+		await rm(workspace, {
+			recursive: true,
+			force: true
 		});
+	}
+}
+/** The declared check as a manager's completion check: every in-run read uses development cases. */
+function declaredCheckDeliverable(check, placement) {
+	assertDeclaredCheck(check, "declaredCheckDeliverable");
+	return {
+		check: (result) => readDeclaredCheck(check, placement, {
+			result,
+			set: "development"
+		}),
+		checkState: () => readDeclaredCheck(check, placement, { set: "development" }),
+		feedback: check.feedback,
+		...check.sealed === void 0 ? {} : { sealed: true },
+		...check.describe === void 0 ? {} : { describe: check.describe }
 	};
 }
 /**
-* Adapter for `runProfileMatrix` (profile is an axis). Returns a
-* `ProfileDispatchFn` that runs `runAgentRounds` per (profile, scenario) cell
-* inside Eval's paid-call lifecycle.
+* The declared check as a version chain's judge: it scores a settled version on its sealed cases
+* when the record has them, and on its development cases otherwise. The per-item verdict rides in
+* the ledger, so the next version's review names each item. A read that could not run scores
+* `null`, which never counts as an improvement.
 */
-function loopDispatch(opts) {
-	return (profile, scenario, ctx) => runLoopForCell(opts, scenario, profile, ctx);
+function declaredCheckJudge(check, placement) {
+	assertDeclaredCheck(check, "declaredCheckJudge");
+	const digest = declaredCheckDigest(check);
+	return {
+		digest,
+		async judge(version, signal) {
+			try {
+				const verdict = await readDeclaredCheck(check, placement, {
+					...version.result.kind === "winner" ? { result: version.result.out } : {},
+					set: check.sealed === void 0 ? "development" : "sealed",
+					signal
+				});
+				return {
+					score: verdict.composite ?? (verdict.pass ? 1 : 0),
+					judgeDigest: digest,
+					check: verdict
+				};
+			} catch (error) {
+				if (!(error instanceof CheckUnavailableError)) throw error;
+				return {
+					score: null,
+					judgeDigest: digest,
+					detail: { unavailable: error.message }
+				};
+			}
+		}
+	};
+}
+function verdictOf(outcome, pass) {
+	if (!outcome.succeeded) throw new CheckUnavailableError(`the check program ${outcome.reason}: ${outcome.diagnostic.slice(0, 2e3)}`);
+	const last = outcome.value.stdout.trimEnd().split("\n").at(-1) ?? "";
+	let score;
+	try {
+		score = JSON.parse(last);
+	} catch {
+		throw new CheckUnavailableError("the check program printed no JudgeScore on its last line");
+	}
+	const raw = score;
+	if (typeof raw !== "object" || raw === null || typeof raw.dimensions !== "object" || raw.dimensions === null || typeof raw.composite !== "number" || typeof raw.notes !== "string") throw new CheckUnavailableError("the check program printed a line that is not a JudgeScore");
+	return verdictFromJudgeScore({
+		dimensions: raw.dimensions,
+		composite: raw.composite,
+		notes: raw.notes,
+		...raw.failed === true ? { failed: true } : {}
+	}, pass);
+}
+/** Copy exactly the bytes whose digest was checked: the files are read once, verified, and those
+*  bytes are written, so a file changed after the check cannot reach the box. */
+async function copyVerified(from, digest, to, label) {
+	const captured = await captureMaterializedWorkspace(from);
+	const actual = canonicalCandidateDigest(captured.manifest);
+	if (actual !== digest) throw new ValidationError(`readDeclaredCheck: the ${label} at ${from} is ${actual}; the record names ${digest}`);
+	for (const file of captured.files) {
+		const path = join(to, file.path);
+		await mkdir(dirname(path), { recursive: true });
+		await writeFile(path, file.bytes, { mode: file.mode });
+	}
 }
 //#endregion
-//#region src/runtime/inline-sandbox-client.ts
-/**
+//#region src/runtime/loop-dispatch.ts
+/** Bridge a campaign `DispatchContext.trace` to a `LoopTraceEmitter` so every
+*  `loop.*` event lands as a span under the cell's scoped trace. */
+function campaignTraceToLoopEmitter(trace) {
+	return { emit(event) {
+		trace.span(event.kind, {
+			runId: event.runId,
+			timestamp: event.timestamp,
+			...event.payload
+		}).end();
+	} };
+}
+async function runLoopForCell(opts, scenario, profile, ctx) {
+	const loopOptions = opts.toLoopOptions(scenario, profile);
+	return runLoopWithCampaignContext(opts, loopOptions, ctx, {
+		model: profile.model?.default ?? modelFromLoopOptions(loopOptions),
+		maximumCharge: typeof opts.maximumCharge === "function" ? opts.maximumCharge(scenario, profile) : opts.maximumCharge,
+		resolveModel: opts.resolveCostModel ? (result) => opts.resolveCostModel?.(result, scenario, profile) : void 0
+	});
+}
+async function runLoopWithCampaignContext(opts, loopOptions, ctx, cost) {
+	const paid = await ctx.cost.runPaidCall({
+		channel: "agent",
+		actor: opts.costSource ?? "loop",
+		model: cost.model,
+		signal: ctx.signal,
+		...cost.maximumCharge ? { maximumCharge: cost.maximumCharge } : {},
+		execute: (executionSignal) => runAgentRounds({
+			...loopOptions,
+			ctx: {
+				sandboxClient: opts.sandboxClient,
+				...opts.promptOptions === void 0 ? {} : { promptOptions: opts.promptOptions },
+				signal: executionSignal,
+				traceEmitter: opts.forwardTrace === false ? void 0 : campaignTraceToLoopEmitter(ctx.trace)
+			}
+		}),
+		receipt: (result) => loopCostReceipt(result, cost.resolveModel?.(result) ?? cost.model)
+	});
+	if (!paid.succeeded) throw paid.error;
+	const result = paid.value;
+	return (opts.toArtifact ?? ((r) => r.winner?.output))(result);
+}
+function loopCostReceipt(result, model) {
+	return costReceiptFromUsage(result.tokenUsage, model, {
+		usageUnknown: result.tokenUsage.tokensKnown === false,
+		actualCostUsd: result.costUsdKnown !== false ? result.costUsd : void 0,
+		costUnknown: result.costUsdKnown === false,
+		estimatedCostUsd: result.estimatedCostUsd
+	});
+}
+/** Map Runtime usage into Eval's canonical paid-call receipt without inventing cache classes. */
+function costReceiptFromUsage(usage, model, cost) {
+	const cacheComplete = hasCompleteCacheBreakdown(usage) && (usage.freshInput !== void 0 || usage.cacheRead !== void 0 || usage.cacheWrite !== void 0);
+	const cacheRead = cacheComplete ? usage.cacheRead ?? 0 : void 0;
+	const cacheWrite = cacheComplete ? usage.cacheWrite ?? 0 : void 0;
+	const classified = (cacheRead ?? 0) + (cacheWrite ?? 0);
+	return {
+		model,
+		inputTokens: cacheComplete ? usage.input - classified : usage.input,
+		outputTokens: usage.output,
+		...cacheComplete ? {
+			cachedTokens: cacheRead,
+			cacheWriteTokens: cacheWrite
+		} : {},
+		...usage.tokensKnown === false || cost.usageUnknown ? { usageUnknown: true } : {},
+		...cost.actualCostUsd !== void 0 ? { actualCostUsd: cost.actualCostUsd } : {},
+		...cost.costUnknown ? { costUnknown: true } : {},
+		...cost.estimatedCostUsd !== void 0 ? { estimatedCostUsd: cost.estimatedCostUsd } : {}
+	};
+}
+/** Eval has one pre-admitted paid call for this dispatch. A tree can settle that call only when
+* Runtime has provider-served identity for every inference attempt that actually started. Plan
+* materialization is deliberately ignored: it describes what Runtime requested, not what the
+* provider served. Every visible terminal child must carry provider attempt evidence; a missing
+* evidence record stays unknown, including zero-valued or incomplete spend.
+* @internal Testable identity projection used by superviseDispatch. */
+function supervisedTreeModelForDispatch(result, rootProfile) {
+	const canonicalModels = /* @__PURE__ */ new Set();
+	const observedModels = [];
+	const wholeTreeEvidence = result.providerModel;
+	if (wholeTreeEvidence === void 0 || wholeTreeEvidence.status !== "known" && wholeTreeEvidence.reason !== "provider-model-conflict" || wholeTreeEvidence.attempts.length === 0) return { kind: "unknown" };
+	const wholeTreeIdentity = collectProviderModels(wholeTreeEvidence, () => true);
+	if (wholeTreeIdentity.kind !== "known") return wholeTreeIdentity;
+	for (const model of wholeTreeIdentity.observed) {
+		observedModels.push(model.raw);
+		canonicalModels.add(model.canonical);
+	}
+	if (canonicalModels.size === 0) return { kind: "unknown" };
+	if (canonicalModels.size !== 1) return {
+		kind: "mixed",
+		models: [...canonicalModels].sort()
+	};
+	return {
+		kind: "known",
+		model: observedModels[0]
+	};
+}
+function collectProviderModels(evidence, validate) {
+	if (evidence.status !== "known" && evidence.reason !== "provider-model-conflict" || !Array.isArray(evidence.attempts) || evidence.attempts.length === 0 || !Array.isArray(evidence.models)) return { kind: "unknown" };
+	const observed = [];
+	const canonical = /* @__PURE__ */ new Set();
+	const observedRaw = /* @__PURE__ */ new Set();
+	for (const attempt of evidence.attempts) {
+		if (attempt.providerDispatch === "not_started") {
+			if (attempt.observations.length > 0 || attempt.identityConflict === true) return { kind: "unknown" };
+			continue;
+		}
+		if (attempt === null || typeof attempt !== "object" || !Array.isArray(attempt.observations) || attempt.observations.length === 0 || attempt.identityConflict === true) return { kind: "unknown" };
+		let attemptBase;
+		let attemptSnapshot;
+		let attemptSnapshotKind;
+		let representative;
+		for (const model of attempt.observations) {
+			if (typeof model !== "string" || !validate(model)) return { kind: "unknown" };
+			const identity = canonicalObservedModelParts(model);
+			if (identity === void 0) return { kind: "unknown" };
+			const base = identity.base;
+			const snapshot = identity.snapshot;
+			if (attemptBase !== void 0 && attemptBase !== base) return {
+				kind: "mixed",
+				models: [.../* @__PURE__ */ new Set([...attemptBase ? [attemptBase] : [], identity.canonical])]
+			};
+			if (attemptSnapshot !== void 0 && snapshot !== void 0 && (attemptSnapshot !== snapshot || attemptSnapshotKind !== identity.snapshotKind)) {
+				if (attemptBase === void 0 || attemptSnapshotKind === void 0) return { kind: "unknown" };
+				return {
+					kind: "mixed",
+					models: [attemptIdentityText(attemptBase, attemptSnapshot, attemptSnapshotKind), identity.canonical]
+				};
+			}
+			attemptBase = base;
+			attemptSnapshot ??= snapshot;
+			attemptSnapshotKind ??= identity.snapshotKind;
+			if (snapshot !== void 0) representative = model;
+			observedRaw.add(model);
+		}
+		if (attemptBase === void 0 || attemptSnapshot === void 0 || attemptSnapshotKind === void 0 || representative === void 0) return { kind: "unknown" };
+		const attemptIdentity = attemptIdentityText(attemptBase, attemptSnapshot, attemptSnapshotKind);
+		observed.push({
+			raw: representative,
+			canonical: attemptIdentity
+		});
+		canonical.add(attemptIdentity);
+	}
+	if (observed.length === 0) return { kind: "unknown" };
+	const declaredRaw = /* @__PURE__ */ new Set();
+	for (const model of evidence.models) {
+		if (typeof model !== "string") return { kind: "unknown" };
+		declaredRaw.add(model);
+	}
+	if (declaredRaw.size !== observedRaw.size || [...declaredRaw].some((model) => !observedRaw.has(model))) return { kind: "unknown" };
+	return canonical.size > 1 ? {
+		kind: "mixed",
+		models: [...canonical].sort()
+	} : {
+		kind: "known",
+		observed
+	};
+}
+function attemptIdentityText(base, snapshot, kind) {
+	return kind === "date" ? `${base}-${snapshot}` : `${base}@${snapshot}`;
+}
+/** The Eval receipt surface has no pre-admitted per-model recursive-tree receipt bundle yet. */
+var SupervisedTreeModelIdentityError = class extends Error {
+	constructor(identity) {
+		const detail = identity.kind === "mixed" ? `multiple models (${identity.models.join(", ")})` : "an unknown materialized model";
+		super(`superviseDispatch: cannot settle one Eval paid-call receipt for a tree with ${detail}`);
+		this.name = "SupervisedTreeModelIdentityError";
+	}
+};
+function unknownSupervisedTreeReceipt() {
+	return {
+		model: "unknown",
+		inputTokens: 0,
+		outputTokens: 0,
+		usageUnknown: true,
+		costUnknown: true
+	};
+}
+/** Run one recursive supervised tree inside Eval's pre-execution paid-call lifecycle. */
+function superviseDispatch(opts) {
+	return async (profile, scenario, ctx) => {
+		const superviseOptions = opts.toSuperviseOptions(scenario, profile);
+		const task = opts.toTask(scenario, profile);
+		const maximumCharge = typeof opts.maximumCharge === "function" ? opts.maximumCharge(scenario, profile) : opts.maximumCharge;
+		const paid = await ctx.cost.runPaidCall({
+			channel: "agent",
+			actor: opts.costSource ?? "supervise",
+			model: "unknown",
+			signal: ctx.signal,
+			...maximumCharge ? { maximumCharge } : {},
+			execute: async (executionSignal) => {
+				const result = await supervise(profile, task, {
+					...superviseOptions,
+					signal: executionSignal
+				});
+				const identity = supervisedTreeModelForDispatch(result, profile);
+				if (identity.kind !== "known") throw new SupervisedTreeModelIdentityError(identity);
+				return result;
+			},
+			receipt: (result) => {
+				const identity = supervisedTreeModelForDispatch(result, profile);
+				if (identity.kind !== "known") throw new SupervisedTreeModelIdentityError(identity);
+				return costReceiptFromUsage(result.spentTotal.tokens, identity.model, {
+					usageUnknown: result.spentTotal.tokensKnown === false,
+					actualCostUsd: result.spentTotal.usdKnown !== false ? result.spentTotal.usd : void 0,
+					costUnknown: result.spentTotal.usdKnown === false
+				});
+			},
+			receiptFromError: (error) => error instanceof SupervisedTreeModelIdentityError ? unknownSupervisedTreeReceipt() : void 0
+		});
+		if (!paid.succeeded) throw paid.error;
+		return (opts.toArtifact ?? ((result) => {
+			if (result.kind !== "winner") throw new Error(`superviseDispatch: supervised tree ended without a winner (${result.reason})`);
+			return result.out;
+		}))(paid.value);
+	};
+}
+function modelFromLoopOptions(options) {
+	const profiles = options.agentRun ? [options.agentRun.profile] : options.agentRuns?.map((run) => run.profile) ?? [];
+	const models = new Set(profiles.map((profile) => profile.model?.default).filter((model) => !!model));
+	if (models.size === 1) return [...models][0];
+	return models.size > 1 ? "mixed" : "unknown";
+}
+/**
+* Adapter for plain `runCampaign` scenarios. This is the Runtime-side pair for
+* agent-eval fixture scenarios: load fixtures in `agent-eval/campaign`, build
+* the Runtime cell here, and keep paid-call admission, receipts, and traces
+* automatic.
+*/
+function loopCampaignDispatch(opts) {
+	return (scenario, ctx) => {
+		const loopOptions = opts.toLoopOptions(scenario);
+		return runLoopWithCampaignContext(opts, loopOptions, ctx, {
+			model: modelFromLoopOptions(loopOptions),
+			maximumCharge: typeof opts.maximumCharge === "function" ? opts.maximumCharge(scenario) : opts.maximumCharge,
+			resolveModel: opts.resolveCostModel ? (result) => opts.resolveCostModel?.(result, scenario) : void 0
+		});
+	};
+}
+/**
+* Adapter for `runProfileMatrix` (profile is an axis). Returns a
+* `ProfileDispatchFn` that runs `runAgentRounds` per (profile, scenario) cell
+* inside Eval's paid-call lifecycle.
+*/
+function loopDispatch(opts) {
+	return (profile, scenario, ctx) => runLoopForCell(opts, scenario, profile, ctx);
+}
+//#endregion
+//#region src/runtime/inline-sandbox-client.ts
+/**
 * The ONE pseudo-box adapter: present any one-shot `Executor` (router / bridge /
 * BYO) as a `SandboxClient` so the round-synchronous `runAgentRounds` can drive it
 * without each call site re-faking a box. This is the single shell that
@@ -2264,626 +3344,177 @@ async function harvestCorpus(opts) {
 		if (done || opts.signal?.aborted || opts.maxRuns !== void 0 && consumed >= opts.maxRuns) return null;
 		const sequence = ++consumed;
 		let r;
-		try {
-			r = await iterator.next();
-		} catch (error) {
-			done = true;
-			report.failures.push({
-				runId: `source-${sequence}`,
-				error: `trace source: ${error instanceof Error ? error.message.slice(0, 300) : String(error)}`
-			});
-			return null;
-		}
-		if (r.done) {
-			done = true;
-			return null;
-		}
-		return {
-			input: r.value,
-			sequence
-		};
-	};
-	const workers = Array.from({ length: concurrency }, async () => {
-		for (let run = await next(); run !== null; run = await next()) {
-			const { input, sequence } = run;
-			if (opts.signal?.aborted) return;
-			try {
-				const obs = await observe(input, opts);
-				report.runsObserved += 1;
-				report.findings += obs.findings.length;
-				report.learned += obs.learned.length;
-				report.usage.input += obs.usage.input;
-				report.usage.output += obs.usage.output;
-				report.usage.known &&= obs.usage.known;
-			} catch (e) {
-				report.usage.known &&= e instanceof ObservationError && e.usage.known;
-				if (e instanceof ObservationError) {
-					report.usage.input += e.usage.input;
-					report.usage.output += e.usage.output;
-				}
-				report.failures.push({
-					runId: input.runId ?? `run-${sequence}`,
-					error: e instanceof Error ? e.message.slice(0, 300) : String(e)
-				});
-			}
-		}
-	});
-	await Promise.all(workers);
-	if (report.runsObserved === 0 && report.failures.length > 0) throw new HarvestError(report);
-	return report;
-}
-//#endregion
-//#region src/runtime/in-process-sandbox-client.ts
-/**
-* The ONE in-process pseudo-box: present a plain user callback as a
-* `SandboxClient` so an example or test can drive `runAgentRounds` / `openSandboxRun`
-* with zero credentials and zero network — without re-faking a box at each call
-* site via `as unknown as SandboxInstance`.
-*
-* It is the structural sibling of {@link inlineSandboxClient}: that one adapts an
-* `Executor` (router / bridge / BYO) into a box; this one adapts a single
-* `onPrompt(prompt, round)` callback into a box. Both exist because
-* `SandboxInstance` is a `declare class` with private fields — a plain object
-* literal can NEVER structurally satisfy it, so every offline seam was forced to
-* write `as unknown as SandboxInstance`. The one unavoidable cast now lives HERE,
-* documented and tested, instead of in every example.
-*
-* What the box implements is exactly the subset `runAgentRounds` + `openSandboxRun`
-* actually call on a box:
-*   - `id` — stable per box, used for trace correlation.
-*   - `streamPrompt(prompt, opts?)` — runs `onPrompt` and streams its events.
-*   - `fs.read` / `fs.write` — over the optional real `workdir` (the deliverable
-*     artifact + any seeded fixtures live there). Present only when a `workdir`
-*     is given.
-*   - `exec(command)` — runs the command in `workdir`. Present only when a
-*     `workdir` is given.
-*   - `delete()` — removes the per-box temp dir (when one was minted) and is a
-*     no-op otherwise; `deleteBoxSafe` calls it at teardown.
-*
-* The `SandboxEvent` shape the callback returns — `{ type, data }` — is the
-* runtime metering protocol the kernel reads: emit a flat `llm_call`
-* (`{ tokensIn, tokensOut, costUsd }`) or a terminal `done`
-* (`{ tokenUsage, totalCostUsd }`) / `result` event and the kernel's cost ledger
-* picks it up. No cast is needed on the events (the union is structural); only
-* the box object is cast, once, inside this file.
-*/
-function isAsyncIterable(v) {
-	return typeof v === "object" && v !== null && Symbol.asyncIterator in v;
-}
-/**
-* Adapt a single `onPrompt(prompt, ctx)` callback into a `SandboxClient` for
-* `runAgentRounds` / `openSandboxRun`. Returns a PROPERLY-TYPED `SandboxClient`: the
-* lone `SandboxInstance` cast (object literal → `declare class`) lives inside
-* this function, so call sites stay cast-free.
-*
-* There is no box, so a per-prompt `backend` override is refused rather than dropped. A per-turn
-* `model` IS delivered, because `onPrompt` receives the verbatim options and is free to honor it.
-* Other per-prompt options (`timeoutMs`, `context`) are accepted and ignored.
-*
-* @experimental
-*/
-function inProcessSandboxClient(options) {
-	const { onPrompt, workdir: workdirPrefix, id: idOption } = options;
-	let seq = 0;
-	return { async create(_options) {
-		const current = seq++;
-		const id = typeof idOption === "function" ? idOption(current) : idOption ?? `in-process-${current}`;
-		const boxWorkdir = workdirPrefix !== void 0 ? mkdtempSync(join(tmpdir(), `${workdirPrefix}-`)) : void 0;
-		let round = 0;
-		const fsMembers = boxWorkdir !== void 0 ? {
-			fs: {
-				async read(path) {
-					return readFile(join(boxWorkdir, path), "utf8");
-				},
-				async write(path, content) {
-					const abs = join(boxWorkdir, path);
-					await mkdir(dirname(abs), { recursive: true });
-					await writeFile(abs, content, "utf8");
-				}
-			},
-			async exec(command) {
-				const { exec: execCb } = await import("node:child_process");
-				const { promisify } = await import("node:util");
-				const execAsync = promisify(execCb);
-				try {
-					const { stdout, stderr } = await execAsync(command, {
-						cwd: boxWorkdir,
-						timeout: 3e4
-					});
-					return {
-						exitCode: 0,
-						stdout,
-						stderr
-					};
-				} catch (err) {
-					const e = err;
-					return {
-						exitCode: e.code ?? 1,
-						stdout: e.stdout ?? "",
-						stderr: e.stderr ?? e.message ?? ""
-					};
-				}
-			}
-		} : {};
-		async function* drive(behavior, message, opts) {
-			const prompt = typeof message === "string" ? message : JSON.stringify(message);
-			const { signal: optSignal, ...rest } = opts ?? {};
-			const signal = optSignal ?? new AbortController().signal;
-			const ctx = {
-				round,
-				workdir: boxWorkdir,
-				signal,
-				...Object.keys(rest).length > 0 ? { options: rest } : {}
-			};
-			round += 1;
-			const produced = await behavior(prompt, ctx);
-			if (isAsyncIterable(produced)) for await (const ev of produced) yield ev;
-			else for (const ev of produced) yield ev;
-		}
-		return {
-			id,
-			streamPrompt(message, opts) {
-				assertBoxlessPromptOptions(opts, "inProcessSandboxClient", ["backend"]);
-				return drive(onPrompt, message, opts);
-			},
-			...fsMembers,
-			async delete() {
-				if (boxWorkdir !== void 0) rmSync(boxWorkdir, {
-					recursive: true,
-					force: true
-				});
-			}
-		};
-	} };
-}
-//#endregion
-//#region src/runtime/isolated-checker.ts
-const toolchains = [
-	"/usr",
-	"/bin",
-	"/lib",
-	"/lib64"
-];
-const contains = (parent, child) => {
-	const path = relative(parent, child);
-	return path === "" || path !== ".." && !path.startsWith(`..${sep}`) && !path.startsWith(sep);
-};
-/**
-* Run an untrusted check in Linux Bubblewrap, or in its own Sandbox box when `box` is set.
-* Never falls back to host execution.
-*
-* Bubblewrap requires /usr/bin/bwrap and permission to create Linux namespaces.
-* Only trusted system toolchains, private proc/dev/tmp, and the writable copy are mounted.
-* The canonical input path remains the working directory; copy writes are discarded.
-* Limits bound command time and captured output, not copy size or memory consumption.
-* Callers must keep the input and trusted toolchains stable while preparing the check.
-*
-* A box check creates one fresh box with no owner secrets and blocked egress, delivers the
-* tree's regular files verified by sha256, runs the command there, and deletes the box.
-*/
-async function runIsolatedCheck(options) {
-	if (options.box) return runInBox(options, options.box);
-	let scratch;
-	let result;
-	try {
-		if (process.platform !== "linux") throw new Error("Linux Bubblewrap namespaces are required");
-		const { timeoutMs, maxOutputBytes } = checkLimits(options);
-		if (options.signal?.aborted) return {
-			succeeded: false,
-			reason: "cancelled",
-			diagnostic: "Check cancelled"
-		};
-		const { workspace, tree } = await protectedTree(options);
-		const binds = [];
-		for (const path of toolchains) {
-			let actual;
-			try {
-				actual = await realpath(path);
-			} catch (error) {
-				if (error.code === "ENOENT") continue;
-				throw error;
-			}
-			for (const mount of [path, actual]) if (contains(mount, workspace) || contains(workspace, mount) || contains(mount, tree) || contains(tree, mount)) throw new Error(`Toolchain overlaps protected workspace: ${path}`);
-			binds.push("--ro-bind", actual, path);
-		}
-		if (["/proc", "/dev"].some((path) => contains(path, tree) || contains(tree, path))) throw new Error("Tree overlaps a reserved namespace mount");
-		scratch = await mkdtemp(join(tmpdir(), "runtime-check-"));
-		if (contains(tree, scratch)) throw new Error("Temporary storage must be outside the input tree");
-		const copy = join(scratch, "tree");
-		await cp(tree, copy, {
-			recursive: true,
-			dereference: false,
-			verbatimSymlinks: true
-		});
-		result = await execute([
-			"--unshare-all",
-			"--die-with-parent",
-			"--new-session",
-			"--cap-drop",
-			"ALL",
-			"--clearenv",
-			"--setenv",
-			"PATH",
-			"/usr/bin:/bin",
-			"--setenv",
-			"HOME",
-			"/tmp",
-			"--setenv",
-			"LANG",
-			"C",
-			...binds,
-			"--proc",
-			"/proc",
-			"--dev",
-			"/dev",
-			"--tmpfs",
-			"/tmp",
-			"--bind",
-			copy,
-			tree,
-			"--chdir",
-			tree,
-			"--",
-			...options.command
-		], timeoutMs, maxOutputBytes, options.signal);
-	} catch (error) {
-		result = {
-			succeeded: false,
-			reason: "refused",
-			diagnostic: String(error)
-		};
-	}
-	if (scratch) try {
-		await removeScratch(scratch);
-	} catch (error) {
-		const cleanupDiagnostic = String(error);
-		result = result.succeeded ? {
-			succeeded: false,
-			reason: "cleanup-failed",
-			diagnostic: cleanupDiagnostic,
-			stdout: result.value.stdout,
-			stderr: result.value.stderr,
-			exitCode: 0
-		} : {
-			...result,
-			cleanupDiagnostic
-		};
-	}
-	return result;
-}
-function checkLimits(options) {
-	const timeoutMs = options.timeoutMs ?? 3e4;
-	const maxOutputBytes = options.maxOutputBytes ?? 1048576;
-	if (!Number.isSafeInteger(timeoutMs) || timeoutMs < 1 || timeoutMs > 2147483647 || !Number.isSafeInteger(maxOutputBytes) || maxOutputBytes < 1) throw new Error("Invalid execution limits");
-	if (!options.command.length || !options.command[0]) throw new Error("A command is required");
-	return {
-		timeoutMs,
-		maxOutputBytes
-	};
-}
-async function protectedTree(options) {
-	const workspace = await realpath(options.workspaceRoot);
-	const tree = await realpath(options.tree);
-	if (!contains(workspace, tree) || !(await stat(tree)).isDirectory()) throw new Error("Tree must be a directory inside the workspace");
-	return {
-		workspace,
-		tree
-	};
-}
-/** Box-workspace-relative directory that receives the tree and is the command's cwd. */
-const BOX_TREE = "tree";
-/** Bound on provisioning, delivery, and deletion; the box expires even if this process dies. */
-const BOX_SETUP_SECONDS = 900;
-/** The box's own process timeout is a backstop behind this module's deadline. */
-const BOX_PROCESS_BACKSTOP_MS = 3e4;
-/** Concurrent file deliveries into one check box. */
-const BOX_UPLOADS = 4;
-/** The box's process supervisor prefixes this to stderr when it cannot start the executable. */
-const BOX_EXEC_FAILURE = "process-supervisor: exec failed";
-async function runInBox(options, placement) {
-	let box;
-	let evidence;
-	let result;
-	try {
-		const { timeoutMs, maxOutputBytes } = checkLimits(options);
-		if (options.signal?.aborted) return {
-			succeeded: false,
-			reason: "cancelled",
-			diagnostic: "Check cancelled"
-		};
-		const { tree } = await protectedTree(options);
-		const captured = await captureMaterializedWorkspace(tree);
-		if (placement.builderAccounts.length === 0 || placement.builderAccounts.some((id) => !id)) throw new Error("builderAccounts must name the account of every key the judged run holds");
-		const account = (await placement.client.getIdentity()).customerId;
-		if (!account) throw new Error("Sandbox returned no account for the check key");
-		if (placement.builderAccounts.includes(account)) throw new Error(`Check account ${account} is an account the judged run holds a key to, so the run can reach the check box`);
-		options.signal?.throwIfAborted();
-		box = await placement.client.createIsolated({
-			environment: placement.environment,
-			agent: false,
-			bare: false,
-			ephemeral: true,
-			egressPolicy: { mode: "blocked" },
-			...placement.resources ? { resources: placement.resources } : {},
-			maxLifetimeSeconds: Math.ceil(timeoutMs / 1e3) + BOX_SETUP_SECONDS,
-			idempotencyKey: `agent-runtime-check-${randomUUID()}`
-		}, options.signal ? { signal: options.signal } : void 0);
-		const receipt = box.createReceipt();
-		if (receipt?.outcome !== "created" || receipt.ownerContext !== "isolated" || !Array.isArray(receipt.injectedSecrets) || receipt.injectedSecrets.length !== 0) throw new Error("Sandbox did not confirm a fresh box with no owner secrets");
-		const egress = (await box.egress.get()).policy;
-		if (egress.mode !== "blocked") throw new Error(`Check box egress is ${egress.mode}, not blocked`);
-		await box.fs.mkdir(BOX_TREE, { recursive: true });
-		const digests = new Map(captured.manifest.files.map((entry) => [entry.path, entry.sha256]));
-		const target = box;
-		const pending = [...captured.files];
-		const deliver = async () => {
-			try {
-				for (let file = pending.shift(); file; file = pending.shift()) {
-					options.signal?.throwIfAborted();
-					const received = await target.fs.uploadData(`${BOX_TREE}/${file.path}`, file.bytes, { mode: file.mode });
-					if (`sha256:${received.hash.replace(/^sha256:/, "").toLowerCase()}` !== digests.get(file.path) || received.size !== file.bytes.byteLength) throw new Error(`Check box received different bytes for ${file.path}`);
-				}
-			} catch (error) {
-				pending.length = 0;
-				throw error;
-			}
-		};
-		await Promise.all(Array.from({ length: BOX_UPLOADS }, deliver));
-		evidence = {
-			sandboxId: box.id,
-			account,
-			input: captured.manifest,
-			inputDigest: canonicalCandidateDigest(captured.manifest)
-		};
-		result = await executeInBox(box, options.command, timeoutMs, maxOutputBytes, options.signal);
-	} catch (error) {
-		result = {
-			succeeded: false,
-			reason: options.signal?.aborted ? "cancelled" : "refused",
-			diagnostic: String(error)
-		};
-	}
-	if (box) try {
-		await box.delete();
-	} catch (error) {
-		const cleanupDiagnostic = `Check box ${box.id} was not deleted: ${String(error)}`;
-		result = result.succeeded ? {
-			succeeded: false,
-			reason: "cleanup-failed",
-			diagnostic: cleanupDiagnostic,
-			stdout: result.value.stdout,
-			stderr: result.value.stderr,
-			exitCode: 0
-		} : {
-			...result,
-			cleanupDiagnostic
-		};
-	}
-	return evidence ? {
-		...result,
-		box: evidence
-	} : result;
-}
-async function executeInBox(box, command, timeoutMs, limit, signal) {
-	const [executable, ...args] = command;
-	const child = await box.process.spawnExact(executable, args, {
-		cwd: BOX_TREE,
-		env: {
-			PATH: "/usr/bin:/bin",
-			HOME: "/tmp",
-			LANG: "C"
-		},
-		inheritEnv: false,
-		timeoutMs: timeoutMs + BOX_PROCESS_BACKSTOP_MS
-	});
-	const stdout = [];
-	const stderr = [];
-	let bytes = 0;
-	let failure;
-	let stopping;
-	const stop = (reason) => {
-		failure ??= reason;
-		stopping ??= child.kill("SIGKILL", { tree: true }).catch(() => void 0);
-	};
-	const clearTimer = armDeadlineTimer(timeoutMs, () => stop("timeout"), true);
-	const cancel = () => stop("cancelled");
-	signal?.addEventListener("abort", cancel, { once: true });
-	if (signal?.aborted) cancel();
-	const capture = async (stream, target) => {
-		for await (const text of stream) {
-			const chunk = Buffer.from(text);
-			const remaining = Math.max(0, limit - bytes);
-			bytes += chunk.length;
-			if (remaining) target.push(chunk.subarray(0, remaining));
-			if (bytes > limit) stop("output-limit");
-		}
-	};
-	let exitCode;
-	let exitSignal;
-	try {
-		await Promise.all([capture(child.stdout(), stdout), capture(child.stderr(), stderr)]);
-		exitCode = await child.wait();
-		exitSignal = (await child.status()).exitSignal;
-	} finally {
-		clearTimer();
-		signal?.removeEventListener("abort", cancel);
-		await stopping;
-	}
-	const out = Buffer.concat(stdout).toString();
-	const err = Buffer.concat(stderr).toString();
-	const evidence = {
-		stdout: out,
-		stderr: err,
-		exitCode: exitSignal ? null : exitCode
-	};
-	if (failure) return {
-		succeeded: false,
-		reason: failure,
-		diagnostic: err || failure,
-		...evidence
-	};
-	if (exitCode === 127 && err.startsWith(BOX_EXEC_FAILURE)) return {
-		succeeded: false,
-		reason: "refused",
-		diagnostic: err,
-		...evidence
-	};
-	if (exitSignal) return {
-		succeeded: false,
-		reason: "failed",
-		diagnostic: err || `Check killed by ${exitSignal}`,
-		...evidence
-	};
-	if (exitCode !== 0) return {
-		succeeded: false,
-		reason: "failed",
-		diagnostic: err || out || `Check exited ${exitCode}`,
-		...evidence
-	};
-	return {
-		succeeded: true,
-		value: {
-			stdout: out,
-			stderr: err
-		}
-	};
-}
-function execute(args, timeoutMs, limit, signal) {
-	return new Promise((done) => {
-		const child = spawn("/usr/bin/bwrap", [
-			"--json-status-fd",
-			"3",
-			...args
-		], {
-			env: {},
-			stdio: [
-				"ignore",
-				"pipe",
-				"pipe",
-				"pipe"
-			],
-			detached: true
-		});
-		const stdout = [];
-		const stderr = [];
-		let bytes = 0;
-		let status = "";
-		let failure;
-		const stop = (reason) => {
-			failure ??= reason;
-			if (child.pid) try {
-				process.kill(-child.pid, "SIGKILL");
-			} catch (error) {
-				if (error.code !== "ESRCH") child.kill("SIGKILL");
-			}
-		};
-		const clearTimer = armDeadlineTimer(timeoutMs, () => stop("timeout"), true);
-		const cancel = () => stop("cancelled");
-		signal?.addEventListener("abort", cancel, { once: true });
-		if (signal?.aborted) cancel();
-		const capture = (target) => (chunk) => {
-			const remaining = Math.max(0, limit - bytes);
-			bytes += chunk.length;
-			if (remaining) target.push(chunk.subarray(0, remaining));
-			if (bytes > limit) stop("output-limit");
-		};
-		child.stdio[3]?.on("data", (chunk) => {
-			if (status.length + chunk.length > 16384) {
-				stop("output-limit");
-				return;
-			}
-			status += chunk.toString();
-		});
-		child.stdout.on("data", capture(stdout));
-		child.stderr.on("data", capture(stderr));
-		let spawnError;
-		child.on("error", (error) => {
-			spawnError = error;
-		});
-		child.on("close", (code) => {
-			clearTimer();
-			signal?.removeEventListener("abort", cancel);
-			const out = Buffer.concat(stdout).toString();
-			const err = Buffer.concat(stderr).toString();
-			const evidence = {
-				stdout: out,
-				stderr: err,
-				exitCode: code
-			};
-			const executed = status.split("\n").some((line) => {
-				try {
-					const record = JSON.parse(line);
-					return record !== null && typeof record === "object" && "exit-code" in record && typeof record["exit-code"] === "number" && record["exit-code"] === code;
-				} catch {
-					return false;
-				}
-			});
-			if (failure) done({
-				succeeded: false,
-				reason: failure,
-				diagnostic: err || failure,
-				...evidence
-			});
-			else if (spawnError) done({
-				succeeded: false,
-				reason: "refused",
-				diagnostic: String(spawnError),
-				...evidence
-			});
-			else if (!executed) done({
-				succeeded: false,
-				reason: "refused",
-				diagnostic: err || "Bubblewrap did not confirm command execution",
-				...evidence
-			});
-			else if (code !== 0) done({
-				succeeded: false,
-				reason: "failed",
-				diagnostic: err || out || `Check exited ${code}`,
-				...evidence
+		try {
+			r = await iterator.next();
+		} catch (error) {
+			done = true;
+			report.failures.push({
+				runId: `source-${sequence}`,
+				error: `trace source: ${error instanceof Error ? error.message.slice(0, 300) : String(error)}`
 			});
-			else done({
-				succeeded: true,
-				value: {
-					stdout: out,
-					stderr: err
+			return null;
+		}
+		if (r.done) {
+			done = true;
+			return null;
+		}
+		return {
+			input: r.value,
+			sequence
+		};
+	};
+	const workers = Array.from({ length: concurrency }, async () => {
+		for (let run = await next(); run !== null; run = await next()) {
+			const { input, sequence } = run;
+			if (opts.signal?.aborted) return;
+			try {
+				const obs = await observe(input, opts);
+				report.runsObserved += 1;
+				report.findings += obs.findings.length;
+				report.learned += obs.learned.length;
+				report.usage.input += obs.usage.input;
+				report.usage.output += obs.usage.output;
+				report.usage.known &&= obs.usage.known;
+			} catch (e) {
+				report.usage.known &&= e instanceof ObservationError && e.usage.known;
+				if (e instanceof ObservationError) {
+					report.usage.input += e.usage.input;
+					report.usage.output += e.usage.output;
 				}
-			});
-		});
+				report.failures.push({
+					runId: input.runId ?? `run-${sequence}`,
+					error: e instanceof Error ? e.message.slice(0, 300) : String(e)
+				});
+			}
+		}
 	});
+	await Promise.all(workers);
+	if (report.runsObserved === 0 && report.failures.length > 0) throw new HarvestError(report);
+	return report;
 }
-const executeFile = promisify(execFile);
-/** GNU tools traverse relative to open directories, including trees deeper than PATH_MAX.
-* Recursive chmod ignores encountered symlinks; rm never follows their targets. */
-async function removeScratch(path) {
-	const options = {
-		env: {},
-		timeout: 1e4,
-		maxBuffer: 16384
-	};
-	let permissionError;
-	try {
-		await executeFile("/bin/chmod", [
-			"--recursive",
-			"--preserve-root",
-			"u+rwX",
-			"--",
-			path
-		], options);
-	} catch (error) {
-		permissionError = error;
-	}
-	try {
-		await executeFile("/bin/rm", [
-			"--recursive",
-			"--force",
-			"--one-file-system",
-			"--",
-			path
-		], options);
-	} catch (error) {
-		throw new Error([permissionError, error].filter((value) => value !== void 0).map(String).join("; "));
-	}
+//#endregion
+//#region src/runtime/in-process-sandbox-client.ts
+/**
+* The ONE in-process pseudo-box: present a plain user callback as a
+* `SandboxClient` so an example or test can drive `runAgentRounds` / `openSandboxRun`
+* with zero credentials and zero network — without re-faking a box at each call
+* site via `as unknown as SandboxInstance`.
+*
+* It is the structural sibling of {@link inlineSandboxClient}: that one adapts an
+* `Executor` (router / bridge / BYO) into a box; this one adapts a single
+* `onPrompt(prompt, round)` callback into a box. Both exist because
+* `SandboxInstance` is a `declare class` with private fields — a plain object
+* literal can NEVER structurally satisfy it, so every offline seam was forced to
+* write `as unknown as SandboxInstance`. The one unavoidable cast now lives HERE,
+* documented and tested, instead of in every example.
+*
+* What the box implements is exactly the subset `runAgentRounds` + `openSandboxRun`
+* actually call on a box:
+*   - `id` — stable per box, used for trace correlation.
+*   - `streamPrompt(prompt, opts?)` — runs `onPrompt` and streams its events.
+*   - `fs.read` / `fs.write` — over the optional real `workdir` (the deliverable
+*     artifact + any seeded fixtures live there). Present only when a `workdir`
+*     is given.
+*   - `exec(command)` — runs the command in `workdir`. Present only when a
+*     `workdir` is given.
+*   - `delete()` — removes the per-box temp dir (when one was minted) and is a
+*     no-op otherwise; `deleteBoxSafe` calls it at teardown.
+*
+* The `SandboxEvent` shape the callback returns — `{ type, data }` — is the
+* runtime metering protocol the kernel reads: emit a flat `llm_call`
+* (`{ tokensIn, tokensOut, costUsd }`) or a terminal `done`
+* (`{ tokenUsage, totalCostUsd }`) / `result` event and the kernel's cost ledger
+* picks it up. No cast is needed on the events (the union is structural); only
+* the box object is cast, once, inside this file.
+*/
+function isAsyncIterable(v) {
+	return typeof v === "object" && v !== null && Symbol.asyncIterator in v;
+}
+/**
+* Adapt a single `onPrompt(prompt, ctx)` callback into a `SandboxClient` for
+* `runAgentRounds` / `openSandboxRun`. Returns a PROPERLY-TYPED `SandboxClient`: the
+* lone `SandboxInstance` cast (object literal → `declare class`) lives inside
+* this function, so call sites stay cast-free.
+*
+* There is no box, so a per-prompt `backend` override is refused rather than dropped. A per-turn
+* `model` IS delivered, because `onPrompt` receives the verbatim options and is free to honor it.
+* Other per-prompt options (`timeoutMs`, `context`) are accepted and ignored.
+*
+* @experimental
+*/
+function inProcessSandboxClient(options) {
+	const { onPrompt, workdir: workdirPrefix, id: idOption } = options;
+	let seq = 0;
+	return { async create(_options) {
+		const current = seq++;
+		const id = typeof idOption === "function" ? idOption(current) : idOption ?? `in-process-${current}`;
+		const boxWorkdir = workdirPrefix !== void 0 ? mkdtempSync(join(tmpdir(), `${workdirPrefix}-`)) : void 0;
+		let round = 0;
+		const fsMembers = boxWorkdir !== void 0 ? {
+			fs: {
+				async read(path) {
+					return readFile(join(boxWorkdir, path), "utf8");
+				},
+				async write(path, content) {
+					const abs = join(boxWorkdir, path);
+					await mkdir(dirname(abs), { recursive: true });
+					await writeFile(abs, content, "utf8");
+				}
+			},
+			async exec(command) {
+				const { exec: execCb } = await import("node:child_process");
+				const { promisify } = await import("node:util");
+				const execAsync = promisify(execCb);
+				try {
+					const { stdout, stderr } = await execAsync(command, {
+						cwd: boxWorkdir,
+						timeout: 3e4
+					});
+					return {
+						exitCode: 0,
+						stdout,
+						stderr
+					};
+				} catch (err) {
+					const e = err;
+					return {
+						exitCode: e.code ?? 1,
+						stdout: e.stdout ?? "",
+						stderr: e.stderr ?? e.message ?? ""
+					};
+				}
+			}
+		} : {};
+		async function* drive(behavior, message, opts) {
+			const prompt = typeof message === "string" ? message : JSON.stringify(message);
+			const { signal: optSignal, ...rest } = opts ?? {};
+			const signal = optSignal ?? new AbortController().signal;
+			const ctx = {
+				round,
+				workdir: boxWorkdir,
+				signal,
+				...Object.keys(rest).length > 0 ? { options: rest } : {}
+			};
+			round += 1;
+			const produced = await behavior(prompt, ctx);
+			if (isAsyncIterable(produced)) for await (const ev of produced) yield ev;
+			else for (const ev of produced) yield ev;
+		}
+		return {
+			id,
+			streamPrompt(message, opts) {
+				assertBoxlessPromptOptions(opts, "inProcessSandboxClient", ["backend"]);
+				return drive(onPrompt, message, opts);
+			},
+			...fsMembers,
+			async delete() {
+				if (boxWorkdir !== void 0) rmSync(boxWorkdir, {
+					recursive: true,
+					force: true
+				});
+			}
+		};
+	} };
 }
 //#endregion
 //#region src/runtime/observation-registry.ts
@@ -5438,6 +6069,7 @@ async function createWorker(lease, root, createProfile, placement) {
 		const timeoutMs = options?.timeoutMs ?? 0;
 		const turnDeadline = timeoutMs > 0 ? Date.now() + timeoutMs : void 0;
 		let sessionId;
+		const subagents = /* @__PURE__ */ new Set();
 		let refusalsInARow = 0;
 		let prompt = message;
 		for (let invocation = 1;; invocation += 1) {
@@ -5465,12 +6097,14 @@ async function createWorker(lease, root, createProfile, placement) {
 				running = void 0;
 			}
 			sessionId = parsed.sessionId() ?? sessionId;
+			for (const child of parsed.subagentSessionIds()) subagents.add(child);
 			const failure = parsed.failure(exitCode, errorText);
 			const refusal = failure === void 0 || unavailablePause === false || signal?.aborted ? void 0 : unavailableSignalOfFailure({ error: failure });
 			refusalsInARow = parsed.madeProgress() ? 1 : refusalsInARow + 1;
 			const pauseMs = refusal === void 0 || unavailablePause === false ? 0 : unavailablePauseMs(refusalsInARow, unavailablePause);
 			if (refusal === void 0 || turnDeadline !== void 0 && Date.now() + pauseMs >= turnDeadline) {
 				if (sessionId !== void 0) await exportSession(run, collect, paths, sessionId);
+				for (const child of subagents) if (child !== sessionId) await exportSession(run, collect, paths, child);
 				signal?.throwIfAborted();
 				yield* parsed.finish(exitCode, errorText, invocation);
 				return;
@@ -5494,7 +6128,7 @@ async function createWorker(lease, root, createProfile, placement) {
 			if (released) throw new ValidationError("sharedBoxPlacement: this worker was released");
 			if (turnActive) throw new ValidationError("sharedBoxPlacement: a worker runs one turn at a time");
 			const turnProfile = options?.backend?.profile === void 0 ? createProfile : agentProfileSchema.parse(options.backend.profile);
-			if (canonicalCandidateDigest(turnProfile) !== canonicalCandidateDigest(createProfile) && sharedBoxRefusal(turnProfile) !== void 0) throw new ValidationError(`sharedBoxPlacement: ${sharedBoxRefusal(turnProfile)}`);
+			if (canonicalAgentProfileDigest(turnProfile) !== canonicalAgentProfileDigest(createProfile) && sharedBoxRefusal(turnProfile) !== void 0) throw new ValidationError(`sharedBoxPlacement: ${sharedBoxRefusal(turnProfile)}`);
 			if (options?.backend?.type !== void 0 && options.backend.type !== HARNESS) throw new ValidationError(`sharedBoxPlacement: backend ${options.backend.type} is not ${HARNESS}`);
 			turnActive = true;
 			try {
@@ -5688,7 +6322,7 @@ async function materializeWorker(box, paths, profile, task, turnModel, clientNam
 * `opencode export` writes the same session as JSON.
 */
 async function exportSession(run, collect, paths, sessionId) {
-	if (!/^[A-Za-z0-9_-]+$/u.test(sessionId)) return;
+	if (!SESSION_ID.test(sessionId)) return;
 	await collect(await run([
 		"/bin/sh",
 		"-c",
@@ -5698,6 +6332,29 @@ async function exportSession(run, collect, paths, sessionId) {
 		`${paths.home}/.local/share/opencode/export/${sessionId}.json`
 	], DEFAULT_EXEC_TIMEOUT_MS));
 }
+const SESSION_ID = /^[A-Za-z0-9_-]+$/u;
+/** A subagent's session id in a `task` result (`<task id="ses_…">`) or failure (`task_id: ses_…`). */
+const TASK_SESSION = /(?:<task id="|task_id: )(ses_[A-Za-z0-9]+)/u;
+/**
+* The session a harness subagent ran in, named by its parent's `task` tool part.
+*
+* opencode starts each subagent in a child session and refuses a nested one unless the
+* configuration raises `subagent_depth` above 1, so under the default the parent's parts name
+* every subagent session. A running part carries the id in `state.metadata.sessionId`; a finished
+* one also carries it in its output, and a failed one in its error.
+*/
+function subagentSessionOf(part) {
+	if (part.type !== "tool" || part.tool !== "task") return void 0;
+	const state = part.state;
+	if (state === void 0 || state === null || typeof state !== "object") return void 0;
+	const { metadata, output, error } = state;
+	const named = metadata !== null && typeof metadata === "object" ? metadata.sessionId : void 0;
+	if (typeof named === "string" && SESSION_ID.test(named)) return named;
+	for (const text of [output, error]) {
+		const match = typeof text === "string" ? TASK_SESSION.exec(text) : null;
+		if (match !== null) return match[1];
+	}
+}
 /**
 * Translate opencode's JSON event lines into the Sandbox event wire the provider executor reads.
 *
@@ -5711,6 +6368,7 @@ function createOpencodeEventParser(model) {
 	let sessionId;
 	let finalMessageId;
 	const textByMessage = /* @__PURE__ */ new Map();
+	const subagentSessions = /* @__PURE__ */ new Set();
 	const errors = [];
 	let malformed = 0;
 	let spentTokens = false;
@@ -5723,6 +6381,7 @@ function createOpencodeEventParser(model) {
 	};
 	return {
 		sessionId: () => sessionId,
+		subagentSessionIds: () => [...subagentSessions],
 		/** Why this run failed, or `undefined` when it answered. */
 		failure: failureOf,
 		/** Whether this run spent any model tokens before it ended. */
@@ -5747,6 +6406,8 @@ function createOpencodeEventParser(model) {
 			}
 			const part = event.part;
 			if (part === void 0 || part === null || typeof part !== "object") return;
+			const subagent = subagentSessionOf(part);
+			if (subagent !== void 0) subagentSessions.add(subagent);
 			yield {
 				type: "message.part.updated",
 				data: { part }
@@ -7001,6 +7662,205 @@ function signalPass(value, required) {
 	return !required;
 }
 //#endregion
+//#region src/runtime/supervise/run-context-sql.ts
+/**
+*
+* `createSqlRunContext` — the SQL-backed durable bundle a `createSupervisor().run` (or a
+* `runGraph`/`supervise` call that accepts injected stores) needs: a `SqlSpawnJournal`, a
+* `SqlResultBlobStore` (both over one `SqlStatements` seam — the same adapter shape
+* `SqlConversationJournal` takes), and a fresh `createExecutorRegistry()`, with `resume: true`
+* so spreading the context makes the run loadTree-first.
+*
+* The SQL analogue of `createFileRunContext`: where that bundle owns a directory, this one owns
+* tables in a database the caller already operates. The durable coordination side-log and
+* cancellation observers remain file-based behind `runDir`; a SQL coordination log is follow-up.
+*
+* @experimental
+*/
+/** Build a durable run context over one SQL statement seam. Tables are created on first use. */
+function createSqlRunContext(db) {
+	return {
+		journal: new SqlSpawnJournal(db),
+		blobs: new SqlResultBlobStore(db),
+		executors: createExecutorRegistry(),
+		resume: true
+	};
+}
+//#endregion
+//#region src/runtime/supervise/sql-run-context.ts
+/**
+* A cross-machine run context on the existing autocommit SqlAdapter. Reuse the same database,
+* tablePrefix and runId on every host; no runDir or shared filesystem is required.
+*
+* Each ownership generation gets fresh store capabilities. The public context can inspect SQL
+* at any time, but cannot write without acquire(). runGraph/supervise acquire and release it.
+* Retained provider execution supplies external admission/result idempotency; SQL does not turn
+* an arbitrary unkeyed network effect into an exactly-once operation.
+* @experimental
+*/
+async function createFencedSqlRunContext(db, runId, options = {}) {
+	const store = await openSqlRunStore(db, runId, options);
+	const { executors } = createInMemoryRunContext({ withDriver: options.withDriver ?? true });
+	const cold = async () => projection(await store.read());
+	const unowned = async () => {
+		throw new SqlRunOwnershipError(`SQL run '${runId}' requires an acquired lease before writing`);
+	};
+	const context = {
+		durability: "sql",
+		runId,
+		namespace: store.namespace,
+		resume: true,
+		executors,
+		journal: {
+			loadTree: async (root) => (await cold()).journal.loadTree(root),
+			beginTree: unowned,
+			appendEvent: unowned,
+			appendEvents: unowned
+		},
+		blobs: {
+			get: async (ref) => (await cold()).blobs.get(ref),
+			put: unowned
+		},
+		coordinationLog: {
+			load: async (id, owner) => (await cold()).loadCoordination(id, owner),
+			append: unowned
+		},
+		async acquire(signal) {
+			const lease = await store.acquire(signal);
+			try {
+				const failureController = new AbortController();
+				const leaseSignal = AbortSignal.any([lease.signal, failureController.signal]);
+				const view = await projection(lease.records);
+				let tail = Promise.resolve();
+				let accepting = true;
+				let failed;
+				let hasFailed = false;
+				const check = () => {
+					leaseSignal.throwIfAborted();
+					if (hasFailed) throw failed;
+				};
+				const read = async (operation) => {
+					await tail;
+					check();
+					return operation();
+				};
+				const commit = (entry) => {
+					if (!accepting) return unowned();
+					const captured = detachedSnapshot(entry, "SQL run record");
+					const write = tail.then(async () => {
+						check();
+						if (await view.apply(captured)) await lease.append(captured);
+					});
+					tail = write.catch((error) => {
+						hasFailed = true;
+						failed = error;
+						failureController.abort(error);
+					});
+					return write;
+				};
+				const bound = {
+					durability: "sql",
+					runId,
+					namespace: store.namespace,
+					resume: true,
+					executors,
+					journal: {
+						loadTree: (root) => read(() => view.journal.loadTree(root)),
+						beginTree: (root, at) => commit({
+							kind: "begin",
+							root,
+							at
+						}),
+						appendEvent: (root, event) => commit({
+							kind: "events",
+							root,
+							events: [event]
+						}),
+						appendEvents: (root, events) => commit({
+							kind: "events",
+							root,
+							events: [...events]
+						})
+					},
+					blobs: {
+						get: (ref) => read(() => view.blobs.get(ref)),
+						put: (ref, value) => commit({
+							kind: "blobs",
+							ref,
+							value
+						})
+					},
+					coordinationLog: {
+						load: (id, owner) => read(() => view.loadCoordination(id, owner)),
+						append: (id, record, ownerId) => commit({
+							kind: "coordination",
+							runId: id,
+							record,
+							...ownerId === void 0 ? {} : { ownerId }
+						})
+					}
+				};
+				return {
+					context: Object.freeze(bound),
+					signal: leaseSignal,
+					async release() {
+						accepting = false;
+						await tail;
+						await lease.release();
+					}
+				};
+			} catch (error) {
+				await lease.release().catch(() => void 0);
+				throw error;
+			}
+		}
+	};
+	return Object.freeze(context);
+}
+/** Reuse the existing journal's uniqueness/sequence rules and blob hash validation verbatim. */
+async function projection(entries) {
+	const journal = new InMemorySpawnJournal();
+	const blobs = new InMemoryResultBlobStore();
+	const beginnings = /* @__PURE__ */ new Map();
+	const coordination = [];
+	const apply = async (entry) => {
+		switch (entry.kind) {
+			case "begin": {
+				const prior = beginnings.get(entry.root);
+				await journal.beginTree(entry.root, entry.at);
+				beginnings.set(entry.root, entry.at);
+				return prior === void 0;
+			}
+			case "events":
+				for (const event of entry.events) await journal.appendEvent(entry.root, event);
+				return entry.events.length > 0;
+			case "blobs": {
+				const existing = await blobs.get(entry.ref);
+				await blobs.put(entry.ref, entry.value);
+				return existing === void 0;
+			}
+			case "coordination":
+				if (entry.record.event.type === "settled") return false;
+				coordination.push(entry);
+				return true;
+			default: throw new Error("Unknown SQL run record kind");
+		}
+	};
+	for (const entry of entries) await apply(entry);
+	return {
+		journal,
+		blobs,
+		apply,
+		loadCoordination(id, ownerId) {
+			return foldCoordinationRecords(coordination.map(({ runId, ownerId, record }) => ({
+				runId,
+				...record,
+				...ownerId === void 0 ? {} : { ownerId }
+			})), id, ownerId);
+		}
+	};
+}
+//#endregion
 //#region src/runtime/supervise/trajectory-recorder.ts
 /**
 *
@@ -8284,6 +9144,6 @@ function tail(s) {
 	return s.slice(-400);
 }
 //#endregion
-export { definePersona as $, createTangleSandboxExactProcessProvider as $t, chatWorkerSeam as A, superviseDispatch as At, DEFAULT_SHARED_BOX_RESOURCES as B, renderPairwiseMarkdown as Bt, withUntrackedArtifacts as C, harvestCorpus as Ct, codeModeSupervisorTools as D, inlineSandboxClient as Dt, runCoderChecks as E, localSandboxClient as Et, selectChampion as F, leaderboard as Ft, sharedWorkerClientName as G, materializeLocalMcp as Gt, ROUTER_CLIENT_HEADER as H, defaultAuditorInstruction as Ht, assertStrategyContract as I, pairwiseSignificance as It, printBenchmarkReport as J, envKeyProvider as Jt, SandboxRunAbortError as K, createMcpEnvironment as Kt, authorStrategy as L, renderLeaderboardHtml as Lt, discriminatingMeans as M, deterministicCompletion as Mt, pickChampion as N, sentinelCompletion as Nt, unsafeInProcessRunner as O, loopCampaignDispatch as Ot, runStrategyEvolution as P, stopSentinel as Pt, trajectoryReport as Q, secretEnvOfMcpServer as Qt, strategyAuthorContract as R, renderLeaderboardMarkdown as Rt, copyUntrackedIntoClone as S, HarvestError as St, patchDelivered as T, resolveSandboxClient as Tt, sharedBoxPlacement as U, McpSpawnFault as Ut, DEFAULT_SHARED_BOX_WORKERS as V, auditIntent as Vt, sharedBoxRefusal as W, connectStdioMcp as Wt, promotionGate as X, resolveMcpServerLaunch as Xt, runBenchmark as Y, mcpSecretEnvMetadataKey as Yt, equalKOnCost as Z, resolveSecretEnv as Zt, NOTE_MAX_CHARS as _, createScopeAnalyst as _t, localShell as a, InMemoryCorpus as at, composeWorkerEvidence as b, runIsolatedCheck as bt, createVerifierEnvironment as c, flatWidenGate as ct, harvestSurfaceDiffs as d, pipeline as dt, runPersonified as et, analystsFromRegistry as f, selectValidWinner as ft, EVIDENCE_MAX_CHARS as g, buildSteerContext as gt, worktreeFanout as h, assertTraceDerivedFindings as ht, jjWorkspace as i, FileCorpus as it, createChatSessionStore as j, completionAuthorizes as jt, chatTransportExecutor as k, loopDispatch as kt, boxSurfaceReader as l, loopUntil as lt, superviseSurface as m, widen as mt, makeFinding$1 as n, createShapeRegistry as nt, runInWorkspace as o, renderCorpusToInstructions as ot, failuresAnalyst as p, verify as pt, openSandboxRun as q, sanitizeMcpToolSchema as qt, gitWorkspace as r, registerShape as rt, createWaterfallCollector as s, fanout as st, computeFindingId$1 as t, builtinShapes as tt, fsSurfaceReader as u, panel as ut, VERIFY_TAIL_CHARS as v, registryScopeAnalyst as vt, analyzeTrace as w, defineLeaderboard as wt, settledWorkerOut as x, inProcessSandboxClient as xt, closingWorkerNote as y, observationFromRegistry as yt, strategyAuthorSystemPrompt as z, renderLeaderboardSvg as zt };
+export { equalKOnCost as $, SqlResultBlobStore as $t, unsafeInProcessRunner as A, loopDispatch as At, strategyAuthorContract as B, deterministicCompletion as Bt, withUntrackedArtifacts as C, HarvestError as Ct, patchDelivered as D, localSandboxClient as Dt, createSqlRunContext as E, resolveSandboxClient as Et, pickChampion as F, declaredCheckDigest as Ft, sharedBoxPlacement as G, renderLeaderboardHtml as Gt, DEFAULT_SHARED_BOX_RESOURCES as H, stopSentinel as Ht, runStrategyEvolution as I, declaredCheckJudge as It, SandboxRunAbortError as J, renderPairwiseMarkdown as Jt, sharedBoxRefusal as K, renderLeaderboardMarkdown as Kt, selectChampion as L, readDeclaredCheck as Lt, chatWorkerSeam as M, assertDeclaredCheck as Mt, createChatSessionStore as N, checkProgramDigest as Nt, runCoderChecks as O, inlineSandboxClient as Ot, discriminatingMeans as P, declaredCheckDeliverable as Pt, promotionGate as Q, openSqlRunStore as Qt, assertStrategyContract as R, runIsolatedCheck as Rt, copyUntrackedIntoClone as S, inProcessSandboxClient as St, createFencedSqlRunContext as T, defineLeaderboard as Tt, DEFAULT_SHARED_BOX_WORKERS as U, leaderboard as Ut, strategyAuthorSystemPrompt as V, sentinelCompletion as Vt, ROUTER_CLIENT_HEADER as W, pairwiseSignificance as Wt, printBenchmarkReport as X, defaultAuditorInstruction as Xt, openSandboxRun as Y, auditIntent as Yt, runBenchmark as Z, SqlRunOwnershipError as Zt, NOTE_MAX_CHARS as _, assertTraceDerivedFindings as _t, localShell as a, sanitizeMcpToolSchema as an, registerShape as at, composeWorkerEvidence as b, registryScopeAnalyst as bt, createVerifierEnvironment as c, resolveMcpServerLaunch as cn, renderCorpusToInstructions as ct, harvestSurfaceDiffs as d, createTangleSandboxExactProcessProvider as dn, loopUntil as dt, SqlSpawnJournal as en, trajectoryReport as et, analystsFromRegistry as f, panel as ft, EVIDENCE_MAX_CHARS as g, widen as gt, worktreeFanout as h, verify as ht, jjWorkspace as i, createMcpEnvironment as in, createShapeRegistry as it, chatTransportExecutor as j, superviseDispatch as jt, codeModeSupervisorTools as k, loopCampaignDispatch as kt, boxSurfaceReader as l, resolveSecretEnv as ln, fanout as lt, superviseSurface as m, selectValidWinner as mt, makeFinding$1 as n, connectStdioMcp as nn, runPersonified as nt, runInWorkspace as o, envKeyProvider as on, FileCorpus as ot, failuresAnalyst as p, pipeline as pt, sharedWorkerClientName as q, renderLeaderboardSvg as qt, gitWorkspace as r, materializeLocalMcp as rn, builtinShapes as rt, createWaterfallCollector as s, mcpSecretEnvMetadataKey as sn, InMemoryCorpus as st, computeFindingId$1 as t, McpSpawnFault as tn, definePersona as tt, fsSurfaceReader as u, secretEnvOfMcpServer as un, flatWidenGate as ut, VERIFY_TAIL_CHARS as v, buildSteerContext as vt, analyzeTrace as w, harvestCorpus as wt, settledWorkerOut as x, observationFromRegistry as xt, closingWorkerNote as y, createScopeAnalyst as yt, authorStrategy as z, completionAuthorizes as zt };
 
-//# sourceMappingURL=runtime-hOLlAc1i.js.map
+//# sourceMappingURL=runtime-CHxXrUeZ.js.map