@tangle-network/agent-runtime 0.317.0 → 0.319.3

package/dist/{runtime-B9BOFyEp.js → runtime-6qzuLTJ7.js}

@@ -1,16 +1,17 @@
-import { $i as executableAgentSpecSnapshot, Bn as InMemoryResultBlobStore, Cn as readPromptOptions, Hn as insideCursorNamespace, It as createWorktreeCliExecutor, Jn as readCommittedJsonLines, Mr as contentAddress, Nt as createExecutor, Ot as verdictFromJudgeScore, Pt as createExecutorRegistry, Qi as executableAgentProfileSnapshot, Qn as isTraceAnalysisStore, Sn as assertBoxlessPromptOptions, Tn as runBrainLoop, Vn as InMemorySpawnJournal, Yn as writeAllBytes, _n as runAgentRounds, ea as detachedFrozen, fa as notifySandboxEventObserver, hn as defaultSelectWinner, ht as mapExecutorResult, j as settledToIteration, mt as gateOnDeliverable, pt as rollingDispatch, qn as prepareJsonlAppend, r as createSupervisor, ta as detachedSnapshot, v as withDriverExecutor, vn as createSandboxLineage, vt as CheckUnavailableError, wn as routerBrain } from "./supervisor-CbFyf48U.js";
+import { a as graphRunsFor, d as recordGraphRun, i as graphRegistry, l as lookupGraph, p as taskShapeDigest, r as graphFromStored, t as digestOfGraph } from "./graph-registry-BuJbzTzF.js";
+import { Bn as InMemoryResultBlobStore, Cn as readPromptOptions, Hn as insideCursorNamespace, It as createWorktreeCliExecutor, Jn as readCommittedJsonLines, Mr as contentAddress, Nt as createExecutor, Ot as verdictFromJudgeScore, Pt as createExecutorRegistry, Qn as isTraceAnalysisStore, Sn as assertBoxlessPromptOptions, Tn as runBrainLoop, Vn as InMemorySpawnJournal, Yn as writeAllBytes, _n as runAgentRounds, aa as detachedSnapshot, ga as notifySandboxEventObserver, hn as defaultSelectWinner, ht as mapExecutorResult, ia as detachedFrozen, j as settledToIteration, mt as gateOnDeliverable, na as executableAgentProfileSnapshot, pt as rollingDispatch, qn as prepareJsonlAppend, r as createSupervisor, ra as executableAgentSpecSnapshot, v as withDriverExecutor, vn as createSandboxLineage, vt as CheckUnavailableError, wn as routerBrain } from "./supervisor-Cqhu3xH-.js";
 import { i as ConfigError, m as ValidationError, n as AnalystError, s as PlannerError } from "./errors-DodWX-cb.js";
-import { B as runAgentic, G as observe, K as renderReport, U as ObservationError, V as sample, X as strategyAuthorMethod, a as reconcileInterruptedSearchCalls, c as searchExecutor, q as profileChatClient, r as dedicatedLane, x as runtimeShipDecision, z as refine } from "./search-executor-B5ZVFsDV.js";
-import { $ as randomSuffix, B as addSpend, H as chargedTokens, I as immutableCandidateValue, J as hasCompleteCacheBreakdown, K as errorMessage, M as canonicalCandidateDigest$1, R as sha256Bytes$1, U as cloneSpend, X as isAsyncIterable, Y as isAbortError, bt as armDeadlineTimer, ct as zeroSpend, k as markPutStreamVerified, nt as sleep, q as fnv1a32Hex, rt as stringifySafe, v as WorkspaceScanLimitError, x as captureMaterializedWorkspace } from "./workspace-streams-DkijayqX.js";
-import { c as profileModelExecutionSettings, i as concreteModelId, l as profileProviderModel, o as enforceTokenLimits, p as canonicalObservedModelParts, t as assertExecutableAgentProfile } from "./model-policy-DhvyZ8-O.js";
+import { B as runAgentic, G as observe, K as renderReport, U as ObservationError, V as sample, X as strategyAuthorMethod, a as reconcileInterruptedSearchCalls, c as searchExecutor, q as profileChatClient, r as dedicatedLane, x as runtimeShipDecision, z as refine } from "./search-executor-DlaLafvy.js";
+import { A as markPutStreamVerified, J as fnv1a32Hex, L as immutableCandidateValue, N as canonicalCandidateDigest$1, S as captureMaterializedWorkspace, U as chargedTokens, V as addSpend, W as cloneSpend, X as isAbortError, Y as hasCompleteCacheBreakdown, Z as isAsyncIterable, et as randomSuffix, it as stringifySafe, lt as zeroSpend, q as errorMessage, rt as sleep, xt as armDeadlineTimer, y as WorkspaceScanLimitError, z as sha256Bytes$1 } from "./workspace-streams-DFAhW7hF.js";
+import { c as profileModelExecutionSettings, i as concreteModelId, l as profileProviderModel, o as enforceTokenLimits, p as canonicalObservedModelParts, t as assertExecutableAgentProfile } from "./model-policy-CNe257pB.js";
 import { i as notifyRuntimeHookEvent } from "./runtime-hooks-tXpAarhW.js";
 import { i as redactProtectedValue, r as redactProtectedReason } from "./protected-redaction-DylCC_ot.js";
-import { C as createInMemoryRunContext, E as foldCoordinationRecords } from "./coordination-driver-DGhN8GO9.js";
-import { r as supervise } from "./supervise-CU6AuxWY.js";
+import { C as createInMemoryRunContext, E as foldCoordinationRecords } from "./coordination-driver-Culvomn2.js";
+import { r as supervise } from "./supervise-D4CnC-cl.js";
 import "./run-layout-DSCWdbX2.js";
-import "./provision-supervisor-BQLLrUtn.js";
-import "./delegate-B5pmSbQa.js";
-import "./graph-G0j1ysqe.js";
+import "./provision-supervisor-DiZTjzdp.js";
+import "./delegate-CpMbpiIR.js";
+import "./graph-DnfSGUM8.js";
 import { agentProfileSchema, canonicalAgentProfileDigest, canonicalCandidateDigest, sha256Bytes, validateAgentProfileSecurity } from "@tangle-network/agent-interface";
 import { CODING_HARNESSES, DEFAULT_TRACE_ANALYST_KINDS, InMemoryTraceStore, OUTPUT_VALUE, benjaminiHochberg, buildTrajectory, computeFindingId as computeFindingId$1, confidenceInterval, createTraceAnalyst, expandProfileAxes, makeFinding as makeFinding$1, pairedBootstrap, paretoFrontier, wilcoxonSignedRank, wilson } from "@tangle-network/agent-eval";
 import { createAgentRunOutcomeTracker } from "@tangle-network/sandbox/runtime";
@@ -29,7 +30,6 @@ import { defineEvaluationClaim, summarizeEvaluationUnits } from "@tangle-network
 import { createInterface } from "node:readline";
 import { pathToFileURL } from "node:url";
 import { gzipSync } from "node:zlib";
-import { createContext, runInContext } from "node:vm";
 import { stuckLoopView, toolWasteView } from "@tangle-network/agent-eval/pipelines";
 //#region src/runtime/tangle-sandbox-exact-process-provider.ts
 const exactProcessProviderMarker = "agent-runtime.exact-process-provider";
@@ -393,6 +393,165 @@ async function afterAbortCheck(signal, operation) {
 	return result;
 }
 //#endregion
+//#region src/runtime/http-mcp-client.ts
+/**
+* `connectHttpMcp` — the remote (streamable HTTP) MCP client, sibling of
+* `connectStdioMcp`. Same connection contract (`tools`, `callTool`, `close`),
+* same error semantics (a JSON-RPC error / `isError` result is the agent's
+* `ERROR: …` outcome; a transport fault or timeout throws), no child process —
+* which is the point: this is the MCP path for environments that cannot spawn
+* stdio servers (Workers, browser-context agents, locked-down sandboxes) and
+* for servers that only exist as endpoints (a remote Hindsight, a hosted MCP).
+*
+* Transport: MCP "streamable HTTP" (protocol 2025-03-26 / 2025-06-18). Every
+* request is a POST with `Accept: application/json, text/event-stream`; the
+* server may answer either shape, so both are parsed. A server-assigned
+* `Mcp-Session-Id` response header is captured and replayed on every later
+* request (and the DELETE on close) — stateful servers refuse without it,
+* stateless ones simply never send it.
+*
+* Auth headers can be protected values: they are sent to the server but never
+* allowed back out — error messages and tool results are redacted against the
+* exact protected values, mirroring `connectStdioMcp`'s protectedEnv handling.
+*/
+const HTTP_MCP_PROTOCOL_VERSION = "2025-06-18";
+/** A remote MCP endpoint refused the connection before the handshake completed. */
+var McpConnectFault = class extends Error {
+	status;
+	constructor(message, status) {
+		super(message);
+		this.status = status;
+		this.name = "McpConnectFault";
+	}
+};
+const SSE_DATA_LINE = /^data:\s?(.*)$/s;
+function parseSseBody(body, wantId) {
+	for (const chunk of body.split(/\r?\n\r?\n/)) for (const line of chunk.split(/\r?\n/)) {
+		const match = SSE_DATA_LINE.exec(line);
+		if (!match) continue;
+		try {
+			const parsed = JSON.parse(match[1] ?? "");
+			if (parsed.id === wantId) return parsed;
+		} catch {}
+	}
+}
+function redactValuesFrom(text, values) {
+	let out = text;
+	for (const value of values) if (value.length > 0) out = out.split(value).join("[redacted]");
+	return out;
+}
+/** Connect to a remote MCP endpoint: initialize, list tools, return the live connection. */
+async function connectHttpMcp(spec) {
+	let endpoint;
+	try {
+		endpoint = new URL(spec.url);
+	} catch {
+		throw new ValidationError(`connectHttpMcp: invalid MCP endpoint URL: ${spec.url}`);
+	}
+	if (endpoint.protocol !== "https:" && endpoint.hostname !== "localhost" && endpoint.hostname !== "127.0.0.1") throw new ValidationError(`connectHttpMcp: refusing non-HTTPS MCP endpoint ${endpoint.origin} (localhost excepted) — a bearer or api key on plain HTTP would cross the network in the clear`);
+	const fetchImpl = spec.fetchImpl ?? fetch;
+	const timeoutMs = spec.timeoutMs ?? 3e4;
+	const protectedValues = Object.values(spec.protectedHeaders ?? {});
+	const redact = (text) => redactValuesFrom(text, protectedValues);
+	let sessionId;
+	let nextId = 1;
+	let closed = false;
+	const post = async (path, body, method = "POST") => fetchImpl(`${endpoint.origin}${endpoint.pathname}${endpoint.search}${path}`, {
+		method,
+		headers: {
+			accept: "application/json, text/event-stream",
+			...body !== void 0 ? { "content-type": "application/json" } : {},
+			...sessionId !== void 0 ? { "mcp-session-id": sessionId } : {},
+			...body !== void 0 ? { "x-request-id": String(nextId) } : {},
+			...spec.headers ?? {},
+			...spec.protectedHeaders ?? {}
+		},
+		...body !== void 0 ? { body: JSON.stringify(body) } : {}
+	});
+	const request = async (method, params) => {
+		if (closed) throw new Error("HTTP MCP connection closed");
+		const id = nextId++;
+		const controller = new AbortController();
+		const timer = setTimeout(() => controller.abort(), timeoutMs);
+		try {
+			const res = await post("", {
+				jsonrpc: "2.0",
+				id,
+				method,
+				params
+			}, "POST");
+			const sessionHeader = res.headers.get("mcp-session-id");
+			if (sessionHeader) sessionId = sessionHeader;
+			if (!res.ok) {
+				const text = redact((await res.text()).slice(0, 500));
+				throw new McpConnectFault(`HTTP MCP ${method} failed (${res.status} ${res.statusText}): ${text}`, res.status);
+			}
+			if ((res.headers.get("content-type") ?? "").includes("text/event-stream")) {
+				const parsed = parseSseBody(await res.text(), id);
+				if (!parsed) throw new Error(`HTTP MCP ${method}: SSE response carried no JSON-RPC message for request ${id}`);
+				return parsed;
+			}
+			return JSON.parse(await res.text());
+		} catch (error) {
+			if (error instanceof McpConnectFault) throw error;
+			const reason = error instanceof Error ? error.message : String(error);
+			throw new Error(redact(`HTTP MCP ${method} transport failed: ${reason}`));
+		} finally {
+			clearTimeout(timer);
+		}
+	};
+	`${endpoint.origin}${endpoint.pathname}${timeoutMs}`;
+	try {
+		const init = await request("initialize", {
+			protocolVersion: HTTP_MCP_PROTOCOL_VERSION,
+			capabilities: {},
+			clientInfo: {
+				name: "agent-runtime-http-mcp",
+				version: "0"
+			}
+		});
+		if (init.error) throw new McpConnectFault(redact(`initialize errored: ${JSON.stringify(init.error)}`), void 0);
+		await post("", {
+			jsonrpc: "2.0",
+			method: "notifications/initialized"
+		}, "POST").catch(() => void 0);
+		const list = await request("tools/list", void 0);
+		if (list.error) throw new Error(redact(`tools/list errored: ${JSON.stringify(list.error)}`));
+		const rawTools = list.result?.tools;
+		if (!Array.isArray(rawTools)) throw new Error("tools/list result has no tools array");
+		const tools = JSON.parse(redact(JSON.stringify(rawTools)));
+		const callTool = async (name, args) => {
+			const res = await request("tools/call", {
+				name,
+				arguments: args
+			});
+			if (res.error) return `ERROR: ${redact(JSON.stringify(res.error)).slice(0, 300)}`;
+			const result = res.result;
+			const chunks = result?.content?.map((c) => c.text ?? "");
+			const joined = chunks?.join("\n") ?? JSON.stringify(result ?? null);
+			const collapsed = chunks?.join("");
+			let text = joined;
+			if (collapsed !== void 0) {
+				const collapsedRedacted = redact(collapsed);
+				if (collapsedRedacted !== collapsed) text = collapsedRedacted;
+			}
+			return redact(result?.isError ? `ERROR: ${text}` : text);
+		};
+		const close = async () => {
+			if (closed) return;
+			closed = true;
+			await post("", void 0, "DELETE").catch(() => void 0);
+		};
+		return {
+			tools,
+			callTool,
+			close
+		};
+	} catch (error) {
+		throw error instanceof Error ? error : new Error(String(error));
+	}
+}
+//#endregion
 //#region src/runtime/key-provider.ts
 /** The env-backed provider: reads the (dotenvx-loaded) process env. Empty /
 *  whitespace-only values count as absent — fail loud, not with a blank key. */
@@ -404,12 +563,23 @@ function envKeyProvider(env = process.env) {
 }
 /** The `AgentProfileMcpServer.metadata` key the declarative secret-env map
 *  rides under: `{ ENV_VAR_NAME: 'PROVIDER_KEY_NAME' }`. Names only — values
-*  are resolved at materialize time and never stored. */
+*  are resolved at materialize time and never stored.
+*
+*  DEPRECATED (2026-10-12): this is the interface <0.40 channel. Author
+*  `profile.mcp[key].env.ENV_VAR_NAME = { kind: 'secret-ref', key }` instead —
+*  the canonical form since 0.40. The legacy map keeps resolving (profiles
+*  are data in the wild and must not break at boot) but every use now warns
+*  once per server; removal lands at the next interface major. */
 const mcpSecretEnvMetadataKey = "secretEnv";
+const warnedSecretEnv = /* @__PURE__ */ new Set();
 /** Read (and validate) a server entry's declared secret-env map, if any.
 *  Malformed metadata throws — a half-declared secret must never half-boot. */
-function secretEnvOfMcpServer(server) {
+function secretEnvOfMcpServer(server, label = "profile.mcp server") {
 	const raw = server.metadata?.[mcpSecretEnvMetadataKey];
+	if (raw !== void 0 && !warnedSecretEnv.has(label)) {
+		warnedSecretEnv.add(label);
+		console.warn(`${label}: metadata.${mcpSecretEnvMetadataKey} is deprecated — author env secret-refs (profile.mcp[key].env.ENV = { kind: 'secret-ref', key }) instead; support is removed at the next interface major`);
+	}
 	if (raw === void 0 || raw === null) return void 0;
 	if (typeof raw !== "object" || Array.isArray(raw)) throw new ValidationError(`secretEnvOfMcpServer: metadata.${mcpSecretEnvMetadataKey} must be an object mapping env var name -> key name`);
 	const entries = Object.entries(raw);
@@ -793,6 +963,34 @@ async function connectStdioMcp(spec) {
 * child and expose its tools under `<server>__<tool>` names. The default policy
 * refuses local processes. A profile with no MCP surface returns zero tools.
 */
+/** Resolve a remote server's `url` + `headers` profile config values into the
+*  plain strings + protected headers an HTTP connection needs. Same fail-closed
+*  contract as `resolveMcpServerLaunch`: no KeyProvider for a declared secret, or
+*  a missing key, aborts the materialization naming the KEY only. */
+async function resolveRemoteMcpHeaders(server, keys, label) {
+	if (typeof server.url !== "string" || server.url.trim().length === 0) throw new ValidationError(`${label}: a remote (http/sse) server requires url`);
+	const headers = {};
+	const protectedHeaders = {};
+	for (const [name, value] of Object.entries(server.headers ?? {})) if (value.kind === "public") headers[name] = value.value ?? "";
+	else {
+		if (!keys) throw new ValidationError(`${label}: header ${name} is a secret-ref but no KeyProvider was supplied — refusing to connect a remote server with unresolvable auth`);
+		const secret = await keys.get(value.key ?? "");
+		if (secret === void 0) throw new ValidationError(`${label}: the KeyProvider holds no value for '${value.key}' (wanted for header ${name}) — provision the key or drop the header`);
+		protectedHeaders[name] = value.format === "bearer" ? `Bearer ${secret}` : secret;
+	}
+	return {
+		url: server.url,
+		...Object.keys(headers).length > 0 ? { headers } : {},
+		...Object.keys(protectedHeaders).length > 0 ? { protectedHeaders } : {}
+	};
+}
+/**
+* Spawn every enabled stdio server in `profile.mcp` and expose their tools as
+* `<server>__<tool>` behind one route and close facade.
+*
+* Fails closed: a declared server that cannot boot throws, so a profile is never
+* scored as if it had no MCP surface.
+*/
 async function materializeLocalMcp(profile, opts = {}) {
 	const security = validateAgentProfileSecurity(profile, opts.profileSecurityPolicy);
 	if (!security.ok) throw new ValidationError(`materializeLocalMcp: profile host execution refused: ${security.issues.filter((issue) => issue.level === "error").map((issue) => issue.message).join("; ")}`);
@@ -807,7 +1005,35 @@ async function materializeLocalMcp(profile, opts = {}) {
 		for (const [key, server] of Object.entries(profile.mcp ?? {})) {
 			if (server.enabled === false) continue;
 			const transport = server.transport ?? "stdio";
-			if (transport !== "stdio") throw new ValidationError(`materializeLocalMcp: profile.mcp['${key}'] has transport '${transport}' — the same-host client only spawns stdio servers; a remote (http/sse) server needs an http MCP client (not yet built here) or the sandbox backend. Failing loud: scoring this profile without its declared server would fake the with/without ablation`);
+			if (transport === "http" || transport === "sse") {
+				const { url, headers, protectedHeaders } = await resolveRemoteMcpHeaders(server, opts.keys, `materializeLocalMcp: profile.mcp['${key}']`);
+				const conn = await connectHttpMcp({
+					url,
+					...headers !== void 0 ? { headers } : {},
+					...protectedHeaders !== void 0 ? { protectedHeaders } : {},
+					...opts.timeoutMs !== void 0 ? { timeoutMs: opts.timeoutMs } : {}
+				});
+				connections.push(conn);
+				const prefix = key.replace(/[^a-zA-Z0-9_-]/g, "_");
+				for (const t of conn.tools) {
+					const name = `${prefix}__${t.name.replace(/[^a-zA-Z0-9_-]/g, "_")}`;
+					if (routes.has(name)) throw new ValidationError(`materializeLocalMcp: namespaced tool '${name}' collides across servers — rename the profile.mcp keys`);
+					routes.set(name, {
+						conn,
+						tool: t.name
+					});
+					tools.push({
+						type: "function",
+						function: {
+							name,
+							description: (t.description ?? "").slice(0, 1e3),
+							parameters: sanitizeMcpToolSchema(t.inputSchema)
+						}
+					});
+				}
+				continue;
+			}
+			if (transport !== "stdio") throw new ValidationError(`materializeLocalMcp: profile.mcp['${key}'] has unsupported transport '${transport}'`);
 			if (!server.command || server.command.trim().length === 0) throw new ValidationError(`materializeLocalMcp: profile.mcp['${key}'] declares a stdio server with no command`);
 			const launch = await resolveMcpServerLaunch(server, opts.keys, `materializeLocalMcp: profile.mcp['${key}']`);
 			const conn = await connectStdioMcp({
@@ -2745,6 +2971,8 @@ function localSandboxClient(opts) {
 				const r = await runBrainLoop({
 					chat,
 					tools: mcp.tools,
+					...opts.codeMode ? { codeMode: opts.codeMode } : {},
+					...popts?.signal ? { signal: popts.signal } : {},
 					execute: (name, args) => mcp.call(name, args),
 					initialMessages: [...system ? [{
 						role: "system",
@@ -2760,7 +2988,7 @@ function localSandboxClient(opts) {
 					type: "llm_call",
 					data: {
 						model,
-						tools: mcp.tools.map((t) => t.function.name),
+						tools: r.modelToolNames ?? mcp.tools.map((t) => t.function.name),
 						...r.tokensKnown === false ? { tokensKnown: false } : {
 							tokensIn: r.usage.input,
 							tokensOut: r.usage.output
@@ -5953,9 +6181,8 @@ function hashText(value) {
 /**
 * The ONE lint over model-authored source.
 *
-* Two features have a model write code the runtime then runs: `authorStrategy` (an authored
-* optimization strategy, since 0.60) and code mode's `execute` (a program over the coordination
-* verbs). Both need the same refusals; this module is the single copy both import.
+* Authored optimization strategies use this static contract lint. General Runtime code-mode
+* scripts execute in the isolated QuickJS/WASM engine instead of relying on source lint.
 *
 * A LINT, NOT A SANDBOX — it reads text and cannot constrain what running code does, and trivial
 * concatenation defeats any token match. Its only job is refusing the obvious escapes so a typo or
@@ -6901,276 +7128,183 @@ function chatWorkerSeam(opts) {
 	};
 }
 //#endregion
-//#region src/runtime/supervise/code-mode.ts
+//#region src/runtime/supervise/designer-tools.ts
 /**
-* Code mode — the pattern Cloudflare ("Code Mode") and Anthropic ("code execution with MCP")
-* define, over this runtime's coordination verbs: generate a typed API from the tools' schemas,
-* expose exactly two tools (`search`, `execute`), and run model-written code whose only intended
-* capability is the API bindings. One model turn where the tool-calling loop pays one round trip
-* per call; intermediates live in the program, not the context window.
+* `graphDesignerExtraTools` — the designer's toolset on the existing
+* `RunGraphOptions.extraTools` seam.
 *
-* WHAT THIS RUNTIME OWNS AND THE SOURCES' CENTRAL PROPERTY — read this before choosing a runner.
-* The sources isolate execution in a REAL boundary: Cloudflare runs the code in a V8 isolate with
-* a separate heap; Anthropic runs it out of process. That is not a detail — it is the whole reason
-* "let the model write code" is safe. This runtime does NOT ship an isolate, so `execute`'s
-* execution boundary is a SEAM you must fill: `codeModeSupervisorTools(runner)` REQUIRES a
-* `CodeModeRunner`, and there is no default. For untrusted model output, supply a jailed runner
-* (a sub-sandbox, a worker isolate). {@link unsafeInProcessRunner} is provided for TRUSTED output
-* only — your own eval harness, an offline test, a model you control — and is named for what it is:
-* `node:vm` shares the host realm, so host code is reachable from inside it and it is not a
-* security boundary. Choosing it for a hostile model is remote code execution, by construction.
+* A meta-graph designer is an ordinary supervisor ROOT whose ONLY tools are
+* these three: look up what this task shape has run, run a graph (authored or
+* replayed — every run recorded, terminal accounting included), and read the
+* history. The agent authors graphs as DATA (nodes, edges, budget, deliverable
+* description); execution is ENVIRONMENT-OWNED — the caller closes over how
+* graphs run (backend/brain/leaf seam) and how the deliverable's check is
+* re-bound, because oracles are environment, never agent-supplied.
 *
-* WHAT IS GENUINELY THIS RUNTIME'S CONTRIBUTION, and survives audit: every call the program makes
-* crosses the IDENTICAL kernel path an MCP verb crosses. Bindings dispatch through `context.verbs`
-* → the live coordination descriptor's own handler → authorization, the conserved pool, the
-* journal ("there is no second spawn path"). The model authors a workflow as code at runtime and
-* the kernel still meters and records every edge of it — a dynamic workflow system, not a bypass.
-* Verb RESULTS are detached (JSON round-trip) before they re-enter the program, so in-code calls
-* cannot mutate live coordination state the MCP transport would have copied.
-*
-* WHAT STAYS THE MODEL'S: `submit_result`, `stop`, `ask_parent` are never in the API — a program
-* that could settle the run would be a second brain. `search` names them and says why. Code does
-* the mechanics; the model keeps the judgment, the same split the sources draw.
-*
-* THE GRANT CANNOT DRIFT FROM THE DOCS: `search` renders from `context.coordinationTools()`, the
-* same descriptor objects the verbs are served from — never prose written beside them.
+* This is the `measure_rung` pattern from the graph contract generalized: the
+* root's profile declares the tools; the graph options supply them; nothing
+* new exists below this line but the registry calls themselves.
 */
-/** The coordination verbs callable in code, and the `context.verbs` member each maps to. */
-const CODE_CALLABLE_VERBS = {
-	spawn_worker: "spawnAgent",
-	await_settlement: "awaitSettlement",
-	steer_agent: "steerAgent",
-	observe_agent: "observeAgent",
-	list_questions: "listQuestions",
-	answer_question: "answerQuestion",
-	run_analyst: "runAnalyst",
-	read_journal: "readJournal",
-	define_analyst: "defineAnalyst"
+const taskShapeSchema = {
+	type: "object",
+	description: "Stable descriptor of this class of work (kind, source, constraints) — the lookup key. Not the payload.",
+	additionalProperties: true
 };
-/** A program that spawns may join what it spawned. Not an MCP tool: a manager waits by ending its
-*  turn, and only code inside one call needs to wait in place. */
-const AWAIT_SETTLEMENT_FACE = Object.freeze({
-	name: "await_settlement",
-	description: "Wait until at least one of the named workers has settled; returns { settled: [ids] }. Read each output with observe_agent. Takes nothing from your inbox, so you still hear of each settlement when you are woken.",
-	inputSchema: {
-		type: "object",
-		properties: { workerIds: {
-			type: "array",
-			items: { type: "string" }
-		} },
-		required: ["workerIds"]
-	}
-});
-/** The manager's own lifecycle verbs — never callable from code; `search` names them and why. */
-const LIFECYCLE_VERBS = [
-	"submit_result",
-	"stop",
-	"ask_parent"
-];
-/** Render a JSON Schema as TypeScript type text. Bounded and structural: enough for tool input
-*  schemas (objects, enums, arrays, unions); anything unrecognized renders `unknown`, never a
-*  guess. Module-level (not root) export: consumed by `renderCodeModeApi` and its tests only. */
-function renderJsonSchemaType(schema, depth = 0) {
-	if (depth > 6 || typeof schema !== "object" || schema === null) return "unknown";
-	const node = schema;
-	if (node.const !== void 0) return JSON.stringify(node.const);
-	if (Array.isArray(node.enum)) return node.enum.map((value) => JSON.stringify(value)).join(" | ");
-	const variants = node.anyOf ?? node.oneOf;
-	if (Array.isArray(variants)) return variants.map((variant) => renderJsonSchemaType(variant, depth + 1)).join(" | ");
-	const type = Array.isArray(node.type) ? node.type : [node.type];
-	if (type.includes("object") || node.type === void 0 && node.properties !== void 0) {
-		const properties = node.properties ?? {};
-		const required = new Set(Array.isArray(node.required) ? node.required : []);
-		const fields = Object.entries(properties).map(([name, property]) => {
-			const doc = describeSchema(property);
-			const optional = required.has(name) ? "" : "?";
-			return `${doc}${JSON.stringify(name).slice(1, -1)}${optional}: ${renderJsonSchemaType(property, depth + 1)}`;
-		});
-		if (fields.length === 0) return "Record<string, unknown>";
-		const indent = "  ".repeat(depth + 1);
-		return `{\n${fields.map((field) => `${indent}${field}`).join("\n")}\n${"  ".repeat(depth)}}`;
-	}
-	if (type.includes("array")) return `Array<${renderJsonSchemaType(node.items, depth + 1)}>`;
-	const primitives = type.map((entry) => entry === "integer" ? "number" : typeof entry === "string" ? entry : void 0).filter((entry) => entry === "string" || entry === "number" || entry === "boolean" || entry === "null");
-	return primitives.length > 0 ? primitives.join(" | ") : "unknown";
-}
-function describeSchema(schema) {
-	const description = typeof schema === "object" && schema !== null ? schema.description : void 0;
-	if (typeof description !== "string" || description.length === 0) return "";
-	const first = description.split("\n")[0] ?? "";
-	return `/** ${first.length > 140 ? `${first.slice(0, 140)}…` : first} */ `;
-}
-/** Render the callable API from tool faces — `declare function` per tool, doc from its own
-*  description. This is the text `search` answers; generated, never hand-written. Module-level
-*  export for tests. */
-function renderCodeModeApi(tools, query) {
-	const needle = query?.trim().toLowerCase();
-	const blocks = tools.filter((tool) => !needle || tool.name.toLowerCase().includes(needle) || (tool.description ?? "").toLowerCase().includes(needle)).map((tool) => {
-		const doc = (tool.description ?? "").split("\n")[0] ?? "";
-		const args = tool.inputSchema === void 0 ? "unknown" : renderJsonSchemaType(tool.inputSchema);
-		return `/** ${doc} */\ndeclare function ${tool.name}(args: ${args}): Promise<unknown>`;
-	});
-	const header = [
-		"// Call these as `api.<name>(args)` from code passed to `execute`.",
-		"// Results are the same JSON the tools return. Intermediates stay in your program;",
-		"// return only what the next decision needs.",
-		`// NOT callable from code: ${LIFECYCLE_VERBS.join(", ")} — those are your own tools,`,
-		"// because a program that could settle the run would be a second brain."
-	].join("\n");
-	if (blocks.length === 0) return `${header}\n\n// No API member matches ${JSON.stringify(query ?? "")}. Call search with no query for the full API.`;
-	return `${header}\n\n${blocks.join("\n\n")}`;
+const graphDataSchema = {
+	type: "object",
+	description: "A graph as data: { nodes: [{id, profile}], edges: [{kind, from, to, directive, ...}], budget, deliverable: {describe} }. No check function — the environment binds it.",
+	additionalProperties: true
+};
+function asRecord(value, context) {
+	if (typeof value !== "object" || value === null || Array.isArray(value)) throw new ValidationError(`${context}: expected an object`);
+	return value;
 }
-/**
-* An in-process runner for TRUSTED model output ONLY. NOT a security boundary.
-*
-* It runs the program in a `node:vm` context whose globals are the bindings (`api`) and a
-* capturing `console`, with code generation disabled and inherited properties stripped. Those are
-* capability discipline, not containment: `node:vm` shares the host realm, and a host function's
-* `.constructor` is the host `Function`, so code that WANTS out can get out
-* (`api.<binding>.constructor('return process')()`). Use this for your own eval harness, offline
-* tests, or a model you trust; for untrusted output supply a jailed `CodeModeRunner` instead.
-*/
-function unsafeInProcessRunner() {
-	return { async run({ code, bindings, signal }) {
-		const logs = [];
-		const capture = (level) => (...args) => {
-			const line = args.map((value) => typeof value === "string" ? value : safeJson(value)).join(" ");
-			if (logs.length < 200) logs.push(level === "log" ? line : `[${level}] ${line}`);
-		};
-		const target = Object.create(null);
-		for (const [name, fn] of Object.entries(bindings)) target[name] = fn;
-		const sandbox = Object.create(null);
-		sandbox.api = new Proxy(Object.freeze(target), { get(owned, member) {
-			if (typeof member !== "string") return void 0;
-			if (Object.hasOwn(owned, member)) return owned[member];
-			throw new ValidationError(LIFECYCLE_VERBS.includes(member) ? `code mode: api.${member} is not callable from code — it is the manager's own lifecycle verb; return from your program and call it as a tool` : `code mode: api.${member} is not in the granted API — call search to see what is`);
-		} });
-		sandbox.console = Object.freeze({
-			log: capture("log"),
-			warn: capture("warn"),
-			error: capture("error")
-		});
-		const context = createContext(sandbox, { codeGeneration: {
-			strings: false,
-			wasm: false
-		} });
-		const program = runInContext(`(async () => {\n${code}\n})()`, context);
-		const aborted = new Promise((_resolve, reject) => {
-			if (signal.aborted) reject(abortReason(signal));
-			else signal.addEventListener("abort", () => reject(abortReason(signal)), { once: true });
+/** The designer's three tools over one registry. Record-every-run is enforced
+*  by construction: running IS recording. */
+function graphDesignerExtraTools(env) {
+	const registry = graphRegistry(env.registryDir);
+	let runCounter = 0;
+	const runId = env.nextRunId ?? (() => `designer-${++runCounter}`);
+	const runAndRecord = async (taskShape, graph, mode) => {
+		const digest = digestOfGraph(graph);
+		const startedAt = (/* @__PURE__ */ new Date()).toISOString();
+		const result = await env.runGraph(graph);
+		const winner = result.result.kind === "winner";
+		const spent = winner ? result.result.spentTotal : void 0;
+		await recordGraphRun(registry, graph, {
+			graphDigest: digest,
+			taskDigest: taskShapeDigest(taskShape),
+			startedAt,
+			finishedAt: (/* @__PURE__ */ new Date()).toISOString(),
+			outcome: winner ? { kind: "delivered" } : {
+				kind: "no-winner",
+				reason: `mode=${mode} result=${result.result.kind}`
+			},
+			cost: {
+				...spent?.iterations !== void 0 ? { iterations: spent.iterations } : {},
+				...spent?.tokens && typeof spent.tokens === "object" && "input" in spent.tokens ? { tokens: (spent.tokens.input ?? 0) + (spent.tokens.output ?? 0) } : {},
+				...spent?.usd !== void 0 ? { usd: spent.usd } : {}
+			},
+			traversals: result.ledger.length,
+			...result.exhaustedEdges.length > 0 ? { exhaustedEdges: result.exhaustedEdges } : {}
 		});
 		return {
-			result: await Promise.race([program, aborted]) ?? null,
-			logs
+			runId: runId(),
+			outcome: winner ? "delivered" : `no-winner (${result.result.kind})`,
+			graphDigest: digest,
+			traversals: result.ledger.length,
+			...spent?.iterations !== void 0 ? { iterations: spent.iterations } : {},
+			...spent?.tokens && typeof spent.tokens === "object" && "input" in spent.tokens ? { tokens: (spent.tokens.input ?? 0) + (spent.tokens.output ?? 0) } : {}
 		};
-	} };
-}
-function abortReason(signal) {
-	const reason = signal.reason;
-	return reason instanceof Error ? reason : new ValidationError("code mode: program aborted");
-}
-function safeJson(value) {
-	try {
-		return JSON.stringify(value) ?? String(value);
-	} catch {
-		return String(value);
-	}
-}
-/** Detach a verb result before it re-enters the program — the deep copy the MCP transport makes,
-*  so in-code calls cannot mutate live coordination state. Matches the MCP path exactly (both
-*  JSON round-trip); a non-serializable result degrades to a marker rather than leaking a live
-*  reference. */
-function detach(value) {
-	if (value === void 0) return void 0;
-	try {
-		return JSON.parse(JSON.stringify(value));
-	} catch {
-		return { nonSerializable: true };
-	}
-}
-/**
-* Put a supervisor in code mode: its product tool surface becomes exactly `search` and `execute`.
-*
-* `runner` is REQUIRED and has no default — this runtime ships no isolate, so the execution
-* boundary is the caller's explicit choice (see the module doc). Use {@link unsafeInProcessRunner}
-* for trusted output; a jailed runner for untrusted models.
-*
-* Pass the result as `SuperviseOptions.resolveSupervisorTools` (which `runGraph` forwards to its
-* root supervisor). The graph engine's `supervisorKind` does not accept it yet, so a graph
-* supervisor node cannot be put in code mode through node config today.
-*/
-function codeModeSupervisorTools(runner, options = {}) {
-	if (runner === void 0 || typeof runner.run !== "function") throw new ValidationError("codeModeSupervisorTools: a CodeModeRunner is required (no default) — pass unsafeInProcessRunner() for trusted output, or a jailed runner for untrusted models");
-	const timeoutMs = options.timeoutMs ?? null;
-	if (timeoutMs !== null && (!Number.isSafeInteger(timeoutMs) || timeoutMs <= 0)) throw new ValidationError("codeModeSupervisorTools: timeoutMs must be a positive safe integer or null");
-	const faces = (context) => {
-		const granted = context.coordinationTools().filter((tool) => CODE_CALLABLE_VERBS[tool.name] !== void 0);
-		return granted.some((tool) => tool.name === "spawn_worker") ? [...granted, AWAIT_SETTLEMENT_FACE] : granted;
-	};
-	return () => [{
-		name: "search",
-		description: "Search the callable API. Returns TypeScript declarations for the operations your code may call, generated from the live grant. Optional `query` filters by name or description; omit it for the full API.",
-		inputSchema: {
-			type: "object",
-			properties: { query: {
-				type: "string",
-				description: "Substring filter over names and descriptions."
-			} }
-		},
-		handler: async (raw, context) => {
-			const query = typeof raw === "object" && raw !== null ? raw.query : void 0;
-			return renderCodeModeApi(faces(context), typeof query === "string" ? query : void 0);
-		}
-	}, {
-		name: "execute",
-		description: "Run JavaScript against the API from `search`. Write the BODY of an async function: call `api.<name>(args)` (await each call), use loops and Promise.all for fan-out, keep intermediates in variables, `return` only what the next decision needs. `console.log` lines come back beside the result. No imports, no network, no filesystem — the API is the intended capability.",
-		inputSchema: {
-			type: "object",
-			properties: { code: {
-				type: "string",
-				description: "The async function body to run."
-			} },
-			required: ["code"]
-		},
-		handler: async (raw, context) => {
-			const code = typeof raw === "object" && raw !== null ? raw.code : void 0;
-			if (typeof code !== "string" || code.trim().length === 0) throw new ValidationError("code mode: execute needs { code: string }");
-			assertAuthoredCode(code, { context: `code mode (${context.nodeId})` });
-			const execution = new AbortController();
-			let timedOut = false;
-			const onScopeAbort = () => execution.abort(abortReason(context.signal));
-			const clearTimer = timeoutMs === null ? void 0 : armDeadlineTimer(timeoutMs, () => {
-				if (!execution.signal.aborted) {
-					timedOut = true;
-					execution.abort(new ValidationError(`code mode: program timed out after ${timeoutMs}ms`));
+	};
+	const summarize = (row) => ({
+		graphDigest: row.graphDigest.slice(0, 12),
+		outcome: row.outcome.kind,
+		cost: row.cost,
+		finishedAt: row.finishedAt
+	});
+	return {
+		extraTools: [
+			{
+				name: "designer_lookup_graph",
+				description: "Look up what this task shape has run before. Returns replay (a known-good graph — run it verbatim with designer_run_graph, near-zero inference) or author (with the reason), plus the recent history for context.",
+				parameters: {
+					type: "object",
+					properties: { taskShape: taskShapeSchema },
+					required: ["taskShape"],
+					additionalProperties: false
+				}
+			},
+			{
+				name: "designer_run_graph",
+				description: "Run a graph and record it. REPLAY mode: pass the graphDigest from lookup — the stored graph runs verbatim, check re-bound by the environment. AUTHOR mode: pass the graph as data (no check). Every run is recorded with its terminal accounting; the registry is the memory.",
+				parameters: {
+					type: "object",
+					properties: {
+						taskShape: taskShapeSchema,
+						mode: {
+							type: "string",
+							enum: ["replay", "authored"]
+						},
+						graphDigest: {
+							type: "string",
+							description: "Replay mode: the digest lookup returned."
+						},
+						graph: graphDataSchema,
+						mutationNote: {
+							type: "string",
+							description: "Author mode after a failed replay lineage: what the prior record says went wrong and the ONE axis this graph changes."
+						}
+					},
+					required: ["taskShape", "mode"],
+					additionalProperties: false
+				}
+			},
+			{
+				name: "designer_history",
+				description: "Every recorded run for a task shape (or all shapes): graph digest, outcome, cost, finish time. The evidence for improvement decisions.",
+				parameters: {
+					type: "object",
+					properties: { taskShape: taskShapeSchema },
+					additionalProperties: false
 				}
-			}, true);
-			if (context.signal.aborted) execution.abort(abortReason(context.signal));
-			else context.signal.addEventListener("abort", onScopeAbort, { once: true });
-			const bindings = {};
-			for (const face of faces(context)) {
-				const member = CODE_CALLABLE_VERBS[face.name];
-				if (member === void 0) continue;
-				bindings[face.name] = async (args) => {
-					if (execution.signal.aborted) {
-						if (!timedOut) throw abortReason(execution.signal);
-						throw new ValidationError(`code mode: the execute deadline passed; api.${face.name} is refused so no work outlives the call`);
-					}
-					return detach(await context.verbs[member](args));
-				};
-			}
-			try {
-				return await runner.run({
-					code,
-					bindings,
-					signal: execution.signal
-				});
-			} finally {
-				clearTimer?.();
-				context.signal.removeEventListener("abort", onScopeAbort);
 			}
+		],
+		executeExtraTool: (name, raw) => {
+			if (name === "designer_lookup_graph") return (async () => {
+				return lookupGraphSyncish(asRecord(asRecord(raw, "designer_lookup_graph").taskShape, "designer_lookup_graph.taskShape"));
+			})();
+			if (name === "designer_history") return (async () => {
+				const args = asRecord(raw ?? {}, "designer_history");
+				const { listGraphRuns } = await import("./graph-registry-BuJbzTzF.js").then((n) => n.o);
+				const all = await listGraphRuns(registry);
+				return { runs: (args.taskShape === void 0 ? all : all.filter((row) => row.taskDigest === taskShapeDigest(asRecord(args.taskShape, "designer_history.taskShape")))).map(summarize) };
+			})();
+			if (name === "designer_run_graph") return (async () => {
+				const args = asRecord(raw, "designer_run_graph");
+				const taskShape = asRecord(args.taskShape, "designer_run_graph.taskShape");
+				const mode = args.mode;
+				if (mode === "replay") {
+					const digest = args.graphDigest;
+					if (typeof digest !== "string" || digest.length === 0) throw new ValidationError("designer_run_graph: replay mode requires graphDigest from lookup");
+					const { loadGraph } = await import("./graph-registry-BuJbzTzF.js").then((n) => n.o);
+					const stored = await loadGraph(registry, digest);
+					if (!stored) throw new ValidationError(`designer_run_graph: no stored graph ${digest.slice(0, 12)} — re-lookup`);
+					const graph = env.bindCheck(graphFromStored(stored, () => {
+						throw new Error("designer: environment did not bind the deliverable check");
+					}));
+					return runAndRecord(taskShape, graph, "replay");
+				}
+				if (mode === "authored") {
+					const graph = asRecord(args.graph, "designer_run_graph.graph");
+					for (const axis of [
+						"nodes",
+						"edges",
+						"budget",
+						"deliverable"
+					]) if (graph[axis] === void 0) throw new ValidationError(`designer_run_graph.graph: ${axis} is required`);
+					return runAndRecord(taskShape, env.bindCheck(graph), "authored");
+				}
+				throw new ValidationError("designer_run_graph: mode must be 'replay' | 'authored'");
+			})();
+			return null;
 		}
-	}];
+	};
+	async function lookupGraphSyncish(taskShape) {
+		const selection = await lookupGraph(registry, taskShapeDigest(taskShape));
+		const history = (await graphRunsFor(registry, taskShapeDigest(taskShape))).map(summarize);
+		if (selection.kind === "replay") return {
+			decision: "replay",
+			reason: `a delivered graph exists (${selection.record.cost.iterations ?? "?"} iterations, ${selection.record.cost.tokens ?? "?"} tokens)`,
+			graphDigest: selection.graph.digest,
+			history
+		};
+		return {
+			decision: "author",
+			reason: selection.reason,
+			history
+		};
+	}
 }
 //#endregion
 //#region src/runtime/supervise/patch-checks.ts
@@ -7302,6 +7436,109 @@ function signalPass(value, required) {
 	return !required;
 }
 //#endregion
+//#region src/runtime/supervise/profile-registry.ts
+/**
+* `profile-registry` — named AgentProfiles with run receipts: the missing
+* bottom layer of the designer's memory.
+*
+* The graph registry (#1719) answers "which GRAPH won for this task shape?"
+* but a profile is reused ACROSS graphs and across products — the same
+* summarizer, the same referee, the same driver — and "did the v2 prompt
+* actually improve?" was answerable only per-graph. This module gives named
+* profiles their own receipt loop in the exact same shape as the graph
+* registry: profiles content-addressed by the interface's canonical digest,
+* one JSONL record per run, pickBest by the same documented heuristic.
+*
+* A profile record answers the question a prompt change has to answer before
+* it deserves to exist: same name, new digest — what did each version cost,
+* and did it deliver? Versions never overwrite (immutability), so old-vs-new
+* is always a controlled diff, and a product mounting the registry can refuse
+* a profile revision with no runs behind it.
+*/
+const RECORDS_FILE = "profile-records.jsonl";
+const PROFILES_DIR = "profiles";
+function assertRecord(record) {
+	if (typeof record.name !== "string" || record.name.trim().length === 0) throw new ValidationError("profile-registry: record.name is required");
+	if (typeof record.profileDigest !== "string" || record.profileDigest.length === 0) throw new ValidationError("profile-registry: record.profileDigest is required");
+	if (record.outcome.kind !== "delivered" && record.outcome.kind !== "failed") throw new ValidationError("profile-registry: record.outcome.kind must be 'delivered' | 'failed'");
+}
+/** Open (or lazily create) a profile registry rooted at a workspace directory. */
+function profileRegistry(root) {
+	if (!root || root.trim().length === 0) throw new ValidationError("profileRegistry: root directory is required");
+	return { root };
+}
+async function ensureLayout(reg) {
+	await mkdir(join(reg.root, PROFILES_DIR), { recursive: true });
+}
+async function readRecords(reg) {
+	try {
+		return (await readFile(join(reg.root, RECORDS_FILE), "utf8")).split("\n").filter((line) => line.trim().length > 0).map((line) => JSON.parse(line));
+	} catch {
+		return [];
+	}
+}
+/** Record one run and persist the exact profile revision beside it. The
+*  record's digest must match the supplied profile — a record always names
+*  the revision that actually ran. The revision file is write-once: a
+*  different profile under the same digest is refused. */
+async function recordProfileRun(reg, profile, record) {
+	assertRecord(record);
+	if (typeof profile?.name !== "string" || profile.name !== record.name) throw new ValidationError(`profile-registry: the supplied profile's name must equal record.name ('${record.name}')`);
+	const digest = canonicalAgentProfileDigest(profile);
+	if (digest !== record.profileDigest) throw new ValidationError(`profile-registry: record.profileDigest ${record.profileDigest.slice(0, 12)} does not match the supplied profile (${digest.slice(0, 12)}) — record the revision that actually ran`);
+	await ensureLayout(reg);
+	const file = join(reg.root, PROFILES_DIR, `${digest}.json`);
+	try {
+		if (canonicalAgentProfileDigest(JSON.parse(await readFile(file, "utf8"))) !== digest) throw new ValidationError(`profile-registry: revision ${digest.slice(0, 12)} is immutable but its stored copy differs — refusing to overwrite`);
+	} catch (error) {
+		if (!(error instanceof ValidationError)) await writeFile(file, JSON.stringify(profile), "utf8");
+		else throw error;
+	}
+	const deduped = (await readRecords(reg)).filter((row) => !(row.name === record.name && row.profileDigest === record.profileDigest && row.startedAt === record.startedAt));
+	deduped.push(record);
+	await writeFile(join(reg.root, RECORDS_FILE), deduped.map((row) => JSON.stringify(row)).join("\n") + "\n", "utf8");
+}
+/** All records for one name, newest last. */
+async function profileRunsForName(reg, name) {
+	return (await readRecords(reg)).filter((row) => row.name === name);
+}
+/** The best revision of a name by the same documented heuristic as the graph
+*  registry: delivered beats failed, then cheaper (tokens, then iterations),
+*  then most recent. This is the answer to "which prompt revision is winning?"
+*  — and every alternative is a controlled diff away (versions never overwrite). */
+function pickBestProfile(records) {
+	const delivered = records.filter((row) => row.outcome.kind === "delivered");
+	if (delivered.length === 0) return void 0;
+	const better = (a, b) => {
+		const aTokens = a.cost.tokens ?? Number.POSITIVE_INFINITY;
+		const bTokens = b.cost.tokens ?? Number.POSITIVE_INFINITY;
+		if (aTokens !== bTokens) return aTokens < bTokens ? a : b;
+		const aIter = a.cost.iterations ?? Number.POSITIVE_INFINITY;
+		const bIter = b.cost.iterations ?? Number.POSITIVE_INFINITY;
+		if (aIter !== bIter) return aIter < bIter ? a : b;
+		return a.finishedAt >= b.finishedAt ? a : b;
+	};
+	return delivered.reduce((best, row) => better(best, row) === best ? best : row);
+}
+/** Load a stored profile revision by digest (for replaying the winning revision). */
+async function loadProfile(reg, digest) {
+	try {
+		return JSON.parse(await readFile(join(reg.root, PROFILES_DIR, `${digest}.json`), "utf8"));
+	} catch {
+		return;
+	}
+}
+/** The winning revision of a name, ready to mount. */
+async function bestProfileFor(reg, name) {
+	const best = pickBestProfile(await profileRunsForName(reg, name));
+	if (!best) return void 0;
+	const profile = await loadProfile(reg, best.profileDigest);
+	return profile ? {
+		profile,
+		record: best
+	} : void 0;
+}
+//#endregion
 //#region src/runtime/supervise/sql-run-context.ts
 /**
 * A cross-machine run context on the existing autocommit SqlAdapter. Reuse the same database,
@@ -8587,6 +8824,6 @@ function tail(s) {
 	return s.slice(-400);
 }
 //#endregion
-export { renderCorpusToInstructions as $, chatWorkerSeam as A, completionAuthorizes as At, createS3PrivateCasStore as B, SqlRunOwnershipError as Bt, analyzeTrace as C, assertDeclaredCheck as Ct, codeModeSupervisorTools as D, declaredCheckJudge as Dt, runCoderChecks as E, declaredCheckDigest as Et, authorStrategy as F, pairwiseSignificance as Ft, trajectoryReport as G, createMcpEnvironment as Gt, runBenchmark as H, McpSpawnFault as Ht, strategyAuthorContract as I, renderLeaderboardHtml as It, builtinShapes as J, mcpSecretEnvMetadataKey as Jt, definePersona as K, sanitizeMcpToolSchema as Kt, strategyAuthorSystemPrompt as L, renderLeaderboardMarkdown as Lt, runStrategyEvolution as M, sentinelCompletion as Mt, strategyTournament as N, stopSentinel as Nt, unsafeInProcessRunner as O, readDeclaredCheck as Ot, assertStrategyContract as P, leaderboard as Pt, InMemoryCorpus as Q, createTangleSandboxExactProcessProvider as Qt, SandboxRunAbortError as R, renderLeaderboardSvg as Rt, withUntrackedArtifacts as S, superviseDispatch as St, patchDelivered as T, declaredCheckDeliverable as Tt, createPrivateCasArtifactPort as U, connectStdioMcp as Ut, printBenchmarkReport as V, openSqlRunStore as Vt, equalKOnCost as W, materializeLocalMcp as Wt, registerShape as X, resolveSecretEnv as Xt, createShapeRegistry as Y, resolveMcpServerLaunch as Yt, FileCorpus as Z, secretEnvOfMcpServer as Zt, VERIFY_TAIL_CHARS as _, resolveSandboxClient as _t, localShell as a, selectValidWinner as at, settledWorkerOut as b, loopCampaignDispatch as bt, createVerifierEnvironment as c, assertTraceDerivedFindings as ct, harvestSurfaceDiffs as d, registryScopeAnalyst as dt, fanout as et, analystsFromRegistry as f, observationFromRegistry as ft, NOTE_MAX_CHARS as g, defineLeaderboard as gt, EVIDENCE_MAX_CHARS as h, harvestCorpus as ht, jjWorkspace as i, pipeline as it, createChatSessionStore as j, deterministicCompletion as jt, chatTransportExecutor as k, runIsolatedCheck as kt, boxSurfaceReader as l, buildSteerContext as lt, worktreeFanout as m, HarvestError as mt, makeFinding$1 as n, loopUntil as nt, runInWorkspace as o, verify as ot, failuresAnalyst as p, inProcessSandboxClient as pt, runPersonified as q, envKeyProvider as qt, gitWorkspace as r, panel as rt, createWaterfallCollector as s, widen as st, computeFindingId$1 as t, flatWidenGate as tt, fsSurfaceReader as u, createScopeAnalyst as ut, closingWorkerNote as v, localSandboxClient as vt, createFencedSqlRunContext as w, checkProgramDigest as wt, copyUntrackedIntoClone as x, loopDispatch as xt, composeWorkerEvidence as y, inlineSandboxClient as yt, openSandboxRun as z, renderPairwiseMarkdown as zt };
+export { builtinShapes as $, mcpSecretEnvMetadataKey as $t, recordProfileRun as A, declaredCheckDeliverable as At, authorStrategy as B, pairwiseSignificance as Bt, analyzeTrace as C, localSandboxClient as Ct, pickBestProfile as D, superviseDispatch as Dt, loadProfile as E, loopDispatch as Et, chatWorkerSeam as F, completionAuthorizes as Ft, createS3PrivateCasStore as G, SqlRunOwnershipError as Gt, strategyAuthorSystemPrompt as H, renderLeaderboardMarkdown as Ht, createChatSessionStore as I, deterministicCompletion as It, createPrivateCasArtifactPort as J, connectStdioMcp as Jt, printBenchmarkReport as K, openSqlRunStore as Kt, runStrategyEvolution as L, sentinelCompletion as Lt, runCoderChecks as M, declaredCheckJudge as Mt, graphDesignerExtraTools as N, readDeclaredCheck as Nt, profileRegistry as O, assertDeclaredCheck as Ot, chatTransportExecutor as P, runIsolatedCheck as Pt, runPersonified as Q, envKeyProvider as Qt, strategyTournament as R, stopSentinel as Rt, withUntrackedArtifacts as S, resolveSandboxClient as St, bestProfileFor as T, loopCampaignDispatch as Tt, SandboxRunAbortError as U, renderLeaderboardSvg as Ut, strategyAuthorContract as V, renderLeaderboardHtml as Vt, openSandboxRun as W, renderPairwiseMarkdown as Wt, trajectoryReport as X, createMcpEnvironment as Xt, equalKOnCost as Y, materializeLocalMcp as Yt, definePersona as Z, sanitizeMcpToolSchema as Zt, VERIFY_TAIL_CHARS as _, observationFromRegistry as _t, localShell as a, fanout as at, settledWorkerOut as b, harvestCorpus as bt, createVerifierEnvironment as c, panel as ct, harvestSurfaceDiffs as d, verify as dt, resolveMcpServerLaunch as en, createShapeRegistry as et, analystsFromRegistry as f, widen as ft, NOTE_MAX_CHARS as g, registryScopeAnalyst as gt, EVIDENCE_MAX_CHARS as h, createScopeAnalyst as ht, jjWorkspace as i, renderCorpusToInstructions as it, patchDelivered as j, declaredCheckDigest as jt, profileRunsForName as k, checkProgramDigest as kt, boxSurfaceReader as l, pipeline as lt, worktreeFanout as m, buildSteerContext as mt, makeFinding$1 as n, secretEnvOfMcpServer as nn, FileCorpus as nt, runInWorkspace as o, flatWidenGate as ot, failuresAnalyst as p, assertTraceDerivedFindings as pt, runBenchmark as q, McpSpawnFault as qt, gitWorkspace as r, createTangleSandboxExactProcessProvider as rn, InMemoryCorpus as rt, createWaterfallCollector as s, loopUntil as st, computeFindingId$1 as t, resolveSecretEnv as tn, registerShape as tt, fsSurfaceReader as u, selectValidWinner as ut, closingWorkerNote as v, inProcessSandboxClient as vt, createFencedSqlRunContext as w, inlineSandboxClient as wt, copyUntrackedIntoClone as x, defineLeaderboard as xt, composeWorkerEvidence as y, HarvestError as yt, assertStrategyContract as z, leaderboard as zt };
 
-//# sourceMappingURL=runtime-B9BOFyEp.js.map
+//# sourceMappingURL=runtime-6qzuLTJ7.js.map