chainlesschain 0.166.43 → 0.166.45

package/src/gateways/ws/personal-data-hub-protocol.js

@@ -192,6 +192,15 @@ async function withHub(fn, loadHub = getHub) {
   }
 }
 
+function governedHubLoader(factory) {
+  if (typeof factory === "function") return () => getGovernedAnalysisHub(factory);
+  const error = new Error(
+    "Personal Data Hub model egress requires an authenticated evolution composition factory",
+  );
+  error.code = "CC_AGENT_EVOLUTION_INGRESS_FAILED";
+  throw error;
+}
+
 export const PERSONAL_DATA_HUB_HANDLERS = {
   "personal-data-hub.ask": async (msg, context = {}) => {
     const factory = context.server?.evolutionCompositionFactory;
@@ -200,7 +209,7 @@ export const PERSONAL_DATA_HUB_HANDLERS = {
         if (!hub.engine) throw new Error("Analysis engine unavailable");
         return await hub.engine.ask(msg.question, msg.options || {});
       },
-      factory == null ? getHub : () => getGovernedAnalysisHub(factory),
+      governedHubLoader(factory),
     );
   },
 
@@ -614,9 +623,7 @@ export const PERSONAL_DATA_HUB_HANDLERS = {
     withHub(async (hub) => {
       if (!hub.entityResolver) throw new Error("EntityResolver not wired");
       const factory = context.server?.evolutionCompositionFactory;
-      if (factory != null)
-        return hub.drainResolver({ limit: msg.limit || 50 }, factory);
-      return await hub.entityResolver.drain({ limit: msg.limit || 50 });
+      return await hub.drainResolver({ limit: msg.limit || 50 }, factory);
     }),
 
   "personal-data-hub.resolver-stats": async () =>
@@ -641,7 +648,7 @@ export const PERSONAL_DATA_HUB_HANDLERS = {
     const factory = context.server?.evolutionCompositionFactory;
     return withHub(
       async (hub) => await hub.runSkill(msg.name, msg.options || {}),
-      factory == null ? getHub : () => getGovernedAnalysisHub(factory),
+      governedHubLoader(factory),
     );
   },
 

package/src/lazy-dispatch.js

@@ -688,6 +688,24 @@ async function defaultLoadCommandDependencies(commandName) {
   return loadEvolutionDeploymentCommandDependencies(commandName);
 }
 
+function isEvolutionDeploymentInvocation(argv, entry) {
+  if (entry.name !== "evolution") return false;
+  const location = findCommandTokenLocation(argv);
+  if (!location) return false;
+  for (let index = location.index + 1; index < argv.length;) {
+    const option = consumeGlobalOption(argv, index);
+    if (option) {
+      index = option.nextIndex;
+      continue;
+    }
+    const token = argv[index++];
+    if (token === "--") return argv[index] === "deployment";
+    if (token.startsWith("-")) continue;
+    return token === "deployment";
+  }
+  return false;
+}
+
 /**
  * Load/register may fall back to the compatibility program. parseAsync is
  * intentionally outside that catch: once an action begins, any failure must
@@ -706,21 +724,39 @@ export async function dispatchManifestEntry(
   } = {},
 ) {
   let program;
-  let allowCompatibilityFallback = true;
+  // Deployment inspection and repair must remain usable even when the signed
+  // host throws during import or dependency construction. Register only this
+  // configuration subtree, without executing the host or importing the eager
+  // program (which assembles every command's deployment dependencies).
+  const deploymentConfigurationOnly = isEvolutionDeploymentInvocation(
+    argv,
+    entry,
+  );
+  const registrationEntry = deploymentConfigurationOnly
+    ? {
+        ...entry,
+        module: "./commands/evolution-deployment.js",
+        register: "registerEvolutionDeploymentCommand",
+      }
+    : entry;
+  let allowCompatibilityFallback = !deploymentConfigurationOnly;
   try {
     program = await createBaseProgram();
-    const mod = await loadCommandModule(entry);
-    const registerFn = mod[entry.register];
+    const mod = await loadCommandModule(registrationEntry);
+    const registerFn = mod[registrationEntry.register];
     if (typeof registerFn !== "function") {
       throw new Error(
-        `Register function '${entry.register}' not found in ${entry.module}`,
+        `Register function '${registrationEntry.register}' not found in ${registrationEntry.module}`,
       );
     }
     // Governed deployment loading may reconcile durable state. Do not hide a
     // failed trust check or retry that assembly through the eager program.
     allowCompatibilityFallback = false;
-    const dependencies = await loadCommandDependencies(entry.name);
-    allowCompatibilityFallback = dependencies == null;
+    const dependencies = deploymentConfigurationOnly
+      ? null
+      : await loadCommandDependencies(entry.name);
+    allowCompatibilityFallback =
+      !deploymentConfigurationOnly && dependencies == null;
     registerFn(program, dependencies ?? undefined);
   } catch (error) {
     if (!allowCompatibilityFallback) throw error;

package/src/lib/agent-router.js

@@ -22,7 +22,10 @@
  *     ],
  *     strategy: "round-robin",
  *   });
- *   const results = await router.dispatch(subtasks, { cwd: "/my/project" });
+ *   const results = await router.dispatch(subtasks, {
+ *     cwd: "/my/project",
+ *     evolutionIngress,
+ *   });
  */
 
 import { EventEmitter } from "events";
@@ -253,24 +256,30 @@ export class AgentRouter extends EventEmitter {
    * @param {Array<{id, description, context?, type?}>} subtasks
    * @param {object} options
    * @param {string} options.cwd
+   * @param {object} options.evolutionIngress authenticated model ingress
    * @returns {Promise<Array<{taskId, agentId, backendType, success, output, duration}>>}
    */
   async dispatch(subtasks, options = {}) {
     const { cwd = process.cwd() } = options;
+    if (this._backends.length === 0) {
+      throw new Error(
+        "No agent backends available. Install Claude Code: npm i -g @anthropic-ai/claude-code",
+      );
+    }
     const evolutionIngress =
       options.evolutionIngress == null
         ? null
         : captureAgentEvolutionIngress(options.evolutionIngress);
-    const backends =
-      evolutionIngress === null
-        ? this._backends
-        : this._backends.filter((backend) => !backend.isCLI);
-
-    if (this._backends.length === 0) {
-      throw new Error(
-        "No agent backends available. Install Claude Code: npm i -g @anthropic-ai/claude-code",
+    if (evolutionIngress === null) {
+      const error = new Error(
+        "AgentRouter model dispatch requires an authenticated evolution composition",
       );
+      error.code = "CC_AGENT_EVOLUTION_INGRESS_FAILED";
+      throw error;
     }
+    const backends =
+      this._backends.filter((backend) => !backend.isCLI);
+
     if (backends.length === 0) {
       const error = new Error(
         "No backend can attest per-request evolution ingress; external agent CLIs are opaque",
@@ -422,20 +431,13 @@ export class AgentRouter extends EventEmitter {
       // tool, or model calls crossed this Run's durable ingress. Until an
       // authenticated child protocol can bind every such call and return
       // evidence, admitting the black box would create an unobservable model
-      // bypass. Keep unmanaged legacy dispatch available, but fail closed for
-      // governed evolution Runs before the process can be spawned.
-      if (evolutionIngress !== null) {
-        const error = new Error(
-          `External ${backend.type} CLI does not attest per-request evolution ingress`,
-        );
-        error.code = AGENT_ROUTER_ERROR.EXTERNAL_MODEL_INGRESS_UNATTESTED;
-        throw error;
-      }
-
-      // Use ClaudeCodePool for unmanaged CLI-based backends.
-      const pool = backend._pool;
-      const [r] = await pool.dispatch([task], { cwd });
-      result = r;
+      // bypass. This is deliberately unconditional so a future internal caller
+      // cannot bypass dispatch()'s candidate filter by calling this helper.
+      const error = new Error(
+        `External ${backend.type} CLI does not attest per-request evolution ingress`,
+      );
+      error.code = AGENT_ROUTER_ERROR.EXTERNAL_MODEL_INGRESS_UNATTESTED;
+      throw error;
     } else {
       // Use LLM API for API-based backends
       result = await executeViaAPI(task, {

package/src/lib/chat-intent-service.js

@@ -17,7 +17,7 @@
  * JSON-output prompt as V5.
  */
 
-import { chatWithStreaming, chatStream } from "./chat-core.js";
+import { chatStream } from "./chat-core.js";
 import { firstBalancedJson } from "./json-schema-output.js";
 import { prepareGovernedModelTurn } from "./evolution/governed-model-turn.js";
 
@@ -41,10 +41,6 @@ async function waitForIntentOperation(operation, signal) {
 }
 
 async function* intentModelStream(messages, options, factory, mode) {
-  if (factory === null) {
-    yield* chatStream(messages, options);
-    return;
-  }
   const controller = new AbortController();
   const timeoutMs = resolveIntentTimeout(options);
   const timer =
@@ -92,12 +88,6 @@ async function* intentModelStream(messages, options, factory, mode) {
 }
 
 async function intentModelText(messages, options, factory, mode) {
-  if (factory === null) {
-    return withIntentTimeout(
-      chatWithStreaming(messages, options),
-      resolveIntentTimeout(options),
-    );
-  }
   let content = "";
   for await (const event of intentModelStream(
     messages,
@@ -330,8 +320,8 @@ export async function* understandIntentStream({
   );
   let buffer = "";
   try {
-    // Governed streams use an abortable per-call intent deadline. The legacy
-    // unconfigured stream retains chat-core's silence-based stall guard.
+    // Every model-backed intent stream uses an abortable per-call deadline and
+    // authenticated composition; the rule-only path above stays local.
     for await (const event of intentModelStream(
       [
         { role: "system", content: systemPrompt },

package/src/lib/context-memory-kernel/provider-context.js

@@ -1,6 +1,7 @@
 import {
   canonicalDigest,
   canonicalJson,
+  isProtected,
   normalizeContextItem,
 } from "@chainlesschain/context-memory-kernel";
 import { getContextWindow } from "../model-context-window.js";
@@ -145,10 +146,20 @@ export async function prepareCanonicalProviderContext(
   );
   const inputBudget =
     modelWindowTokens - reservedOutputTokens - safetyMarginTokens;
-  const recoveryReserveTokens = Math.min(
+  const desiredRecoveryReserveTokens = Math.min(
     Math.max(32, Math.floor(inputBudget * 0.05)),
     Math.max(0, inputBudget - 1),
   );
+  // The recovery reserve is a soft allocation. It must yield to protected
+  // current-turn state, which is already part of this provider request.
+  const protectedTokens = items.reduce(
+    (total, item) => total + (isProtected(item) ? item.tokenEstimate : 0),
+    0,
+  );
+  const recoveryReserveTokens = Math.min(
+    desiredRecoveryReserveTokens,
+    Math.max(0, inputBudget - protectedTokens),
+  );
   const sessionHead =
     options.contextMemorySessionHead ||
     canonicalDigest(
@@ -171,8 +182,13 @@ export async function prepareCanonicalProviderContext(
       "tool-evidence": inputBudget,
       "memory-and-rules": Math.max(1, Math.floor(inputBudget * 0.12)),
     },
-    policyVersion: String(options.contextMemoryPolicyVersion || "cli-provider-v1"),
-    modelProfile: `${provider}:${String(options.model || "default")}`.slice(0, 256),
+    policyVersion: String(
+      options.contextMemoryPolicyVersion || "cli-provider-v1",
+    ),
+    modelProfile: `${provider}:${String(options.model || "default")}`.slice(
+      0,
+      256,
+    ),
     sessionHead,
     memoryRevision: recall.memoryRevision,
   });

package/src/lib/cowork-adapter.js

@@ -121,6 +121,13 @@ export function createChatFn(options = {}) {
     options.evolutionIngress == null
       ? null
       : captureAgentEvolutionIngress(options.evolutionIngress);
+  if (evolutionIngress === null) {
+    const error = new Error(
+      "Cowork model egress requires an authenticated evolution ingress",
+    );
+    error.code = "CC_AGENT_EVOLUTION_INGRESS_FAILED";
+    throw error;
+  }
   // Fill provider/model/baseUrl/apiKey from config.llm only when the caller
   // gave no explicit provider AND no LLM_PROVIDER env override (both still win).
   // Fail-open: a config read must never break chat construction.
@@ -157,10 +164,8 @@ export function createChatFn(options = {}) {
     // Every invocation (including concurrent reviewers) gets fresh durable
     // admission; the original conversation is never replaced in place.
     const prepareMessages = async () =>
-      evolutionIngress === null
-        ? messages
-        : (await evolutionIngress.prepareModelRequest({ messages, tools: [] }))
-            .messages;
+      (await evolutionIngress.prepareModelRequest({ messages, tools: [] }))
+        .messages;
 
     if (provider === "ollama") {
       const envelope = await invokeChatCall(

package/src/lib/doctor-checkup.js

@@ -387,6 +387,47 @@ async function providerSection(_opts, _deps2) {
   return { id: "provider", title: "Provider auth", checks };
 }
 
+// ── governed model execution ───────────────────────────────────────────────
+async function evolutionDeploymentSection(opts) {
+  const checks = [];
+  try {
+    const { getEvolutionDeploymentStatus, assessEvolutionDeploymentReadiness } =
+      await import("./evolution/evolution-deployment-config.js");
+    const readiness = assessEvolutionDeploymentReadiness(
+      await getEvolutionDeploymentStatus(opts.evolutionDeploymentOptions),
+    );
+    checks.push(
+      check(
+        "evolution-model-ingress",
+        "Model deployment admission (ask, agent)",
+        readiness.ready ? CHECK_LEVELS.OK : CHECK_LEVELS.ERR,
+        readiness.detail,
+        readiness.ready
+          ? null
+          : {
+              id: "configure-evolution-model-ingress",
+              safe: false,
+              description: readiness.remediation,
+              command: "cc evolution deployment status --json",
+            },
+      ),
+    );
+  } catch (err) {
+    checks.push(
+      failedCheck(
+        "evolution-model-ingress",
+        "Model deployment admission (ask, agent)",
+        err,
+      ),
+    );
+  }
+  return {
+    id: "evolution-deployment",
+    title: "Model deployment prerequisites (not an execution probe)",
+    checks,
+  };
+}
+
 // ── MCP config ─────────────────────────────────────────────────────────────
 async function mcpSection(opts, deps) {
   const checks = [];
@@ -1274,6 +1315,7 @@ export async function collectCheckupSections(opts = {}) {
   const builders = [
     configSection,
     providerSection,
+    evolutionDeploymentSection,
     mcpSection,
     ideSection,
     pluginSection,

package/src/lib/eval/evidence.js

@@ -0,0 +1,203 @@
+import { createHash, randomUUID } from "node:crypto";
+import fs from "node:fs";
+import { computeTrend } from "./trend.js";
+import { redactSecrets } from "../secret-scan.js";
+
+export const EVAL_HISTORY_SCHEMA = "chainlesschain.eval-history/v1";
+export const EVAL_CONTEXT_SCHEMA = "chainlesschain.eval-comparison-context/v1";
+export const EVAL_COMPARISON_SCHEMA = "chainlesschain.eval-comparison/v1";
+export const EVAL_EXECUTION_PROTOCOL = "cc-agent-stream-json/v1";
+const DIGEST = /^sha256:[a-f0-9]{64}$/u;
+const MAX_HISTORY_BYTES = 16 * 1024 * 1024;
+const CONTEXT_KEYS = [
+  "schema", "provider", "model", "modelRevision", "environmentDigest",
+  "permissionDigest", "inferenceDigest",
+];
+
+function canonical(value) {
+  if (Array.isArray(value)) return `[${value.map(canonical).join(",")}]`;
+  if (value && typeof value === "object") {
+    return `{${Object.keys(value).sort().map((key) => `${JSON.stringify(key)}:${canonical(value[key])}`).join(",")}}`;
+  }
+  return JSON.stringify(value);
+}
+
+export function evalDigest(value) {
+  return `sha256:${createHash("sha256").update(value).digest("hex")}`;
+}
+
+function nonempty(value) {
+  return typeof value === "string" && value.trim().length > 0 && value.length <= 1024;
+}
+
+/** These are operator declarations, not observed provider state or PKI proofs. */
+export function validateComparisonContext(value, { provider, model } = {}) {
+  if (!value || typeof value !== "object" || Array.isArray(value) ||
+      Object.keys(value).length !== CONTEXT_KEYS.length ||
+      Object.keys(value).some((key) => !CONTEXT_KEYS.includes(key)) ||
+      value.schema !== EVAL_CONTEXT_SCHEMA ||
+      ![value.provider, value.model, value.modelRevision].every(nonempty) ||
+      ![value.environmentDigest, value.permissionDigest, value.inferenceDigest].every((v) => DIGEST.test(v || ""))) {
+    throw new Error("comparison context requires its v1 schema, provider, model, modelRevision and environment/permission/inference sha256 digests");
+  }
+  if ((provider !== undefined && value.provider !== provider) ||
+      (model !== undefined && value.model !== model)) {
+    throw new Error("comparison context must match explicit --provider and --model");
+  }
+  return { ...value };
+}
+
+export function readComparisonContext(file, selection) {
+  const bytes = fs.readFileSync(file);
+  if (bytes.length === 0 || bytes.length > 16 * 1024) {
+    throw new Error("comparison context exceeds its size limit");
+  }
+  return validateComparisonContext(JSON.parse(bytes.toString("utf8")), selection);
+}
+
+export function createEvalComparison({ suite, corpusDigest, provider, model, context,
+  platform = process.platform, arch = process.arch, node = process.version } = {}) {
+  if (!context) return null;
+  if (!nonempty(provider) || !nonempty(model)) {
+    throw new Error("--comparison-context requires explicit --provider and --model");
+  }
+  if (!nonempty(suite) || !DIGEST.test(corpusDigest || "")) throw new Error("eval corpus identity is required");
+  const declared = validateComparisonContext(context, { provider, model });
+  return {
+    schema: EVAL_COMPARISON_SCHEMA,
+    basis: "local-runtime-and-operator-declarations",
+    suite, corpusDigest, provider, model,
+    runtime: { platform, arch, node },
+    permissionMode: "acceptEdits",
+    executionProtocol: EVAL_EXECUTION_PROTOCOL,
+    declared,
+  };
+}
+
+export function createEvalHistoryRecord(summary, {
+  comparison = null, dryRun = false, label = null,
+  ranAt = new Date().toISOString(), runId = randomUUID(),
+} = {}) {
+  return {
+    schema: EVAL_HISTORY_SCHEMA, runId, ranAt, label, dryRun, comparison,
+    passed: summary.passed, failed: summary.failed, total: summary.total,
+    passRate: summary.passRate, unrelatedChangeRate: summary.unrelatedChangeRate,
+    results: summary.results.map((result) => ({
+      id: result.id, pass: result.pass,
+      artifactCheckPassed: result.artifactCheckPassed,
+      executionSucceeded: result.executionSucceeded,
+      agentOk: result.agentOk,
+      executionEvidence: result.executionEvidence,
+      error: result.error == null ? null : redactSecrets(String(result.error)).slice(0, 2048),
+      detail: redactSecrets(String(result.detail || "")).slice(0, 2048),
+      ms: result.ms,
+      changedFiles: result.changedFiles,
+      unrelatedChanges: result.unrelatedChanges,
+    })),
+  };
+}
+
+/** Diagnostic callers may inspect valid rows, but must keep parse issues. */
+export function parseEvalHistory(text) {
+  const runs = [], issues = [];
+  if (Buffer.byteLength(text, "utf8") > MAX_HISTORY_BYTES) {
+    return { runs, issues: [{ code: "history_too_large" }] };
+  }
+  text.split(/\r?\n/u).forEach((line, index) => {
+    if (!line.trim()) return;
+    try {
+      const value = JSON.parse(line);
+      if (!value || typeof value !== "object" || Array.isArray(value)) throw new Error("not a record");
+      runs.push(value);
+    } catch {
+      issues.push({ code: "invalid_history_record", line: index + 1 });
+    }
+  });
+  return { runs, issues };
+}
+
+export function readEvalHistory(file) {
+  if (!fs.existsSync(file)) return { runs: [], issues: [] };
+  if (fs.statSync(file).size > MAX_HISTORY_BYTES) {
+    return { runs: [], issues: [{ code: "history_too_large" }] };
+  }
+  return parseEvalHistory(fs.readFileSync(file, "utf8"));
+}
+
+function validateComparison(value) {
+  try {
+    const rebuilt = createEvalComparison({
+      suite: value?.suite, corpusDigest: value?.corpusDigest,
+      provider: value?.provider, model: value?.model, context: value?.declared,
+      platform: value?.runtime?.platform, arch: value?.runtime?.arch, node: value?.runtime?.node,
+    });
+    return rebuilt && Object.values(value.runtime).every(nonempty) && canonical(rebuilt) === canonical(value);
+  } catch { return false; }
+}
+
+function recordIssues(record, now, maxAgeMs) {
+  if (!record || typeof record !== "object" || Array.isArray(record)) return ["invalid_history_record"];
+  const issues = [];
+  if (record.schema !== EVAL_HISTORY_SCHEMA || !nonempty(record.runId)) issues.push("legacy_or_missing_run_identity");
+  if (record.dryRun !== false) issues.push("dry_run_or_missing_execution_mode");
+  const epoch = Date.parse(record.ranAt);
+  if (typeof record.ranAt !== "string" || !Number.isFinite(epoch) ||
+      new Date(epoch).toISOString() !== record.ranAt || epoch > now || now - epoch > maxAgeMs) issues.push("invalid_or_expired_evidence");
+  if (!validateComparison(record.comparison)) issues.push("missing_comparison_identity");
+  const results = record.results;
+  if (!Array.isArray(results) || results.length === 0) return [...issues, "missing_task_results"];
+  const ids = new Set();
+  let passed = 0;
+  for (const result of results) {
+    if (!result || !nonempty(result.id) || ids.has(result.id)) {
+      issues.push("invalid_or_duplicate_task");
+      continue;
+    }
+    ids.add(result.id);
+    const execution = result.executionEvidence;
+    if (typeof result.pass !== "boolean" || typeof result.artifactCheckPassed !== "boolean" ||
+        typeof result.executionSucceeded !== "boolean" || result.agentOk !== result.executionSucceeded ||
+        result.pass !== (result.artifactCheckPassed && result.executionSucceeded)) issues.push("inconsistent_task_verdict");
+    if (!result.executionSucceeded || result.error !== null ||
+        execution?.protocol !== EVAL_EXECUTION_PROTOCOL || execution.exitCode !== 0 ||
+        execution.signal !== null || execution.terminalVerified !== true) issues.push("execution_not_successful");
+    if (result.pass === true) passed += 1;
+  }
+  if (record.total !== results.length || record.passed !== passed ||
+      record.failed !== results.length - passed || record.passRate !== passed / results.length) issues.push("inconsistent_task_totals");
+  return issues;
+}
+
+/**
+ * A local comparison gate. It does not attest model checkpoints, configuration
+ * declarations, edited JSONL, hidden holdouts, or production release authority.
+ * Append order selects the pair; timestamps cannot silently select older rows.
+ */
+export function evaluateStrictEvalGate({ runs = [], issues = [] } = {}, {
+  now = Date.now(), maxAgeMs = 7 * 24 * 60 * 60 * 1000, regressionThreshold = 0,
+} = {}) {
+  const reasons = issues.map((issue) => issue.code);
+  if (!Number.isFinite(now) || !Number.isFinite(maxAgeMs) || maxAgeMs <= 0 ||
+      !Number.isFinite(regressionThreshold) || regressionThreshold < 0 || regressionThreshold > 1) reasons.push("invalid_gate_options");
+  if (!Array.isArray(runs) || runs.length < 2) reasons.push("missing_baseline");
+  const pair = Array.isArray(runs) ? runs.slice(-2) : [];
+  for (const record of pair) reasons.push(...recordIssues(record, now, maxAgeMs));
+  if (pair.length === 2) {
+    const [baseline, candidate] = pair;
+    if (baseline?.runId === candidate?.runId || Date.parse(baseline?.ranAt) >= Date.parse(candidate?.ranAt)) reasons.push("duplicate_or_unordered_runs");
+    if (canonical(baseline?.comparison) !== canonical(candidate?.comparison)) reasons.push("comparison_identity_changed");
+    const ids = (record) => (Array.isArray(record?.results) ? record.results : []).map((r) => r?.id).sort();
+    if (canonical(ids(baseline)) !== canonical(ids(candidate))) reasons.push("task_population_changed");
+  }
+  const uniqueReasons = [...new Set(reasons)];
+  const base = {
+    scope: "local-eval-comparison", productionAttested: false,
+    baselineRunId: pair.length === 2 ? pair[0]?.runId || null : null,
+    candidateRunId: pair.at(-1)?.runId || null,
+  };
+  if (uniqueReasons.length) return { ...base, status: "INSUFFICIENT_EVIDENCE", passed: false, reasons: uniqueReasons };
+  const trend = computeTrend(pair, { regressionThreshold });
+  const failed = trend.regressed || pair[1].passed !== pair[1].total;
+  return { ...base, status: failed ? "FAIL" : "PASS", passed: !failed,
+    reasons: failed ? [trend.regressed ? "task_regression" : "candidate_tasks_failed"] : [], trend };
+}

package/src/lib/eval/runner.js

@@ -104,6 +104,10 @@ export async function runEvalSuite(tasks, opts = {}) {
       id: task?.id || "(unnamed)",
       description: task?.description || "",
       pass: false,
+      artifactCheckPassed: false,
+      executionSucceeded: false,
+      agentOk: false,
+      executionEvidence: null,
       ms: 0,
       detail: "",
       error: null,
@@ -142,7 +146,12 @@ export async function runEvalSuite(tasks, opts = {}) {
         // and still run check() (the workspace may be partially done).
         rec.error = `agent error: ${agentErr.message}`;
       }
-      rec.agentOk = agentResult ? agentResult.ok !== false : false;
+      rec.executionSucceeded = agentResult?.ok === true && !rec.error;
+      rec.agentOk = rec.executionSucceeded;
+      rec.executionEvidence = agentResult?.executionEvidence || null;
+      if (!rec.executionSucceeded && !rec.error) {
+        rec.error = `agent error: ${agentResult?.error || "execution did not report success"}`;
+      }
       // Edit locality — snapshot NOW, before check() (some checks write to the
       // workspace themselves). `unrelatedChanges` = files touched outside the
       // task's declared legitimate surface; null when the task doesn't declare
@@ -158,7 +167,10 @@ export async function runEvalSuite(tasks, opts = {}) {
         rec.unrelatedChanges = null; // not measured
       }
       const verdict = await task.check(dir, agentResult);
-      rec.pass = verdict?.pass === true;
+      rec.artifactCheckPassed = verdict?.pass === true;
+      // A useful artifact survives a provider/transport failure, but it is not
+      // evidence that the Agent completed the task successfully.
+      rec.pass = rec.artifactCheckPassed && rec.executionSucceeded;
       rec.detail = verdict?.detail || "";
     } catch (err) {
       // A harness-level error (bad task def / setup threw) — mark failed.
@@ -216,6 +228,8 @@ export async function runEvalSuite(tasks, opts = {}) {
     failed: total - passed,
     total,
     passRate: total > 0 ? passed / total : 0,
+    artifactChecksPassed: results.filter((r) => r.artifactCheckPassed).length,
+    executionsSucceeded: results.filter((r) => r.executionSucceeded).length,
     tasksWithUnrelatedChanges,
     unrelatedChangeRate: measured.length
       ? tasksWithUnrelatedChanges / measured.length

package/src/lib/eval/trend.js

@@ -1,13 +1,14 @@
 /**
  * Eval trend analysis (Phase 7) — turn a history of `cc eval` runs into a
- * release-gate signal: is the task-success rate trending down, and did any task
+ * diagnostic signal: is the task-success rate trending down, and did any task
  * that used to pass start failing (a regression)?
  *
  * The eval RUNS themselves need a real model (a dry-run is always 0%), but the
  * REPORTING is pure: given the recorded per-run summaries (pass-rate + which
  * tasks passed), computing the delta, per-task regressions, and the gate verdict
  * is deterministic and unit-testable with fixtures — which is what a release
- * pipeline actually wires up. This module is that consumer.
+ * pipeline can consume. Formal completeness/comparability is checked separately
+ * by evaluateStrictEvalGate in evidence.js; this module preserves legacy history.
  *
  * A run record is the JSON `cc eval --json` emits, optionally tagged with
  * `ranAt` / `label` (version or commit). `perTask` is derived from `results`.
@@ -200,7 +201,7 @@ export function formatTrend(trend) {
   lines.push(
     trend.regressed
       ? "  RESULT: REGRESSED (gate fails)"
-      : "  RESULT: ok (no regression)",
+      : "  RESULT: ok (no regression; diagnostic only, use --strict for a comparison gate)",
   );
   return lines.join("\n");
 }