chainlesschain 0.166.85 → 0.166.87

package/src/command-help-index.json

@@ -55,7 +55,7 @@
     "economy": "Usage: chainlesschain economy [options] [command]\n\nAgent economy — payments, channels, marketplace, NFTs\n\nOptions:\n  -h, --help                                                 display help for command\n\nCommands:\n  price <service-id> <price>                                 Set a service price\n  pay [options] <from> <to> <amount>                         Make a payment between agents\n  balance [options] <agent-id>                               Show agent balance\n  channel                                                    State channel management\n  market                                                     Resource marketplace\n  trade <listing-id> <buyer> <quantity>                      Buy a resource from the marketplace\n  nft                                                        NFT management\n  revenue <pool> <agent-ids>                                 Distribute revenue pool (comma-separated agent IDs)\n  contribute <agent-id> <type> <value>                       Record agent contribution\n  payment-types [options]                                    List PAYMENT_TYPE enum values (Phase 85)\n  channel-statuses [options]                                 List CHANNEL_STATUS enum values (Phase 85)\n  resource-types [options]                                   List RESOURCE_TYPE enum values (Phase 85)\n  nft-statuses [options]                                     List NFT_STATUS enum values (Phase 85)\n  price-v2 [options] <service-id> <payment-type> <rate>      Set a service price with payment-type model (Phase 85)\n  price-get [options] <service-id>                           Get a service's price model (Phase 85)\n  pay-v2 [options] <from> <to> <service-id>                  Pay for a priced service (computes amount from usage) (Phase 85)\n  channel-open-v2 [options] <party-a> <party-b>              Open a two-sided channel (Phase 85)\n  channel-activate [options] <id>                            OPEN → ACTIVE (Phase 85)\n  channel-settle [options] <id>                              ACTIVE → SETTLING with final balances (Phase 85)\n  channel-close-v2 [options] <id>                            Close channel and release locked funds (Phase 85)\n  channel-dispute [options] <id>                             Mark channel DISPUTED (Phase 85)\n  channels-v2 [options]                                      List channels with optional status/party filter (Phase 85)\n  market-list-v2 [options] <seller> <resource-type> <price>  List a resource with validated RESOURCE_TYPE (Phase 85)\n  nft-mint-v2 [options] <owner> <asset-type>                 Mint NFT with royalty tracking (Phase 85)\n  nft-list [options] <id> <price>                            List NFT for sale at a price (Phase 85)\n  nft-buy [options] <id> <buyer>                             Buy a listed NFT (Phase 85)\n  nft-burn [options] <id>                                    Burn an NFT (Phase 85)\n  nft-status [options] <id>                                  Get NFT status (Phase 85)\n  contribute-task [options] <task-id> <agent-id>             Record a weighted task contribution (Phase 85)\n  contributions-task [options] <task-id>                     List contributions for a task (Phase 85)\n  distribute-v2 [options] <task-id> <total>                  Distribute revenue across task contributors (Phase 85)\n  distributions [options]                                    List distribution records (Phase 85)\n  stats-v2 [options]                                         Extended economy stats (Phase 85)\n  enums-v2                                                   Show V2 enums (account maturity + tx lifecycle)\n  config-v2                                                  Show V2 config thresholds\n  set-max-active-accounts-v2 <n>                             Set max active accounts per holder\n  set-max-pending-txs-v2 <n>                                 Set max pending txs per account\n  set-account-idle-ms-v2 <n>                                 Set account idle threshold (ms)\n  set-tx-stuck-ms-v2 <n>                                     Set tx stuck threshold (ms)\n  register-account-v2 [options] <id> <holder>                Register V2 economy account\n  activate-account-v2 <id>                                   Activate account (pending→active or frozen→active)\n  freeze-account-v2 <id>                                     Freeze account\n  close-account-v2 <id>                                      Close account (terminal)\n  touch-account-v2 <id>                                      Touch account lastTouchedAt\n  get-account-v2 <id>                                        Get V2 account\n  list-accounts-v2                                           List all V2 accounts\n  create-tx-v2 [options] <id> <accountId>                    Create V2 tx (queued)\n  start-tx-v2 <id>                                           Start tx (queued→processing)\n  settle-tx-v2 <id>                                          Settle tx (processing→settled)\n  fail-tx-v2 <id> [reason]                                   Fail tx\n  cancel-tx-v2 <id> [reason]                                 Cancel tx\n  get-tx-v2 <id>                                             Get V2 tx\n  list-txs-v2                                                List all V2 txs\n  auto-freeze-idle-v2                                        Auto-freeze idle active accounts\n  auto-fail-stuck-v2                                         Auto-fail stuck processing txs\n  gov-stats-v2                                               V2 governance aggregate stats\n  help [command]                                             display help for command\n",
     "ecosystem": "Usage: chainlesschain ecosystem|eco [options] [command]\n\nPlugin Ecosystem 2.0 (Phase 64) — registry + deps + install + AI review +\npublish + revenue + recommend\n\nOptions:\n  -h, --help                                             display help for command\n\nCommands:\n  config                                                 Show ecosystem config (severities, statuses, rules, defaults)\n  severities                                             List review severities\n  statuses                                               List publish / install statuses\n  revenue-types                                          List revenue event types\n  dep-kinds                                              List dependency kinds\n  rules                                                  List heuristic AI review rules\n  register [options]                                     Register a new plugin (status=draft)\n  plugins [options]                                      List plugins\n  show <pluginId>                                        Show plugin details\n  update-stats [options] <pluginId>                      Update download count / avg rating\n  dep-add [options] <pluginId>                           Add a dependency to a plugin\n  deps <pluginId>                                        List direct dependencies of a plugin\n  resolve <pluginId>                                     Resolve dependency tree (detects conflicts + cycles)\n  install [options]                                      Install a plugin for a user (auto-fails on cycle/conflict)\n  installs [options]                                     List install records\n  uninstall <installId>                                  Mark an install as uninstalled\n  review [options] <pluginId>                            Run heuristic AI code review (regex rules + score)\n  review-show <reviewId>                                 Show a single review record\n  reviews [options]                                      List review records\n  sandbox [options] <pluginId>                           Record a sandbox test result (caller pushes outcome)\n  sandbox-show <testId>                                  Show a single sandbox test record\n  sandbox-tests [options]                                List sandbox test records\n  submit <pluginId>                                      Submit a plugin for review (draft/rejected → reviewing)\n  approve <pluginId>                                     Approve a reviewing plugin\n  reject [options] <pluginId>                            Reject a reviewing plugin (appends a rejection review record)\n  publish [options] <pluginId>                           Publish an approved plugin (computes sourceHash)\n  rev-record [options]                                   Record a revenue event (splits via developerShareRatio)\n  revenue [options] <developerId>                        Aggregate a developer's revenue\n  recommend [options]                                    Heuristic plugin recommendations for a user\n  stats                                                  Show ecosystem stats\n  maturity-statuses-v2                                   List V2 plugin maturity statuses\n  install-lifecycle-v2                                   List V2 install lifecycle statuses\n  default-max-active-plugins-per-developer               Show V2 default max active plugins per developer\n  max-active-plugins-per-developer                       Show current V2 max active plugins per developer\n  set-max-active-plugins-per-developer <n>               Set V2 max active plugins per developer\n  default-max-pending-installs-per-user                  Show V2 default max pending installs per user\n  max-pending-installs-per-user                          Show current V2 max pending installs per user\n  set-max-pending-installs-per-user <n>                  Set V2 max pending installs per user\n  default-auto-deprecate-after-ms                        Show V2 default auto-deprecate threshold (ms)\n  auto-deprecate-after-ms                                Show current V2 auto-deprecate threshold (ms)\n  set-auto-deprecate-after-ms <ms>                       Set V2 auto-deprecate threshold (ms)\n  default-auto-archive-after-ms                          Show V2 default auto-archive threshold (ms)\n  auto-archive-after-ms                                  Show current V2 auto-archive threshold (ms)\n  set-auto-archive-after-ms <ms>                         Set V2 auto-archive threshold (ms)\n  active-plugin-count [options]                          Count V2 active plugins (optionally scoped)\n  pending-install-count [options]                        Count V2 pending+resolving installs (optionally scoped)\n  register-plugin-v2 [options] <plugin-id>               Register V2 plugin (status=active)\n  maturity-v2 <plugin-id>                                Show V2 plugin maturity\n  set-maturity-v2 [options] <plugin-id> <status>         Transition V2 plugin maturity\n  deprecate-plugin [options] <plugin-id>                 Deprecate V2 plugin\n  archive-plugin-v2 [options] <plugin-id>                Archive V2 plugin\n  remove-plugin-v2 [options] <plugin-id>                 Remove V2 plugin (terminal)\n  touch-plugin-activity <plugin-id>                      Bump lastActivityAt for V2 plugin\n  submit-install-v2 [options] <install-id>               Submit V2 install (status=pending)\n  install-status-v2 <install-id>                         Show V2 install status\n  set-install-status-v2 [options] <install-id> <status>  Transition V2 install status\n  resolve-install [options] <install-id>                 Mark V2 install as resolving\n  complete-install [options] <install-id>                Mark V2 install as installed\n  fail-install [options] <install-id>                    Mark V2 install as failed\n  uninstall-install-v2 [options] <install-id>            Mark V2 install as uninstalled (terminal)\n  retry-failed-install [options] <install-id>            Retry a failed V2 install (failed → pending)\n  auto-deprecate-stale-plugins                           Bulk-flip stale V2 ACTIVE plugins to DEPRECATED\n  auto-archive-long-deprecated                           Bulk-flip long-deprecated V2 plugins to ARCHIVED\n  stats-v2                                               Show V2 ecosystem stats (maturity + install)\n  help [command]                                         display help for command\n",
     "encrypt": "Usage: chainlesschain encrypt [options] [command]\n\nFile encryption and database encryption management\n\nOptions:\n  -h, --help                            display help for command\n\nCommands:\n  file [options] <path>                 Encrypt a file with AES-256-GCM\n  db [options]                          Enable database encryption tracking\n  info [options] <path>                 Check if a file is encrypted\n  status [options]                      Show database encryption status\n  key-maturities-v2 [options]           [V2] List crypto key maturity states\n  job-lifecycles-v2 [options]           [V2] List crypto job lifecycle states\n  config-v2 [options]                   [V2] Show governance config\n  set-max-active-keys-per-owner-v2 <n>  [V2] Set per-owner active key cap\n  set-max-pending-jobs-per-key-v2 <n>   [V2] Set per-key pending job cap\n  set-key-idle-ms-v2 <ms>               [V2] Set key idle threshold (ms)\n  set-job-stuck-ms-v2 <ms>              [V2] Set job stuck threshold (ms)\n  register-key-v2 [options] <id>        [V2] Register a crypto key profile\n                                        (PENDING)\n  activate-key-v2 <id>                  [V2] Activate key (pending|rotated ->\n                                        active)\n  rotate-key-v2 <id>                    [V2] Rotate key (active -> rotated)\n  retire-key-v2 <id>                    [V2] Retire key (terminal)\n  touch-key-v2 <id>                     [V2] Bump key lastSeenAt\n  get-key-v2 [options] <id>             [V2] Show crypto key profile\n  list-keys-v2 [options]                [V2] List crypto key profiles\n  create-job-v2 [options] <id>          [V2] Create a queued V2 crypto job\n  start-job-v2 <id>                     [V2] Start crypto job (queued ->\n                                        running)\n  complete-job-v2 <id>                  [V2] Complete crypto job (running ->\n                                        completed)\n  fail-job-v2 <id>                      [V2] Fail crypto job (running ->\n                                        failed)\n  cancel-job-v2 <id>                    [V2] Cancel crypto job (queued|running\n                                        -> cancelled)\n  get-job-v2 [options] <id>             [V2] Show crypto job\n  list-jobs-v2 [options]                [V2] List V2 crypto jobs\n  active-key-count-v2 [options]         [V2] Count active crypto keys (optional\n                                        --owner)\n  pending-job-count-v2 [options]        [V2] Count pending crypto jobs\n                                        (queued+running)\n  auto-rotate-idle-keys-v2 [options]    [V2] Rotate idle active keys\n  auto-fail-stuck-jobs-v2 [options]     [V2] Fail stuck running crypto jobs\n  stats-v2 [options]                    [V2] Show governance stats\n  help [command]                        display help for command\n",
-    "eval": "Usage: chainlesschain eval [options]\n\nRun the reliability eval suite (self-checking coding tasks) and report the\ntask-success rate\n\nOptions:\n  --suite <name>                Suite to run (default: \"builtin\")\n  --model <model>               Model for the agent runs\n  --provider <provider>         Provider for the agent runs\n  --json                        Output the summary as JSON\n  --keep                        Keep the per-task temp workspaces (debug)\n  --otlp <file>                 Write OpenTelemetry (OTLP/JSON) spans for the\n                                run to a file\n  --dry-run                     Use a no-op agent (exercise the harness/report\n                                without a model)\n  --history <file>              Append this run's summary (JSONL) for trend\n                                tracking\n  --label <label>               Tag this run in the history (e.g. a\n                                version/commit)\n  --trend                       Report the diagnostic pass-rate trend from\n                                --history instead of running\n  --strict                      With --trend: require complete, comparable\n                                recent evidence; legacy history cannot pass\n  --max-age-hours <hours>       With --strict: maximum age of both compared\n                                runs (default: \"168\")\n  --comparison-context <file>   Bind explicit provider/model to\n                                operator-declared modelRevision and\n                                environment/permission/inference digests (not\n                                production attestation)\n  --regression-threshold <pct>  With --trend: pass-rate drop (in points) that\n                                fails the gate on its own (default: \"0\")\n  -h, --help                    display help for command\n",
+    "eval": "Usage: chainlesschain eval [options]\n\nRun the reliability eval suite (self-checking coding tasks) and report the\ntask-success rate\n\nOptions:\n  --suite <name>                Suite to run (default: \"builtin\")\n  --plan-dir <directory>        Frozen VERIFY-01 plan bundle\n  --plan-digest <digest>        Externally pinned frozen plan digest\n  --review <file>               Independent setup/check review configuration\n  --review-digest <digest>      Review digest pinned before execution\n  --review-root <directory>     Trusted evaluator source root outside the task\n                                project\n  --project-root <directory>    Actual checkout of the frozen project commit\n  --samples <ids>               Selected frozen sample IDs; unselected samples\n                                remain missing\n  --evidence-dir <directory>    Keep frozen-suite raw process output and\n                                complete diffs outside compact Eval history\n  --model <model>               Model for the agent runs\n  --provider <provider>         Provider for the agent runs\n  --json                        Output the summary as JSON\n  --keep                        Keep the per-task temp workspaces (debug)\n  --otlp <file>                 Write OpenTelemetry (OTLP/JSON) spans for the\n                                run to a file\n  --dry-run                     Use a no-op agent (exercise the harness/report\n                                without a model)\n  --history <file>              Append this run's summary (JSONL) for trend\n                                tracking\n  --label <label>               Tag this run in the history (e.g. a\n                                version/commit)\n  --trend                       Report the diagnostic pass-rate trend from\n                                --history instead of running\n  --strict                      With --trend: require complete, comparable\n                                recent evidence; legacy history cannot pass\n  --max-age-hours <hours>       With --strict: maximum age of both compared\n                                runs (default: \"168\")\n  --comparison-context <file>   Bind explicit provider/model to\n                                operator-declared modelRevision and\n                                environment/permission/inference digests (not\n                                production attestation)\n  --regression-threshold <pct>  With --trend: pass-rate drop (in points) that\n                                fails the gate on its own (default: \"0\")\n  -h, --help                    display help for command\n",
     "evolution": "Usage: chainlesschain evolution [options] [command]\n\nEvolution metrics and governance records — not model training or active Skill\npromotion\n\nOptions:\n  -h, --help                                 display help for command\n\nCommands:\n  workbench                                  Review governed Skill evolution evidence and versions\n  attestor-trust                             Operate the governed Skill attestor trust control plane\n  knowledge                                  Review encrypted governed knowledge conflicts\n  benchmark                                  Run and inspect governed WikiSkill benchmark reports\n  deployment                                 Configure the signed governed Skill evolution deployment\n  assess [options] <name> <score>            Assess and track a capability\n  record-model-metrics [options] <model-id>  Record a synthetic model metric estimate (no training)\n  diagnose [options]                         Diagnose recorded evolution metrics\n  repair [options] <issue>                   Apply a maintenance strategy to a recorded diagnosis\n  predict [options] [user-id]                Predict user behavior\n  growth [options]                           Show growth log\n  stats [options]                            Show capabilities and models overview\n  export [options] <model-id>                Export a model metric record for portability\n  dimensions [options]                       List CAPABILITY_DIMENSION enum\n  severities [options]                       List DIAGNOSIS_SEVERITY enum\n  strategies [options]                       List REPAIR_STRATEGY enum\n  milestones [options]                       List GROWTH_MILESTONE enum\n  assess-v2 [options] <dimension> <score>    Assess capability by canonical dimension\n  capabilities-v2 [options]                  List V2 capabilities\n  record-training-metrics-v2 [options]       Record caller-supplied loss metrics (no training)\n  training-metrics-v2 [options]              List V2 training metric records\n  diagnose-v2 [options]                      Diagnose recorded V2 evolution metrics\n  diagnoses-v2 [options]                     List V2 diagnoses\n  diagnosis-show [options] <id>              Show a specific diagnosis\n  repair-v2 [options] <diagnosis-id>         Record a V2 maintenance strategy for a diagnosis\n  predict-v2 [options]                       Project behavior from recorded V2 metrics\n  record-milestone [options] <type>          Record a growth milestone explicitly\n  growth-v2 [options]                        List V2 growth milestones\n  configure [options]                        Update evolution config\n  config [options]                           Show evolution config\n  stats-v2 [options]                         V2 evolution stats\n  enums-v2                                   Show V2 enums (goal maturity + cycle lifecycle)\n  config-v2                                  Show V2 config thresholds\n  set-max-active-goals-v2 <n>                Set max active goals per owner\n  set-max-pending-cycles-v2 <n>              Set max pending cycles per goal\n  set-goal-idle-ms-v2 <n>                    Set goal idle threshold (ms)\n  set-cycle-stuck-ms-v2 <n>                  Set cycle stuck threshold (ms)\n  register-goal-v2 [options] <id> <owner>    Register V2 evo goal\n  activate-goal-v2 <id>                      Activate evo goal\n  pause-goal-v2 <id>                         Pause evo goal\n  archive-goal-v2 <id>                       Archive goal (terminal)\n  touch-goal-v2 <id>                         Touch goal lastTouchedAt\n  get-goal-v2 <id>                           Get V2 goal\n  list-goals-v2                              List all V2 goals\n  create-cycle-v2 [options] <id> <goalId>    Create V2 cycle (queued)\n  start-cycle-v2 <id>                        Start cycle (queued→running)\n  complete-cycle-v2 <id>                     Complete cycle (running→completed)\n  fail-cycle-v2 <id> [reason]                Fail cycle\n  cancel-cycle-v2 <id> [reason]              Cancel cycle\n  get-cycle-v2 <id>                          Get V2 cycle\n  list-cycles-v2                             List all V2 cycles\n  auto-pause-idle-v2                         Auto-pause idle active goals\n  auto-fail-stuck-v2                         Auto-fail stuck running cycles\n  gov-stats-v2                               V2 governance aggregate stats\n  help [command]                             display help for command\n",
     "evomap": "Usage: chainlesschain evomap [options] [command]\n\nEvoMap — gene exchange protocol for agent capabilities\n\nOptions:\n  -h, --help                          display help for command\n\nCommands:\n  search [options] <query>            Search for genes on the hub\n  download <geneId>                   Download a gene from the hub\n  publish [options]                   Publish a gene to the hub\n  list                                List locally installed genes\n  hubs                                List configured EvoMap hubs\n  federation                          Federated hub management and gene syncing\n  gov                                 EvoMap governance — ownership, proposals,\n                                      voting\n  enums-v2                            Show V2 governance enums\n  register-map-v2 [options]           Register an evomap profile (pending)\n  activate-map-v2 <id>                Activate map\n  stale-map-v2 <id>                   Mark map stale\n  archive-map-v2 <id>                 Archive map (terminal)\n  touch-map-v2 <id>                   Refresh lastTouchedAt\n  get-map-v2 <id>                     Get map\n  list-maps-v2                        List maps\n  create-evolution-v2 [options]       Create an evolution (queued)\n  start-evolution-v2 <id>             Transition evolution to running\n  complete-evolution-v2 <id>          Transition evolution to completed\n  fail-evolution-v2 [options] <id>    Fail evolution\n  cancel-evolution-v2 [options] <id>  Cancel evolution\n  get-evolution-v2 <id>               Get evolution\n  list-evolutions-v2                  List evolutions\n  set-max-active-maps-v2 <n>          Set per-owner active cap\n  set-max-pending-evolutions-v2 <n>   Set per-map pending cap\n  set-map-idle-ms-v2 <n>              Set idle threshold\n  set-evolution-stuck-ms-v2 <n>       Set stuck threshold\n  auto-stale-idle-maps-v2             Auto-stale idle maps\n  auto-fail-stuck-evolutions-v2       Auto-fail stuck running evolutions\n  gov-stats-v2                        V2 governance aggregate stats\n  help [command]                      display help for command\n",
     "execbe": "Usage: chainlesschain execbe [options] [command]\n\nExecution backend V2 governance\n\nOptions:\n  -h, --help                               display help for command\n\nCommands:\n  maturities-v2\n  job-lifecycle-v2\n  stats-v2\n  config-v2\n  register-backend-v2 <id> <owner> [kind]\n  activate-backend-v2 <id>\n  degrade-backend-v2 <id>\n  retire-backend-v2 <id>\n  touch-backend-v2 <id>\n  get-backend-v2 <id>\n  list-backends-v2\n  create-job-v2 <id> <backendId> [cmd]\n  start-job-v2 <id>\n  succeed-job-v2 <id>\n  fail-job-v2 <id> [reason]\n  cancel-job-v2 <id> [reason]\n  get-job-v2 <id>\n  list-jobs-v2\n  auto-degrade-idle-v2\n  auto-fail-stuck-v2\n  set-max-active-v2 <n>\n  set-max-pending-v2 <n>\n  set-idle-ms-v2 <n>\n  set-stuck-ms-v2 <n>\n  reset-state-v2\n  help [command]                           display help for command\n",

package/src/commands/eval.js

@@ -14,6 +14,7 @@ import path from "path";
 import { fileURLToPath } from "url";
 import { runEvalSuite } from "../lib/eval/runner.js";
 import { getSuite } from "../lib/eval/tasks.js";
+import { persistVerify01Receipts } from "../lib/eval/verify01-execution.js";
 import executionBroker from "../lib/process-execution-broker/index.js";
 import {
   TelemetryRecorder,
@@ -142,7 +143,7 @@ function killAgentTree(child) {
  * workspace. acceptEdits lets it write files without an interactive prompt.
  */
 function makeHeadlessRunAgent(opts = {}) {
-  return function runAgent({ prompt, cwd, timeoutMs }) {
+  return function runAgent({ prompt, cwd, timeoutMs, costBudgetUsd }) {
     return new Promise((resolve) => {
       let args;
       if (opts._argv) {
@@ -163,6 +164,9 @@ function makeHeadlessRunAgent(opts = {}) {
         if (opts.model) args.push("--model", opts.model);
         if (opts.provider) args.push("--provider", opts.provider);
         if (opts.ephemeral === true) args.push("--ephemeral");
+        if (opts.sandboxMode) args.push("--sandbox-mode", opts.sandboxMode);
+        if (Number.isFinite(costBudgetUsd) && costBudgetUsd >= 0)
+          args.push("--max-budget-usd", String(costBudgetUsd));
       }
       const child = _deps.spawn(process.execPath, args, {
         cwd,
@@ -272,6 +276,26 @@ export function registerEvalCommand(program, { logger } = {}) {
       "Run the reliability eval suite (self-checking coding tasks) and report the task-success rate",
     )
     .option("--suite <name>", "Suite to run", "builtin")
+    .option("--plan-dir <directory>", "Frozen VERIFY-01 plan bundle")
+    .option("--plan-digest <digest>", "Externally pinned frozen plan digest")
+    .option("--review <file>", "Independent setup/check review configuration")
+    .option("--review-digest <digest>", "Review digest pinned before execution")
+    .option(
+      "--review-root <directory>",
+      "Trusted evaluator source root outside the task project",
+    )
+    .option(
+      "--project-root <directory>",
+      "Actual checkout of the frozen project commit",
+    )
+    .option(
+      "--samples <ids>",
+      "Selected frozen sample IDs; unselected samples remain missing",
+    )
+    .option(
+      "--evidence-dir <directory>",
+      "Keep frozen-suite raw process output and complete diffs outside compact Eval history",
+    )
     .option("--model <model>", "Model for the agent runs")
     .option("--provider <provider>", "Provider for the agent runs")
     .option("--json", "Output the summary as JSON")
@@ -381,21 +405,54 @@ export function registerEvalCommand(program, { logger } = {}) {
       let tasks;
       let comparison;
       try {
-        tasks = _deps.getSuite(options.suite);
-        comparison = createEvalComparison({
-          suite: options.suite,
-          corpusDigest: evalDigest(
-            fs.readFileSync(new URL("../lib/eval/tasks.js", import.meta.url)),
-          ),
-          provider: options.provider,
-          model: options.model,
-          context: options.comparisonContext
-            ? readComparisonContext(options.comparisonContext, {
-                provider: options.provider,
-                model: options.model,
-              })
-            : null,
+        tasks = _deps.getSuite(options.suite, {
+          verify01: {
+            planDir: options.planDir,
+            planDigest: options.planDigest,
+            reviewFile: options.review,
+            reviewDigest: options.reviewDigest,
+            reviewRoot: options.reviewRoot,
+            projectRoot: options.projectRoot,
+            sampleIds: options.samples,
+            provider: options.provider,
+            model: options.model,
+          },
         });
+        if (tasks.verification && !/^[a-f0-9]{40}$/u.test(options.label || ""))
+          throw new Error(
+            "frozen suite requires --label <40-character tested CLI source SHA>; this differs from the task project checkout SHA",
+          );
+        if (tasks.verification)
+          tasks.verification.executionSource = {
+            declaredCommit: options.label,
+            identityVerified: false,
+            declarationOnly: true,
+            entryDigest: evalDigest(fs.readFileSync(BIN)),
+          };
+        if (tasks.verification && !options.evidenceDir)
+          throw new Error(
+            "frozen suite requires --evidence-dir to retain raw execution material",
+          );
+        if (tasks.verification && options.comparisonContext)
+          throw new Error(
+            "frozen suite comparison is bound by its plan; --comparison-context cannot override it",
+          );
+        comparison =
+          tasks.verification?.comparison ||
+          createEvalComparison({
+            suite: options.suite,
+            corpusDigest: evalDigest(
+              fs.readFileSync(new URL("../lib/eval/tasks.js", import.meta.url)),
+            ),
+            provider: options.provider,
+            model: options.model,
+            context: options.comparisonContext
+              ? readComparisonContext(options.comparisonContext, {
+                  provider: options.provider,
+                  model: options.model,
+                })
+              : null,
+          });
       } catch (err) {
         log.error ? log.error(err.message) : console.error(err.message);
         process.exitCode = 1;
@@ -406,6 +463,12 @@ export function registerEvalCommand(program, { logger } = {}) {
         : makeHeadlessRunAgent({
             model: options.model,
             provider: options.provider,
+            ...(tasks.verification
+              ? {
+                  ephemeral: true,
+                  sandboxMode: tasks.verification.requiredSandboxMode,
+                }
+              : {}),
           });
 
       // OTel-shaped telemetry for the run (per-task span + failure class).
@@ -414,7 +477,7 @@ export function registerEvalCommand(program, { logger } = {}) {
       const summary = await _deps.runEvalSuite(tasks, {
         runAgent,
         recorder,
-        keepWorkspaces: options.keep === true,
+        keepWorkspaces: options.keep === true || Boolean(tasks.verification),
         onResult: options.json
           ? undefined
           : (r) =>
@@ -432,6 +495,40 @@ export function registerEvalCommand(program, { logger } = {}) {
         dryRun: options.dryRun === true,
         label: options.label || null,
       });
+      if (tasks.verification) {
+        try {
+          record.verification = {
+            ...persistVerify01Receipts(
+              tasks.verification,
+              options.evidenceDir,
+              record.runId,
+            ),
+            executionStatus: options.dryRun ? "DRY_RUN" : "ATTEMPTED",
+            // Execution material for the existing collector, not an observation
+            // or an independent acceptance of the frozen population.
+            observationsCreated: false,
+            collectionReady:
+              options.dryRun !== true &&
+              record.results.every(
+                (result) =>
+                  result.executionEvidence?.terminalVerified === true &&
+                  result.executionEvidence.protocol ===
+                    EVAL_EXECUTION_PROTOCOL &&
+                  result.executionEvidence.observedFallback === false &&
+                  Number.isFinite(result.totalCostUsd) &&
+                  result.totalCostUsd >= 0 &&
+                  Array.isArray(result.unrelatedChanges) &&
+                  result.unrelatedChanges.length === 0,
+              ),
+          };
+        } catch (error) {
+          (log.error || console.error)(
+            `frozen evidence persistence failed: ${error.message}`,
+          );
+          process.exitCode = 1;
+          return;
+        }
+      }
 
       if (options.otlp) {
         try {
@@ -445,8 +542,9 @@ export function registerEvalCommand(program, { logger } = {}) {
         }
       }
       try {
-        const { exportTelemetryRecorder } =
-          await import("../lib/observability/index.js");
+        const { exportTelemetryRecorder } = await import(
+          "../lib/observability/index.js"
+        );
         exportTelemetryRecorder(recorder);
       } catch {
         // Collector export is best-effort and never changes evaluation gates.
@@ -485,6 +583,8 @@ export function registerEvalCommand(program, { logger } = {}) {
       // Non-zero exit when not every task passed — usable as a CI gate.
       if (summary.total === 0 || summary.passed < summary.total)
         process.exitCode = 1;
+      else if (record.verification && !record.verification.collectionReady)
+        process.exitCode = 2;
     });
   return program;
 }

package/src/commands/memory.js

@@ -166,27 +166,40 @@ export function registerMemoryCommand(program) {
     .description("Show memory entries")
     .option("-n, --limit <n>", "Max entries", "20")
     .option("--category <cat>", "Filter by category")
+    .option("--page", "Return a page with a next-page cursor")
+    .option("--cursor <cursor>", "Continue a page using the same filters")
     .option("--json", "Output as JSON")
     .action(async (options) => {
       try {
         const ctx = await bootstrap({ verbose: program.opts().verbose });
         const service = await resolveCanonicalMemory(ctx);
         if (!ctx.db && !service.decision.canonical) {
-          logger.error("Database not available");
-          process.exit(1);
+          throw new Error("Database not available");
         }
-        const entries = service.decision.canonical
-          ? await service.list({
-              limit: Math.max(1, parseInt(options.limit) || 20),
-              category: options.category,
-            })
-          : listMemory(ctx.db.getDatabase(), {
-              limit: Math.max(1, parseInt(options.limit) || 20),
-              category: options.category,
-            });
+        const paged = Boolean(options.page || options.cursor !== undefined);
+        if (paged && !service.decision.canonical) {
+          throw new Error(
+            "Paged memory listing requires canonical memory mode",
+          );
+        }
+        if (options.cursor !== undefined && !options.cursor.trim()) {
+          throw new Error("Pagination cursor must not be empty");
+        }
+        const query = {
+          limit: Math.max(1, parseInt(options.limit) || 20),
+          category: options.category,
+        };
+        const page = paged
+          ? await service.listPage({ ...query, cursor: options.cursor })
+          : null;
+        const entries = page
+          ? page.entries
+          : service.decision.canonical
+            ? await service.list(query)
+            : listMemory(ctx.db.getDatabase(), query);
 
         if (options.json) {
-          console.log(JSON.stringify(entries, null, 2));
+          console.log(JSON.stringify(page || entries, null, 2));
         } else if (entries.length === 0) {
           logger.info("No memory entries. Use 'memory add' to create one.");
         } else {
@@ -206,11 +219,17 @@ export function registerMemoryCommand(program) {
             logger.log(`    ${chalk.gray(e.created_at)}`);
           }
         }
-
-        await shutdown();
+        if (!options.json && page?.nextCursor) {
+          logger.log(`Next page cursor: ${page.nextCursor}`);
+          logger.log(
+            "Use 'memory show --cursor <cursor>' with the same category and limit.",
+          );
+        }
       } catch (err) {
         logger.error(`Failed: ${err.message}`);
-        process.exit(1);
+        process.exitCode = 1;
+      } finally {
+        await shutdown();
       }
     });
 

package/src/commands/sandbox.js

@@ -5,6 +5,7 @@
 
 import chalk from "chalk";
 import { intArg } from "../lib/cli-arg.js";
+import { describeExecutionSupport } from "../lib/execution-support.js";
 import ora from "ora";
 import { logger } from "../lib/logger.js";
 import { bootstrap, shutdown } from "../runtime/bootstrap.js";
@@ -132,6 +133,7 @@ export function registerSandboxCommand(program, dependencies = {}) {
           availability,
           host: dependencies.host,
         });
+        report.support = describeExecutionSupport({ capabilityReport: report });
 
         if (options.json) {
           console.log(JSON.stringify(report, null, 2));
@@ -144,6 +146,13 @@ export function registerSandboxCommand(program, dependencies = {}) {
             `  Backend: ${report.backend.engine || "none"} (${report.backend.availabilityChecked ? (report.backend.available ? "available" : "unavailable") : "not probed"})`,
           );
           logger.log(`  Status:  ${report.status}`);
+          logger.log(
+            `  I/O:     ${report.support.io.stdin} stdin; captured stdout/stderr`,
+          );
+          logger.log(`  Permission source: ${report.support.permissionSource}`);
+          logger.log(
+            `  Persistent network revocation: ${report.support.persistentNetworkRevocation.status} (${report.support.persistentNetworkRevocation.reason || "configured"})`,
+          );
           logger.log(
             `  Execution observed: ${report.execution.observed ? "yes" : "no"}`,
           );

package/src/data/changelog.json

@@ -1,6 +1,32 @@
 {
   "source": "CHANGELOG.md",
   "releases": [
+    {
+      "productVersion": null,
+      "cliVersion": "0.166.87",
+      "cliVersions": ["0.166.87"],
+      "date": null,
+      "title": "",
+      "sections": [
+        {
+          "heading": "Added - cc CLI 0.166.87: October model contracts and indexed memory queries",
+          "body": "- Add exact GPT-6.1 Sol and Claude Sonnet 5.5 profiles, model-specific cache\n  pricing, Responses reasoning/output validation and reviewed catalog drift checks.\n- Push memory list filters and limits into authority-bound query indexes, retain\n  stable snapshot pagination and rebuild corrupted derived indexes from authority.\n  Upgraded index descriptors require compatible readers; older readers fail closed.\n- Add a reviewed frozen CLI evaluation entry with isolated project snapshots,\n  independent acceptance scripts and raw execution evidence. Real provider/IDE\n  evaluation and billing acceptance remain separate from fixture validation.\n- Support explicit cooperative Linux cgroup2 ownership cleanup after supervisor\n  loss, preserving quarantine when kernel identity or durable settlement is unknown.\n- Verify Codex 0.160.0 native protocol and pinned MCP reference-server recovery\n  without expanding the production external-agent admission allowlist.\n- Pair VS Code `0.37.132` and JetBrains `0.4.150` with CLI `0.166.87` for live\n  capability diagnostics, strict CLI identity and bounded slow-start draft handling."
+        }
+      ]
+    },
+    {
+      "productVersion": null,
+      "cliVersion": "0.166.86",
+      "cliVersions": ["0.166.86"],
+      "date": null,
+      "title": "",
+      "sections": [
+        {
+          "heading": "Added - cc CLI 0.166.86: segmented memory and controlled permission authority",
+          "body": "- Store canonical Context/Memory records, audit events and reconciliations in\n  bounded immutable buckets committed through one atomic manifest; migrate v1\n  under the existing authority lock. Shadow mode remains read-only.\n- Keep per-file limits, bounded aggregate capacity and explicit post-commit\n  failure reporting. Full queries still scan; this is not an indexed-query SLO.\n- Add an explicit cooperative Linux host for durable settings/scoped permission\n  authority across processes and Workers, with bound cleanup acknowledgements.\n  Default CLI/IDE activation and Windows/macOS durable support are unchanged.\n- Pair VS Code `0.37.131` bounded image decoding and JetBrains `0.4.149` bounded\n  file snapshots only after complete exact-commit gates and public CLI verification."
+        }
+      ]
+    },
     {
       "productVersion": null,
       "cliVersion": "0.166.85",

package/src/lib/causal-observability.js

@@ -7,7 +7,11 @@
  */
 
 import crypto from "node:crypto";
-import { PRICE_TABLE, priceRollup } from "./llm-pricing.js";
+import {
+  PRICE_TABLE,
+  priceRollup,
+  normalizePricingTerms,
+} from "./llm-pricing.js";
 import {
   projectUsagePricingContext,
   mergeUsagePricingBucket,
@@ -267,50 +271,7 @@ function normalizePricingTable(table = PRICE_TABLE) {
         result.exact = entry.exact;
       }
       if (Object.hasOwn(entry, "terms")) {
-        const terms = entry.terms;
-        const nonNegative = (value) => {
-          if (typeof value !== "number" || !Number.isFinite(value) || value < 0)
-            throw new Error("invalid pricing multiplier");
-          return value;
-        };
-        assertKnownOwnKeys(
-          terms,
-          new Set([
-            "cacheReadMultiplier",
-            "cacheWriteMultiplier",
-            "longContext",
-            "serviceMultipliers",
-          ]),
-          "pricing terms",
-        );
-        assertKnownOwnKeys(
-          terms.longContext,
-          new Set(["threshold", "inputMultiplier", "outputMultiplier"]),
-          "pricing long context",
-        );
-        const threshold = nonNegative(terms.longContext.threshold);
-        if (!Number.isSafeInteger(threshold))
-          throw new Error("invalid pricing threshold");
-        assertKnownOwnKeys(
-          terms.serviceMultipliers,
-          new Set(["standard", "default", "auto", "batch", "flex", "fast"]),
-          "pricing service multipliers",
-        );
-        result.terms = {
-          cacheReadMultiplier: nonNegative(terms.cacheReadMultiplier),
-          cacheWriteMultiplier: nonNegative(terms.cacheWriteMultiplier),
-          longContext: {
-            threshold,
-            inputMultiplier: nonNegative(terms.longContext.inputMultiplier),
-            outputMultiplier: nonNegative(terms.longContext.outputMultiplier),
-          },
-          serviceMultipliers: Object.fromEntries(
-            Object.entries(terms.serviceMultipliers).map(([key, value]) => [
-              key,
-              nonNegative(value),
-            ]),
-          ),
-        };
+        result.terms = normalizePricingTerms(entry.terms);
       }
       return result;
     });

package/src/lib/context-memory-kernel/durable-memory-port.js

@@ -21,6 +21,16 @@ import {
 } from "@chainlesschain/context-memory-kernel";
 import { withFileLock } from "../with-file-lock.js";
 import { getHomeDir } from "../paths.js";
+import { resolve } from "node:path";
+import {
+  compareMemoryRows,
+  decodeListCursor,
+  encodeListCursor,
+  listCursorBinding,
+  matchesListQuery,
+  normalizeListQuery,
+  pageLimit,
+} from "./memory-query-index.js";
 
 const STORE_SCHEMA = "chainlesschain.cli-context-memory-store/v1";
 const DEFAULT_MAX_STORE_BYTES = 64 * 1024 * 1024;
@@ -139,7 +149,7 @@ function advanceRevision(state) {
   state.storeRevision += 1;
 }
 
-function readBoundedState(filePath, maxStoreBytes) {
+function readBoundedState(filePath, maxStoreBytes, rejectHardLinks = false) {
   const descriptor = openSync(
     filePath,
     constants.O_RDONLY |
@@ -148,7 +158,7 @@ function readBoundedState(filePath, maxStoreBytes) {
   );
   try {
     const stat = fstatSync(descriptor);
-    if (!stat.isFile()) {
+    if (!stat.isFile() || (rejectHardLinks && stat.nlink !== 1)) {
       throw corruptStore(filePath, "authority path is not a regular file");
     }
     if (stat.size > maxStoreBytes) {
@@ -292,19 +302,48 @@ export class DurableJsonMemoryPort {
     );
   }
 
-  async listRecords({ includeTombstones = false } = {}) {
+  async listRecords(options = {}) {
+    const query = normalizeListQuery(options);
     const records = await this.query();
     return records
-      .filter(
-        (record) =>
-          includeTombstones || !["deleted", "purged"].includes(record.state),
-      )
-      .sort(
-        (left, right) =>
-          right.importance - left.importance ||
-          right.updatedAt.localeCompare(left.updatedAt, "en") ||
-          left.memoryId.localeCompare(right.memoryId, "en"),
+      .filter((record) => matchesListQuery(record, query))
+      .sort(compareMemoryRows)
+      .slice(
+        0,
+        options.limit == null
+          ? undefined
+          : Math.max(1, Number(options.limit) || 20),
+      );
+  }
+
+  async listPage(options = {}) {
+    const query = normalizeListQuery(options);
+    const count = pageLimit(options.limit);
+    return this._locked(() => {
+      const state = this._readUnlocked();
+      const binding = listCursorBinding(
+        resolve(this.filePath),
+        state.digest,
+        query,
       );
+      const after = decodeListCursor(options.cursor, binding);
+      const matches = Object.values(state.records)
+        .filter(
+          (record) =>
+            matchesListQuery(record, query) &&
+            (!after || compareMemoryRows(record, after) > 0),
+        )
+        .sort(compareMemoryRows);
+      const records = matches.slice(0, count);
+      return {
+        records,
+        storeRevision: state.storeRevision,
+        nextCursor:
+          matches.length > count
+            ? encodeListCursor(binding, records.at(-1))
+            : null,
+      };
+    });
   }
 
   async commit({ record, event, reconciliation }, expectedRevision = 0) {
@@ -364,6 +403,9 @@ export class DurableJsonMemoryPort {
 }
 
 export {
+  corruptStore,
+  readBoundedState,
+  syncDirectory,
   DEFAULT_MAX_EVENTS,
   DEFAULT_MAX_STORE_BYTES,
   STORE_SCHEMA,

package/src/lib/context-memory-kernel/index.js

@@ -1,5 +1,6 @@
 export * from "./authority.js";
 export * from "./durable-memory-port.js";
+export * from "./segmented-memory-port.js";
 export * from "./jsonl-session-context-port.js";
 export * from "./message-adapter.js";
 export * from "./memory-service.js";