chainlesschain 0.166.44 → 0.166.46

package/src/commands/eval.js

@@ -19,12 +19,23 @@ import {
   formatTelemetry,
 } from "../lib/telemetry/span-recorder.js";
 import { computeTrend, formatTrend } from "../lib/eval/trend.js";
+import {
+  createEvalComparison,
+  createEvalHistoryRecord,
+  evalDigest,
+  evaluateStrictEvalGate,
+  EVAL_EXECUTION_PROTOCOL,
+  readComparisonContext,
+  readEvalHistory,
+} from "../lib/eval/evidence.js";
 
 export const _deps = {
   platform: process.platform,
   kill: process.kill.bind(process),
   spawn: executionBroker.spawn.bind(executionBroker),
   spawnSync: executionBroker.spawnSync.bind(executionBroker),
+  runEvalSuite,
+  getSuite,
 };
 
 /** Append a run summary as one JSONL line to the history file. */
@@ -32,26 +43,21 @@ function appendHistory(file, record) {
   fs.appendFileSync(file, JSON.stringify(record) + "\n", "utf8");
 }
 
-/** Read a JSONL eval-history file into an array of run records (skips bad lines). */
-function readHistory(file) {
-  if (!fs.existsSync(file)) return [];
-  const out = [];
-  for (const line of fs.readFileSync(file, "utf8").split(/\r?\n/)) {
-    const t = line.trim();
-    if (!t) continue;
-    try {
-      out.push(JSON.parse(t));
-    } catch {
-      /* skip a corrupt history line rather than abort the report */
-    }
-  }
-  return out;
-}
-
 const __dirname = path.dirname(fileURLToPath(import.meta.url));
 // This file is src/commands/eval.js → the CLI entry is bin/chainlesschain.js.
 const BIN = path.resolve(__dirname, "..", "..", "bin", "chainlesschain.js");
 
+function verifyAgentTerminal(output) {
+  try {
+    const events = output.split(/\r?\n/u).filter((line) => line.trim()).map((line) => JSON.parse(line));
+    const results = events.filter((event) => event?.type === "result");
+    const terminal = results[0];
+    return results.length === 1 && events.at(-1) === terminal &&
+      terminal.subtype === "success" && terminal.is_error !== true &&
+      !events.some((event) => event?.type === "error");
+  } catch { return false; }
+}
+
 /**
  * Kill an agent child AND its tool grandchildren. A bare child.kill("SIGTERM")
  * only reaches the direct child (and on Windows TerminateProcess never reaches
@@ -111,7 +117,7 @@ function makeHeadlessRunAgent(opts = {}) {
           "--permission-mode",
           "acceptEdits",
           "--output-format",
-          "text",
+          "stream-json",
         ];
         if (opts.model) args.push("--model", opts.model);
         if (opts.provider) args.push("--provider", opts.provider);
@@ -136,7 +142,15 @@ function makeHeadlessRunAgent(opts = {}) {
         if (settled) return;
         settled = true;
         clearTimeout(graceTimer);
-        resolve(result);
+        resolve({
+          ...result,
+          executionEvidence: {
+            protocol: EVAL_EXECUTION_PROTOCOL,
+            exitCode: result.exitCode ?? null,
+            signal: result.signal ?? null,
+            terminalVerified: result.terminalVerified === true,
+          },
+        });
       };
       const timer = setTimeout(() => {
         // Kill the WHOLE tree, then settle on `close` — resolving immediately
@@ -162,17 +176,27 @@ function makeHeadlessRunAgent(opts = {}) {
         clearTimeout(timer);
         done({ ok: false, output: out, error: e.message });
       });
-      child.on("close", (code) => {
+      child.on("close", (code, signal) => {
         clearTimeout(timer);
         if (timedOut) {
           done({
             ok: false,
             output: out,
+            exitCode: code,
+            signal: signal || null,
             error: `timed out after ${timeoutMs || 120000}ms`,
           });
           return;
         }
-        done({ ok: code === 0, output: out, error: code === 0 ? null : err });
+        const terminalVerified = !opts._argv && verifyAgentTerminal(out);
+        const ok = code === 0 && !signal && (opts._argv || terminalVerified);
+        done({
+          ok: Boolean(ok), output: out, exitCode: code, signal: signal || null,
+          terminalVerified,
+          error: ok ? null : code === 0 && !signal
+            ? "agent stream lacks a valid success terminal"
+            : err || `agent process exited with ${signal || code}`,
+        });
       });
     });
   };
@@ -211,14 +235,22 @@ export function registerEvalCommand(program, { logger } = {}) {
     )
     .option(
       "--trend",
-      "Report the pass-rate trend from --history instead of running (CI gate)",
+      "Report the diagnostic pass-rate trend from --history instead of running",
     )
+    .option("--strict", "With --trend: require complete, comparable recent evidence; legacy history cannot pass")
+    .option("--max-age-hours <hours>", "With --strict: maximum age of both compared runs", "168")
+    .option("--comparison-context <file>", "Bind explicit provider/model to operator-declared modelRevision and environment/permission/inference digests (not production attestation)")
     .option(
       "--regression-threshold <pct>",
       "With --trend: pass-rate drop (in points) that fails the gate on its own",
       "0",
     )
     .action(async (options) => {
+      if (options.strict && !options.trend) {
+        (log.error || console.error)("--strict requires --trend --history <file>");
+        process.exitCode = 1;
+        return;
+      }
       // Trend mode: don't run the suite — read the recorded history and report
       // the pass-rate trend + per-task regressions. This is the release-pipeline
       // consumer (the runs themselves need a real model; the report is pure).
@@ -228,19 +260,50 @@ export function registerEvalCommand(program, { logger } = {}) {
           process.exitCode = 1;
           return;
         }
-        const runs = readHistory(options.history);
-        const threshold =
-          Math.max(0, Number(options.regressionThreshold) || 0) / 100;
-        const trend = computeTrend(runs, { regressionThreshold: threshold });
+        let history;
+        try { history = readEvalHistory(options.history); }
+        catch {
+          history = { runs: [], issues: [{ code: "history_unreadable" }] };
+        }
+        const threshold = Number(options.regressionThreshold) / 100;
+        if (options.strict) {
+          const gate = evaluateStrictEvalGate(history, {
+            maxAgeMs: Number(options.maxAgeHours) * 60 * 60 * 1000,
+            regressionThreshold: threshold,
+          });
+          if (options.json) console.log(JSON.stringify(gate, null, 2));
+          else (log.log || console.log)(
+            `Eval comparison: ${gate.status}\n` +
+            `  Scope: local configuration comparison; operator declarations are not production attestation.\n` +
+            (gate.reasons.length ? `  ${gate.reasons.join(", ")}` : "  Comparable executions and candidate checks passed."),
+          );
+          if (!gate.passed) process.exitCode = 1;
+          return;
+        }
+        const trend = computeTrend(history.runs, { regressionThreshold: Math.max(0, threshold || 0) });
+        if (history.issues.length) trend.historyIssues = history.issues;
         if (options.json) console.log(JSON.stringify(trend, null, 2));
-        else (log.log || console.log)(formatTrend(trend));
+        else {
+          (log.log || console.log)(formatTrend(trend));
+          if (history.issues.length) (log.error || console.error)("History contains invalid or unreadable records; this diagnostic is not release evidence.");
+        }
         if (trend.regressed) process.exitCode = 1;
         return;
       }
 
       let tasks;
+      let comparison;
       try {
-        tasks = getSuite(options.suite);
+        tasks = _deps.getSuite(options.suite);
+        comparison = createEvalComparison({
+          suite: options.suite,
+          corpusDigest: evalDigest(fs.readFileSync(new URL("../lib/eval/tasks.js", import.meta.url))),
+          provider: options.provider,
+          model: options.model,
+          context: options.comparisonContext
+            ? readComparisonContext(options.comparisonContext, { provider: options.provider, model: options.model })
+            : null,
+        });
       } catch (err) {
         log.error ? log.error(err.message) : console.error(err.message);
         process.exitCode = 1;
@@ -256,7 +319,7 @@ export function registerEvalCommand(program, { logger } = {}) {
       // OTel-shaped telemetry for the run (per-task span + failure class).
       const recorder = new TelemetryRecorder({ serviceName: "cc-eval" });
 
-      const summary = await runEvalSuite(tasks, {
+      const summary = await _deps.runEvalSuite(tasks, {
         runAgent,
         recorder,
         keepWorkspaces: options.keep === true,
@@ -272,6 +335,11 @@ export function registerEvalCommand(program, { logger } = {}) {
                       : ""),
               ),
       });
+      const record = createEvalHistoryRecord(summary, {
+        comparison,
+        dryRun: options.dryRun === true,
+        label: options.label || null,
+      });
 
       if (options.otlp) {
         try {
@@ -296,28 +364,15 @@ export function registerEvalCommand(program, { logger } = {}) {
       // pass/fail + a timestamp/label — so `cc eval --trend` can chart it).
       if (options.history) {
         try {
-          appendHistory(options.history, {
-            ranAt: new Date().toISOString(),
-            label: options.label || null,
-            // Tagged so --trend can exclude it: a dry-run is always 0% and
-            // would otherwise report every passing task as a regression.
-            ...(options.dryRun ? { dryRun: true } : {}),
-            passed: summary.passed,
-            total: summary.total,
-            passRate: summary.passRate,
-            unrelatedChangeRate: summary.unrelatedChangeRate,
-            results: (summary.results || []).map((r) => ({
-              id: r.id,
-              pass: r.pass,
-            })),
-          });
+          appendHistory(options.history, record);
         } catch (e) {
           (log.error || console.error)(`  history write failed: ${e.message}`);
+          process.exitCode = 1;
         }
       }
 
       if (options.json) {
-        console.log(JSON.stringify(summary, null, 2));
+        console.log(JSON.stringify({ ...summary, ...record }, null, 2));
       } else {
         // Per-task lines already streamed via onResult; print the summary +
         // the telemetry metrics (durations / failure classification).
@@ -336,7 +391,7 @@ export function registerEvalCommand(program, { logger } = {}) {
         }
       }
       // Non-zero exit when not every task passed — usable as a CI gate.
-      if (summary.passed < summary.total) process.exitCode = 1;
+      if (summary.total === 0 || summary.passed < summary.total) process.exitCode = 1;
     });
   return program;
 }

package/src/commands/evolution-deployment.js

@@ -3,6 +3,7 @@ import { logger } from "../lib/logger.js";
 import {
   configureEvolutionDeployment,
   getEvolutionDeploymentStatus,
+  revokeEvolutionDeploymentDescriptorRevisions,
   setEvolutionDeploymentEnabled,
 } from "../lib/evolution/evolution-deployment-config.js";
 
@@ -21,8 +22,24 @@ function printStatus(status) {
     logger.log(`  Descriptor:      ${status.descriptorPath}`);
   if (status.trustRootPath)
     logger.log(`  Trust root:      ${status.trustRootPath}`);
+  if (status.activeTrustRootDigest)
+    logger.log(`  Active root:     ${status.activeTrustRootDigest}`);
+  if (status.revisionFloor)
+    logger.log(`  Revision floor:  ${status.revisionFloor}`);
   if (status.commands?.length)
     logger.log(`  Commands:        ${status.commands.join(", ")}`);
+  if (status.readiness) {
+    for (const command of ["ask", "agent"]) {
+      const admission = status.readiness[command];
+      if (admission)
+        logger.log(
+          `  ${command} admission: ${admission.state} — ${admission.detail}`,
+        );
+    }
+    logger.log(
+      "  Runtime:         not checked (host composition and model execution)",
+    );
+  }
   if (status.error) logger.log(chalk.red(`  Error:           ${status.error}`));
 }
 
@@ -38,6 +55,16 @@ function fail(error, json) {
   process.exitCode = 1;
 }
 
+/** Standalone configuration route: never assemble the configured host. */
+export function registerEvolutionDeploymentCommand(program) {
+  const evolution = program
+    .command("evolution")
+    .description(
+      "Evolution metrics and governance records — not model training or active Skill promotion",
+    );
+  registerEvolutionDeploymentCommands(evolution);
+}
+
 export function registerEvolutionDeploymentCommands(parent) {
   const deployment = parent
     .command("deployment")
@@ -60,6 +87,14 @@ export function registerEvolutionDeploymentCommands(parent) {
     .description("Verify, save, and enable a signed deployment")
     .requiredOption("--descriptor <path>", "Absolute signed descriptor path")
     .requiredOption("--trust-root <path>", "Absolute Ed25519 public key path")
+    .option(
+      "--root-rotation <path>",
+      "Certificate signed by the current root when changing trust roots",
+    )
+    .option(
+      "--descriptor-revocations <path>",
+      "Signed descriptor-revocation record for this trust root",
+    )
     .option("--disabled", "Save without enabling")
     .option("--json", "Output as JSON")
     .action(async (options) => {
@@ -68,6 +103,8 @@ export function registerEvolutionDeploymentCommands(parent) {
           await configureEvolutionDeployment({
             descriptorPath: options.descriptor,
             trustRootPath: options.trustRoot,
+            rootRotationPath: options.rootRotation || null,
+            revocationPath: options.descriptorRevocations || null,
             enabled: options.disabled !== true,
           }),
           options.json,
@@ -92,4 +129,25 @@ export function registerEvolutionDeploymentCommands(parent) {
         }
       });
   }
+
+  deployment
+    .command("revoke")
+    .description("Record signed descriptor revocations and disable the profile")
+    .requiredOption(
+      "--descriptor-revocations <path>",
+      "Signed descriptor-revocation record for the active trust root",
+    )
+    .option("--json", "Output as JSON")
+    .action(async (options) => {
+      try {
+        output(
+          await revokeEvolutionDeploymentDescriptorRevisions({
+            revocationPath: options.descriptorRevocations,
+          }),
+          options.json,
+        );
+      } catch (error) {
+        fail(error, options.json);
+      }
+    });
 }

package/src/commands/hub.js

@@ -3448,13 +3448,19 @@ function _defaultKnownVendors() {
 
 export function registerHubCommand(program, dependencies = {}) {
   const factory = readEvolutionCompositionFactory(dependencies);
-  const invocationOptions = (options) =>
-    factory === null
-      ? options
-      : {
-          ...options,
-          _getHub: () => getGovernedAnalysisHub(factory),
-        };
+  const invocationOptions = (options) => {
+    if (factory === null) {
+      const error = new Error(
+        "Hub model egress requires an authenticated evolution composition factory",
+      );
+      error.code = "CC_AGENT_EVOLUTION_INGRESS_FAILED";
+      throw error;
+    }
+    return {
+      ...options,
+      _getHub: () => getGovernedAnalysisHub(factory),
+    };
+  };
   const hub = program
     .command("hub")
     .description(

package/src/commands/setup.js

@@ -26,6 +26,10 @@ import {
   askPassword,
 } from "../lib/prompts.js";
 import logger from "../lib/logger.js";
+import {
+  assessEvolutionDeploymentReadiness,
+  getEvolutionDeploymentStatus,
+} from "../lib/evolution/evolution-deployment-config.js";
 
 export function registerSetupCommand(program) {
   program
@@ -180,6 +184,24 @@ async function runSetup(options) {
   }
   logger.success("Configuration saved");
 
+  // Saving a provider setting does not itself authorize a content-bearing
+  // request. Check command-specific deployment admission without executing the
+  // host module; a successful preflight is not a model execution probe.
+  const modelReadiness = assessEvolutionDeploymentReadiness(
+    await getEvolutionDeploymentStatus(),
+  );
+  if (modelReadiness.ready) {
+    logger.success("Signed deployment admits ask and agent");
+    logger.info(
+      "Runtime composition and model execution will be checked when you run a task.",
+    );
+  } else {
+    logger.warn(
+      `Model deployment prerequisites not met: ${modelReadiness.detail}`,
+    );
+    logger.info(`To enable it: ${modelReadiness.remediation}`);
+  }
+
   // Step 8: Docker services
   if (!options.skipServices && dockerOk && composeOk) {
     logger.newline();
@@ -207,7 +229,15 @@ async function runSetup(options) {
 
   // Done
   logger.newline();
-  logger.log(chalk.bold.green("  Setup complete!\n"));
+  logger.log(
+    modelReadiness.ready
+      ? chalk.bold.green(
+          "  Setup saved; deployment prerequisites checked (model execution not tested).\n",
+        )
+      : chalk.bold.yellow(
+          "  Setup saved; ask/agent deployment prerequisites remain incomplete.\n",
+        ),
+  );
   logger.log("  Next steps:");
   logger.log(
     `    ${chalk.cyan("chainlesschain start")}      Launch the desktop app`,

package/src/data/changelog.json

@@ -2,8 +2,21 @@
   "source": "CHANGELOG.md",
   "releases": [
     {
-      "productVersion": "v5.0.3.136",
-      "cliVersion": "0.166.44",
+      "productVersion": null,
+      "cliVersion": "0.166.46",
+      "cliVersions": ["0.166.46"],
+      "date": null,
+      "title": "",
+      "sections": [
+        {
+          "heading": "Fixed - cc CLI 0.166.46: restore Agent chat before Evolution deployment",
+          "body": "- Restore ordinary Agent and IDE stream chat for installations with no\n  Evolution deployment configured.\n- Continue authenticating configured deployments and reject invalid, disabled,\n  or unauthorized Agent deployments without falling back to ordinary chat.\n- Refresh public npm metadata during release verification retries."
+        }
+      ]
+    },
+    {
+      "productVersion": "v5.0.3.137",
+      "cliVersion": "0.166.45",
       "cliVersions": [
         "0.1.1",
         "0.1.2",
@@ -107,14 +120,14 @@
         "0.166.41",
         "0.166.42",
         "0.166.43",
-        "0.166.44"
+        "0.166.45"
       ],
       "date": "2026-09-11",
       "title": "DeepSeek V4 Flash GA 默认模型与全端同步发行",
       "sections": [
         {
-          "heading": "Changed - cc CLI 0.166.44: use DeepSeek V4 Flash GA by default",
-          "body": "- Use `deepseek-v4-flash-ga-260731` as the default Volcengine text model for\n  new CLI, agent and task-model configurations.\n- Keep `deepseek-v4-flash-260425` available for existing saved settings and\n  explicit model selection.\n- Pair VS Code `0.37.94` and JetBrains `0.4.121` with the same exact-gated CLI,\n  and embed it in the `v5.0.3.136` desktop and mobile release artifacts."
+          "heading": "Changed - cc CLI 0.166.45: use DeepSeek V4 Flash GA by default",
+          "body": "- Use `deepseek-v4-flash-ga-260731` as the default Volcengine text model for\n  new CLI, agent and task-model configurations.\n- Keep `deepseek-v4-flash-260425` available for existing saved settings and\n  explicit model selection.\n- Pair VS Code `0.37.94` and JetBrains `0.4.122` with the same exact-gated CLI,\n  and embed it in the `v5.0.3.137` desktop and mobile release artifacts."
         },
         {
           "heading": "Added - cc CLI 0.166.43: configure governed Skill evolution",

package/src/gateways/ws/personal-data-hub-protocol.js

@@ -192,6 +192,15 @@ async function withHub(fn, loadHub = getHub) {
   }
 }
 
+function governedHubLoader(factory) {
+  if (typeof factory === "function") return () => getGovernedAnalysisHub(factory);
+  const error = new Error(
+    "Personal Data Hub model egress requires an authenticated evolution composition factory",
+  );
+  error.code = "CC_AGENT_EVOLUTION_INGRESS_FAILED";
+  throw error;
+}
+
 export const PERSONAL_DATA_HUB_HANDLERS = {
   "personal-data-hub.ask": async (msg, context = {}) => {
     const factory = context.server?.evolutionCompositionFactory;
@@ -200,7 +209,7 @@ export const PERSONAL_DATA_HUB_HANDLERS = {
         if (!hub.engine) throw new Error("Analysis engine unavailable");
         return await hub.engine.ask(msg.question, msg.options || {});
       },
-      factory == null ? getHub : () => getGovernedAnalysisHub(factory),
+      governedHubLoader(factory),
     );
   },
 
@@ -614,9 +623,7 @@ export const PERSONAL_DATA_HUB_HANDLERS = {
     withHub(async (hub) => {
       if (!hub.entityResolver) throw new Error("EntityResolver not wired");
       const factory = context.server?.evolutionCompositionFactory;
-      if (factory != null)
-        return hub.drainResolver({ limit: msg.limit || 50 }, factory);
-      return await hub.entityResolver.drain({ limit: msg.limit || 50 });
+      return await hub.drainResolver({ limit: msg.limit || 50 }, factory);
     }),
 
   "personal-data-hub.resolver-stats": async () =>
@@ -641,7 +648,7 @@ export const PERSONAL_DATA_HUB_HANDLERS = {
     const factory = context.server?.evolutionCompositionFactory;
     return withHub(
       async (hub) => await hub.runSkill(msg.name, msg.options || {}),
-      factory == null ? getHub : () => getGovernedAnalysisHub(factory),
+      governedHubLoader(factory),
     );
   },
 

package/src/lazy-dispatch.js

@@ -688,6 +688,24 @@ async function defaultLoadCommandDependencies(commandName) {
   return loadEvolutionDeploymentCommandDependencies(commandName);
 }
 
+function isEvolutionDeploymentInvocation(argv, entry) {
+  if (entry.name !== "evolution") return false;
+  const location = findCommandTokenLocation(argv);
+  if (!location) return false;
+  for (let index = location.index + 1; index < argv.length;) {
+    const option = consumeGlobalOption(argv, index);
+    if (option) {
+      index = option.nextIndex;
+      continue;
+    }
+    const token = argv[index++];
+    if (token === "--") return argv[index] === "deployment";
+    if (token.startsWith("-")) continue;
+    return token === "deployment";
+  }
+  return false;
+}
+
 /**
  * Load/register may fall back to the compatibility program. parseAsync is
  * intentionally outside that catch: once an action begins, any failure must
@@ -706,21 +724,39 @@ export async function dispatchManifestEntry(
   } = {},
 ) {
   let program;
-  let allowCompatibilityFallback = true;
+  // Deployment inspection and repair must remain usable even when the signed
+  // host throws during import or dependency construction. Register only this
+  // configuration subtree, without executing the host or importing the eager
+  // program (which assembles every command's deployment dependencies).
+  const deploymentConfigurationOnly = isEvolutionDeploymentInvocation(
+    argv,
+    entry,
+  );
+  const registrationEntry = deploymentConfigurationOnly
+    ? {
+        ...entry,
+        module: "./commands/evolution-deployment.js",
+        register: "registerEvolutionDeploymentCommand",
+      }
+    : entry;
+  let allowCompatibilityFallback = !deploymentConfigurationOnly;
   try {
     program = await createBaseProgram();
-    const mod = await loadCommandModule(entry);
-    const registerFn = mod[entry.register];
+    const mod = await loadCommandModule(registrationEntry);
+    const registerFn = mod[registrationEntry.register];
     if (typeof registerFn !== "function") {
       throw new Error(
-        `Register function '${entry.register}' not found in ${entry.module}`,
+        `Register function '${registrationEntry.register}' not found in ${registrationEntry.module}`,
       );
     }
     // Governed deployment loading may reconcile durable state. Do not hide a
     // failed trust check or retry that assembly through the eager program.
     allowCompatibilityFallback = false;
-    const dependencies = await loadCommandDependencies(entry.name);
-    allowCompatibilityFallback = dependencies == null;
+    const dependencies = deploymentConfigurationOnly
+      ? null
+      : await loadCommandDependencies(entry.name);
+    allowCompatibilityFallback =
+      !deploymentConfigurationOnly && dependencies == null;
     registerFn(program, dependencies ?? undefined);
   } catch (error) {
     if (!allowCompatibilityFallback) throw error;

package/src/lib/agent-router.js

@@ -22,7 +22,10 @@
  *     ],
  *     strategy: "round-robin",
  *   });
- *   const results = await router.dispatch(subtasks, { cwd: "/my/project" });
+ *   const results = await router.dispatch(subtasks, {
+ *     cwd: "/my/project",
+ *     evolutionIngress,
+ *   });
  */
 
 import { EventEmitter } from "events";
@@ -253,24 +256,30 @@ export class AgentRouter extends EventEmitter {
    * @param {Array<{id, description, context?, type?}>} subtasks
    * @param {object} options
    * @param {string} options.cwd
+   * @param {object} options.evolutionIngress authenticated model ingress
    * @returns {Promise<Array<{taskId, agentId, backendType, success, output, duration}>>}
    */
   async dispatch(subtasks, options = {}) {
     const { cwd = process.cwd() } = options;
+    if (this._backends.length === 0) {
+      throw new Error(
+        "No agent backends available. Install Claude Code: npm i -g @anthropic-ai/claude-code",
+      );
+    }
     const evolutionIngress =
       options.evolutionIngress == null
         ? null
         : captureAgentEvolutionIngress(options.evolutionIngress);
-    const backends =
-      evolutionIngress === null
-        ? this._backends
-        : this._backends.filter((backend) => !backend.isCLI);
-
-    if (this._backends.length === 0) {
-      throw new Error(
-        "No agent backends available. Install Claude Code: npm i -g @anthropic-ai/claude-code",
+    if (evolutionIngress === null) {
+      const error = new Error(
+        "AgentRouter model dispatch requires an authenticated evolution composition",
       );
+      error.code = "CC_AGENT_EVOLUTION_INGRESS_FAILED";
+      throw error;
     }
+    const backends =
+      this._backends.filter((backend) => !backend.isCLI);
+
     if (backends.length === 0) {
       const error = new Error(
         "No backend can attest per-request evolution ingress; external agent CLIs are opaque",
@@ -422,20 +431,13 @@ export class AgentRouter extends EventEmitter {
       // tool, or model calls crossed this Run's durable ingress. Until an
       // authenticated child protocol can bind every such call and return
       // evidence, admitting the black box would create an unobservable model
-      // bypass. Keep unmanaged legacy dispatch available, but fail closed for
-      // governed evolution Runs before the process can be spawned.
-      if (evolutionIngress !== null) {
-        const error = new Error(
-          `External ${backend.type} CLI does not attest per-request evolution ingress`,
-        );
-        error.code = AGENT_ROUTER_ERROR.EXTERNAL_MODEL_INGRESS_UNATTESTED;
-        throw error;
-      }
-
-      // Use ClaudeCodePool for unmanaged CLI-based backends.
-      const pool = backend._pool;
-      const [r] = await pool.dispatch([task], { cwd });
-      result = r;
+      // bypass. This is deliberately unconditional so a future internal caller
+      // cannot bypass dispatch()'s candidate filter by calling this helper.
+      const error = new Error(
+        `External ${backend.type} CLI does not attest per-request evolution ingress`,
+      );
+      error.code = AGENT_ROUTER_ERROR.EXTERNAL_MODEL_INGRESS_UNATTESTED;
+      throw error;
     } else {
       // Use LLM API for API-based backends
       result = await executeViaAPI(task, {