@tangle-network/agent-runtime 0.271.0 → 0.273.3

package/dist/{runtime-DVjIH1eo.js → runtime-CHxXrUeZ.js}

@@ -1,24 +1,24 @@
-import { At as insideCursorNamespace, Dn as runAgentRounds, Dt as SpawnEventIndex, Et as InMemorySpawnJournal, Fn as canonicalObservedModelParts, Gn as unavailableSignalOfFailure, Gr as harnessInvocation, Ii as executableAgentProfileSnapshot, Kn as createPushTraceSource, Li as executableAgentSpecSnapshot, Lt as isTraceAnalysisStore, M as settledToIteration, Mn as readPromptOptions, Nn as routerBrain, On as createSandboxLineage, Ot as assertContentAddress, Pn as runBrainLoop, Ri as detachedFrozen, Rn as LEAF_CONTINUATION_TASK, Sa as armDeadlineTimer, Tn as defaultSelectWinner, Tt as InMemoryResultBlobStore, Un as sandboxClientAsProvider, Wn as unavailablePauseMs, Xi as notifySandboxEventObserver, _i as writeAllBytes, _t as createExecutorRegistry, aa as isAbortError, b as withDriverExecutor, ca as sleep, dt as rollingDispatch, ea as addSpend, gi as readCommittedJsonLines, gt as createExecutor, hi as prepareJsonlAppend, hr as contentAddress, ia as hasCompleteCacheBreakdown, jn as assertBoxlessPromptOptions, kn as probeSandboxCapabilities, kt as encodeResultBlob, la as stringifySafe, ma as zeroSpend, na as cloneSpend, r as createSupervisor, sa as randomSuffix, ta as chargedTokens, yt as createWorktreeCliExecutor, zi as detachedSnapshot } from "./supervisor-Cvd5mf7x.js";
+import { $i as detachedSnapshot, Ai as readCommittedJsonLines, Bn as runAgentRounds, Bt as SpawnEventIndex, Ca as stringifySafe, Ct as rollingDispatch, Gn as readPromptOptions, Hn as probeSandboxCapabilities, Ht as encodeResultBlob, Ia as armDeadlineTimer, Jn as canonicalObservedModelParts, Kn as routerBrain, M as withDriverExecutor, O as verdictFromJudgeScore, Oa as zeroSpend, Ot as createExecutor, Qi as detachedFrozen, Rn as defaultSelectWinner, Rt as InMemoryResultBlobStore, Sa as sleep, Ut as insideCursorNamespace, Vn as createSandboxLineage, Vt as assertContentAddress, W as settledToIteration, Wn as assertBoxlessPromptOptions, Xi as executableAgentProfileSnapshot, Xt as isTraceAnalysisStore, Zi as executableAgentSpecSnapshot, Zn as LEAF_CONTINUATION_TASK, _ as CheckUnavailableError, ai as harnessInvocation, ar as createPushTraceSource, ga as cloneSpend, ha as chargedTokens, ir as unavailableSignalOfFailure, ji as writeAllBytes, jt as createWorktreeCliExecutor, ki as prepareJsonlAppend, kr as contentAddress, kt as createExecutorRegistry, ma as addSpend, nr as sandboxClientAsProvider, qn as runBrainLoop, r as createSupervisor, rr as unavailablePauseMs, ua as notifySandboxEventObserver, va as hasCompleteCacheBreakdown, xa as randomSuffix, ya as isAbortError, zt as InMemorySpawnJournal } from "./supervisor-DdKPGluv.js";
 import { m as ValidationError, n as AnalystError, s as PlannerError } from "./errors-DodWX-cb.js";
-import { E as profileChatClient, S as ObservationError, T as renderReport, b as sample, k as strategyAuthorMethod, v as refine, w as observe, x as sampleThenRefine, y as runAgentic } from "./structural-rollout-I92sIfNl.js";
+import { E as profileChatClient, S as ObservationError, T as renderReport, b as sample, k as strategyAuthorMethod, v as refine, w as observe, x as sampleThenRefine, y as runAgentic } from "./structural-rollout-DCUprNpH.js";
 import { a as concreteProfileModel, c as profileModelExecutionSettings, i as concreteModelId, l as profileProviderModel, o as enforceTokenLimits, t as assertExecutableAgentProfile } from "./model-policy-BbSCSak0.js";
 import { C as canonicalCandidateDigest$1, D as immutableCandidateValue, k as sha256Bytes$1, m as captureMaterializedWorkspace } from "./workspace-archive-C9lgf77y.js";
 import { i as notifyRuntimeHookEvent } from "./runtime-hooks-tXpAarhW.js";
-import { i as redactProtectedValue, r as redactProtectedReason } from "./protected-redaction--F3v1oo8.js";
-import "./coordination-driver-iBGMKDvB.js";
-import { C as gateOnDeliverable, r as supervise, w as mapExecutorResult } from "./supervise-DJ_1i9vj.js";
+import { i as redactProtectedValue, r as redactProtectedReason } from "./protected-redaction-DylCC_ot.js";
+import { S as foldCoordinationRecords, y as createInMemoryRunContext } from "./coordination-driver-CkcW4dxU.js";
+import { C as gateOnDeliverable, r as supervise, w as mapExecutorResult } from "./supervise-Dej5aSDa.js";
 import "./run-layout-vwd4SwX_.js";
-import "./provision-supervisor-Cy8pqE95.js";
-import "./delegate-DOqUvaIz.js";
-import "./graph-DnMcepkN.js";
-import { agentProfileSchema, canonicalAgentProfileDigest, canonicalCandidateDigest, validateAgentProfileSecurity } from "@tangle-network/agent-interface";
+import "./provision-supervisor-BKAvsDtP.js";
+import "./delegate-Dvb1-mE-.js";
+import "./graph-C69Uxtzt.js";
+import { agentProfileSchema, canonicalAgentProfileDigest, canonicalCandidateDigest, sha256Bytes, validateAgentProfileSecurity } from "@tangle-network/agent-interface";
 import { CODING_HARNESSES, DEFAULT_TRACE_ANALYST_KINDS, InMemoryTraceStore, OUTPUT_VALUE, benjaminiHochberg, buildTrajectory, computeFindingId as computeFindingId$1, confidenceInterval, createTraceAnalyst, expandProfileAxes, makeFinding as makeFinding$1, pairedBootstrap, paretoFrontier, wilcoxonSignedRank, wilson } from "@tangle-network/agent-eval";
 import { createAgentRunOutcomeTracker } from "@tangle-network/sandbox/runtime";
 import { createHash, randomUUID } from "node:crypto";
 import { execFile, execFileSync, spawn, spawnSync } from "node:child_process";
 import { appendFileSync, chmodSync, constants, copyFileSync, existsSync, lstatSync, mkdirSync, mkdtempSync, readFileSync, readlinkSync, rmSync, symlinkSync, writeFileSync } from "node:fs";
 import { dirname, isAbsolute, join, relative, resolve, sep } from "node:path";
-import { cp, mkdir, mkdtemp, readFile, realpath, stat, writeFile } from "node:fs/promises";
+import { cp, mkdir, mkdtemp, readFile, readdir, realpath, rm, stat, writeFile } from "node:fs/promises";
 import { materializeProfile } from "@tangle-network/agent-profile-materialize";
 import { tmpdir } from "node:os";
 import { isDeepStrictEqual, promisify } from "node:util";
@@ -1015,6 +1015,266 @@ var SqlResultBlobStore = class {
 	}
 };
 //#endregion
+//#region src/durable/sql-run-store.ts
+/** Refuses a competing or stale SQL run owner before it can publish new work. */
+var SqlRunOwnershipError = class extends Error {
+	constructor(message) {
+		super(message);
+		this.name = "SqlRunOwnershipError";
+	}
+};
+/**
+* Append-only immutable records, published by ONE compare-and-set of the run's head.
+*
+* SqlAdapter has no pinned-connection transaction API. INSERT ... SELECT owner is NOT a
+* fence on MVCC databases: its snapshot can outlive a takeover. Here both publication and
+* takeover UPDATE the SAME row. Unpublished records are harmless, unreachable staging.
+* Healthy appends write only their new payload and one fixed-size head, never the history.
+*
+* Liveness uses a persisted progress counter, not incomparable host clocks. A contender must
+* observe the SAME generation/counter for leaseMs before replacing it with a CAS. Every
+* heartbeat and publication advances that counter. The interval is stored per run so a
+* differently configured contender cannot shorten an existing owner's lease.
+* @internal
+*/
+async function openSqlRunStore(db, runId, options = {}) {
+	const prefix = options.tablePrefix ?? "agent_run";
+	const leaseMs = options.leaseMs ?? 3e4;
+	const heartbeatMs = options.heartbeatMs ?? Math.floor(leaseMs / 3);
+	if (!/^[A-Za-z_][A-Za-z0-9_]{0,39}$/.test(prefix)) throw new Error("SQL run context tablePrefix must be a SQL identifier of at most 40 characters");
+	if (typeof runId !== "string" || runId.length === 0) throw new Error("SQL runId must be nonempty");
+	if (!Number.isSafeInteger(leaseMs) || leaseMs < 100 || leaseMs > 2147483647) throw new Error("SQL leaseMs must be an integer between 100 and 2147483647");
+	if (!Number.isSafeInteger(heartbeatMs) || heartbeatMs < 1 || heartbeatMs > leaseMs / 3) throw new Error("SQL heartbeatMs must be a positive integer no greater than leaseMs / 3");
+	const heads = `${prefix}_heads`;
+	const records = `${prefix}_records`;
+	await db.exec(`CREATE TABLE IF NOT EXISTS ${heads} (
+    run_id TEXT PRIMARY KEY,
+    owner TEXT NOT NULL,
+    generation INTEGER NOT NULL,
+    pulse INTEGER NOT NULL,
+    head TEXT NOT NULL,
+    revision INTEGER NOT NULL,
+    lease_ms INTEGER NOT NULL,
+    namespace TEXT NOT NULL
+  )`);
+	await db.exec(`CREATE TABLE IF NOT EXISTS ${records} (
+    run_id TEXT NOT NULL,
+    id TEXT NOT NULL,
+    parent TEXT NOT NULL,
+    revision INTEGER NOT NULL,
+    payload TEXT NOT NULL,
+    PRIMARY KEY (run_id, id)
+  )`);
+	await db.exec(`INSERT INTO ${heads} (run_id, owner, generation, pulse, head, revision, lease_ms, namespace)
+     VALUES (?, '', 0, 0, '', 0, ?, ?) ON CONFLICT (run_id) DO NOTHING`, [
+		runId,
+		leaseMs,
+		randomUUID()
+	]);
+	async function readHead() {
+		const [row] = await db.query(`SELECT * FROM ${heads} WHERE run_id = ?`, [runId]);
+		if (!row) throw new Error(`SQL run '${runId}' has no head`);
+		for (const key of [
+			"generation",
+			"pulse",
+			"revision",
+			"lease_ms"
+		]) {
+			row[key] = Number(row[key]);
+			if (!Number.isSafeInteger(row[key]) || row[key] < 0) throw new Error(`SQL run '${runId}' has an invalid ${key}`);
+		}
+		if (typeof row.namespace !== "string" || row.namespace.length === 0 || typeof row.head !== "string" || typeof row.owner !== "string" || row.head === "" !== (row.revision === 0)) throw new Error(`SQL run '${runId}' has an invalid head`);
+		if (row.lease_ms !== leaseMs) throw new Error(`SQL run '${runId}' lease configuration differs: recorded ${row.lease_ms}ms, requested ${leaseMs}ms`);
+		return row;
+	}
+	async function load(head) {
+		if (head.revision === 0) return [];
+		const rows = await db.query(`SELECT id, parent, revision, payload FROM ${records} WHERE run_id = ? AND revision <= ?`, [runId, head.revision]);
+		const byId = new Map(rows.map((row) => [row.id, row]));
+		const history = [];
+		let id = head.head;
+		for (let revision = head.revision; revision > 0; revision -= 1) {
+			const row = byId.get(id);
+			if (!row || Number(row.revision) !== revision || recordId(row.parent, revision, row.payload) !== id) throw new Error(`SQL run '${runId}' has a missing or corrupt committed record at revision ${revision}`);
+			history.push(JSON.parse(row.payload));
+			id = row.parent;
+		}
+		if (id !== "") throw new Error(`SQL run '${runId}' has an invalid history origin`);
+		return history.reverse();
+	}
+	return {
+		namespace: (await readHead()).namespace,
+		async read() {
+			return load(await readHead());
+		},
+		async acquire(signal) {
+			signal?.throwIfAborted();
+			const observed = await readHead();
+			if (observed.owner !== "") await wait(leaseMs, signal);
+			signal?.throwIfAborted();
+			const owner = randomUUID();
+			let claimed = false;
+			try {
+				claimed = (await db.exec(`UPDATE ${heads} SET owner = ?, generation = generation + 1, pulse = pulse + 1
+           WHERE run_id = ? AND owner = ? AND generation = ? AND pulse = ?`, [
+					owner,
+					runId,
+					observed.owner,
+					observed.generation,
+					observed.pulse
+				])).rowsAffected === 1;
+			} catch (error) {
+				if ((await readHead().catch(() => void 0))?.owner !== owner) throw error;
+				claimed = true;
+			}
+			if (!claimed) throw new SqlRunOwnershipError(`SQL run '${runId}' is owned by another live process`);
+			const generation = observed.generation + 1;
+			const controller = new AbortController();
+			let accepting = true;
+			let released;
+			let tail = Promise.resolve();
+			let heartbeat;
+			let progressAt = performance.now();
+			let head = observed.head;
+			let revision = observed.revision;
+			let history = [];
+			const lose = (error) => {
+				accepting = false;
+				clearInterval(timer);
+				controller.abort(error);
+			};
+			const timer = setInterval(() => {
+				if (controller.signal.aborted) return;
+				if (performance.now() - progressAt >= leaseMs) {
+					lose(new SqlRunOwnershipError(`SQL run '${runId}' lease heartbeat expired`));
+					return;
+				}
+				if (heartbeat) return;
+				heartbeat = db.exec(`UPDATE ${heads} SET pulse = pulse + 1 WHERE run_id = ? AND owner = ? AND generation = ?`, [
+					runId,
+					owner,
+					generation
+				]).then((result) => {
+					if (result.rowsAffected !== 1) throw new SqlRunOwnershipError(`SQL run '${runId}' lease was replaced`);
+					progressAt = performance.now();
+				}).catch(lose).finally(() => {
+					heartbeat = void 0;
+				});
+			}, heartbeatMs);
+			timer.unref();
+			const lease = {
+				signal: controller.signal,
+				get records() {
+					return JSON.parse(JSON.stringify(history));
+				},
+				append(payload) {
+					if (!accepting) return Promise.reject(controller.signal.reason ?? new SqlRunOwnershipError(`SQL run '${runId}' lease is released`));
+					let encoded;
+					try {
+						encoded = JSON.stringify(payload);
+						if (encoded === void 0) throw new Error("SQL run records must be JSON serializable");
+					} catch (error) {
+						return Promise.reject(error);
+					}
+					const write = tail.then(async () => {
+						controller.signal.throwIfAborted();
+						const nextRevision = revision + 1;
+						const id = recordId(head, nextRevision, encoded);
+						try {
+							await db.exec(`INSERT INTO ${records} (run_id, id, parent, revision, payload) VALUES (?, ?, ?, ?, ?)
+                 ON CONFLICT (run_id, id) DO NOTHING`, [
+								runId,
+								id,
+								head,
+								nextRevision,
+								encoded
+							]);
+						} catch (error) {
+							const [staged] = await db.query(`SELECT id, parent, revision, payload FROM ${records} WHERE run_id = ? AND id = ?`, [runId, id]).catch(() => []);
+							if (!staged || staged.payload !== encoded || staged.parent !== head || Number(staged.revision) !== nextRevision) throw error;
+						}
+						controller.signal.throwIfAborted();
+						let published = false;
+						let failure;
+						try {
+							published = (await db.exec(`UPDATE ${heads} SET head = ?, revision = ?, pulse = pulse + 1
+                 WHERE run_id = ? AND owner = ? AND generation = ? AND head = ? AND revision = ?`, [
+								id,
+								nextRevision,
+								runId,
+								owner,
+								generation,
+								head,
+								revision
+							])).rowsAffected === 1;
+						} catch (error) {
+							failure = error;
+						}
+						if (!published) {
+							const current = await readHead();
+							if (current.owner !== owner || current.generation !== generation) throw new SqlRunOwnershipError(`SQL run '${runId}' lease was replaced before publication`);
+							if (current.head !== id || current.revision !== nextRevision) throw failure ?? new SqlRunOwnershipError(`SQL run '${runId}' publication conflicted`);
+						}
+						controller.signal.throwIfAborted();
+						head = id;
+						revision = nextRevision;
+						history.push(JSON.parse(encoded));
+						progressAt = performance.now();
+					});
+					tail = write.catch(lose);
+					return write;
+				},
+				release() {
+					if (released) return released;
+					accepting = false;
+					released = (async () => {
+						await tail;
+						clearInterval(timer);
+						try {
+							await db.exec(`UPDATE ${heads} SET owner = '', pulse = pulse + 1 WHERE run_id = ? AND owner = ? AND generation = ?`, [
+								runId,
+								owner,
+								generation
+							]);
+						} finally {
+							controller.abort(new SqlRunOwnershipError(`SQL run '${runId}' lease is released`));
+						}
+					})();
+					return released;
+				}
+			};
+			try {
+				history = await load(observed);
+				signal?.throwIfAborted();
+				controller.signal.throwIfAborted();
+				return lease;
+			} catch (error) {
+				await lease.release().catch(() => void 0);
+				throw error;
+			}
+		}
+	};
+}
+function recordId(parent, revision, payload) {
+	return createHash("sha256").update(`${revision}\0${parent}\0${payload}`).digest("hex");
+}
+function wait(ms, signal) {
+	return new Promise((resolve, reject) => {
+		const cleanup = () => signal?.removeEventListener("abort", abort);
+		const timer = setTimeout(() => {
+			cleanup();
+			resolve();
+		}, ms);
+		const abort = () => {
+			clearTimeout(timer);
+			cleanup();
+			reject(signal?.reason);
+		};
+		if (signal?.aborted) abort();
+		else signal?.addEventListener("abort", abort, { once: true });
+	});
+}
+//#endregion
 //#region src/runtime/audit-intent.ts
 /** Default system instruction for intent-auditor agents: diagnose diverged/drifting trajectories. */
 const defaultAuditorInstruction = "You audit whether an AI agent is on the RIGHT ROUTE — not whether it works hard, but whether its actions serve the stated intents. Infer the REVEALED intent from the action pattern (what the trajectory is actually optimizing). Compare against the declared task intent, the user intent when given, and the meta-intent when given. Flawless execution down the wrong route is DIVERGED. Busy-work that neither advances nor harms is DRIFTING. Judge only from the trajectory — be specific about which actions ground your verdict. Recommend abort only when continuing cannot serve the intent.";
@@ -1528,1529 +1788,1733 @@ function deterministicCompletion(check) {
 	} };
 }
 //#endregion
-//#region src/runtime/loop-dispatch.ts
-/** Bridge a campaign `DispatchContext.trace` to a `LoopTraceEmitter` so every
-*  `loop.*` event lands as a span under the cell's scoped trace. */
-function campaignTraceToLoopEmitter(trace) {
-	return { emit(event) {
-		trace.span(event.kind, {
-			runId: event.runId,
-			timestamp: event.timestamp,
-			...event.payload
-		}).end();
-	} };
-}
-async function runLoopForCell(opts, scenario, profile, ctx) {
-	const loopOptions = opts.toLoopOptions(scenario, profile);
-	return runLoopWithCampaignContext(opts, loopOptions, ctx, {
-		model: profile.model?.default ?? modelFromLoopOptions(loopOptions),
-		maximumCharge: typeof opts.maximumCharge === "function" ? opts.maximumCharge(scenario, profile) : opts.maximumCharge,
-		resolveModel: opts.resolveCostModel ? (result) => opts.resolveCostModel?.(result, scenario, profile) : void 0
-	});
-}
-async function runLoopWithCampaignContext(opts, loopOptions, ctx, cost) {
-	const paid = await ctx.cost.runPaidCall({
-		channel: "agent",
-		actor: opts.costSource ?? "loop",
-		model: cost.model,
-		signal: ctx.signal,
-		...cost.maximumCharge ? { maximumCharge: cost.maximumCharge } : {},
-		execute: (executionSignal) => runAgentRounds({
-			...loopOptions,
-			ctx: {
-				sandboxClient: opts.sandboxClient,
-				...opts.promptOptions === void 0 ? {} : { promptOptions: opts.promptOptions },
-				signal: executionSignal,
-				traceEmitter: opts.forwardTrace === false ? void 0 : campaignTraceToLoopEmitter(ctx.trace)
+//#region src/runtime/isolated-checker.ts
+const toolchains = [
+	"/usr",
+	"/bin",
+	"/lib",
+	"/lib64"
+];
+const contains = (parent, child) => {
+	const path = relative(parent, child);
+	return path === "" || path !== ".." && !path.startsWith(`..${sep}`) && !path.startsWith(sep);
+};
+/**
+* Run an untrusted check in Linux Bubblewrap, or in its own Sandbox box when `box` is set.
+* Never falls back to host execution.
+*
+* Bubblewrap requires /usr/bin/bwrap and permission to create Linux namespaces.
+* Only trusted system toolchains, private proc/dev/tmp, and the writable copy are mounted.
+* The canonical input path remains the working directory; copy writes are discarded.
+* Limits bound command time and captured output, not copy size or memory consumption.
+* Callers must keep the input and trusted toolchains stable while preparing the check.
+*
+* A box check creates one fresh box with no owner secrets and blocked egress (or strict egress to
+* the placement's named domains), delivers the tree's regular files verified by sha256, runs the
+* command there with only the environment `env` names, and deletes the box.
+*/
+async function runIsolatedCheck(options) {
+	if (options.box) return runInBox(options, options.box);
+	let scratch;
+	let result;
+	try {
+		if (process.platform !== "linux") throw new Error("Linux Bubblewrap namespaces are required");
+		const { timeoutMs, maxOutputBytes } = checkLimits(options);
+		if (options.signal?.aborted) return {
+			succeeded: false,
+			reason: "cancelled",
+			diagnostic: "Check cancelled"
+		};
+		const { workspace, tree } = await protectedTree(options);
+		const binds = [];
+		for (const path of toolchains) {
+			let actual;
+			try {
+				actual = await realpath(path);
+			} catch (error) {
+				if (error.code === "ENOENT") continue;
+				throw error;
 			}
-		}),
-		receipt: (result) => loopCostReceipt(result, cost.resolveModel?.(result) ?? cost.model)
-	});
-	if (!paid.succeeded) throw paid.error;
-	const result = paid.value;
-	return (opts.toArtifact ?? ((r) => r.winner?.output))(result);
-}
-function loopCostReceipt(result, model) {
-	return costReceiptFromUsage(result.tokenUsage, model, {
-		usageUnknown: result.tokenUsage.tokensKnown === false,
-		actualCostUsd: result.costUsdKnown !== false ? result.costUsd : void 0,
-		costUnknown: result.costUsdKnown === false,
-		estimatedCostUsd: result.estimatedCostUsd
-	});
+			for (const mount of [path, actual]) if (contains(mount, workspace) || contains(workspace, mount) || contains(mount, tree) || contains(tree, mount)) throw new Error(`Toolchain overlaps protected workspace: ${path}`);
+			binds.push("--ro-bind", actual, path);
+		}
+		if (["/proc", "/dev"].some((path) => contains(path, tree) || contains(tree, path))) throw new Error("Tree overlaps a reserved namespace mount");
+		scratch = await mkdtemp(join(tmpdir(), "runtime-check-"));
+		if (contains(tree, scratch)) throw new Error("Temporary storage must be outside the input tree");
+		const copy = join(scratch, "tree");
+		await cp(tree, copy, {
+			recursive: true,
+			dereference: false,
+			verbatimSymlinks: true
+		});
+		result = await execute([
+			"--unshare-all",
+			"--die-with-parent",
+			"--new-session",
+			"--cap-drop",
+			"ALL",
+			"--clearenv",
+			"--setenv",
+			"PATH",
+			"/usr/bin:/bin",
+			"--setenv",
+			"HOME",
+			"/tmp",
+			"--setenv",
+			"LANG",
+			"C",
+			...Object.entries(options.env ?? {}).flatMap(([name, value]) => [
+				"--setenv",
+				name,
+				value
+			]),
+			...binds,
+			"--proc",
+			"/proc",
+			"--dev",
+			"/dev",
+			"--tmpfs",
+			"/tmp",
+			"--bind",
+			copy,
+			tree,
+			"--chdir",
+			tree,
+			"--",
+			...options.command
+		], timeoutMs, maxOutputBytes, options.signal);
+	} catch (error) {
+		result = {
+			succeeded: false,
+			reason: "refused",
+			diagnostic: String(error)
+		};
+	}
+	if (scratch) try {
+		await removeScratch(scratch);
+	} catch (error) {
+		const cleanupDiagnostic = String(error);
+		result = result.succeeded ? {
+			succeeded: false,
+			reason: "cleanup-failed",
+			diagnostic: cleanupDiagnostic,
+			stdout: result.value.stdout,
+			stderr: result.value.stderr,
+			exitCode: 0
+		} : {
+			...result,
+			cleanupDiagnostic
+		};
+	}
+	return result;
 }
-/** Map Runtime usage into Eval's canonical paid-call receipt without inventing cache classes. */
-function costReceiptFromUsage(usage, model, cost) {
-	const cacheComplete = hasCompleteCacheBreakdown(usage) && (usage.freshInput !== void 0 || usage.cacheRead !== void 0 || usage.cacheWrite !== void 0);
-	const cacheRead = cacheComplete ? usage.cacheRead ?? 0 : void 0;
-	const cacheWrite = cacheComplete ? usage.cacheWrite ?? 0 : void 0;
-	const classified = (cacheRead ?? 0) + (cacheWrite ?? 0);
+function checkLimits(options) {
+	const timeoutMs = options.timeoutMs ?? 3e4;
+	const maxOutputBytes = options.maxOutputBytes ?? 1048576;
+	if (!Number.isSafeInteger(timeoutMs) || timeoutMs < 1 || timeoutMs > 2147483647 || !Number.isSafeInteger(maxOutputBytes) || maxOutputBytes < 1) throw new Error("Invalid execution limits");
+	if (!options.command.length || !options.command[0]) throw new Error("A command is required");
 	return {
-		model,
-		inputTokens: cacheComplete ? usage.input - classified : usage.input,
-		outputTokens: usage.output,
-		...cacheComplete ? {
-			cachedTokens: cacheRead,
-			cacheWriteTokens: cacheWrite
-		} : {},
-		...usage.tokensKnown === false || cost.usageUnknown ? { usageUnknown: true } : {},
-		...cost.actualCostUsd !== void 0 ? { actualCostUsd: cost.actualCostUsd } : {},
-		...cost.costUnknown ? { costUnknown: true } : {},
-		...cost.estimatedCostUsd !== void 0 ? { estimatedCostUsd: cost.estimatedCostUsd } : {}
+		timeoutMs,
+		maxOutputBytes
 	};
 }
-/** Eval has one pre-admitted paid call for this dispatch. A tree can settle that call only when
-* Runtime has provider-served identity for every inference attempt that actually started. Plan
-* materialization is deliberately ignored: it describes what Runtime requested, not what the
-* provider served. Every visible terminal child must carry provider attempt evidence; a missing
-* evidence record stays unknown, including zero-valued or incomplete spend.
-* @internal Testable identity projection used by superviseDispatch. */
-function supervisedTreeModelForDispatch(result, rootProfile) {
-	const canonicalModels = /* @__PURE__ */ new Set();
-	const observedModels = [];
-	const wholeTreeEvidence = result.providerModel;
-	if (wholeTreeEvidence === void 0 || wholeTreeEvidence.status !== "known" && wholeTreeEvidence.reason !== "provider-model-conflict" || wholeTreeEvidence.attempts.length === 0) return { kind: "unknown" };
-	const wholeTreeIdentity = collectProviderModels(wholeTreeEvidence, () => true);
-	if (wholeTreeIdentity.kind !== "known") return wholeTreeIdentity;
-	for (const model of wholeTreeIdentity.observed) {
-		observedModels.push(model.raw);
-		canonicalModels.add(model.canonical);
-	}
-	if (canonicalModels.size === 0) return { kind: "unknown" };
-	if (canonicalModels.size !== 1) return {
-		kind: "mixed",
-		models: [...canonicalModels].sort()
-	};
+async function protectedTree(options) {
+	const workspace = await realpath(options.workspaceRoot);
+	const tree = await realpath(options.tree);
+	if (!contains(workspace, tree) || !(await stat(tree)).isDirectory()) throw new Error("Tree must be a directory inside the workspace");
 	return {
-		kind: "known",
-		model: observedModels[0]
+		workspace,
+		tree
 	};
 }
-function collectProviderModels(evidence, validate) {
-	if (evidence.status !== "known" && evidence.reason !== "provider-model-conflict" || !Array.isArray(evidence.attempts) || evidence.attempts.length === 0 || !Array.isArray(evidence.models)) return { kind: "unknown" };
-	const observed = [];
-	const canonical = /* @__PURE__ */ new Set();
-	const observedRaw = /* @__PURE__ */ new Set();
-	for (const attempt of evidence.attempts) {
-		if (attempt.providerDispatch === "not_started") {
-			if (attempt.observations.length > 0 || attempt.identityConflict === true) return { kind: "unknown" };
-			continue;
-		}
-		if (attempt === null || typeof attempt !== "object" || !Array.isArray(attempt.observations) || attempt.observations.length === 0 || attempt.identityConflict === true) return { kind: "unknown" };
-		let attemptBase;
-		let attemptSnapshot;
-		let attemptSnapshotKind;
-		let representative;
-		for (const model of attempt.observations) {
-			if (typeof model !== "string" || !validate(model)) return { kind: "unknown" };
-			const identity = canonicalObservedModelParts(model);
-			if (identity === void 0) return { kind: "unknown" };
-			const base = identity.base;
-			const snapshot = identity.snapshot;
-			if (attemptBase !== void 0 && attemptBase !== base) return {
-				kind: "mixed",
-				models: [.../* @__PURE__ */ new Set([...attemptBase ? [attemptBase] : [], identity.canonical])]
-			};
-			if (attemptSnapshot !== void 0 && snapshot !== void 0 && (attemptSnapshot !== snapshot || attemptSnapshotKind !== identity.snapshotKind)) {
-				if (attemptBase === void 0 || attemptSnapshotKind === void 0) return { kind: "unknown" };
-				return {
-					kind: "mixed",
-					models: [attemptIdentityText(attemptBase, attemptSnapshot, attemptSnapshotKind), identity.canonical]
-				};
+/** Box-workspace-relative directory that receives the tree and is the command's cwd. */
+const BOX_TREE = "tree";
+/** Bound on provisioning, delivery, and deletion; the box expires even if this process dies. */
+const BOX_SETUP_SECONDS = 900;
+/** The box's own process timeout is a backstop behind this module's deadline. */
+const BOX_PROCESS_BACKSTOP_MS = 3e4;
+/** Concurrent file deliveries into one check box. */
+const BOX_UPLOADS = 4;
+/** The box's process supervisor prefixes this to stderr when it cannot start the executable. */
+const BOX_EXEC_FAILURE = "process-supervisor: exec failed";
+async function runInBox(options, placement) {
+	let box;
+	let evidence;
+	let result;
+	try {
+		const { timeoutMs, maxOutputBytes } = checkLimits(options);
+		if (options.signal?.aborted) return {
+			succeeded: false,
+			reason: "cancelled",
+			diagnostic: "Check cancelled"
+		};
+		const { tree } = await protectedTree(options);
+		const captured = await captureMaterializedWorkspace(tree);
+		if (placement.builderAccounts.length === 0 || placement.builderAccounts.some((id) => !id)) throw new Error("builderAccounts must name the account of every key the judged run holds");
+		const account = (await placement.client.getIdentity()).customerId;
+		if (!account) throw new Error("Sandbox returned no account for the check key");
+		if (placement.builderAccounts.includes(account)) throw new Error(`Check account ${account} is an account the judged run holds a key to, so the run can reach the check box`);
+		options.signal?.throwIfAborted();
+		box = await placement.client.createIsolated({
+			environment: placement.environment,
+			agent: false,
+			bare: false,
+			ephemeral: true,
+			egressPolicy: egressFor(placement),
+			...placement.resources ? { resources: placement.resources } : {},
+			maxLifetimeSeconds: Math.ceil(timeoutMs / 1e3) + BOX_SETUP_SECONDS,
+			idempotencyKey: `agent-runtime-check-${randomUUID()}`
+		}, options.signal ? { signal: options.signal } : void 0);
+		const receipt = box.createReceipt();
+		if (receipt?.outcome !== "created" || receipt.ownerContext !== "isolated" || !Array.isArray(receipt.injectedSecrets) || receipt.injectedSecrets.length !== 0) throw new Error("Sandbox did not confirm a fresh box with no owner secrets");
+		const egress = (await box.egress.get()).policy;
+		const wanted = egressFor(placement);
+		if (egress.mode !== wanted.mode || wanted.mode === "strict" && (egress.includeImplicitDomains === true || [...egress.allowDomains ?? []].sort().join(",") !== [...wanted.allowDomains ?? []].sort().join(","))) throw new Error(`Check box egress is ${egress.mode} ${JSON.stringify(egress.allowDomains ?? [])}, not ${wanted.mode} ${JSON.stringify(wanted.allowDomains ?? [])}`);
+		await box.fs.mkdir(BOX_TREE, { recursive: true });
+		const digests = new Map(captured.manifest.files.map((entry) => [entry.path, entry.sha256]));
+		const target = box;
+		const pending = [...captured.files];
+		const deliver = async () => {
+			try {
+				for (let file = pending.shift(); file; file = pending.shift()) {
+					options.signal?.throwIfAborted();
+					const received = await target.fs.uploadData(`${BOX_TREE}/${file.path}`, file.bytes, { mode: file.mode });
+					if (`sha256:${received.hash.replace(/^sha256:/, "").toLowerCase()}` !== digests.get(file.path) || received.size !== file.bytes.byteLength) throw new Error(`Check box received different bytes for ${file.path}`);
+				}
+			} catch (error) {
+				pending.length = 0;
+				throw error;
 			}
-			attemptBase = base;
-			attemptSnapshot ??= snapshot;
-			attemptSnapshotKind ??= identity.snapshotKind;
-			if (snapshot !== void 0) representative = model;
-			observedRaw.add(model);
-		}
-		if (attemptBase === void 0 || attemptSnapshot === void 0 || attemptSnapshotKind === void 0 || representative === void 0) return { kind: "unknown" };
-		const attemptIdentity = attemptIdentityText(attemptBase, attemptSnapshot, attemptSnapshotKind);
-		observed.push({
-			raw: representative,
-			canonical: attemptIdentity
-		});
-		canonical.add(attemptIdentity);
+		};
+		await Promise.all(Array.from({ length: BOX_UPLOADS }, deliver));
+		evidence = {
+			sandboxId: box.id,
+			account,
+			input: captured.manifest,
+			inputDigest: canonicalCandidateDigest(captured.manifest)
+		};
+		result = await executeInBox(box, options.command, timeoutMs, maxOutputBytes, options.env ?? {}, options.signal);
+	} catch (error) {
+		result = {
+			succeeded: false,
+			reason: options.signal?.aborted ? "cancelled" : "refused",
+			diagnostic: String(error)
+		};
 	}
-	if (observed.length === 0) return { kind: "unknown" };
-	const declaredRaw = /* @__PURE__ */ new Set();
-	for (const model of evidence.models) {
-		if (typeof model !== "string") return { kind: "unknown" };
-		declaredRaw.add(model);
+	if (box) try {
+		await box.delete();
+	} catch (error) {
+		const cleanupDiagnostic = `Check box ${box.id} was not deleted: ${String(error)}`;
+		result = result.succeeded ? {
+			succeeded: false,
+			reason: "cleanup-failed",
+			diagnostic: cleanupDiagnostic,
+			stdout: result.value.stdout,
+			stderr: result.value.stderr,
+			exitCode: 0
+		} : {
+			...result,
+			cleanupDiagnostic
+		};
 	}
-	if (declaredRaw.size !== observedRaw.size || [...declaredRaw].some((model) => !observedRaw.has(model))) return { kind: "unknown" };
-	return canonical.size > 1 ? {
-		kind: "mixed",
-		models: [...canonical].sort()
-	} : {
-		kind: "known",
-		observed
-	};
+	return evidence ? {
+		...result,
+		box: evidence
+	} : result;
 }
-function attemptIdentityText(base, snapshot, kind) {
-	return kind === "date" ? `${base}-${snapshot}` : `${base}@${snapshot}`;
+/** Blocked unless the placement names domains; then strict, with no implicit domain list. */
+function egressFor(placement) {
+	const domains = [...new Set(placement.egress ?? [])].filter((domain) => domain.trim() !== "");
+	return domains.length === 0 ? { mode: "blocked" } : {
+		mode: "strict",
+		allowDomains: domains,
+		includeImplicitDomains: false
+	};
 }
-/** The Eval receipt surface has no pre-admitted per-model recursive-tree receipt bundle yet. */
-var SupervisedTreeModelIdentityError = class extends Error {
-	constructor(identity) {
-		const detail = identity.kind === "mixed" ? `multiple models (${identity.models.join(", ")})` : "an unknown materialized model";
-		super(`superviseDispatch: cannot settle one Eval paid-call receipt for a tree with ${detail}`);
-		this.name = "SupervisedTreeModelIdentityError";
+async function executeInBox(box, command, timeoutMs, limit, env, signal) {
+	const [executable, ...args] = command;
+	const child = await box.process.spawnExact(executable, args, {
+		cwd: BOX_TREE,
+		env: {
+			PATH: "/usr/bin:/bin",
+			HOME: "/tmp",
+			LANG: "C",
+			...env
+		},
+		inheritEnv: false,
+		timeoutMs: timeoutMs + BOX_PROCESS_BACKSTOP_MS
+	});
+	const stdout = [];
+	const stderr = [];
+	let bytes = 0;
+	let failure;
+	let stopping;
+	const stop = (reason) => {
+		failure ??= reason;
+		stopping ??= child.kill("SIGKILL", { tree: true }).catch(() => void 0);
+	};
+	const clearTimer = armDeadlineTimer(timeoutMs, () => stop("timeout"), true);
+	const cancel = () => stop("cancelled");
+	signal?.addEventListener("abort", cancel, { once: true });
+	if (signal?.aborted) cancel();
+	const capture = async (stream, target) => {
+		for await (const text of stream) {
+			const chunk = Buffer.from(text);
+			const remaining = Math.max(0, limit - bytes);
+			bytes += chunk.length;
+			if (remaining) target.push(chunk.subarray(0, remaining));
+			if (bytes > limit) stop("output-limit");
+		}
+	};
+	let exitCode;
+	let exitSignal;
+	try {
+		await Promise.all([capture(child.stdout(), stdout), capture(child.stderr(), stderr)]);
+		exitCode = await child.wait();
+		exitSignal = (await child.status()).exitSignal;
+	} finally {
+		clearTimer();
+		signal?.removeEventListener("abort", cancel);
+		await stopping;
 	}
-};
-function unknownSupervisedTreeReceipt() {
+	const out = Buffer.concat(stdout).toString();
+	const err = Buffer.concat(stderr).toString();
+	const evidence = {
+		stdout: out,
+		stderr: err,
+		exitCode: exitSignal ? null : exitCode
+	};
+	if (failure) return {
+		succeeded: false,
+		reason: failure,
+		diagnostic: err || failure,
+		...evidence
+	};
+	if (exitCode === 127 && err.startsWith(BOX_EXEC_FAILURE)) return {
+		succeeded: false,
+		reason: "refused",
+		diagnostic: err,
+		...evidence
+	};
+	if (exitSignal) return {
+		succeeded: false,
+		reason: "failed",
+		diagnostic: err || `Check killed by ${exitSignal}`,
+		...evidence
+	};
+	if (exitCode !== 0) return {
+		succeeded: false,
+		reason: "failed",
+		diagnostic: err || out || `Check exited ${exitCode}`,
+		...evidence
+	};
 	return {
-		model: "unknown",
-		inputTokens: 0,
-		outputTokens: 0,
-		usageUnknown: true,
-		costUnknown: true
+		succeeded: true,
+		value: {
+			stdout: out,
+			stderr: err
+		}
 	};
 }
-/** Run one recursive supervised tree inside Eval's pre-execution paid-call lifecycle. */
-function superviseDispatch(opts) {
-	return async (profile, scenario, ctx) => {
-		const superviseOptions = opts.toSuperviseOptions(scenario, profile);
-		const task = opts.toTask(scenario, profile);
-		const maximumCharge = typeof opts.maximumCharge === "function" ? opts.maximumCharge(scenario, profile) : opts.maximumCharge;
-		const paid = await ctx.cost.runPaidCall({
-			channel: "agent",
-			actor: opts.costSource ?? "supervise",
-			model: "unknown",
-			signal: ctx.signal,
-			...maximumCharge ? { maximumCharge } : {},
-			execute: async (executionSignal) => {
-				const result = await supervise(profile, task, {
-					...superviseOptions,
-					signal: executionSignal
-				});
-				const identity = supervisedTreeModelForDispatch(result, profile);
-				if (identity.kind !== "known") throw new SupervisedTreeModelIdentityError(identity);
-				return result;
-			},
-			receipt: (result) => {
-				const identity = supervisedTreeModelForDispatch(result, profile);
-				if (identity.kind !== "known") throw new SupervisedTreeModelIdentityError(identity);
-				return costReceiptFromUsage(result.spentTotal.tokens, identity.model, {
-					usageUnknown: result.spentTotal.tokensKnown === false,
-					actualCostUsd: result.spentTotal.usdKnown !== false ? result.spentTotal.usd : void 0,
-					costUnknown: result.spentTotal.usdKnown === false
-				});
-			},
-			receiptFromError: (error) => error instanceof SupervisedTreeModelIdentityError ? unknownSupervisedTreeReceipt() : void 0
+function execute(args, timeoutMs, limit, signal) {
+	return new Promise((done) => {
+		const child = spawn("/usr/bin/bwrap", [
+			"--json-status-fd",
+			"3",
+			...args
+		], {
+			env: {},
+			stdio: [
+				"ignore",
+				"pipe",
+				"pipe",
+				"pipe"
+			],
+			detached: true
 		});
-		if (!paid.succeeded) throw paid.error;
-		return (opts.toArtifact ?? ((result) => {
-			if (result.kind !== "winner") throw new Error(`superviseDispatch: supervised tree ended without a winner (${result.reason})`);
-			return result.out;
-		}))(paid.value);
+		const stdout = [];
+		const stderr = [];
+		let bytes = 0;
+		let status = "";
+		let failure;
+		const stop = (reason) => {
+			failure ??= reason;
+			if (child.pid) try {
+				process.kill(-child.pid, "SIGKILL");
+			} catch (error) {
+				if (error.code !== "ESRCH") child.kill("SIGKILL");
+			}
+		};
+		const clearTimer = armDeadlineTimer(timeoutMs, () => stop("timeout"), true);
+		const cancel = () => stop("cancelled");
+		signal?.addEventListener("abort", cancel, { once: true });
+		if (signal?.aborted) cancel();
+		const capture = (target) => (chunk) => {
+			const remaining = Math.max(0, limit - bytes);
+			bytes += chunk.length;
+			if (remaining) target.push(chunk.subarray(0, remaining));
+			if (bytes > limit) stop("output-limit");
+		};
+		child.stdio[3]?.on("data", (chunk) => {
+			if (status.length + chunk.length > 16384) {
+				stop("output-limit");
+				return;
+			}
+			status += chunk.toString();
+		});
+		child.stdout.on("data", capture(stdout));
+		child.stderr.on("data", capture(stderr));
+		let spawnError;
+		child.on("error", (error) => {
+			spawnError = error;
+		});
+		child.on("close", (code) => {
+			clearTimer();
+			signal?.removeEventListener("abort", cancel);
+			const out = Buffer.concat(stdout).toString();
+			const err = Buffer.concat(stderr).toString();
+			const evidence = {
+				stdout: out,
+				stderr: err,
+				exitCode: code
+			};
+			const executed = status.split("\n").some((line) => {
+				try {
+					const record = JSON.parse(line);
+					return record !== null && typeof record === "object" && "exit-code" in record && typeof record["exit-code"] === "number" && record["exit-code"] === code;
+				} catch {
+					return false;
+				}
+			});
+			if (failure) done({
+				succeeded: false,
+				reason: failure,
+				diagnostic: err || failure,
+				...evidence
+			});
+			else if (spawnError) done({
+				succeeded: false,
+				reason: "refused",
+				diagnostic: String(spawnError),
+				...evidence
+			});
+			else if (!executed) done({
+				succeeded: false,
+				reason: "refused",
+				diagnostic: err || "Bubblewrap did not confirm command execution",
+				...evidence
+			});
+			else if (code !== 0) done({
+				succeeded: false,
+				reason: "failed",
+				diagnostic: err || out || `Check exited ${code}`,
+				...evidence
+			});
+			else done({
+				succeeded: true,
+				value: {
+					stdout: out,
+					stderr: err
+				}
+			});
+		});
+	});
+}
+const executeFile = promisify(execFile);
+/** GNU tools traverse relative to open directories, including trees deeper than PATH_MAX.
+* Recursive chmod ignores encountered symlinks; rm never follows their targets. */
+async function removeScratch(path) {
+	const options = {
+		env: {},
+		timeout: 1e4,
+		maxBuffer: 16384
 	};
+	let permissionError;
+	try {
+		await executeFile("/bin/chmod", [
+			"--recursive",
+			"--preserve-root",
+			"u+rwX",
+			"--",
+			path
+		], options);
+	} catch (error) {
+		permissionError = error;
+	}
+	try {
+		await executeFile("/bin/rm", [
+			"--recursive",
+			"--force",
+			"--one-file-system",
+			"--",
+			path
+		], options);
+	} catch (error) {
+		throw new Error([permissionError, error].filter((value) => value !== void 0).map(String).join("; "));
+	}
 }
-function modelFromLoopOptions(options) {
-	const profiles = options.agentRun ? [options.agentRun.profile] : options.agentRuns?.map((run) => run.profile) ?? [];
-	const models = new Set(profiles.map((profile) => profile.model?.default).filter((model) => !!model));
-	if (models.size === 1) return [...models][0];
-	return models.size > 1 ? "mixed" : "unknown";
+//#endregion
+//#region src/runtime/declared-check.ts
+/**
+* A declared check: the one frozen evaluator program that decides "done" for a run, named by
+* digest, run by Runtime in a fresh box on the check account.
+*
+* The same program is read three times (discovery `docs/38-one-loop-and-continuation.md`, section
+* 1): inside the run on every `submit_result` and at a turn end with no accepted result, after the
+* run to score it, and after each version to rank versions. Before this, each play wrote its own
+* check as Lab code in a method bundle — an exact-check judge, a sealed-cases judge, a product
+* judge — and the in-run check was a separate, weaker "shape and persistence" test, so 22 directors
+* passed their own check and then failed the outside one.
+*
+* The program prints one agent-eval `JudgeScore` as JSON on its last line of stdout: each checked
+* item is a dimension, `composite` is the score, and `notes` holds one `FAIL <item> <where>:
+* <reason>` line per failed item. The record states the pass threshold. A program that does not
+* run, or prints no score, gives no verdict: it is {@link CheckUnavailableError}, and the loop
+* pauses instead of blaming the director.
+*
+* The box receives the program's files at its working directory, the submitted result at
+* `_input/result.json` when there is one, and the sealed cases at `_sealed/` only when the read
+* scores a run or a version. `CHECK_SET` is `development` or `sealed`; `CHECK_RESULT` names the
+* result file when present. Sealed cases never reach an in-run read, so their lines never reach
+* the director.
+*/
+const INPUT_DIR = "_input";
+const SEALED_DIR = "_sealed";
+const DEFAULT_TIMEOUT_MS = 15 * 6e4;
+/** Refuse a malformed declaration before any compute. */
+function assertDeclaredCheck(check, context) {
+	const fail = (message) => {
+		throw new ValidationError(`${context}: check ${message}`);
+	};
+	if (typeof check !== "object" || check === null) fail("must be an object");
+	if (typeof check.program?.dir !== "string" || check.program.dir.trim() === "") fail("program.dir must name the evaluator directory");
+	if (!/^sha256:[0-9a-f]{64}$/u.test(check.program?.digest ?? "")) fail("program.digest must be a sha256 digest");
+	if (!Array.isArray(check.command) || check.command.length === 0 || !check.command[0]) fail("command must name an executable");
+	if (typeof check.environment !== "string" || check.environment.trim() === "") fail("environment must name the box image");
+	if (typeof check.pass !== "number" || !Number.isFinite(check.pass)) fail("pass must be a finite threshold on the composite");
+	if (check.feedback !== "verbatim" && check.feedback !== "pass-only") fail("feedback must be 'verbatim' or 'pass-only'");
+	if (check.sealed !== void 0 && !/^sha256:[0-9a-f]{64}$/u.test(check.sealed.digest ?? "")) fail("sealed.digest must be a sha256 digest");
+	for (const name of check.secrets ?? []) if (!/^[A-Z_][A-Z0-9_]*$/u.test(name)) fail(`secret name ${JSON.stringify(name)} is not an env name`);
+}
+/** The canonical digest of a directory's files: the digest a record names a program by. */
+async function checkProgramDigest(dir) {
+	return canonicalCandidateDigest((await captureMaterializedWorkspace(dir)).manifest);
+}
+/** The digest a version judge records: the program, the sealed cases, and how they are run. */
+function declaredCheckDigest(check) {
+	return sha256Bytes(Buffer.from(JSON.stringify({
+		program: check.program.digest,
+		sealed: check.sealed?.digest ?? null,
+		command: check.command,
+		environment: check.environment,
+		pass: check.pass
+	})));
 }
 /**
-* Adapter for plain `runCampaign` scenarios. This is the Runtime-side pair for
-* agent-eval fixture scenarios: load fixtures in `agent-eval/campaign`, build
-* the Runtime cell here, and keep paid-call admission, receipts, and traces
-* automatic.
+* Read the check once. `result` is the submitted result, absent for a read of the run's state.
+* `set: 'sealed'` adds the sealed cases. Throws {@link CheckUnavailableError} when the program
+* could not run or printed no score.
 */
-function loopCampaignDispatch(opts) {
-	return (scenario, ctx) => {
-		const loopOptions = opts.toLoopOptions(scenario);
-		return runLoopWithCampaignContext(opts, loopOptions, ctx, {
-			model: modelFromLoopOptions(loopOptions),
-			maximumCharge: typeof opts.maximumCharge === "function" ? opts.maximumCharge(scenario) : opts.maximumCharge,
-			resolveModel: opts.resolveCostModel ? (result) => opts.resolveCostModel?.(result, scenario) : void 0
+async function readDeclaredCheck(check, placement, read) {
+	if (read.set === "sealed" && check.sealed === void 0) throw new ValidationError("readDeclaredCheck: a sealed read needs check.sealed");
+	const environment = placement.env ?? process.env;
+	const secrets = {};
+	for (const name of check.secrets ?? []) {
+		const value = environment[name];
+		if (value === void 0 || value === "") throw new CheckUnavailableError(`the check's secret ${name} is not set on this host`);
+		secrets[name] = value;
+	}
+	const workspace = await mkdtemp(join(tmpdir(), "declared-check-"));
+	try {
+		const tree = join(workspace, "tree");
+		await copyVerified(check.program.dir, check.program.digest, tree, "program");
+		const entries = await readdir(tree);
+		if (entries.includes(INPUT_DIR) || entries.includes(SEALED_DIR)) throw new ValidationError(`readDeclaredCheck: the program may not hold ${INPUT_DIR}/ or ${SEALED_DIR}/; Runtime mounts them`);
+		const env = {
+			...secrets,
+			CHECK_SET: read.set
+		};
+		if (read.result !== void 0) {
+			await mkdir(join(tree, INPUT_DIR));
+			await writeFile(join(tree, INPUT_DIR, "result.json"), `${JSON.stringify(read.result)}\n`);
+			env.CHECK_RESULT = `${INPUT_DIR}/result.json`;
+		}
+		if (read.set === "sealed" && check.sealed !== void 0) await copyVerified(check.sealed.dir, check.sealed.digest, join(tree, SEALED_DIR), "sealed cases");
+		return verdictOf(await runIsolatedCheck({
+			workspaceRoot: workspace,
+			tree,
+			command: check.command,
+			timeoutMs: check.timeoutMs ?? DEFAULT_TIMEOUT_MS,
+			env,
+			...read.signal === void 0 ? {} : { signal: read.signal },
+			box: {
+				client: placement.client,
+				builderAccounts: placement.builderAccounts,
+				environment: check.environment,
+				...check.egress === void 0 ? {} : { egress: check.egress },
+				...check.resources === void 0 ? {} : { resources: check.resources }
+			}
+		}), check.pass);
+	} finally {
+		await rm(workspace, {
+			recursive: true,
+			force: true
 		});
+	}
+}
+/** The declared check as a manager's completion check: every in-run read uses development cases. */
+function declaredCheckDeliverable(check, placement) {
+	assertDeclaredCheck(check, "declaredCheckDeliverable");
+	return {
+		check: (result) => readDeclaredCheck(check, placement, {
+			result,
+			set: "development"
+		}),
+		checkState: () => readDeclaredCheck(check, placement, { set: "development" }),
+		feedback: check.feedback,
+		...check.sealed === void 0 ? {} : { sealed: true },
+		...check.describe === void 0 ? {} : { describe: check.describe }
 	};
 }
 /**
-* Adapter for `runProfileMatrix` (profile is an axis). Returns a
-* `ProfileDispatchFn` that runs `runAgentRounds` per (profile, scenario) cell
-* inside Eval's paid-call lifecycle.
+* The declared check as a version chain's judge: it scores a settled version on its sealed cases
+* when the record has them, and on its development cases otherwise. The per-item verdict rides in
+* the ledger, so the next version's review names each item. A read that could not run scores
+* `null`, which never counts as an improvement.
 */
-function loopDispatch(opts) {
-	return (profile, scenario, ctx) => runLoopForCell(opts, scenario, profile, ctx);
+function declaredCheckJudge(check, placement) {
+	assertDeclaredCheck(check, "declaredCheckJudge");
+	const digest = declaredCheckDigest(check);
+	return {
+		digest,
+		async judge(version, signal) {
+			try {
+				const verdict = await readDeclaredCheck(check, placement, {
+					...version.result.kind === "winner" ? { result: version.result.out } : {},
+					set: check.sealed === void 0 ? "development" : "sealed",
+					signal
+				});
+				return {
+					score: verdict.composite ?? (verdict.pass ? 1 : 0),
+					judgeDigest: digest,
+					check: verdict
+				};
+			} catch (error) {
+				if (!(error instanceof CheckUnavailableError)) throw error;
+				return {
+					score: null,
+					judgeDigest: digest,
+					detail: { unavailable: error.message }
+				};
+			}
+		}
+	};
+}
+function verdictOf(outcome, pass) {
+	if (!outcome.succeeded) throw new CheckUnavailableError(`the check program ${outcome.reason}: ${outcome.diagnostic.slice(0, 2e3)}`);
+	const last = outcome.value.stdout.trimEnd().split("\n").at(-1) ?? "";
+	let score;
+	try {
+		score = JSON.parse(last);
+	} catch {
+		throw new CheckUnavailableError("the check program printed no JudgeScore on its last line");
+	}
+	const raw = score;
+	if (typeof raw !== "object" || raw === null || typeof raw.dimensions !== "object" || raw.dimensions === null || typeof raw.composite !== "number" || typeof raw.notes !== "string") throw new CheckUnavailableError("the check program printed a line that is not a JudgeScore");
+	return verdictFromJudgeScore({
+		dimensions: raw.dimensions,
+		composite: raw.composite,
+		notes: raw.notes,
+		...raw.failed === true ? { failed: true } : {}
+	}, pass);
+}
+/** Copy exactly the bytes whose digest was checked: the files are read once, verified, and those
+*  bytes are written, so a file changed after the check cannot reach the box. */
+async function copyVerified(from, digest, to, label) {
+	const captured = await captureMaterializedWorkspace(from);
+	const actual = canonicalCandidateDigest(captured.manifest);
+	if (actual !== digest) throw new ValidationError(`readDeclaredCheck: the ${label} at ${from} is ${actual}; the record names ${digest}`);
+	for (const file of captured.files) {
+		const path = join(to, file.path);
+		await mkdir(dirname(path), { recursive: true });
+		await writeFile(path, file.bytes, { mode: file.mode });
+	}
 }
 //#endregion
-//#region src/runtime/inline-sandbox-client.ts
-/**
-* The ONE pseudo-box adapter: present any one-shot `Executor` (router / bridge /
-* BYO) as a `SandboxClient` so the round-synchronous `runAgentRounds` can drive it
-* without each call site re-faking a box. This is the single shell that
-* `bench/src/router-executor.ts`, generate-eval's old `bridgeSandboxClient`, and
-* the search-bench bridge transport were each re-implementing.
-*
-* It is deliberately for NON-box executors only — a real sandbox harness already
-* IS a `SandboxClient` (boxes, sessions, fs, fork are real there). Here each
-* `streamPrompt` runs the executor once and emits its result plus the canonical
-* `done` event. The result carries output and usage; `done` confirms execution settled.
-* There are no sessions, no fs,
-* no fork (those degrade gracefully via the optional `SandboxClient` methods).
-*/
-function isAsyncIterable$1(v) {
-	return typeof v === "object" && v !== null && Symbol.asyncIterator in v;
+//#region src/runtime/loop-dispatch.ts
+/** Bridge a campaign `DispatchContext.trace` to a `LoopTraceEmitter` so every
+*  `loop.*` event lands as a span under the cell's scoped trace. */
+function campaignTraceToLoopEmitter(trace) {
+	return { emit(event) {
+		trace.span(event.kind, {
+			runId: event.runId,
+			timestamp: event.timestamp,
+			...event.payload
+		}).end();
+	} };
 }
-/** Drive a (possibly streaming) executor to its terminal artifact. */
-async function settle(exec, task, signal) {
-	const r = exec.execute(task, signal);
-	if (isAsyncIterable$1(r)) {
-		for await (const _ of r);
-		return exec.resultArtifact();
-	}
-	return r;
+async function runLoopForCell(opts, scenario, profile, ctx) {
+	const loopOptions = opts.toLoopOptions(scenario, profile);
+	return runLoopWithCampaignContext(opts, loopOptions, ctx, {
+		model: profile.model?.default ?? modelFromLoopOptions(loopOptions),
+		maximumCharge: typeof opts.maximumCharge === "function" ? opts.maximumCharge(scenario, profile) : opts.maximumCharge,
+		resolveModel: opts.resolveCostModel ? (result) => opts.resolveCostModel?.(result, scenario, profile) : void 0
+	});
 }
-/**
-* Adapt an `ExecutorFactory` into a `SandboxClient` for `runAgentRounds`. The factory is
-* instantiated fresh per `streamPrompt` (mirrors the per-spawn executor lifecycle):
-* run once on the prompt, emit the terminal result event, tear down.
-*
-* There is no box, so a per-prompt `backend` or `model` override is refused rather than dropped;
-* other per-prompt options (`timeoutMs`, `context`) are accepted and ignored.
-*/
-function inlineSandboxClient(factory, defaults = {}) {
-	const capturedDefaultProfile = defaults.profile === void 0 ? void 0 : agentProfileSchema.parse(structuredClone(defaults.profile));
-	let seq = 0;
-	return { async create(options) {
-		const id = `inline-${seq++}`;
-		const createOptions = options;
-		return {
-			id,
-			async *streamPrompt(message, opts) {
-				assertBoxlessPromptOptions(opts, "inlineSandboxClient");
-				const controller = new AbortController();
-				const callerSignal = opts?.signal;
-				const onAbort = () => controller.abort(callerSignal?.reason ?? /* @__PURE__ */ new Error("prompt aborted"));
-				if (callerSignal) if (callerSignal.aborted) onAbort();
-				else callerSignal.addEventListener("abort", onAbort, { once: true });
-				const requestedProfile = (options?.backend && typeof options.backend === "object" ? options.backend.profile : void 0) ?? capturedDefaultProfile;
-				const parsedProfile = agentProfileSchema.safeParse(requestedProfile);
-				if (!parsedProfile.success) throw new Error("inlineSandboxClient: an exact AgentProfile is required; pass defaults.profile or create({ backend: { profile } })");
-				const exec = factory({
-					profile: parsedProfile.data,
-					harness: null
-				}, {
-					signal: controller.signal,
-					seams: { createOptions }
-				});
-				try {
-					const artifact = await settle(exec, message, controller.signal);
-					const out = artifact.out;
-					const tokensIn = artifact.spent.tokens.input;
-					const tokensOut = artifact.spent.tokens.output;
-					const costUsd = artifact.spent.usd;
-					const estimatedCostUsd = out?.estimatedCostUsd;
-					if (artifact.spent.iterations > 0 || artifact.spent.tokensKnown === false || artifact.spent.usdKnown === false || tokensIn > 0 || tokensOut > 0 || costUsd > 0 || estimatedCostUsd !== void 0) yield {
-						type: "llm_call",
-						data: {
-							...artifact.spent.tokensKnown === false ? {} : {
-								tokensIn,
-								tokensOut
-							},
-							...artifact.spent.usdKnown !== false ? { costUsd } : {},
-							...artifact.spent.tokensKnown === false ? { tokensKnown: false } : {},
-							...artifact.spent.usdKnown === false ? { costKnown: false } : {},
-							...artifact.spent.usdKnown !== false ? {
-								costKnown: true,
-								costProvenance: "provider-receipt"
-							} : {},
-							...estimatedCostUsd !== void 0 ? { estimatedCostUsd } : {},
-							...out?.promptCache ? { promptCache: out.promptCache } : {}
-						}
-					};
-					yield {
-						type: "result",
-						data: {
-							finalText: out?.content ?? "",
-							...artifact.spent.tokensKnown === false ? { tokensKnown: false } : { tokenUsage: {
-								inputTokens: tokensIn,
-								outputTokens: tokensOut
-							} },
-							...artifact.spent.usdKnown === false ? {
-								costKnown: false,
-								...costUsd > 0 ? { costUsd } : {}
-							} : {
-								costUsd,
-								costKnown: true,
-								costProvenance: "provider-receipt"
-							},
-							...estimatedCostUsd !== void 0 ? { estimatedCostUsd } : {},
-							...out?.promptCache ? { promptCache: out.promptCache } : {}
-						}
-					};
-					yield {
-						type: "done",
-						data: { outcome: { type: "completed" } }
-					};
-				} finally {
-					callerSignal?.removeEventListener("abort", onAbort);
-					await exec.teardown("brutalKill").catch(() => {});
-				}
-			},
-			async delete() {}
-		};
-	} };
-}
-//#endregion
-//#region src/runtime/local-sandbox-client.ts
-/**
-* `localSandboxClient` — the SAME-HOST pseudo-box: a `SandboxClient` whose
-* `create()` MATERIALIZES the profile's stdio MCP servers as local child
-* processes (`materializeLocalMcp`) and whose `streamPrompt` drives a real
-* tool loop (`runBrainLoop` over the router brain) with those live tools.
-*
-* Despite the interface name, this does NOT isolate processes. It is only for
-* author-controlled profiles whose local MCP commands a caller explicitly
-* trusts; user- or model-authored code belongs in a real sandbox. `delete()`
-* kills the children.
-*
-* A per-create profile may change the prompt surface. Permission to start a
-* local MCP process applies only when its full canonical bytes match the fixed
-* constructor profile; a different generated profile is refused.
-*
-* Event protocol matches `inlineSandboxClient`: known token usage is emitted as one `llm_call`;
-* Router catalog cost remains a separately-labelled estimate, never billed spend.
-*/
-/** A same-host `SandboxClient` adapter with no process isolation. Local MCP is
-* refused unless the caller explicitly supplies a policy that allows it.
-*
-* There is no box, so a per-prompt `backend` or `model` override is refused rather than dropped;
-* other per-prompt options (`timeoutMs`, `context`) are accepted and ignored. */
-function localSandboxClient(opts) {
-	const defaultProfile = opts.profile === void 0 ? void 0 : executableAgentProfileSnapshot(opts.profile, "localSandboxClient default profile");
-	const router = Object.freeze({ ...opts.router });
-	if (opts.profileSecurityPolicy?.allowLocalMcp && defaultProfile === void 0) throw new ValidationError("localSandboxClient: allowLocalMcp requires a fixed author-controlled profile; dynamic profiles need a real sandbox");
-	const trustedProfileDigest = opts.profileSecurityPolicy?.allowLocalMcp && defaultProfile !== void 0 ? canonicalAgentProfileDigest(defaultProfile) : void 0;
-	let seq = 0;
-	return { async create(options) {
-		const profile = executableAgentProfileSnapshot((options?.backend)?.profile ?? defaultProfile, "localSandboxClient");
-		const model = profileProviderModel(profile);
-		const settings = profileModelExecutionSettings(profile, "localSandboxClient");
-		const policyApplies = opts.profileSecurityPolicy !== void 0 && (!opts.profileSecurityPolicy.allowLocalMcp || trustedProfileDigest !== void 0 && canonicalAgentProfileDigest(profile) === trustedProfileDigest);
-		const mcp = await materializeLocalMcp(profile, {
-			...opts.keys ? { keys: opts.keys } : {},
-			...policyApplies ? { profileSecurityPolicy: opts.profileSecurityPolicy } : {}
-		});
-		const brain = routerBrain({
-			routerBaseUrl: router.baseUrl,
-			routerKey: router.key,
-			model,
-			...settings.retry !== void 0 ? { retry: settings.retry } : {},
-			...enforceTokenLimits(settings.tokenLimits, "router", "localSandboxClient").applied,
-			...settings.stream !== void 0 ? { stream: settings.stream } : {}
-		}, {
-			...settings.temperature !== void 0 ? { temperature: settings.temperature } : {},
-			...settings.seed !== void 0 ? { seed: settings.seed } : {},
-			...settings.toolChoice !== void 0 ? { toolChoice: settings.toolChoice } : {},
-			...settings.extraBody !== void 0 ? { extraBody: settings.extraBody } : {},
-			...profile.model?.reasoningEffort ? { reasoningEffort: profile.model.reasoningEffort } : {}
-		});
-		const system = [profile.prompt?.systemPrompt, ...profile.prompt?.instructions ?? []].filter((s) => typeof s === "string" && s.trim().length > 0).join("\n\n");
-		return {
-			id: `local-${seq++}`,
-			async *streamPrompt(message, popts) {
-				assertBoxlessPromptOptions(popts, "localSandboxClient");
-				let estimatedCostUsd = 0;
-				let sawEstimatedCost = false;
-				const chat = async (messages, tools) => {
-					const r = await brain(messages, tools);
-					if (r.costProvenance === "catalog-estimate" && r.costUsd !== void 0) {
-						estimatedCostUsd += r.costUsd;
-						sawEstimatedCost = true;
-					}
-					return r;
-				};
-				const r = await runBrainLoop({
-					chat,
-					tools: mcp.tools,
-					execute: (name, args) => mcp.call(name, args),
-					initialMessages: [...system ? [{
-						role: "system",
-						content: system
-					}] : [], {
-						role: "user",
-						content: message
-					}],
-					maxTurns: settings.maxTurns ?? 0,
-					hooks: { stopBefore: () => popts?.signal?.aborted === true }
-				});
-				if (r.turns > 0) yield {
-					type: "llm_call",
-					data: {
-						model,
-						...r.tokensKnown === false ? { tokensKnown: false } : {
-							tokensIn: r.usage.input,
-							tokensOut: r.usage.output
-						},
-						costKnown: false,
-						...sawEstimatedCost ? { estimatedCostUsd } : {}
-					}
-				};
-				yield {
-					type: "result",
-					data: {
-						finalText: r.final,
-						...r.tokensKnown === false ? { tokensKnown: false } : { tokenUsage: {
-							inputTokens: r.usage.input,
-							outputTokens: r.usage.output
-						} },
-						costKnown: false,
-						...sawEstimatedCost ? { estimatedCostUsd } : {}
-					}
-				};
-			},
-			async delete() {
-				await mcp.close();
+async function runLoopWithCampaignContext(opts, loopOptions, ctx, cost) {
+	const paid = await ctx.cost.runPaidCall({
+		channel: "agent",
+		actor: opts.costSource ?? "loop",
+		model: cost.model,
+		signal: ctx.signal,
+		...cost.maximumCharge ? { maximumCharge: cost.maximumCharge } : {},
+		execute: (executionSignal) => runAgentRounds({
+			...loopOptions,
+			ctx: {
+				sandboxClient: opts.sandboxClient,
+				...opts.promptOptions === void 0 ? {} : { promptOptions: opts.promptOptions },
+				signal: executionSignal,
+				traceEmitter: opts.forwardTrace === false ? void 0 : campaignTraceToLoopEmitter(ctx.trace)
 			}
-		};
-	} };
+		}),
+		receipt: (result) => loopCostReceipt(result, cost.resolveModel?.(result) ?? cost.model)
+	});
+	if (!paid.succeeded) throw paid.error;
+	const result = paid.value;
+	return (opts.toArtifact ?? ((r) => r.winner?.output))(result);
 }
-//#endregion
-//#region src/runtime/resolve-sandbox-client.ts
-/**
-* The product-facing backend selector: one call picks the execution transport a
-* `runAgentRounds` (or any consumer that drives a `SandboxClient`) runs on, from the
-* package a product already depends on. It is pure sugar over the existing
-* primitives — `createExecutor({ backend })` + `inlineSandboxClient` — and adds
-* ZERO transport code (the node:http cli-bridge transport lives in `bridgeExecutor`).
-*
-* The heavy `resolveBenchClient` in `@tangle-network/agent-bench` is the bench-side
-* sibling: it layers router/search specifics a product should not have to depend on.
-* This is the generic, dep-light core products call to switch backends:
-*
-*   - `backend: 'sandbox'` → IN-BOX: return the caller's real Sandbox-backed
-*                            `sandboxClient` unchanged. Fail loud if absent — a
-*                            product on the sandbox backend already holds its box.
-*   - `backend: 'bridge'`  → OFF-BOX: a local cli-bridge fronting a harness CLI
-*                            (opencode / kimi-code / …) as the leaf executor, wired
-*                            through the resumable `bridgeExecutor`.
-*   - `backend: 'router'`  → OFF-BOX: a router chat-completion as the leaf executor,
-*                            presented as a `SandboxClient` (no sandbox dependency).
-*   - `backend: 'local'`   → SAME-HOST: a router-brain tool loop with the
-*                            profile's stdio MCP servers spawned as LOCAL child
-*                            processes — the only backend that can reach an MCP
-*                            server built into a host worktree.
-*/
-/**
-* Resolve a `SandboxClient` for the chosen backend. The generic, dep-light core
-* that `resolveBenchClient` builds on — reuse this instead of hand-rolling the
-* `createExecutor`/`inlineSandboxClient` branch in each product.
-*/
-function resolveSandboxClient(opts) {
-	switch (opts.backend) {
-		case "sandbox":
-			if (!opts.sandboxClient) throw new Error("resolveSandboxClient: backend 'sandbox' requires opts.sandboxClient");
-			return opts.sandboxClient;
-		case "bridge": {
-			const bridge = opts.bridge;
-			if (!bridge?.bearer) throw new Error("resolveSandboxClient: backend 'bridge' requires bridge.bearer");
-			return inlineSandboxClient(createExecutor({
-				backend: "bridge",
-				bridgeUrl: bridge.url ?? "http://127.0.0.1:3355",
-				bridgeBearer: bridge.bearer,
-				timeoutMs: bridge.timeoutMs
-			}));
-		}
-		case "router": {
-			const router = opts.router;
-			if (!router?.baseUrl || !router.key) throw new Error("resolveSandboxClient: backend 'router' requires router.baseUrl and router.key");
-			return inlineSandboxClient(createExecutor({
-				backend: "router",
-				routerBaseUrl: router.baseUrl,
-				routerKey: router.key
-			}));
-		}
-		case "local": {
-			const local = opts.local;
-			if (!local?.router?.baseUrl || !local.router.key) throw new Error("resolveSandboxClient: backend 'local' requires local.router.baseUrl and local.router.key");
-			return localSandboxClient(local);
-		}
-	}
+function loopCostReceipt(result, model) {
+	return costReceiptFromUsage(result.tokenUsage, model, {
+		usageUnknown: result.tokenUsage.tokensKnown === false,
+		actualCostUsd: result.costUsdKnown !== false ? result.costUsd : void 0,
+		costUnknown: result.costUsdKnown === false,
+		estimatedCostUsd: result.estimatedCostUsd
+	});
 }
-//#endregion
-//#region src/runtime/define-leaderboard.ts
-/**
-* `defineLeaderboard` — the declarative eval-leaderboard facade.
-*
-* A product's harness×model leaderboard is always the same assembly: expand a
-* base profile across the harness×model axes (`expandProfileAxes`), run every
-* (profile, case) cell as a driven loop (`loopDispatch` + the naive retry driver), score
-* with the domain's grader, and emit ONE `runProfileMatrix` call. Each product
-* hand-rolled that assembly (~650 lines each) and re-hit the same footguns:
-* stale cell-cache reuse, zero-token stub cells, missing model snapshots.
-*
-* This facade IS that assembly, once, with the domain reduced to a declarative
-* spec: `cases` + `prompt` + `score`. It contains NO execution, judging, or
-* metering logic of its own — every moving part is an existing primitive, and
-* every default is overridable:
-*
-*   - LEVEL 0 (declarative): `cases` / `prompt` / `score` / `axis`.
-*   - LEVEL 1 (seams): `backends`, `flags`, `parseOutput`, `onCellEvents`,
-*     `resolveModel`, `setup`/`teardown`, `export`, `matrix`
-*     passthrough.
-*   - LEVEL 2 (replacement): `dispatch` and `judges` swap out the whole
-*     loop wiring or scoring; `runProfileMatrix` itself stays public as the
-*     escape floor — a product overriding everything just writes what it has
-*     today, no capability removed.
-*
-* `toBenchmarkAdapter()` exposes the same domain surface in the structural
-* `BenchmarkAdapter` shape (`name`/`preflight`/`loadTasks`/`judge`/
-* `goldArtifact`) so a product leaderboard can register into a benchmark
-* registry without this module depending on one.
-*
-* @experimental
-*/
-/**
-* The no-signal retry floor as a bare `Driver` literal: re-run the case VERBATIM as an
-* independent attempt until one shot scores (`verdict.valid`) or the shot cap. It reads ONLY
-* `verdict.valid` — never `notes`/`scores` — so a leaderboard cell's retries carry no grader
-* findings into the next shot (the leak-free firewall). Steering POLICY texts are registry data
-* (`delegates/naive-continuation` and siblings in the kernel prompt registry) attached to graph
-* edges; this loop-kernel control folds no text in — each shot is the same task object, and the
-* per-shot nonce in `taskToPrompt` keeps the attempts independent at the router.
-*/
-function naiveRetryDriver(shots) {
+/** Map Runtime usage into Eval's canonical paid-call receipt without inventing cache classes. */
+function costReceiptFromUsage(usage, model, cost) {
+	const cacheComplete = hasCompleteCacheBreakdown(usage) && (usage.freshInput !== void 0 || usage.cacheRead !== void 0 || usage.cacheWrite !== void 0);
+	const cacheRead = cacheComplete ? usage.cacheRead ?? 0 : void 0;
+	const cacheWrite = cacheComplete ? usage.cacheWrite ?? 0 : void 0;
+	const classified = (cacheRead ?? 0) + (cacheWrite ?? 0);
 	return {
-		name: "naive",
-		plan(task, history) {
-			if (history.length === 0) return Promise.resolve([task]);
-			if (history[history.length - 1]?.verdict?.valid === true) return Promise.resolve([]);
-			if (history.length >= shots) return Promise.resolve([]);
-			return Promise.resolve([task]);
-		},
-		decide(history) {
-			if (history.some((it) => it.verdict?.valid)) return "pick-winner";
-			return history.length < shots ? "refine" : "fail";
-		},
-		describePlan() {
-			return {
-				kind: "refine",
-				rationale: "naive fixed continuation (no grade signal)"
-			};
-		}
+		model,
+		inputTokens: cacheComplete ? usage.input - classified : usage.input,
+		outputTokens: usage.output,
+		...cacheComplete ? {
+			cachedTokens: cacheRead,
+			cacheWriteTokens: cacheWrite
+		} : {},
+		...usage.tokensKnown === false || cost.usageUnknown ? { usageUnknown: true } : {},
+		...cost.actualCostUsd !== void 0 ? { actualCostUsd: cost.actualCostUsd } : {},
+		...cost.costUnknown ? { costUnknown: true } : {},
+		...cost.estimatedCostUsd !== void 0 ? { estimatedCostUsd: cost.estimatedCostUsd } : {}
 	};
 }
-/** Read `--name <value>` from an argv array. */
-function argOf(argv, name) {
-	const i = argv.indexOf(`--${name}`);
-	if (i >= 0 && i + 1 < argv.length) return argv[i + 1];
-}
-function splitList(v) {
-	if (v === void 0) return void 0;
-	const parts = v.split(",").map((s) => s.trim()).filter(Boolean);
-	return parts.length > 0 ? parts : void 0;
-}
-/** RunRecords reject a bare model id — the eval IDENTITY model must carry a
-*  snapshot (`name@<snapshot>`). Unchanged when already stamped. */
-function withSnapshot(model, snapshot) {
-	return model.includes("@") ? model : `${model}@${snapshot}`;
-}
-function gitSha() {
-	try {
-		return execFileSync("git", ["rev-parse", "HEAD"], { encoding: "utf8" }).trim();
-	} catch {
-		return "unknown";
-	}
-}
-function normalizeScore(s) {
-	return typeof s === "number" ? { composite: s } : s;
-}
-/**
-* Assemble a declarative spec (`cases` + `prompt` + `score`) into a runnable
-* harness×model leaderboard — `run()` executes the matrix, `toBenchmarkAdapter()`
-* exposes the same domain as a structural `BenchmarkAdapter`.
-*/
-function defineLeaderboard(spec) {
-	const caseId = (c) => {
-		const id = spec.caseId ? spec.caseId(c) : c.id;
-		if (typeof id !== "string" || id.length === 0) throw new Error(`defineLeaderboard(${spec.name}): every case needs a stable string id — give cases an \`id\` property or supply spec.caseId`);
-		return id;
-	};
-	const selectCases = (ids) => {
-		if (!ids) return spec.cases;
-		const byId = new Map(spec.cases.map((c) => [caseId(c), c]));
-		return ids.map((id) => {
-			const c = byId.get(id);
-			if (c === void 0) throw new Error(`defineLeaderboard(${spec.name}): unknown case "${id}" (have: ${[...byId.keys()].join(", ")})`);
-			return c;
-		});
+/** Eval has one pre-admitted paid call for this dispatch. A tree can settle that call only when
+* Runtime has provider-served identity for every inference attempt that actually started. Plan
+* materialization is deliberately ignored: it describes what Runtime requested, not what the
+* provider served. Every visible terminal child must carry provider attempt evidence; a missing
+* evidence record stays unknown, including zero-valued or incomplete spend.
+* @internal Testable identity projection used by superviseDispatch. */
+function supervisedTreeModelForDispatch(result, rootProfile) {
+	const canonicalModels = /* @__PURE__ */ new Set();
+	const observedModels = [];
+	const wholeTreeEvidence = result.providerModel;
+	if (wholeTreeEvidence === void 0 || wholeTreeEvidence.status !== "known" && wholeTreeEvidence.reason !== "provider-model-conflict" || wholeTreeEvidence.attempts.length === 0) return { kind: "unknown" };
+	const wholeTreeIdentity = collectProviderModels(wholeTreeEvidence, () => true);
+	if (wholeTreeIdentity.kind !== "known") return wholeTreeIdentity;
+	for (const model of wholeTreeIdentity.observed) {
+		observedModels.push(model.raw);
+		canonicalModels.add(model.canonical);
+	}
+	if (canonicalModels.size === 0) return { kind: "unknown" };
+	if (canonicalModels.size !== 1) return {
+		kind: "mixed",
+		models: [...canonicalModels].sort()
 	};
-	const scoreJudge = {
-		name: `${spec.name}-score`,
-		dimensions: [{
-			key: "composite",
-			description: `${spec.name} case score`
-		}],
-		score({ artifact, scenario }) {
-			const s = normalizeScore(spec.score(artifact, scenario.case));
-			return {
-				composite: s.composite,
-				dimensions: {
-					composite: s.composite,
-					...s.dimensions
-				},
-				notes: s.notes ?? ""
-			};
-		}
+	return {
+		kind: "known",
+		model: observedModels[0]
 	};
-	async function run(argv = process.argv.slice(2)) {
-		const args = {};
-		for (const name of [
-			"backend",
-			"harnesses",
-			"models",
-			"cases",
-			"shots",
-			"reps",
-			"model-snapshot",
-			"run-dir",
-			"export-dir"
-		]) args[name] = argOf(argv, name);
-		for (const [name, flag] of Object.entries(spec.flags ?? {})) args[name] = argOf(argv, name) ?? flag.default;
-		const backendName = args.backend ?? "sandbox";
-		const shots = Number(args.shots ?? spec.shots ?? 1);
-		const reps = Number(args.reps ?? spec.reps ?? 1);
-		const snapshot = args["model-snapshot"] ?? "leaderboard";
-		const runDir = args["run-dir"] ?? join(tmpdir(), `leaderboard-${spec.name}-${Date.now()}-${process.pid}`);
-		const exportDir = args["export-dir"] ?? join(runDir, "export");
-		mkdirSync(runDir, { recursive: true });
-		const cases = selectCases(splitList(args.cases));
-		if (cases.length === 0) throw new Error(`defineLeaderboard(${spec.name}): no cases to run`);
-		const scenarios = cases.map((c) => ({
-			id: caseId(c),
-			kind: spec.name,
-			case: c
-		}));
-		const harnesses = splitList(args.harnesses) ?? spec.axis?.harnesses ?? CODING_HARNESSES;
-		const rawModels = splitList(args.models) ?? spec.axis?.models ?? (spec.baseProfile?.model?.default !== void 0 ? [spec.baseProfile.model.default] : void 0);
-		if (!rawModels || rawModels.length === 0) throw new Error(`defineLeaderboard(${spec.name}): no models — pass --models, set spec.axis.models, or give spec.baseProfile a model.default`);
-		const models = rawModels.map((m) => withSnapshot(m, snapshot));
-		const profiles = expandProfileAxes({
-			base: spec.baseProfile,
-			harnesses,
-			models
-		});
-		for (const profile of profiles) assertExecutableAgentProfile(profile, `defineLeaderboard(${spec.name})`);
-		const ctx = {
-			name: spec.name,
-			backend: backendName,
-			runDir,
-			exportDir,
-			args,
-			harnesses,
-			models,
-			caseIds: scenarios.map((s) => s.id),
-			shots,
-			reps
-		};
-		const backends = {
-			sandbox: () => {
-				throw new Error(`defineLeaderboard(${spec.name}): the 'sandbox' backend needs your product's real Sandbox client — supply spec.backends.sandbox (e.g. () => new Sandbox({ apiKey, baseUrl }))`);
-			},
-			"cli-bridge": () => {
-				const bearer = process.env.BRIDGE_BEARER ?? process.env.CLI_BRIDGE_BEARER;
-				if (!bearer) throw new Error(`defineLeaderboard(${spec.name}): backend 'cli-bridge' needs BRIDGE_BEARER or CLI_BRIDGE_BEARER set`);
-				return resolveSandboxClient({
-					backend: "bridge",
-					bridge: {
-						url: process.env.CLI_BRIDGE_URL,
-						bearer,
-						timeoutMs: 9e5
-					}
-				});
-			},
-			...spec.backends
-		};
-		const makeClient = backends[backendName];
-		if (!makeClient) throw new Error(`defineLeaderboard(${spec.name}): unknown backend "${backendName}" (have: ${Object.keys(backends).join(", ")})`);
-		const sandboxClient = makeClient();
-		const promptById = /* @__PURE__ */ new Map();
-		for (const s of scenarios) promptById.set(s.id, await spec.prompt(s.case));
-		const promptOf = (s) => {
-			const p = promptById.get(s.id);
-			if (p === void 0) throw new Error(`defineLeaderboard(${spec.name}): no prompt for case "${s.id}"`);
-			return p;
-		};
-		let shotNonce = 0;
-		const maximumCharge = spec.maximumCharge;
-		const dispatch = spec.dispatch ?? ((profile, scenario, dispatchCtx) => {
-			return loopDispatch({
-				sandboxClient,
-				maximumCharge: typeof maximumCharge === "function" ? (cellScenario, cellProfile) => maximumCharge(cellProfile, cellScenario) : maximumCharge,
-				resolveCostModel: (result, _cellScenario, cellProfile) => {
-					if (!spec.resolveModel) return cellProfile.model?.default;
-					const served = new Set(result.iterations.map((iteration) => spec.resolveModel?.(iteration.events)).filter((model) => model !== void 0));
-					if (served.size > 1) throw new Error(`defineLeaderboard(${spec.name}): one cell reported multiple served models: ${[...served].join(", ")}`);
-					return [...served][0] ?? cellProfile.model?.default;
-				},
-				toLoopOptions: (cellScenario, cellProfile) => {
-					return {
-						driver: naiveRetryDriver(shots),
-						agentRun: {
-							profile: cellProfile,
-							taskToPrompt: (s) => `${promptOf(s)}\n\n<!-- independent-attempt:${shotNonce++} -->`
-						},
-						output: { parse: (events) => spec.parseOutput ? spec.parseOutput(events, cellScenario.case) : collectAgentResponseText(events) ?? "" },
-						validator: { validate: async (output) => {
-							const s = normalizeScore(spec.score(output, cellScenario.case));
-							return {
-								valid: s.composite > 0,
-								score: s.composite
-							};
-						} },
-						task: cellScenario,
-						maxIterations: shots
-					};
-				},
-				toArtifact: (result) => {
-					for (const iter of result.iterations) spec.onCellEvents?.(iter.events, scenario.case, {
-						index: iter.index,
-						...iter.error ? { error: iter.error.message } : {},
-						...iter.verdict ? { verdict: { score: iter.verdict.score } } : {}
-					});
-					return result.winner?.output;
-				}
-			})(profile, scenario, dispatchCtx);
-		});
-		await spec.setup?.(ctx);
-		try {
-			const result = await runProfileMatrix({
-				profiles,
-				scenarios,
-				dispatch,
-				judges: spec.judges ?? [scoreJudge],
-				runDir,
-				commitSha: gitSha(),
-				reps,
-				...spec.matrix
-			});
-			if (spec.export) await spec.export(result, ctx);
-			else {
-				mkdirSync(exportDir, { recursive: true });
-				writeFileSync(join(runDir, "matrix-result.json"), `${JSON.stringify(result, null, 2)}\n`);
-				const table = renderLeaderboardMarkdown(leaderboard(result.records, {
-					title: spec.name,
-					meta: { backend: backendName }
-				}));
-				writeFileSync(join(exportDir, "leaderboard.md"), table);
-				console.log(table);
-			}
-			return result;
-		} finally {
-			await spec.teardown?.(ctx);
+}
+function collectProviderModels(evidence, validate) {
+	if (evidence.status !== "known" && evidence.reason !== "provider-model-conflict" || !Array.isArray(evidence.attempts) || evidence.attempts.length === 0 || !Array.isArray(evidence.models)) return { kind: "unknown" };
+	const observed = [];
+	const canonical = /* @__PURE__ */ new Set();
+	const observedRaw = /* @__PURE__ */ new Set();
+	for (const attempt of evidence.attempts) {
+		if (attempt.providerDispatch === "not_started") {
+			if (attempt.observations.length > 0 || attempt.identityConflict === true) return { kind: "unknown" };
+			continue;
 		}
-	}
-	function toBenchmarkAdapter() {
-		return {
-			name: spec.name,
-			async preflight() {
-				const seen = /* @__PURE__ */ new Set();
-				for (const c of spec.cases) {
-					const id = caseId(c);
-					if (seen.has(id)) throw new Error(`defineLeaderboard(${spec.name}): duplicate case id "${id}"`);
-					seen.add(id);
-				}
-			},
-			async loadTasks(opts) {
-				const selected = selectCases(opts?.ids);
-				const limited = opts?.limit !== void 0 ? selected.slice(0, opts.limit) : selected;
-				return Promise.all(limited.map(async (c) => ({
-					id: caseId(c),
-					prompt: await spec.prompt(c),
-					metadata: { case: c }
-				})));
-			},
-			async judge(task, artifact) {
-				const [c] = selectCases([task.id]);
-				if (c === void 0) throw new Error(`defineLeaderboard(${spec.name}): no case "${task.id}"`);
-				const s = normalizeScore(spec.score(artifact, c));
+		if (attempt === null || typeof attempt !== "object" || !Array.isArray(attempt.observations) || attempt.observations.length === 0 || attempt.identityConflict === true) return { kind: "unknown" };
+		let attemptBase;
+		let attemptSnapshot;
+		let attemptSnapshotKind;
+		let representative;
+		for (const model of attempt.observations) {
+			if (typeof model !== "string" || !validate(model)) return { kind: "unknown" };
+			const identity = canonicalObservedModelParts(model);
+			if (identity === void 0) return { kind: "unknown" };
+			const base = identity.base;
+			const snapshot = identity.snapshot;
+			if (attemptBase !== void 0 && attemptBase !== base) return {
+				kind: "mixed",
+				models: [.../* @__PURE__ */ new Set([...attemptBase ? [attemptBase] : [], identity.canonical])]
+			};
+			if (attemptSnapshot !== void 0 && snapshot !== void 0 && (attemptSnapshot !== snapshot || attemptSnapshotKind !== identity.snapshotKind)) {
+				if (attemptBase === void 0 || attemptSnapshotKind === void 0) return { kind: "unknown" };
 				return {
-					resolved: s.composite > 0,
-					score: s.composite,
-					detail: s.notes
+					kind: "mixed",
+					models: [attemptIdentityText(attemptBase, attemptSnapshot, attemptSnapshotKind), identity.canonical]
 				};
-			},
-			async goldArtifact() {}
-		};
+			}
+			attemptBase = base;
+			attemptSnapshot ??= snapshot;
+			attemptSnapshotKind ??= identity.snapshotKind;
+			if (snapshot !== void 0) representative = model;
+			observedRaw.add(model);
+		}
+		if (attemptBase === void 0 || attemptSnapshot === void 0 || attemptSnapshotKind === void 0 || representative === void 0) return { kind: "unknown" };
+		const attemptIdentity = attemptIdentityText(attemptBase, attemptSnapshot, attemptSnapshotKind);
+		observed.push({
+			raw: representative,
+			canonical: attemptIdentity
+		});
+		canonical.add(attemptIdentity);
+	}
+	if (observed.length === 0) return { kind: "unknown" };
+	const declaredRaw = /* @__PURE__ */ new Set();
+	for (const model of evidence.models) {
+		if (typeof model !== "string") return { kind: "unknown" };
+		declaredRaw.add(model);
+	}
+	if (declaredRaw.size !== observedRaw.size || [...declaredRaw].some((model) => !observedRaw.has(model))) return { kind: "unknown" };
+	return canonical.size > 1 ? {
+		kind: "mixed",
+		models: [...canonical].sort()
+	} : {
+		kind: "known",
+		observed
+	};
+}
+function attemptIdentityText(base, snapshot, kind) {
+	return kind === "date" ? `${base}-${snapshot}` : `${base}@${snapshot}`;
+}
+/** The Eval receipt surface has no pre-admitted per-model recursive-tree receipt bundle yet. */
+var SupervisedTreeModelIdentityError = class extends Error {
+	constructor(identity) {
+		const detail = identity.kind === "mixed" ? `multiple models (${identity.models.join(", ")})` : "an unknown materialized model";
+		super(`superviseDispatch: cannot settle one Eval paid-call receipt for a tree with ${detail}`);
+		this.name = "SupervisedTreeModelIdentityError";
 	}
+};
+function unknownSupervisedTreeReceipt() {
 	return {
-		run,
-		toBenchmarkAdapter
+		model: "unknown",
+		inputTokens: 0,
+		outputTokens: 0,
+		usageUnknown: true,
+		costUnknown: true
+	};
+}
+/** Run one recursive supervised tree inside Eval's pre-execution paid-call lifecycle. */
+function superviseDispatch(opts) {
+	return async (profile, scenario, ctx) => {
+		const superviseOptions = opts.toSuperviseOptions(scenario, profile);
+		const task = opts.toTask(scenario, profile);
+		const maximumCharge = typeof opts.maximumCharge === "function" ? opts.maximumCharge(scenario, profile) : opts.maximumCharge;
+		const paid = await ctx.cost.runPaidCall({
+			channel: "agent",
+			actor: opts.costSource ?? "supervise",
+			model: "unknown",
+			signal: ctx.signal,
+			...maximumCharge ? { maximumCharge } : {},
+			execute: async (executionSignal) => {
+				const result = await supervise(profile, task, {
+					...superviseOptions,
+					signal: executionSignal
+				});
+				const identity = supervisedTreeModelForDispatch(result, profile);
+				if (identity.kind !== "known") throw new SupervisedTreeModelIdentityError(identity);
+				return result;
+			},
+			receipt: (result) => {
+				const identity = supervisedTreeModelForDispatch(result, profile);
+				if (identity.kind !== "known") throw new SupervisedTreeModelIdentityError(identity);
+				return costReceiptFromUsage(result.spentTotal.tokens, identity.model, {
+					usageUnknown: result.spentTotal.tokensKnown === false,
+					actualCostUsd: result.spentTotal.usdKnown !== false ? result.spentTotal.usd : void 0,
+					costUnknown: result.spentTotal.usdKnown === false
+				});
+			},
+			receiptFromError: (error) => error instanceof SupervisedTreeModelIdentityError ? unknownSupervisedTreeReceipt() : void 0
+		});
+		if (!paid.succeeded) throw paid.error;
+		return (opts.toArtifact ?? ((result) => {
+			if (result.kind !== "winner") throw new Error(`superviseDispatch: supervised tree ended without a winner (${result.reason})`);
+			return result.out;
+		}))(paid.value);
+	};
+}
+function modelFromLoopOptions(options) {
+	const profiles = options.agentRun ? [options.agentRun.profile] : options.agentRuns?.map((run) => run.profile) ?? [];
+	const models = new Set(profiles.map((profile) => profile.model?.default).filter((model) => !!model));
+	if (models.size === 1) return [...models][0];
+	return models.size > 1 ? "mixed" : "unknown";
+}
+/**
+* Adapter for plain `runCampaign` scenarios. This is the Runtime-side pair for
+* agent-eval fixture scenarios: load fixtures in `agent-eval/campaign`, build
+* the Runtime cell here, and keep paid-call admission, receipts, and traces
+* automatic.
+*/
+function loopCampaignDispatch(opts) {
+	return (scenario, ctx) => {
+		const loopOptions = opts.toLoopOptions(scenario);
+		return runLoopWithCampaignContext(opts, loopOptions, ctx, {
+			model: modelFromLoopOptions(loopOptions),
+			maximumCharge: typeof opts.maximumCharge === "function" ? opts.maximumCharge(scenario) : opts.maximumCharge,
+			resolveModel: opts.resolveCostModel ? (result) => opts.resolveCostModel?.(result, scenario) : void 0
+		});
 	};
 }
+/**
+* Adapter for `runProfileMatrix` (profile is an axis). Returns a
+* `ProfileDispatchFn` that runs `runAgentRounds` per (profile, scenario) cell
+* inside Eval's paid-call lifecycle.
+*/
+function loopDispatch(opts) {
+	return (profile, scenario, ctx) => runLoopForCell(opts, scenario, profile, ctx);
+}
 //#endregion
-//#region src/runtime/harvest-corpus.ts
+//#region src/runtime/inline-sandbox-client.ts
 /**
-* Analyze completed runs through the selected observer and retain findings in a corpus.
-*
-* Store-agnostic by design: the caller maps its trace store's rows (a
-* `ProductionTraceSink` ndjson, OTLP spans, RunRecords) to `ObserveInput` — task text,
-* final output, the event trace, terminal outcome.
-* The default observer reads execution evidence; an injected analysis owns its admitted sources.
-*
-* The nightly product job is then three lines:
-*   const runs = mapSinkRowsToObserveInputs(await readSink(yesterday))
-*   const report = await harvestCorpus({ runs, profile, executor, corpus })
-*   log(report)   // runsObserved / findings / learned / failures
+* The ONE pseudo-box adapter: present any one-shot `Executor` (router / bridge /
+* BYO) as a `SandboxClient` so the round-synchronous `runAgentRounds` can drive it
+* without each call site re-faking a box. This is the single shell that
+* `bench/src/router-executor.ts`, generate-eval's old `bridgeSandboxClient`, and
+* the search-bench bridge transport were each re-implementing.
 *
-* Consumers choose how retained findings inform later work and how to assess their value.
+* It is deliberately for NON-box executors only — a real sandbox harness already
+* IS a `SandboxClient` (boxes, sessions, fs, fork are real there). Here each
+* `streamPrompt` runs the executor once and emits its result plus the canonical
+* `done` event. The result carries output and usage; `done` confirms execution settled.
+* There are no sessions, no fs,
+* no fork (those degrade gracefully via the optional `SandboxClient` methods).
 */
-/** The completed batch evidence remains available even when every analysis failed. */
-var HarvestError = class extends Error {
-	report;
-	constructor(report) {
-		super(`harvestCorpus: every run failed analysis (${report.failures.length}) — first: ${report.failures[0]?.error}`);
-		this.report = report;
-		this.name = "HarvestError";
+function isAsyncIterable$1(v) {
+	return typeof v === "object" && v !== null && Symbol.asyncIterator in v;
+}
+/** Drive a (possibly streaming) executor to its terminal artifact. */
+async function settle(exec, task, signal) {
+	const r = exec.execute(task, signal);
+	if (isAsyncIterable$1(r)) {
+		for await (const _ of r);
+		return exec.resultArtifact();
 	}
-};
-/** Batch the selected observation implementation over completed runs and retain its findings. */
-async function harvestCorpus(opts) {
-	const concurrency = opts.concurrency ?? 4;
-	if (!Number.isSafeInteger(concurrency) || concurrency < 1 || opts.maxRuns !== void 0 && (!Number.isSafeInteger(opts.maxRuns) || opts.maxRuns < 0)) throw new TypeError("harvest limits require positive integer concurrency and nonnegative integer maxRuns");
-	const report = {
-		runsObserved: 0,
-		findings: 0,
-		learned: 0,
-		failures: [],
-		usage: {
-			input: 0,
-			output: 0,
-			known: true
-		}
-	};
-	const iterator = Symbol.asyncIterator in Object(opts.runs) ? opts.runs[Symbol.asyncIterator]() : (async function* () {
-		yield* opts.runs;
-	})();
-	let consumed = 0;
-	let done = false;
-	const next = async () => {
-		if (done || opts.signal?.aborted || opts.maxRuns !== void 0 && consumed >= opts.maxRuns) return null;
-		const sequence = ++consumed;
-		let r;
-		try {
-			r = await iterator.next();
-		} catch (error) {
-			done = true;
-			report.failures.push({
-				runId: `source-${sequence}`,
-				error: `trace source: ${error instanceof Error ? error.message.slice(0, 300) : String(error)}`
-			});
-			return null;
-		}
-		if (r.done) {
-			done = true;
-			return null;
-		}
+	return r;
+}
+/**
+* Adapt an `ExecutorFactory` into a `SandboxClient` for `runAgentRounds`. The factory is
+* instantiated fresh per `streamPrompt` (mirrors the per-spawn executor lifecycle):
+* run once on the prompt, emit the terminal result event, tear down.
+*
+* There is no box, so a per-prompt `backend` or `model` override is refused rather than dropped;
+* other per-prompt options (`timeoutMs`, `context`) are accepted and ignored.
+*/
+function inlineSandboxClient(factory, defaults = {}) {
+	const capturedDefaultProfile = defaults.profile === void 0 ? void 0 : agentProfileSchema.parse(structuredClone(defaults.profile));
+	let seq = 0;
+	return { async create(options) {
+		const id = `inline-${seq++}`;
+		const createOptions = options;
 		return {
-			input: r.value,
-			sequence
-		};
-	};
-	const workers = Array.from({ length: concurrency }, async () => {
-		for (let run = await next(); run !== null; run = await next()) {
-			const { input, sequence } = run;
-			if (opts.signal?.aborted) return;
-			try {
-				const obs = await observe(input, opts);
-				report.runsObserved += 1;
-				report.findings += obs.findings.length;
-				report.learned += obs.learned.length;
-				report.usage.input += obs.usage.input;
-				report.usage.output += obs.usage.output;
-				report.usage.known &&= obs.usage.known;
-			} catch (e) {
-				report.usage.known &&= e instanceof ObservationError && e.usage.known;
-				if (e instanceof ObservationError) {
-					report.usage.input += e.usage.input;
-					report.usage.output += e.usage.output;
+			id,
+			async *streamPrompt(message, opts) {
+				assertBoxlessPromptOptions(opts, "inlineSandboxClient");
+				const controller = new AbortController();
+				const callerSignal = opts?.signal;
+				const onAbort = () => controller.abort(callerSignal?.reason ?? /* @__PURE__ */ new Error("prompt aborted"));
+				if (callerSignal) if (callerSignal.aborted) onAbort();
+				else callerSignal.addEventListener("abort", onAbort, { once: true });
+				const requestedProfile = (options?.backend && typeof options.backend === "object" ? options.backend.profile : void 0) ?? capturedDefaultProfile;
+				const parsedProfile = agentProfileSchema.safeParse(requestedProfile);
+				if (!parsedProfile.success) throw new Error("inlineSandboxClient: an exact AgentProfile is required; pass defaults.profile or create({ backend: { profile } })");
+				const exec = factory({
+					profile: parsedProfile.data,
+					harness: null
+				}, {
+					signal: controller.signal,
+					seams: { createOptions }
+				});
+				try {
+					const artifact = await settle(exec, message, controller.signal);
+					const out = artifact.out;
+					const tokensIn = artifact.spent.tokens.input;
+					const tokensOut = artifact.spent.tokens.output;
+					const costUsd = artifact.spent.usd;
+					const estimatedCostUsd = out?.estimatedCostUsd;
+					if (artifact.spent.iterations > 0 || artifact.spent.tokensKnown === false || artifact.spent.usdKnown === false || tokensIn > 0 || tokensOut > 0 || costUsd > 0 || estimatedCostUsd !== void 0) yield {
+						type: "llm_call",
+						data: {
+							...artifact.spent.tokensKnown === false ? {} : {
+								tokensIn,
+								tokensOut
+							},
+							...artifact.spent.usdKnown !== false ? { costUsd } : {},
+							...artifact.spent.tokensKnown === false ? { tokensKnown: false } : {},
+							...artifact.spent.usdKnown === false ? { costKnown: false } : {},
+							...artifact.spent.usdKnown !== false ? {
+								costKnown: true,
+								costProvenance: "provider-receipt"
+							} : {},
+							...estimatedCostUsd !== void 0 ? { estimatedCostUsd } : {},
+							...out?.promptCache ? { promptCache: out.promptCache } : {}
+						}
+					};
+					yield {
+						type: "result",
+						data: {
+							finalText: out?.content ?? "",
+							...artifact.spent.tokensKnown === false ? { tokensKnown: false } : { tokenUsage: {
+								inputTokens: tokensIn,
+								outputTokens: tokensOut
+							} },
+							...artifact.spent.usdKnown === false ? {
+								costKnown: false,
+								...costUsd > 0 ? { costUsd } : {}
+							} : {
+								costUsd,
+								costKnown: true,
+								costProvenance: "provider-receipt"
+							},
+							...estimatedCostUsd !== void 0 ? { estimatedCostUsd } : {},
+							...out?.promptCache ? { promptCache: out.promptCache } : {}
+						}
+					};
+					yield {
+						type: "done",
+						data: { outcome: { type: "completed" } }
+					};
+				} finally {
+					callerSignal?.removeEventListener("abort", onAbort);
+					await exec.teardown("brutalKill").catch(() => {});
 				}
-				report.failures.push({
-					runId: input.runId ?? `run-${sequence}`,
-					error: e instanceof Error ? e.message.slice(0, 300) : String(e)
-				});
-			}
-		}
-	});
-	await Promise.all(workers);
-	if (report.runsObserved === 0 && report.failures.length > 0) throw new HarvestError(report);
-	return report;
+			},
+			async delete() {}
+		};
+	} };
 }
 //#endregion
-//#region src/runtime/in-process-sandbox-client.ts
+//#region src/runtime/local-sandbox-client.ts
 /**
-* The ONE in-process pseudo-box: present a plain user callback as a
-* `SandboxClient` so an example or test can drive `runAgentRounds` / `openSandboxRun`
-* with zero credentials and zero network — without re-faking a box at each call
-* site via `as unknown as SandboxInstance`.
+* `localSandboxClient` — the SAME-HOST pseudo-box: a `SandboxClient` whose
+* `create()` MATERIALIZES the profile's stdio MCP servers as local child
+* processes (`materializeLocalMcp`) and whose `streamPrompt` drives a real
+* tool loop (`runBrainLoop` over the router brain) with those live tools.
 *
-* It is the structural sibling of {@link inlineSandboxClient}: that one adapts an
-* `Executor` (router / bridge / BYO) into a box; this one adapts a single
-* `onPrompt(prompt, round)` callback into a box. Both exist because
-* `SandboxInstance` is a `declare class` with private fields — a plain object
-* literal can NEVER structurally satisfy it, so every offline seam was forced to
-* write `as unknown as SandboxInstance`. The one unavoidable cast now lives HERE,
-* documented and tested, instead of in every example.
+* Despite the interface name, this does NOT isolate processes. It is only for
+* author-controlled profiles whose local MCP commands a caller explicitly
+* trusts; user- or model-authored code belongs in a real sandbox. `delete()`
+* kills the children.
 *
-* What the box implements is exactly the subset `runAgentRounds` + `openSandboxRun`
-* actually call on a box:
-*   - `id` — stable per box, used for trace correlation.
-*   - `streamPrompt(prompt, opts?)` — runs `onPrompt` and streams its events.
-*   - `fs.read` / `fs.write` — over the optional real `workdir` (the deliverable
-*     artifact + any seeded fixtures live there). Present only when a `workdir`
-*     is given.
-*   - `exec(command)` — runs the command in `workdir`. Present only when a
-*     `workdir` is given.
-*   - `delete()` — removes the per-box temp dir (when one was minted) and is a
-*     no-op otherwise; `deleteBoxSafe` calls it at teardown.
+* A per-create profile may change the prompt surface. Permission to start a
+* local MCP process applies only when its full canonical bytes match the fixed
+* constructor profile; a different generated profile is refused.
 *
-* The `SandboxEvent` shape the callback returns — `{ type, data }` — is the
-* runtime metering protocol the kernel reads: emit a flat `llm_call`
-* (`{ tokensIn, tokensOut, costUsd }`) or a terminal `done`
-* (`{ tokenUsage, totalCostUsd }`) / `result` event and the kernel's cost ledger
-* picks it up. No cast is needed on the events (the union is structural); only
-* the box object is cast, once, inside this file.
+* Event protocol matches `inlineSandboxClient`: known token usage is emitted as one `llm_call`;
+* Router catalog cost remains a separately-labelled estimate, never billed spend.
 */
-function isAsyncIterable(v) {
-	return typeof v === "object" && v !== null && Symbol.asyncIterator in v;
-}
-/**
-* Adapt a single `onPrompt(prompt, ctx)` callback into a `SandboxClient` for
-* `runAgentRounds` / `openSandboxRun`. Returns a PROPERLY-TYPED `SandboxClient`: the
-* lone `SandboxInstance` cast (object literal → `declare class`) lives inside
-* this function, so call sites stay cast-free.
-*
-* There is no box, so a per-prompt `backend` override is refused rather than dropped. A per-turn
-* `model` IS delivered, because `onPrompt` receives the verbatim options and is free to honor it.
-* Other per-prompt options (`timeoutMs`, `context`) are accepted and ignored.
+/** A same-host `SandboxClient` adapter with no process isolation. Local MCP is
+* refused unless the caller explicitly supplies a policy that allows it.
 *
-* @experimental
-*/
-function inProcessSandboxClient(options) {
-	const { onPrompt, workdir: workdirPrefix, id: idOption } = options;
+* There is no box, so a per-prompt `backend` or `model` override is refused rather than dropped;
+* other per-prompt options (`timeoutMs`, `context`) are accepted and ignored. */
+function localSandboxClient(opts) {
+	const defaultProfile = opts.profile === void 0 ? void 0 : executableAgentProfileSnapshot(opts.profile, "localSandboxClient default profile");
+	const router = Object.freeze({ ...opts.router });
+	if (opts.profileSecurityPolicy?.allowLocalMcp && defaultProfile === void 0) throw new ValidationError("localSandboxClient: allowLocalMcp requires a fixed author-controlled profile; dynamic profiles need a real sandbox");
+	const trustedProfileDigest = opts.profileSecurityPolicy?.allowLocalMcp && defaultProfile !== void 0 ? canonicalAgentProfileDigest(defaultProfile) : void 0;
 	let seq = 0;
-	return { async create(_options) {
-		const current = seq++;
-		const id = typeof idOption === "function" ? idOption(current) : idOption ?? `in-process-${current}`;
-		const boxWorkdir = workdirPrefix !== void 0 ? mkdtempSync(join(tmpdir(), `${workdirPrefix}-`)) : void 0;
-		let round = 0;
-		const fsMembers = boxWorkdir !== void 0 ? {
-			fs: {
-				async read(path) {
-					return readFile(join(boxWorkdir, path), "utf8");
-				},
-				async write(path, content) {
-					const abs = join(boxWorkdir, path);
-					await mkdir(dirname(abs), { recursive: true });
-					await writeFile(abs, content, "utf8");
-				}
-			},
-			async exec(command) {
-				const { exec: execCb } = await import("node:child_process");
-				const { promisify } = await import("node:util");
-				const execAsync = promisify(execCb);
-				try {
-					const { stdout, stderr } = await execAsync(command, {
-						cwd: boxWorkdir,
-						timeout: 3e4
-					});
-					return {
-						exitCode: 0,
-						stdout,
-						stderr
-					};
-				} catch (err) {
-					const e = err;
-					return {
-						exitCode: e.code ?? 1,
-						stdout: e.stdout ?? "",
-						stderr: e.stderr ?? e.message ?? ""
-					};
-				}
-			}
-		} : {};
-		async function* drive(behavior, message, opts) {
-			const prompt = typeof message === "string" ? message : JSON.stringify(message);
-			const { signal: optSignal, ...rest } = opts ?? {};
-			const signal = optSignal ?? new AbortController().signal;
-			const ctx = {
-				round,
-				workdir: boxWorkdir,
-				signal,
-				...Object.keys(rest).length > 0 ? { options: rest } : {}
-			};
-			round += 1;
-			const produced = await behavior(prompt, ctx);
-			if (isAsyncIterable(produced)) for await (const ev of produced) yield ev;
-			else for (const ev of produced) yield ev;
-		}
+	return { async create(options) {
+		const profile = executableAgentProfileSnapshot((options?.backend)?.profile ?? defaultProfile, "localSandboxClient");
+		const model = profileProviderModel(profile);
+		const settings = profileModelExecutionSettings(profile, "localSandboxClient");
+		const policyApplies = opts.profileSecurityPolicy !== void 0 && (!opts.profileSecurityPolicy.allowLocalMcp || trustedProfileDigest !== void 0 && canonicalAgentProfileDigest(profile) === trustedProfileDigest);
+		const mcp = await materializeLocalMcp(profile, {
+			...opts.keys ? { keys: opts.keys } : {},
+			...policyApplies ? { profileSecurityPolicy: opts.profileSecurityPolicy } : {}
+		});
+		const brain = routerBrain({
+			routerBaseUrl: router.baseUrl,
+			routerKey: router.key,
+			model,
+			...settings.retry !== void 0 ? { retry: settings.retry } : {},
+			...enforceTokenLimits(settings.tokenLimits, "router", "localSandboxClient").applied,
+			...settings.stream !== void 0 ? { stream: settings.stream } : {}
+		}, {
+			...settings.temperature !== void 0 ? { temperature: settings.temperature } : {},
+			...settings.seed !== void 0 ? { seed: settings.seed } : {},
+			...settings.toolChoice !== void 0 ? { toolChoice: settings.toolChoice } : {},
+			...settings.extraBody !== void 0 ? { extraBody: settings.extraBody } : {},
+			...profile.model?.reasoningEffort ? { reasoningEffort: profile.model.reasoningEffort } : {}
+		});
+		const system = [profile.prompt?.systemPrompt, ...profile.prompt?.instructions ?? []].filter((s) => typeof s === "string" && s.trim().length > 0).join("\n\n");
 		return {
-			id,
-			streamPrompt(message, opts) {
-				assertBoxlessPromptOptions(opts, "inProcessSandboxClient", ["backend"]);
-				return drive(onPrompt, message, opts);
-			},
-			...fsMembers,
-			async delete() {
-				if (boxWorkdir !== void 0) rmSync(boxWorkdir, {
-					recursive: true,
-					force: true
+			id: `local-${seq++}`,
+			async *streamPrompt(message, popts) {
+				assertBoxlessPromptOptions(popts, "localSandboxClient");
+				let estimatedCostUsd = 0;
+				let sawEstimatedCost = false;
+				const chat = async (messages, tools) => {
+					const r = await brain(messages, tools);
+					if (r.costProvenance === "catalog-estimate" && r.costUsd !== void 0) {
+						estimatedCostUsd += r.costUsd;
+						sawEstimatedCost = true;
+					}
+					return r;
+				};
+				const r = await runBrainLoop({
+					chat,
+					tools: mcp.tools,
+					execute: (name, args) => mcp.call(name, args),
+					initialMessages: [...system ? [{
+						role: "system",
+						content: system
+					}] : [], {
+						role: "user",
+						content: message
+					}],
+					maxTurns: settings.maxTurns ?? 0,
+					hooks: { stopBefore: () => popts?.signal?.aborted === true }
 				});
+				if (r.turns > 0) yield {
+					type: "llm_call",
+					data: {
+						model,
+						...r.tokensKnown === false ? { tokensKnown: false } : {
+							tokensIn: r.usage.input,
+							tokensOut: r.usage.output
+						},
+						costKnown: false,
+						...sawEstimatedCost ? { estimatedCostUsd } : {}
+					}
+				};
+				yield {
+					type: "result",
+					data: {
+						finalText: r.final,
+						...r.tokensKnown === false ? { tokensKnown: false } : { tokenUsage: {
+							inputTokens: r.usage.input,
+							outputTokens: r.usage.output
+						} },
+						costKnown: false,
+						...sawEstimatedCost ? { estimatedCostUsd } : {}
+					}
+				};
+			},
+			async delete() {
+				await mcp.close();
 			}
 		};
 	} };
 }
 //#endregion
-//#region src/runtime/isolated-checker.ts
-const toolchains = [
-	"/usr",
-	"/bin",
-	"/lib",
-	"/lib64"
-];
-const contains = (parent, child) => {
-	const path = relative(parent, child);
-	return path === "" || path !== ".." && !path.startsWith(`..${sep}`) && !path.startsWith(sep);
-};
+//#region src/runtime/resolve-sandbox-client.ts
 /**
-* Run an untrusted check in Linux Bubblewrap, or in its own Sandbox box when `box` is set.
-* Never falls back to host execution.
+* The product-facing backend selector: one call picks the execution transport a
+* `runAgentRounds` (or any consumer that drives a `SandboxClient`) runs on, from the
+* package a product already depends on. It is pure sugar over the existing
+* primitives — `createExecutor({ backend })` + `inlineSandboxClient` — and adds
+* ZERO transport code (the node:http cli-bridge transport lives in `bridgeExecutor`).
 *
-* Bubblewrap requires /usr/bin/bwrap and permission to create Linux namespaces.
-* Only trusted system toolchains, private proc/dev/tmp, and the writable copy are mounted.
-* The canonical input path remains the working directory; copy writes are discarded.
-* Limits bound command time and captured output, not copy size or memory consumption.
-* Callers must keep the input and trusted toolchains stable while preparing the check.
+* The heavy `resolveBenchClient` in `@tangle-network/agent-bench` is the bench-side
+* sibling: it layers router/search specifics a product should not have to depend on.
+* This is the generic, dep-light core products call to switch backends:
 *
-* A box check creates one fresh box with no owner secrets and blocked egress, delivers the
-* tree's regular files verified by sha256, runs the command there, and deletes the box.
+*   - `backend: 'sandbox'` → IN-BOX: return the caller's real Sandbox-backed
+*                            `sandboxClient` unchanged. Fail loud if absent — a
+*                            product on the sandbox backend already holds its box.
+*   - `backend: 'bridge'`  → OFF-BOX: a local cli-bridge fronting a harness CLI
+*                            (opencode / kimi-code / …) as the leaf executor, wired
+*                            through the resumable `bridgeExecutor`.
+*   - `backend: 'router'`  → OFF-BOX: a router chat-completion as the leaf executor,
+*                            presented as a `SandboxClient` (no sandbox dependency).
+*   - `backend: 'local'`   → SAME-HOST: a router-brain tool loop with the
+*                            profile's stdio MCP servers spawned as LOCAL child
+*                            processes — the only backend that can reach an MCP
+*                            server built into a host worktree.
 */
-async function runIsolatedCheck(options) {
-	if (options.box) return runInBox(options, options.box);
-	let scratch;
-	let result;
-	try {
-		if (process.platform !== "linux") throw new Error("Linux Bubblewrap namespaces are required");
-		const { timeoutMs, maxOutputBytes } = checkLimits(options);
-		if (options.signal?.aborted) return {
-			succeeded: false,
-			reason: "cancelled",
-			diagnostic: "Check cancelled"
-		};
-		const { workspace, tree } = await protectedTree(options);
-		const binds = [];
-		for (const path of toolchains) {
-			let actual;
-			try {
-				actual = await realpath(path);
-			} catch (error) {
-				if (error.code === "ENOENT") continue;
-				throw error;
-			}
-			for (const mount of [path, actual]) if (contains(mount, workspace) || contains(workspace, mount) || contains(mount, tree) || contains(tree, mount)) throw new Error(`Toolchain overlaps protected workspace: ${path}`);
-			binds.push("--ro-bind", actual, path);
-		}
-		if (["/proc", "/dev"].some((path) => contains(path, tree) || contains(tree, path))) throw new Error("Tree overlaps a reserved namespace mount");
-		scratch = await mkdtemp(join(tmpdir(), "runtime-check-"));
-		if (contains(tree, scratch)) throw new Error("Temporary storage must be outside the input tree");
-		const copy = join(scratch, "tree");
-		await cp(tree, copy, {
-			recursive: true,
-			dereference: false,
-			verbatimSymlinks: true
-		});
-		result = await execute([
-			"--unshare-all",
-			"--die-with-parent",
-			"--new-session",
-			"--cap-drop",
-			"ALL",
-			"--clearenv",
-			"--setenv",
-			"PATH",
-			"/usr/bin:/bin",
-			"--setenv",
-			"HOME",
-			"/tmp",
-			"--setenv",
-			"LANG",
-			"C",
-			...binds,
-			"--proc",
-			"/proc",
-			"--dev",
-			"/dev",
-			"--tmpfs",
-			"/tmp",
-			"--bind",
-			copy,
-			tree,
-			"--chdir",
-			tree,
-			"--",
-			...options.command
-		], timeoutMs, maxOutputBytes, options.signal);
-	} catch (error) {
-		result = {
-			succeeded: false,
-			reason: "refused",
-			diagnostic: String(error)
-		};
-	}
-	if (scratch) try {
-		await removeScratch(scratch);
-	} catch (error) {
-		const cleanupDiagnostic = String(error);
-		result = result.succeeded ? {
-			succeeded: false,
-			reason: "cleanup-failed",
-			diagnostic: cleanupDiagnostic,
-			stdout: result.value.stdout,
-			stderr: result.value.stderr,
-			exitCode: 0
-		} : {
-			...result,
-			cleanupDiagnostic
-		};
-	}
-	return result;
-}
-function checkLimits(options) {
-	const timeoutMs = options.timeoutMs ?? 3e4;
-	const maxOutputBytes = options.maxOutputBytes ?? 1048576;
-	if (!Number.isSafeInteger(timeoutMs) || timeoutMs < 1 || timeoutMs > 2147483647 || !Number.isSafeInteger(maxOutputBytes) || maxOutputBytes < 1) throw new Error("Invalid execution limits");
-	if (!options.command.length || !options.command[0]) throw new Error("A command is required");
-	return {
-		timeoutMs,
-		maxOutputBytes
-	};
-}
-async function protectedTree(options) {
-	const workspace = await realpath(options.workspaceRoot);
-	const tree = await realpath(options.tree);
-	if (!contains(workspace, tree) || !(await stat(tree)).isDirectory()) throw new Error("Tree must be a directory inside the workspace");
-	return {
-		workspace,
-		tree
-	};
-}
-/** Box-workspace-relative directory that receives the tree and is the command's cwd. */
-const BOX_TREE = "tree";
-/** Bound on provisioning, delivery, and deletion; the box expires even if this process dies. */
-const BOX_SETUP_SECONDS = 900;
-/** The box's own process timeout is a backstop behind this module's deadline. */
-const BOX_PROCESS_BACKSTOP_MS = 3e4;
-/** Concurrent file deliveries into one check box. */
-const BOX_UPLOADS = 4;
-/** The box's process supervisor prefixes this to stderr when it cannot start the executable. */
-const BOX_EXEC_FAILURE = "process-supervisor: exec failed";
-async function runInBox(options, placement) {
-	let box;
-	let evidence;
-	let result;
-	try {
-		const { timeoutMs, maxOutputBytes } = checkLimits(options);
-		if (options.signal?.aborted) return {
-			succeeded: false,
-			reason: "cancelled",
-			diagnostic: "Check cancelled"
-		};
-		const { tree } = await protectedTree(options);
-		const captured = await captureMaterializedWorkspace(tree);
-		if (placement.builderAccounts.length === 0 || placement.builderAccounts.some((id) => !id)) throw new Error("builderAccounts must name the account of every key the judged run holds");
-		const account = (await placement.client.getIdentity()).customerId;
-		if (!account) throw new Error("Sandbox returned no account for the check key");
-		if (placement.builderAccounts.includes(account)) throw new Error(`Check account ${account} is an account the judged run holds a key to, so the run can reach the check box`);
-		options.signal?.throwIfAborted();
-		box = await placement.client.createIsolated({
-			environment: placement.environment,
-			agent: false,
-			bare: false,
-			ephemeral: true,
-			egressPolicy: { mode: "blocked" },
-			...placement.resources ? { resources: placement.resources } : {},
-			maxLifetimeSeconds: Math.ceil(timeoutMs / 1e3) + BOX_SETUP_SECONDS,
-			idempotencyKey: `agent-runtime-check-${randomUUID()}`
-		}, options.signal ? { signal: options.signal } : void 0);
-		const receipt = box.createReceipt();
-		if (receipt?.outcome !== "created" || receipt.ownerContext !== "isolated" || !Array.isArray(receipt.injectedSecrets) || receipt.injectedSecrets.length !== 0) throw new Error("Sandbox did not confirm a fresh box with no owner secrets");
-		const egress = (await box.egress.get()).policy;
-		if (egress.mode !== "blocked") throw new Error(`Check box egress is ${egress.mode}, not blocked`);
-		await box.fs.mkdir(BOX_TREE, { recursive: true });
-		const digests = new Map(captured.manifest.files.map((entry) => [entry.path, entry.sha256]));
-		const target = box;
-		const pending = [...captured.files];
-		const deliver = async () => {
-			try {
-				for (let file = pending.shift(); file; file = pending.shift()) {
-					options.signal?.throwIfAborted();
-					const received = await target.fs.uploadData(`${BOX_TREE}/${file.path}`, file.bytes, { mode: file.mode });
-					if (`sha256:${received.hash.replace(/^sha256:/, "").toLowerCase()}` !== digests.get(file.path) || received.size !== file.bytes.byteLength) throw new Error(`Check box received different bytes for ${file.path}`);
-				}
-			} catch (error) {
-				pending.length = 0;
-				throw error;
-			}
-		};
-		await Promise.all(Array.from({ length: BOX_UPLOADS }, deliver));
-		evidence = {
-			sandboxId: box.id,
-			account,
-			input: captured.manifest,
-			inputDigest: canonicalCandidateDigest(captured.manifest)
-		};
-		result = await executeInBox(box, options.command, timeoutMs, maxOutputBytes, options.signal);
-	} catch (error) {
-		result = {
-			succeeded: false,
-			reason: options.signal?.aborted ? "cancelled" : "refused",
-			diagnostic: String(error)
-		};
-	}
-	if (box) try {
-		await box.delete();
-	} catch (error) {
-		const cleanupDiagnostic = `Check box ${box.id} was not deleted: ${String(error)}`;
-		result = result.succeeded ? {
-			succeeded: false,
-			reason: "cleanup-failed",
-			diagnostic: cleanupDiagnostic,
-			stdout: result.value.stdout,
-			stderr: result.value.stderr,
-			exitCode: 0
-		} : {
-			...result,
-			cleanupDiagnostic
-		};
+/**
+* Resolve a `SandboxClient` for the chosen backend. The generic, dep-light core
+* that `resolveBenchClient` builds on — reuse this instead of hand-rolling the
+* `createExecutor`/`inlineSandboxClient` branch in each product.
+*/
+function resolveSandboxClient(opts) {
+	switch (opts.backend) {
+		case "sandbox":
+			if (!opts.sandboxClient) throw new Error("resolveSandboxClient: backend 'sandbox' requires opts.sandboxClient");
+			return opts.sandboxClient;
+		case "bridge": {
+			const bridge = opts.bridge;
+			if (!bridge?.bearer) throw new Error("resolveSandboxClient: backend 'bridge' requires bridge.bearer");
+			return inlineSandboxClient(createExecutor({
+				backend: "bridge",
+				bridgeUrl: bridge.url ?? "http://127.0.0.1:3355",
+				bridgeBearer: bridge.bearer,
+				timeoutMs: bridge.timeoutMs
+			}));
+		}
+		case "router": {
+			const router = opts.router;
+			if (!router?.baseUrl || !router.key) throw new Error("resolveSandboxClient: backend 'router' requires router.baseUrl and router.key");
+			return inlineSandboxClient(createExecutor({
+				backend: "router",
+				routerBaseUrl: router.baseUrl,
+				routerKey: router.key
+			}));
+		}
+		case "local": {
+			const local = opts.local;
+			if (!local?.router?.baseUrl || !local.router.key) throw new Error("resolveSandboxClient: backend 'local' requires local.router.baseUrl and local.router.key");
+			return localSandboxClient(local);
+		}
 	}
-	return evidence ? {
-		...result,
-		box: evidence
-	} : result;
 }
-async function executeInBox(box, command, timeoutMs, limit, signal) {
-	const [executable, ...args] = command;
-	const child = await box.process.spawnExact(executable, args, {
-		cwd: BOX_TREE,
-		env: {
-			PATH: "/usr/bin:/bin",
-			HOME: "/tmp",
-			LANG: "C"
+//#endregion
+//#region src/runtime/define-leaderboard.ts
+/**
+* `defineLeaderboard` — the declarative eval-leaderboard facade.
+*
+* A product's harness×model leaderboard is always the same assembly: expand a
+* base profile across the harness×model axes (`expandProfileAxes`), run every
+* (profile, case) cell as a driven loop (`loopDispatch` + the naive retry driver), score
+* with the domain's grader, and emit ONE `runProfileMatrix` call. Each product
+* hand-rolled that assembly (~650 lines each) and re-hit the same footguns:
+* stale cell-cache reuse, zero-token stub cells, missing model snapshots.
+*
+* This facade IS that assembly, once, with the domain reduced to a declarative
+* spec: `cases` + `prompt` + `score`. It contains NO execution, judging, or
+* metering logic of its own — every moving part is an existing primitive, and
+* every default is overridable:
+*
+*   - LEVEL 0 (declarative): `cases` / `prompt` / `score` / `axis`.
+*   - LEVEL 1 (seams): `backends`, `flags`, `parseOutput`, `onCellEvents`,
+*     `resolveModel`, `setup`/`teardown`, `export`, `matrix`
+*     passthrough.
+*   - LEVEL 2 (replacement): `dispatch` and `judges` swap out the whole
+*     loop wiring or scoring; `runProfileMatrix` itself stays public as the
+*     escape floor — a product overriding everything just writes what it has
+*     today, no capability removed.
+*
+* `toBenchmarkAdapter()` exposes the same domain surface in the structural
+* `BenchmarkAdapter` shape (`name`/`preflight`/`loadTasks`/`judge`/
+* `goldArtifact`) so a product leaderboard can register into a benchmark
+* registry without this module depending on one.
+*
+* @experimental
+*/
+/**
+* The no-signal retry floor as a bare `Driver` literal: re-run the case VERBATIM as an
+* independent attempt until one shot scores (`verdict.valid`) or the shot cap. It reads ONLY
+* `verdict.valid` — never `notes`/`scores` — so a leaderboard cell's retries carry no grader
+* findings into the next shot (the leak-free firewall). Steering POLICY texts are registry data
+* (`delegates/naive-continuation` and siblings in the kernel prompt registry) attached to graph
+* edges; this loop-kernel control folds no text in — each shot is the same task object, and the
+* per-shot nonce in `taskToPrompt` keeps the attempts independent at the router.
+*/
+function naiveRetryDriver(shots) {
+	return {
+		name: "naive",
+		plan(task, history) {
+			if (history.length === 0) return Promise.resolve([task]);
+			if (history[history.length - 1]?.verdict?.valid === true) return Promise.resolve([]);
+			if (history.length >= shots) return Promise.resolve([]);
+			return Promise.resolve([task]);
 		},
-		inheritEnv: false,
-		timeoutMs: timeoutMs + BOX_PROCESS_BACKSTOP_MS
-	});
-	const stdout = [];
-	const stderr = [];
-	let bytes = 0;
-	let failure;
-	let stopping;
-	const stop = (reason) => {
-		failure ??= reason;
-		stopping ??= child.kill("SIGKILL", { tree: true }).catch(() => void 0);
-	};
-	const clearTimer = armDeadlineTimer(timeoutMs, () => stop("timeout"), true);
-	const cancel = () => stop("cancelled");
-	signal?.addEventListener("abort", cancel, { once: true });
-	if (signal?.aborted) cancel();
-	const capture = async (stream, target) => {
-		for await (const text of stream) {
-			const chunk = Buffer.from(text);
-			const remaining = Math.max(0, limit - bytes);
-			bytes += chunk.length;
-			if (remaining) target.push(chunk.subarray(0, remaining));
-			if (bytes > limit) stop("output-limit");
+		decide(history) {
+			if (history.some((it) => it.verdict?.valid)) return "pick-winner";
+			return history.length < shots ? "refine" : "fail";
+		},
+		describePlan() {
+			return {
+				kind: "refine",
+				rationale: "naive fixed continuation (no grade signal)"
+			};
 		}
 	};
-	let exitCode;
-	let exitSignal;
+}
+/** Read `--name <value>` from an argv array. */
+function argOf(argv, name) {
+	const i = argv.indexOf(`--${name}`);
+	if (i >= 0 && i + 1 < argv.length) return argv[i + 1];
+}
+function splitList(v) {
+	if (v === void 0) return void 0;
+	const parts = v.split(",").map((s) => s.trim()).filter(Boolean);
+	return parts.length > 0 ? parts : void 0;
+}
+/** RunRecords reject a bare model id — the eval IDENTITY model must carry a
+*  snapshot (`name@<snapshot>`). Unchanged when already stamped. */
+function withSnapshot(model, snapshot) {
+	return model.includes("@") ? model : `${model}@${snapshot}`;
+}
+function gitSha() {
 	try {
-		await Promise.all([capture(child.stdout(), stdout), capture(child.stderr(), stderr)]);
-		exitCode = await child.wait();
-		exitSignal = (await child.status()).exitSignal;
-	} finally {
-		clearTimer();
-		signal?.removeEventListener("abort", cancel);
-		await stopping;
+		return execFileSync("git", ["rev-parse", "HEAD"], { encoding: "utf8" }).trim();
+	} catch {
+		return "unknown";
 	}
-	const out = Buffer.concat(stdout).toString();
-	const err = Buffer.concat(stderr).toString();
-	const evidence = {
-		stdout: out,
-		stderr: err,
-		exitCode: exitSignal ? null : exitCode
-	};
-	if (failure) return {
-		succeeded: false,
-		reason: failure,
-		diagnostic: err || failure,
-		...evidence
-	};
-	if (exitCode === 127 && err.startsWith(BOX_EXEC_FAILURE)) return {
-		succeeded: false,
-		reason: "refused",
-		diagnostic: err,
-		...evidence
-	};
-	if (exitSignal) return {
-		succeeded: false,
-		reason: "failed",
-		diagnostic: err || `Check killed by ${exitSignal}`,
-		...evidence
+}
+function normalizeScore(s) {
+	return typeof s === "number" ? { composite: s } : s;
+}
+/**
+* Assemble a declarative spec (`cases` + `prompt` + `score`) into a runnable
+* harness×model leaderboard — `run()` executes the matrix, `toBenchmarkAdapter()`
+* exposes the same domain as a structural `BenchmarkAdapter`.
+*/
+function defineLeaderboard(spec) {
+	const caseId = (c) => {
+		const id = spec.caseId ? spec.caseId(c) : c.id;
+		if (typeof id !== "string" || id.length === 0) throw new Error(`defineLeaderboard(${spec.name}): every case needs a stable string id — give cases an \`id\` property or supply spec.caseId`);
+		return id;
 	};
-	if (exitCode !== 0) return {
-		succeeded: false,
-		reason: "failed",
-		diagnostic: err || out || `Check exited ${exitCode}`,
-		...evidence
+	const selectCases = (ids) => {
+		if (!ids) return spec.cases;
+		const byId = new Map(spec.cases.map((c) => [caseId(c), c]));
+		return ids.map((id) => {
+			const c = byId.get(id);
+			if (c === void 0) throw new Error(`defineLeaderboard(${spec.name}): unknown case "${id}" (have: ${[...byId.keys()].join(", ")})`);
+			return c;
+		});
 	};
-	return {
-		succeeded: true,
-		value: {
-			stdout: out,
-			stderr: err
+	const scoreJudge = {
+		name: `${spec.name}-score`,
+		dimensions: [{
+			key: "composite",
+			description: `${spec.name} case score`
+		}],
+		score({ artifact, scenario }) {
+			const s = normalizeScore(spec.score(artifact, scenario.case));
+			return {
+				composite: s.composite,
+				dimensions: {
+					composite: s.composite,
+					...s.dimensions
+				},
+				notes: s.notes ?? ""
+			};
 		}
 	};
-}
-function execute(args, timeoutMs, limit, signal) {
-	return new Promise((done) => {
-		const child = spawn("/usr/bin/bwrap", [
-			"--json-status-fd",
-			"3",
-			...args
-		], {
-			env: {},
-			stdio: [
-				"ignore",
-				"pipe",
-				"pipe",
-				"pipe"
-			],
-			detached: true
+	async function run(argv = process.argv.slice(2)) {
+		const args = {};
+		for (const name of [
+			"backend",
+			"harnesses",
+			"models",
+			"cases",
+			"shots",
+			"reps",
+			"model-snapshot",
+			"run-dir",
+			"export-dir"
+		]) args[name] = argOf(argv, name);
+		for (const [name, flag] of Object.entries(spec.flags ?? {})) args[name] = argOf(argv, name) ?? flag.default;
+		const backendName = args.backend ?? "sandbox";
+		const shots = Number(args.shots ?? spec.shots ?? 1);
+		const reps = Number(args.reps ?? spec.reps ?? 1);
+		const snapshot = args["model-snapshot"] ?? "leaderboard";
+		const runDir = args["run-dir"] ?? join(tmpdir(), `leaderboard-${spec.name}-${Date.now()}-${process.pid}`);
+		const exportDir = args["export-dir"] ?? join(runDir, "export");
+		mkdirSync(runDir, { recursive: true });
+		const cases = selectCases(splitList(args.cases));
+		if (cases.length === 0) throw new Error(`defineLeaderboard(${spec.name}): no cases to run`);
+		const scenarios = cases.map((c) => ({
+			id: caseId(c),
+			kind: spec.name,
+			case: c
+		}));
+		const harnesses = splitList(args.harnesses) ?? spec.axis?.harnesses ?? CODING_HARNESSES;
+		const rawModels = splitList(args.models) ?? spec.axis?.models ?? (spec.baseProfile?.model?.default !== void 0 ? [spec.baseProfile.model.default] : void 0);
+		if (!rawModels || rawModels.length === 0) throw new Error(`defineLeaderboard(${spec.name}): no models — pass --models, set spec.axis.models, or give spec.baseProfile a model.default`);
+		const models = rawModels.map((m) => withSnapshot(m, snapshot));
+		const profiles = expandProfileAxes({
+			base: spec.baseProfile,
+			harnesses,
+			models
 		});
-		const stdout = [];
-		const stderr = [];
-		let bytes = 0;
-		let status = "";
-		let failure;
-		const stop = (reason) => {
-			failure ??= reason;
-			if (child.pid) try {
-				process.kill(-child.pid, "SIGKILL");
-			} catch (error) {
-				if (error.code !== "ESRCH") child.kill("SIGKILL");
-			}
+		for (const profile of profiles) assertExecutableAgentProfile(profile, `defineLeaderboard(${spec.name})`);
+		const ctx = {
+			name: spec.name,
+			backend: backendName,
+			runDir,
+			exportDir,
+			args,
+			harnesses,
+			models,
+			caseIds: scenarios.map((s) => s.id),
+			shots,
+			reps
 		};
-		const clearTimer = armDeadlineTimer(timeoutMs, () => stop("timeout"), true);
-		const cancel = () => stop("cancelled");
-		signal?.addEventListener("abort", cancel, { once: true });
-		if (signal?.aborted) cancel();
-		const capture = (target) => (chunk) => {
-			const remaining = Math.max(0, limit - bytes);
-			bytes += chunk.length;
-			if (remaining) target.push(chunk.subarray(0, remaining));
-			if (bytes > limit) stop("output-limit");
+		const backends = {
+			sandbox: () => {
+				throw new Error(`defineLeaderboard(${spec.name}): the 'sandbox' backend needs your product's real Sandbox client — supply spec.backends.sandbox (e.g. () => new Sandbox({ apiKey, baseUrl }))`);
+			},
+			"cli-bridge": () => {
+				const bearer = process.env.BRIDGE_BEARER ?? process.env.CLI_BRIDGE_BEARER;
+				if (!bearer) throw new Error(`defineLeaderboard(${spec.name}): backend 'cli-bridge' needs BRIDGE_BEARER or CLI_BRIDGE_BEARER set`);
+				return resolveSandboxClient({
+					backend: "bridge",
+					bridge: {
+						url: process.env.CLI_BRIDGE_URL,
+						bearer,
+						timeoutMs: 9e5
+					}
+				});
+			},
+			...spec.backends
 		};
-		child.stdio[3]?.on("data", (chunk) => {
-			if (status.length + chunk.length > 16384) {
-				stop("output-limit");
-				return;
-			}
-			status += chunk.toString();
-		});
-		child.stdout.on("data", capture(stdout));
-		child.stderr.on("data", capture(stderr));
-		let spawnError;
-		child.on("error", (error) => {
-			spawnError = error;
-		});
-		child.on("close", (code) => {
-			clearTimer();
-			signal?.removeEventListener("abort", cancel);
-			const out = Buffer.concat(stdout).toString();
-			const err = Buffer.concat(stderr).toString();
-			const evidence = {
-				stdout: out,
-				stderr: err,
-				exitCode: code
-			};
-			const executed = status.split("\n").some((line) => {
-				try {
-					const record = JSON.parse(line);
-					return record !== null && typeof record === "object" && "exit-code" in record && typeof record["exit-code"] === "number" && record["exit-code"] === code;
-				} catch {
-					return false;
+		const makeClient = backends[backendName];
+		if (!makeClient) throw new Error(`defineLeaderboard(${spec.name}): unknown backend "${backendName}" (have: ${Object.keys(backends).join(", ")})`);
+		const sandboxClient = makeClient();
+		const promptById = /* @__PURE__ */ new Map();
+		for (const s of scenarios) promptById.set(s.id, await spec.prompt(s.case));
+		const promptOf = (s) => {
+			const p = promptById.get(s.id);
+			if (p === void 0) throw new Error(`defineLeaderboard(${spec.name}): no prompt for case "${s.id}"`);
+			return p;
+		};
+		let shotNonce = 0;
+		const maximumCharge = spec.maximumCharge;
+		const dispatch = spec.dispatch ?? ((profile, scenario, dispatchCtx) => {
+			return loopDispatch({
+				sandboxClient,
+				maximumCharge: typeof maximumCharge === "function" ? (cellScenario, cellProfile) => maximumCharge(cellProfile, cellScenario) : maximumCharge,
+				resolveCostModel: (result, _cellScenario, cellProfile) => {
+					if (!spec.resolveModel) return cellProfile.model?.default;
+					const served = new Set(result.iterations.map((iteration) => spec.resolveModel?.(iteration.events)).filter((model) => model !== void 0));
+					if (served.size > 1) throw new Error(`defineLeaderboard(${spec.name}): one cell reported multiple served models: ${[...served].join(", ")}`);
+					return [...served][0] ?? cellProfile.model?.default;
+				},
+				toLoopOptions: (cellScenario, cellProfile) => {
+					return {
+						driver: naiveRetryDriver(shots),
+						agentRun: {
+							profile: cellProfile,
+							taskToPrompt: (s) => `${promptOf(s)}\n\n<!-- independent-attempt:${shotNonce++} -->`
+						},
+						output: { parse: (events) => spec.parseOutput ? spec.parseOutput(events, cellScenario.case) : collectAgentResponseText(events) ?? "" },
+						validator: { validate: async (output) => {
+							const s = normalizeScore(spec.score(output, cellScenario.case));
+							return {
+								valid: s.composite > 0,
+								score: s.composite
+							};
+						} },
+						task: cellScenario,
+						maxIterations: shots
+					};
+				},
+				toArtifact: (result) => {
+					for (const iter of result.iterations) spec.onCellEvents?.(iter.events, scenario.case, {
+						index: iter.index,
+						...iter.error ? { error: iter.error.message } : {},
+						...iter.verdict ? { verdict: { score: iter.verdict.score } } : {}
+					});
+					return result.winner?.output;
 				}
+			})(profile, scenario, dispatchCtx);
+		});
+		await spec.setup?.(ctx);
+		try {
+			const result = await runProfileMatrix({
+				profiles,
+				scenarios,
+				dispatch,
+				judges: spec.judges ?? [scoreJudge],
+				runDir,
+				commitSha: gitSha(),
+				reps,
+				...spec.matrix
 			});
-			if (failure) done({
-				succeeded: false,
-				reason: failure,
-				diagnostic: err || failure,
-				...evidence
-			});
-			else if (spawnError) done({
-				succeeded: false,
-				reason: "refused",
-				diagnostic: String(spawnError),
-				...evidence
-			});
-			else if (!executed) done({
-				succeeded: false,
-				reason: "refused",
-				diagnostic: err || "Bubblewrap did not confirm command execution",
-				...evidence
-			});
-			else if (code !== 0) done({
-				succeeded: false,
-				reason: "failed",
-				diagnostic: err || out || `Check exited ${code}`,
-				...evidence
+			if (spec.export) await spec.export(result, ctx);
+			else {
+				mkdirSync(exportDir, { recursive: true });
+				writeFileSync(join(runDir, "matrix-result.json"), `${JSON.stringify(result, null, 2)}\n`);
+				const table = renderLeaderboardMarkdown(leaderboard(result.records, {
+					title: spec.name,
+					meta: { backend: backendName }
+				}));
+				writeFileSync(join(exportDir, "leaderboard.md"), table);
+				console.log(table);
+			}
+			return result;
+		} finally {
+			await spec.teardown?.(ctx);
+		}
+	}
+	function toBenchmarkAdapter() {
+		return {
+			name: spec.name,
+			async preflight() {
+				const seen = /* @__PURE__ */ new Set();
+				for (const c of spec.cases) {
+					const id = caseId(c);
+					if (seen.has(id)) throw new Error(`defineLeaderboard(${spec.name}): duplicate case id "${id}"`);
+					seen.add(id);
+				}
+			},
+			async loadTasks(opts) {
+				const selected = selectCases(opts?.ids);
+				const limited = opts?.limit !== void 0 ? selected.slice(0, opts.limit) : selected;
+				return Promise.all(limited.map(async (c) => ({
+					id: caseId(c),
+					prompt: await spec.prompt(c),
+					metadata: { case: c }
+				})));
+			},
+			async judge(task, artifact) {
+				const [c] = selectCases([task.id]);
+				if (c === void 0) throw new Error(`defineLeaderboard(${spec.name}): no case "${task.id}"`);
+				const s = normalizeScore(spec.score(artifact, c));
+				return {
+					resolved: s.composite > 0,
+					score: s.composite,
+					detail: s.notes
+				};
+			},
+			async goldArtifact() {}
+		};
+	}
+	return {
+		run,
+		toBenchmarkAdapter
+	};
+}
+//#endregion
+//#region src/runtime/harvest-corpus.ts
+/**
+* Analyze completed runs through the selected observer and retain findings in a corpus.
+*
+* Store-agnostic by design: the caller maps its trace store's rows (a
+* `ProductionTraceSink` ndjson, OTLP spans, RunRecords) to `ObserveInput` — task text,
+* final output, the event trace, terminal outcome.
+* The default observer reads execution evidence; an injected analysis owns its admitted sources.
+*
+* The nightly product job is then three lines:
+*   const runs = mapSinkRowsToObserveInputs(await readSink(yesterday))
+*   const report = await harvestCorpus({ runs, profile, executor, corpus })
+*   log(report)   // runsObserved / findings / learned / failures
+*
+* Consumers choose how retained findings inform later work and how to assess their value.
+*/
+/** The completed batch evidence remains available even when every analysis failed. */
+var HarvestError = class extends Error {
+	report;
+	constructor(report) {
+		super(`harvestCorpus: every run failed analysis (${report.failures.length}) — first: ${report.failures[0]?.error}`);
+		this.report = report;
+		this.name = "HarvestError";
+	}
+};
+/** Batch the selected observation implementation over completed runs and retain its findings. */
+async function harvestCorpus(opts) {
+	const concurrency = opts.concurrency ?? 4;
+	if (!Number.isSafeInteger(concurrency) || concurrency < 1 || opts.maxRuns !== void 0 && (!Number.isSafeInteger(opts.maxRuns) || opts.maxRuns < 0)) throw new TypeError("harvest limits require positive integer concurrency and nonnegative integer maxRuns");
+	const report = {
+		runsObserved: 0,
+		findings: 0,
+		learned: 0,
+		failures: [],
+		usage: {
+			input: 0,
+			output: 0,
+			known: true
+		}
+	};
+	const iterator = Symbol.asyncIterator in Object(opts.runs) ? opts.runs[Symbol.asyncIterator]() : (async function* () {
+		yield* opts.runs;
+	})();
+	let consumed = 0;
+	let done = false;
+	const next = async () => {
+		if (done || opts.signal?.aborted || opts.maxRuns !== void 0 && consumed >= opts.maxRuns) return null;
+		const sequence = ++consumed;
+		let r;
+		try {
+			r = await iterator.next();
+		} catch (error) {
+			done = true;
+			report.failures.push({
+				runId: `source-${sequence}`,
+				error: `trace source: ${error instanceof Error ? error.message.slice(0, 300) : String(error)}`
 			});
-			else done({
-				succeeded: true,
-				value: {
-					stdout: out,
-					stderr: err
+			return null;
+		}
+		if (r.done) {
+			done = true;
+			return null;
+		}
+		return {
+			input: r.value,
+			sequence
+		};
+	};
+	const workers = Array.from({ length: concurrency }, async () => {
+		for (let run = await next(); run !== null; run = await next()) {
+			const { input, sequence } = run;
+			if (opts.signal?.aborted) return;
+			try {
+				const obs = await observe(input, opts);
+				report.runsObserved += 1;
+				report.findings += obs.findings.length;
+				report.learned += obs.learned.length;
+				report.usage.input += obs.usage.input;
+				report.usage.output += obs.usage.output;
+				report.usage.known &&= obs.usage.known;
+			} catch (e) {
+				report.usage.known &&= e instanceof ObservationError && e.usage.known;
+				if (e instanceof ObservationError) {
+					report.usage.input += e.usage.input;
+					report.usage.output += e.usage.output;
 				}
-			});
-		});
+				report.failures.push({
+					runId: input.runId ?? `run-${sequence}`,
+					error: e instanceof Error ? e.message.slice(0, 300) : String(e)
+				});
+			}
+		}
 	});
+	await Promise.all(workers);
+	if (report.runsObserved === 0 && report.failures.length > 0) throw new HarvestError(report);
+	return report;
 }
-const executeFile = promisify(execFile);
-/** GNU tools traverse relative to open directories, including trees deeper than PATH_MAX.
-* Recursive chmod ignores encountered symlinks; rm never follows their targets. */
-async function removeScratch(path) {
-	const options = {
-		env: {},
-		timeout: 1e4,
-		maxBuffer: 16384
-	};
-	let permissionError;
-	try {
-		await executeFile("/bin/chmod", [
-			"--recursive",
-			"--preserve-root",
-			"u+rwX",
-			"--",
-			path
-		], options);
-	} catch (error) {
-		permissionError = error;
-	}
-	try {
-		await executeFile("/bin/rm", [
-			"--recursive",
-			"--force",
-			"--one-file-system",
-			"--",
-			path
-		], options);
-	} catch (error) {
-		throw new Error([permissionError, error].filter((value) => value !== void 0).map(String).join("; "));
-	}
+//#endregion
+//#region src/runtime/in-process-sandbox-client.ts
+/**
+* The ONE in-process pseudo-box: present a plain user callback as a
+* `SandboxClient` so an example or test can drive `runAgentRounds` / `openSandboxRun`
+* with zero credentials and zero network — without re-faking a box at each call
+* site via `as unknown as SandboxInstance`.
+*
+* It is the structural sibling of {@link inlineSandboxClient}: that one adapts an
+* `Executor` (router / bridge / BYO) into a box; this one adapts a single
+* `onPrompt(prompt, round)` callback into a box. Both exist because
+* `SandboxInstance` is a `declare class` with private fields — a plain object
+* literal can NEVER structurally satisfy it, so every offline seam was forced to
+* write `as unknown as SandboxInstance`. The one unavoidable cast now lives HERE,
+* documented and tested, instead of in every example.
+*
+* What the box implements is exactly the subset `runAgentRounds` + `openSandboxRun`
+* actually call on a box:
+*   - `id` — stable per box, used for trace correlation.
+*   - `streamPrompt(prompt, opts?)` — runs `onPrompt` and streams its events.
+*   - `fs.read` / `fs.write` — over the optional real `workdir` (the deliverable
+*     artifact + any seeded fixtures live there). Present only when a `workdir`
+*     is given.
+*   - `exec(command)` — runs the command in `workdir`. Present only when a
+*     `workdir` is given.
+*   - `delete()` — removes the per-box temp dir (when one was minted) and is a
+*     no-op otherwise; `deleteBoxSafe` calls it at teardown.
+*
+* The `SandboxEvent` shape the callback returns — `{ type, data }` — is the
+* runtime metering protocol the kernel reads: emit a flat `llm_call`
+* (`{ tokensIn, tokensOut, costUsd }`) or a terminal `done`
+* (`{ tokenUsage, totalCostUsd }`) / `result` event and the kernel's cost ledger
+* picks it up. No cast is needed on the events (the union is structural); only
+* the box object is cast, once, inside this file.
+*/
+function isAsyncIterable(v) {
+	return typeof v === "object" && v !== null && Symbol.asyncIterator in v;
+}
+/**
+* Adapt a single `onPrompt(prompt, ctx)` callback into a `SandboxClient` for
+* `runAgentRounds` / `openSandboxRun`. Returns a PROPERLY-TYPED `SandboxClient`: the
+* lone `SandboxInstance` cast (object literal → `declare class`) lives inside
+* this function, so call sites stay cast-free.
+*
+* There is no box, so a per-prompt `backend` override is refused rather than dropped. A per-turn
+* `model` IS delivered, because `onPrompt` receives the verbatim options and is free to honor it.
+* Other per-prompt options (`timeoutMs`, `context`) are accepted and ignored.
+*
+* @experimental
+*/
+function inProcessSandboxClient(options) {
+	const { onPrompt, workdir: workdirPrefix, id: idOption } = options;
+	let seq = 0;
+	return { async create(_options) {
+		const current = seq++;
+		const id = typeof idOption === "function" ? idOption(current) : idOption ?? `in-process-${current}`;
+		const boxWorkdir = workdirPrefix !== void 0 ? mkdtempSync(join(tmpdir(), `${workdirPrefix}-`)) : void 0;
+		let round = 0;
+		const fsMembers = boxWorkdir !== void 0 ? {
+			fs: {
+				async read(path) {
+					return readFile(join(boxWorkdir, path), "utf8");
+				},
+				async write(path, content) {
+					const abs = join(boxWorkdir, path);
+					await mkdir(dirname(abs), { recursive: true });
+					await writeFile(abs, content, "utf8");
+				}
+			},
+			async exec(command) {
+				const { exec: execCb } = await import("node:child_process");
+				const { promisify } = await import("node:util");
+				const execAsync = promisify(execCb);
+				try {
+					const { stdout, stderr } = await execAsync(command, {
+						cwd: boxWorkdir,
+						timeout: 3e4
+					});
+					return {
+						exitCode: 0,
+						stdout,
+						stderr
+					};
+				} catch (err) {
+					const e = err;
+					return {
+						exitCode: e.code ?? 1,
+						stdout: e.stdout ?? "",
+						stderr: e.stderr ?? e.message ?? ""
+					};
+				}
+			}
+		} : {};
+		async function* drive(behavior, message, opts) {
+			const prompt = typeof message === "string" ? message : JSON.stringify(message);
+			const { signal: optSignal, ...rest } = opts ?? {};
+			const signal = optSignal ?? new AbortController().signal;
+			const ctx = {
+				round,
+				workdir: boxWorkdir,
+				signal,
+				...Object.keys(rest).length > 0 ? { options: rest } : {}
+			};
+			round += 1;
+			const produced = await behavior(prompt, ctx);
+			if (isAsyncIterable(produced)) for await (const ev of produced) yield ev;
+			else for (const ev of produced) yield ev;
+		}
+		return {
+			id,
+			streamPrompt(message, opts) {
+				assertBoxlessPromptOptions(opts, "inProcessSandboxClient", ["backend"]);
+				return drive(onPrompt, message, opts);
+			},
+			...fsMembers,
+			async delete() {
+				if (boxWorkdir !== void 0) rmSync(boxWorkdir, {
+					recursive: true,
+					force: true
+				});
+			}
+		};
+	} };
 }
 //#endregion
 //#region src/runtime/observation-registry.ts
@@ -7223,6 +7687,180 @@ function createSqlRunContext(db) {
 	};
 }
 //#endregion
+//#region src/runtime/supervise/sql-run-context.ts
+/**
+* A cross-machine run context on the existing autocommit SqlAdapter. Reuse the same database,
+* tablePrefix and runId on every host; no runDir or shared filesystem is required.
+*
+* Each ownership generation gets fresh store capabilities. The public context can inspect SQL
+* at any time, but cannot write without acquire(). runGraph/supervise acquire and release it.
+* Retained provider execution supplies external admission/result idempotency; SQL does not turn
+* an arbitrary unkeyed network effect into an exactly-once operation.
+* @experimental
+*/
+async function createFencedSqlRunContext(db, runId, options = {}) {
+	const store = await openSqlRunStore(db, runId, options);
+	const { executors } = createInMemoryRunContext({ withDriver: options.withDriver ?? true });
+	const cold = async () => projection(await store.read());
+	const unowned = async () => {
+		throw new SqlRunOwnershipError(`SQL run '${runId}' requires an acquired lease before writing`);
+	};
+	const context = {
+		durability: "sql",
+		runId,
+		namespace: store.namespace,
+		resume: true,
+		executors,
+		journal: {
+			loadTree: async (root) => (await cold()).journal.loadTree(root),
+			beginTree: unowned,
+			appendEvent: unowned,
+			appendEvents: unowned
+		},
+		blobs: {
+			get: async (ref) => (await cold()).blobs.get(ref),
+			put: unowned
+		},
+		coordinationLog: {
+			load: async (id, owner) => (await cold()).loadCoordination(id, owner),
+			append: unowned
+		},
+		async acquire(signal) {
+			const lease = await store.acquire(signal);
+			try {
+				const failureController = new AbortController();
+				const leaseSignal = AbortSignal.any([lease.signal, failureController.signal]);
+				const view = await projection(lease.records);
+				let tail = Promise.resolve();
+				let accepting = true;
+				let failed;
+				let hasFailed = false;
+				const check = () => {
+					leaseSignal.throwIfAborted();
+					if (hasFailed) throw failed;
+				};
+				const read = async (operation) => {
+					await tail;
+					check();
+					return operation();
+				};
+				const commit = (entry) => {
+					if (!accepting) return unowned();
+					const captured = detachedSnapshot(entry, "SQL run record");
+					const write = tail.then(async () => {
+						check();
+						if (await view.apply(captured)) await lease.append(captured);
+					});
+					tail = write.catch((error) => {
+						hasFailed = true;
+						failed = error;
+						failureController.abort(error);
+					});
+					return write;
+				};
+				const bound = {
+					durability: "sql",
+					runId,
+					namespace: store.namespace,
+					resume: true,
+					executors,
+					journal: {
+						loadTree: (root) => read(() => view.journal.loadTree(root)),
+						beginTree: (root, at) => commit({
+							kind: "begin",
+							root,
+							at
+						}),
+						appendEvent: (root, event) => commit({
+							kind: "events",
+							root,
+							events: [event]
+						}),
+						appendEvents: (root, events) => commit({
+							kind: "events",
+							root,
+							events: [...events]
+						})
+					},
+					blobs: {
+						get: (ref) => read(() => view.blobs.get(ref)),
+						put: (ref, value) => commit({
+							kind: "blobs",
+							ref,
+							value
+						})
+					},
+					coordinationLog: {
+						load: (id, owner) => read(() => view.loadCoordination(id, owner)),
+						append: (id, record, ownerId) => commit({
+							kind: "coordination",
+							runId: id,
+							record,
+							...ownerId === void 0 ? {} : { ownerId }
+						})
+					}
+				};
+				return {
+					context: Object.freeze(bound),
+					signal: leaseSignal,
+					async release() {
+						accepting = false;
+						await tail;
+						await lease.release();
+					}
+				};
+			} catch (error) {
+				await lease.release().catch(() => void 0);
+				throw error;
+			}
+		}
+	};
+	return Object.freeze(context);
+}
+/** Reuse the existing journal's uniqueness/sequence rules and blob hash validation verbatim. */
+async function projection(entries) {
+	const journal = new InMemorySpawnJournal();
+	const blobs = new InMemoryResultBlobStore();
+	const beginnings = /* @__PURE__ */ new Map();
+	const coordination = [];
+	const apply = async (entry) => {
+		switch (entry.kind) {
+			case "begin": {
+				const prior = beginnings.get(entry.root);
+				await journal.beginTree(entry.root, entry.at);
+				beginnings.set(entry.root, entry.at);
+				return prior === void 0;
+			}
+			case "events":
+				for (const event of entry.events) await journal.appendEvent(entry.root, event);
+				return entry.events.length > 0;
+			case "blobs": {
+				const existing = await blobs.get(entry.ref);
+				await blobs.put(entry.ref, entry.value);
+				return existing === void 0;
+			}
+			case "coordination":
+				if (entry.record.event.type === "settled") return false;
+				coordination.push(entry);
+				return true;
+			default: throw new Error("Unknown SQL run record kind");
+		}
+	};
+	for (const entry of entries) await apply(entry);
+	return {
+		journal,
+		blobs,
+		apply,
+		loadCoordination(id, ownerId) {
+			return foldCoordinationRecords(coordination.map(({ runId, ownerId, record }) => ({
+				runId,
+				...record,
+				...ownerId === void 0 ? {} : { ownerId }
+			})), id, ownerId);
+		}
+	};
+}
+//#endregion
 //#region src/runtime/supervise/trajectory-recorder.ts
 /**
 *
@@ -8506,6 +9144,6 @@ function tail(s) {
 	return s.slice(-400);
 }
 //#endregion
-export { trajectoryReport as $, resolveMcpServerLaunch as $t, chatTransportExecutor as A, loopDispatch as At, strategyAuthorSystemPrompt as B, renderLeaderboardSvg as Bt, withUntrackedArtifacts as C, HarvestError as Ct, runCoderChecks as D, localSandboxClient as Dt, patchDelivered as E, resolveSandboxClient as Et, runStrategyEvolution as F, stopSentinel as Ft, sharedBoxRefusal as G, SqlSpawnJournal as Gt, DEFAULT_SHARED_BOX_WORKERS as H, auditIntent as Ht, selectChampion as I, leaderboard as It, openSandboxRun as J, materializeLocalMcp as Jt, sharedWorkerClientName as K, McpSpawnFault as Kt, assertStrategyContract as L, pairwiseSignificance as Lt, createChatSessionStore as M, completionAuthorizes as Mt, discriminatingMeans as N, deterministicCompletion as Nt, codeModeSupervisorTools as O, inlineSandboxClient as Ot, pickChampion as P, sentinelCompletion as Pt, equalKOnCost as Q, mcpSecretEnvMetadataKey as Qt, authorStrategy as R, renderLeaderboardHtml as Rt, copyUntrackedIntoClone as S, inProcessSandboxClient as St, createSqlRunContext as T, defineLeaderboard as Tt, ROUTER_CLIENT_HEADER as U, defaultAuditorInstruction as Ut, DEFAULT_SHARED_BOX_RESOURCES as V, renderPairwiseMarkdown as Vt, sharedBoxPlacement as W, SqlResultBlobStore as Wt, runBenchmark as X, sanitizeMcpToolSchema as Xt, printBenchmarkReport as Y, createMcpEnvironment as Yt, promotionGate as Z, envKeyProvider as Zt, NOTE_MAX_CHARS as _, buildSteerContext as _t, localShell as a, FileCorpus as at, composeWorkerEvidence as b, observationFromRegistry as bt, createVerifierEnvironment as c, fanout as ct, harvestSurfaceDiffs as d, panel as dt, resolveSecretEnv as en, definePersona as et, analystsFromRegistry as f, pipeline as ft, EVIDENCE_MAX_CHARS as g, assertTraceDerivedFindings as gt, worktreeFanout as h, widen as ht, jjWorkspace as i, registerShape as it, chatWorkerSeam as j, superviseDispatch as jt, unsafeInProcessRunner as k, loopCampaignDispatch as kt, boxSurfaceReader as l, flatWidenGate as lt, superviseSurface as m, verify as mt, makeFinding$1 as n, createTangleSandboxExactProcessProvider as nn, builtinShapes as nt, runInWorkspace as o, InMemoryCorpus as ot, failuresAnalyst as p, selectValidWinner as pt, SandboxRunAbortError as q, connectStdioMcp as qt, gitWorkspace as r, createShapeRegistry as rt, createWaterfallCollector as s, renderCorpusToInstructions as st, computeFindingId$1 as t, secretEnvOfMcpServer as tn, runPersonified as tt, fsSurfaceReader as u, loopUntil as ut, VERIFY_TAIL_CHARS as v, createScopeAnalyst as vt, analyzeTrace as w, harvestCorpus as wt, settledWorkerOut as x, runIsolatedCheck as xt, closingWorkerNote as y, registryScopeAnalyst as yt, strategyAuthorContract as z, renderLeaderboardMarkdown as zt };
+export { equalKOnCost as $, SqlResultBlobStore as $t, unsafeInProcessRunner as A, loopDispatch as At, strategyAuthorContract as B, deterministicCompletion as Bt, withUntrackedArtifacts as C, HarvestError as Ct, patchDelivered as D, localSandboxClient as Dt, createSqlRunContext as E, resolveSandboxClient as Et, pickChampion as F, declaredCheckDigest as Ft, sharedBoxPlacement as G, renderLeaderboardHtml as Gt, DEFAULT_SHARED_BOX_RESOURCES as H, stopSentinel as Ht, runStrategyEvolution as I, declaredCheckJudge as It, SandboxRunAbortError as J, renderPairwiseMarkdown as Jt, sharedBoxRefusal as K, renderLeaderboardMarkdown as Kt, selectChampion as L, readDeclaredCheck as Lt, chatWorkerSeam as M, assertDeclaredCheck as Mt, createChatSessionStore as N, checkProgramDigest as Nt, runCoderChecks as O, inlineSandboxClient as Ot, discriminatingMeans as P, declaredCheckDeliverable as Pt, promotionGate as Q, openSqlRunStore as Qt, assertStrategyContract as R, runIsolatedCheck as Rt, copyUntrackedIntoClone as S, inProcessSandboxClient as St, createFencedSqlRunContext as T, defineLeaderboard as Tt, DEFAULT_SHARED_BOX_WORKERS as U, leaderboard as Ut, strategyAuthorSystemPrompt as V, sentinelCompletion as Vt, ROUTER_CLIENT_HEADER as W, pairwiseSignificance as Wt, printBenchmarkReport as X, defaultAuditorInstruction as Xt, openSandboxRun as Y, auditIntent as Yt, runBenchmark as Z, SqlRunOwnershipError as Zt, NOTE_MAX_CHARS as _, assertTraceDerivedFindings as _t, localShell as a, sanitizeMcpToolSchema as an, registerShape as at, composeWorkerEvidence as b, registryScopeAnalyst as bt, createVerifierEnvironment as c, resolveMcpServerLaunch as cn, renderCorpusToInstructions as ct, harvestSurfaceDiffs as d, createTangleSandboxExactProcessProvider as dn, loopUntil as dt, SqlSpawnJournal as en, trajectoryReport as et, analystsFromRegistry as f, panel as ft, EVIDENCE_MAX_CHARS as g, widen as gt, worktreeFanout as h, verify as ht, jjWorkspace as i, createMcpEnvironment as in, createShapeRegistry as it, chatTransportExecutor as j, superviseDispatch as jt, codeModeSupervisorTools as k, loopCampaignDispatch as kt, boxSurfaceReader as l, resolveSecretEnv as ln, fanout as lt, superviseSurface as m, selectValidWinner as mt, makeFinding$1 as n, connectStdioMcp as nn, runPersonified as nt, runInWorkspace as o, envKeyProvider as on, FileCorpus as ot, failuresAnalyst as p, pipeline as pt, sharedWorkerClientName as q, renderLeaderboardSvg as qt, gitWorkspace as r, materializeLocalMcp as rn, builtinShapes as rt, createWaterfallCollector as s, mcpSecretEnvMetadataKey as sn, InMemoryCorpus as st, computeFindingId$1 as t, McpSpawnFault as tn, definePersona as tt, fsSurfaceReader as u, secretEnvOfMcpServer as un, flatWidenGate as ut, VERIFY_TAIL_CHARS as v, buildSteerContext as vt, analyzeTrace as w, harvestCorpus as wt, settledWorkerOut as x, observationFromRegistry as xt, closingWorkerNote as y, createScopeAnalyst as yt, authorStrategy as z, completionAuthorizes as zt };
 
-//# sourceMappingURL=runtime-DVjIH1eo.js.map
+//# sourceMappingURL=runtime-CHxXrUeZ.js.map