dsh-continual-evolve 0.4.0 → 0.6.0

package/README.md

@@ -7,7 +7,7 @@
 [![CI](https://github.com/ZK-Andy/dsh-continual-evolve/actions/workflows/ci.yml/badge.svg)](https://github.com/ZK-Andy/dsh-continual-evolve/actions/workflows/ci.yml)
 [![License: MIT](https://img.shields.io/badge/license-MIT-blue.svg)](LICENSE)
 [![Node](https://img.shields.io/badge/node-%5E22.19%20%7C%7C%20%3E%3D24-339933)](package.json)
-[![Tests](https://img.shields.io/badge/tests-527%20passing-brightgreen)]()
+[![Tests](https://img.shields.io/badge/tests-573%20passing-brightgreen)]()
 
 Continual self-evolution for [DeepSeek Harness](https://github.com/deepseek-ai/deepseek-harness): a versioned, auditable, rollback-safe harness state layer — prompt notes, memories, skills, subagent specs — refined from session trajectories.
 
@@ -20,14 +20,15 @@ Agents accumulate reusable experience (repeated failures, durable facts, reusabl
 - **Local scope** per session; **global scope** across sessions with merge semantics — plus mechanical promotion guards so only portable, substantial, non-duplicate knowledge reaches global
 - **Deterministic rollback**: inverse edits generated from applied results — no LLM re-guessing
 - **Benchmark loop**: candidate refinements are evaluated against frozen cases by a separate scorer before acceptance (rubric encrypted at rest)
+- **Store hygiene**: `/evolve consolidate` turns write-time conflict hints and zero-use staleness into one approved, fully reversible batch of archives — with `merge`, near-duplicate content folds into the surviving original
 
 ## How it works
 
 1. **Sediment** — the model creates entries via `evolve_add`, or the automatic review gate proposes them from the session trajectory (turn-interval + compaction checkpoints).
-2. **Guard** — code-enforced validation: edit schema, blast-radius/scope coherence, and the promotion policy (project-scoped markers, thin content, near-duplicate detection keep the global store clean).
+2. **Guard** — code-enforced validation: edit schema, blast-radius/scope coherence, and the promotion policy (project-scoped markers, thin content, near-duplicate detection, credential screening keep the global store clean — secrets are rejected at every write sink, including mount materialization). Global creates that near-duplicate an existing entry are rejected at write time (≥0.8 similarity); moderate overlaps carry a `conflictHint` for later consolidation.
 3. **Approve** — global writes require explicit human approval; local-fate proposals are consulted before they land.
-4. **Apply & inject** — atomic apply with snapshot + audit event. Prompt notes and delegation specs inject into the system prompt (capped, relevance-ranked, zero tokens when empty); memories/skills appear as a capped directory index.
-5. **Validate & roll back** — benchmarks score candidates against frozen cases; rejected candidates roll back deterministically.
+4. **Apply & inject** — atomic apply with snapshot + audit event. Prompt notes and delegation specs inject into the system prompt (capped, relevance-ranked, contradicted entries demoted, zero tokens when empty); memories/skills appear as a capped directory index.
+5. **Validate & roll back** — benchmarks score candidates against frozen cases; rejected candidates roll back deterministically and are captured as draft regression cases (`auto_regression` benchmark).
 
 ## Install
 
@@ -52,6 +53,7 @@ Commands (in-session):
 | `/evolve plan [msg]` | run the LLM planner against the store |
 | `/evolve wrapup` | assess this session's local entries: promote / archive / keep |
 | `/evolve archive · unarchive · demote <id>` | hide from injection (data kept, restorable) — `demote` targets global noise |
+| `/evolve consolidate [apply] [merge]` | report (or apply) one batch archive of conflict-hinted + stale zero-use global entries; `merge` folds near-duplicate content into the survivors |
 | `/evolve failures` | aggregated failure classes (gate + benchmark) |
 | `/evolve log [tail N] [session <id>]` | plugin log |
 | `/evolve export · import <path>` | backup / restore a store |
@@ -61,6 +63,8 @@ Commands (in-session):
 
 Model tools: `evolve_list / add / update / delete / rollback`.
 
+For third-party consumers: every applied evolution (gate or manual) appends a structured `evolve_complete` event to `reviews.jsonl` (`src/evolve-event.ts` defines the shape) alongside the human-readable audit records.
+
 Injection shape: prompt notes and delegation specs inject with content (≤6/kind × 180 chars, relevance-ranked). Memories and skills appear as a directory index (`[kind:id] title`, capped at 15 lines with a fold counter) — full text via `evolve_list`. Empty store = zero injected tokens.
 
 ## Configuration
@@ -85,6 +89,7 @@ Injection shape: prompt notes and delegation specs inject with content (≤6/kin
 | `rubricKey` | auto-generated key file | AES-256-GCM passphrase for benchmark rubrics (`DSH_EVOLVE_RUBRIC_KEY` overrides) |
 | `logToFile` / `logLevel` / `logMaxBytes` | `true` / `1` / 5 MiB | plugin-owned JSONL file log with rotation |
 | `autoRollbackOnReject` | `true` | deterministic rollback after a benchmark rejection |
+| `autoCase` | `true` | failed evolution attempts are captured as draft regression cases (`auto_regression` benchmark) |
 | `reviewModel` | agent's own | optional cheaper model for the gate (`"provider/model"`) |
 
 Example profile patch:
@@ -100,7 +105,7 @@ Example profile patch:
 
 ```bash
 pnpm install && pnpm build   # deps + tsc -> lib/
-pnpm test                    # vitest (527 tests)
+pnpm test                    # vitest (573 tests)
 pnpm test:coverage           # v8 coverage, thresholds enforced in CI
 pnpm lint                    # oxlint src test
 ```
@@ -109,12 +114,13 @@ Project layout:
 
 ```
 ├── src/                   # engine, tools, commands, gate, fate, benchmark, usage…
-├── test/                  # vitest suites (33 files)
+├── test/                  # vitest suites (36 files)
 ├── lib/                   # build output (tsc)
 ├── docs/
 │   ├── design.md          # full design doc (hardening matrix)
 │   ├── FAQ.md             # real failure/fix records
 │   ├── gap-analysis.md    # vs prime-agent /refine + penguin-harness
+│   ├── research/pi-dsh-competitor-gap-analysis.md  # pi/dsh ecosystem competitors
 │   ├── experiment-bootstrap.md
 │   ├── archive/           # closed point-in-time reports
 │   └── research/          # penguin report + prime-agent annotated source

package/README.zh.md

@@ -7,7 +7,7 @@
 [![CI](https://github.com/ZK-Andy/dsh-continual-evolve/actions/workflows/ci.yml/badge.svg)](https://github.com/ZK-Andy/dsh-continual-evolve/actions/workflows/ci.yml)
 [![License: MIT](https://img.shields.io/badge/license-MIT-blue.svg)](LICENSE)
 [![Node](https://img.shields.io/badge/node-%5E22.19%20%7C%7C%20%3E%3D24-339933)](package.json)
-[![Tests](https://img.shields.io/badge/tests-527%20passing-brightgreen)]()
+[![Tests](https://img.shields.io/badge/tests-573%20passing-brightgreen)]()
 
 [DeepSeek Harness](https://github.com/deepseek-ai/deepseek-harness)（`dsh`）的持续自进化插件：一套**版本化、可审计、可回滚**的 harness 状态层——提示词补充、记忆、技能、子代理规格——从会话轨迹中沉淀而来。
 
@@ -20,14 +20,15 @@ Agent 在每个会话里积累可复用经验（重复失败、持久事实、
 - **local 会话级 / global 跨会话** 双作用域与合并语义——配合机械化晋升守卫，只有可携带、有分量、非重复的知识才能进全局
 - **确定性回滚**：逆操作编辑由已应用结果生成——不靠 LLM 重新猜测
 - **benchmark 闭环**：候选沉淀先经冻结用例 + 独立评分者评估再接受（rubric 加密落盘）
+- **store 卫生**：`/evolve consolidate` 把写入时冲突提示与零使用陈旧条目变成一次批准、完全可逆的批量归档——加 `merge` 可将近重复内容并入幸存原条目
 
 ## 工作原理
 
 1. **沉淀**——模型经 `evolve_add` 创建条目，或自动 review 门禁从会话轨迹提议（回合间隔 + 压缩检查点）。
-2. **守卫**——代码强制校验：编辑 schema、blast-radius 与作用域一致性、晋升政策（项目专属标记 / 过薄内容 / 近似重复检测保持全局库干净）。
+2. **守卫**——代码强制校验：编辑 schema、blast-radius 与作用域一致性、晋升政策（项目专属标记 / 过薄内容 / 近似重复检测 / 凭据筛查保持全局库干净——密钥类内容在所有写入出口被拒，含 mount 物化）。全局 create 与既有条目高度相似（≥0.8）时写入即拒；中等重叠带 `conflictHint` 供后续合并。
 3. **审批**——全局写入需明确人工批准；local 归宿提议先征询后落地。
-4. **应用与注入**——原子应用带快照与审计事件。prompt 补充与委派规格注入系统提示词（封顶、按相关性排序、空 store 零 token）；memory/skill 以目录索引出现。
-5. **验证与回滚**——benchmark 用冻结用例为候选打分；被拒候选确定性回滚。
+4. **应用与注入**——原子应用带快照与审计事件。prompt 补充与委派规格注入系统提示词（封顶、按相关性排序、被证伪条目降权、空 store 零 token）；memory/skill 以目录索引出现。
+5. **验证与回滚**——benchmark 用冻结用例为候选打分；被拒候选确定性回滚，并自动沉淀为 draft 回归用例（`auto_regression` 基准）。
 
 ## 安装
 
@@ -52,6 +53,7 @@ dsh plugin add ZK-Andy/dsh-continual-evolve
 | `/evolve plan [msg]` | 对 store 运行 LLM 规划器 |
 | `/evolve wrapup` | 收尾本会话 local 条目：晋升 / 归档 / 保留 |
 | `/evolve archive · unarchive · demote <id>` | 从注入中隐藏（数据保留可恢复）——`demote` 针对全局噪声 |
+| `/evolve consolidate [apply] [merge]` | 报告（或应用）冲突提示 + 零使用陈旧全局条目的批量归档；`merge` 将近重复内容并入幸存原条目 |
 | `/evolve failures` | 失败类聚合（门禁 + benchmark） |
 | `/evolve log [tail N] [session <id>]` | 插件日志 |
 | `/evolve export · import <path>` | 备份 / 恢复 store |
@@ -61,6 +63,8 @@ dsh plugin add ZK-Andy/dsh-continual-evolve
 
 模型工具：`evolve_list / add / update / delete / rollback`。
 
+第三方消费：每次进化落地（门禁或手动）都会向 `reviews.jsonl` 追加结构化 `evolve_complete` 事件（shape 见 `src/evolve-event.ts`），与人类可读的审计记录并存。
+
 注入形态：prompt 补充与委派规格带内容注入（每 kind ≤6 条 × 180 字符，按相关性排序）。memory/skill 以目录索引出现（`[kind:id] 标题`，15 行封顶 + 折叠计数行）——全文经 `evolve_list` 获取。空 store = 零注入 token。
 
 ## 配置
@@ -85,6 +89,7 @@ dsh plugin add ZK-Andy/dsh-continual-evolve
 | `rubricKey` | 自动生成本地密钥文件 | benchmark rubric 的 AES-256-GCM 口令（`DSH_EVOLVE_RUBRIC_KEY` 可覆盖） |
 | `logToFile` / `logLevel` / `logMaxBytes` | `true` / `1` / 5 MiB | 插件自带 JSONL 文件日志带轮转 |
 | `autoRollbackOnReject` | `true` | benchmark 拒绝后自动确定性回滚 |
+| `autoCase` | `true` | 失败的进化尝试自动沉淀为 draft 回归用例（`auto_regression` 基准） |
 | `reviewModel` | agent 自身 | 门禁可选更便宜的模型（`"provider/model"`） |
 
 profile patch 示例：
@@ -100,7 +105,7 @@ profile patch 示例：
 
 ```bash
 pnpm install && pnpm build   # 依赖 + tsc -> lib/
-pnpm test                    # vitest（527 例）
+pnpm test                    # vitest（573 例）
 pnpm test:coverage           # v8 覆盖率，CI 强制阈值
 pnpm lint                    # oxlint src test
 ```
@@ -109,12 +114,13 @@ pnpm lint                    # oxlint src test
 
 ```
 ├── src/                   # 引擎、工具、命令、门禁、fate、benchmark、usage…
-├── test/                  # vitest 测试套件（33 个文件）
+├── test/                  # vitest 测试套件（36 个文件）
 ├── lib/                   # 构建产物（tsc）
 ├── docs/
 │   ├── design.md          # 完整设计文档（硬化矩阵）
 │   ├── FAQ.md             # 真实踩坑记录
 │   ├── gap-analysis.md    # 对照 prime-agent /refine + penguin-harness
+│   ├── research/pi-dsh-competitor-gap-analysis.md  # pi/dsh 生态竞品差距分析
 │   ├── experiment-bootstrap.md
 │   ├── archive/           # 已完结的一次性报告
 │   └── research/          # penguin 报告 + prime-agent 注释源码

package/lib/apply.d.ts

@@ -5,7 +5,6 @@
  * edits whose target entry changed while planning was in flight.
  */
 import type { EntrySource, HarnessScope, HarnessState, RefinementProposal, RefinementResult } from "./types.js";
-import { entryChangedSince } from "./state.js";
 export interface ApplyOptions {
     id: string;
     scope?: HarnessScope;
@@ -20,5 +19,4 @@ export interface ApplyOptions {
     source?: EntrySource;
 }
 export declare function applyRefinementProposal(state: HarnessState, proposal: RefinementProposal, options: ApplyOptions): RefinementResult;
-export { entryChangedSince };
 //# sourceMappingURL=apply.d.ts.map

package/lib/apply.js

@@ -11,19 +11,23 @@ export function applyRefinementProposal(state, proposal, options) {
         // A CREATE must never bake that view prefix into a permanent id
         // (observed: global entries literally named "local:handoff_todo_…").
         // Updates/deletes keep the raw id — they address existing entries.
-        const requestedId = edit.action === "create" ? edit.id?.replace(/^(?:local|global):/, "") : edit.id;
+        // (Review audit 2026-08-28 S7: planner update/delete edits against
+        // the merged view carry the same prefix — strip it there too, they
+        // address the same underlying entry.)
+        const prefixlessId = edit.id?.replace(/^(?:local|global):/, "");
+        const requestedId = edit.action === "create" ? prefixlessId : edit.id && prefixlessId;
         const computedId = requestedId ?? (edit.action === "create" ? slug(edit.title ?? edit.kind, edit.kind) : undefined);
         const id = computedId ?? "";
-        const validationError = validateEdit(edit, computedId, options.scope);
-        if (validationError) {
-            appliedEdits.push({ ...edit, id, applied: false, error: validationError });
+        // Unknown kinds fail per-edit — a malformed proposal must never crash
+        // the whole pass (review audit 2026-08-28 S1).
+        const records = state.entries[edit.kind];
+        if (!records) {
+            appliedEdits.push({ ...edit, id, applied: false, error: `unsupported kind ${String(edit.kind)}` });
             continue;
         }
-        const records = state.entries[edit.kind];
         const before = cloneEntry(records[id]);
         const entryKey = `${edit.kind}:${id}`;
-        const baseline = cloneEntry(options.baselineState?.entries[edit.kind][id]);
-        if (options.baselineState && !touched.has(entryKey) && JSON.stringify(before ?? null) !== JSON.stringify(baseline ?? null)) {
+        if (options.baselineState && !touched.has(entryKey) && entryChangedSince(options.baselineState, state, edit.kind, id)) {
             appliedEdits.push({
                 ...edit,
                 id,
@@ -33,6 +37,13 @@ export function applyRefinementProposal(state, proposal, options) {
             });
             continue;
         }
+        // Validation sees the current entry so update rules can distinguish
+        // "carrying the persisted value" from "changing it" (skill_kind).
+        const validationError = validateEdit(edit, computedId, options.scope, before);
+        if (validationError) {
+            appliedEdits.push({ ...edit, id, applied: false, error: validationError });
+            continue;
+        }
         if (edit.action === "delete") {
             if (!before) {
                 appliedEdits.push({ ...edit, id, applied: false, error: "entry not found" });
@@ -135,5 +146,4 @@ export function applyRefinementProposal(state, proposal, options) {
         ...(options.scope ? { scope: options.scope } : {}),
     };
 }
-export { entryChangedSince };
 //# sourceMappingURL=apply.js.map

package/lib/auto.d.ts

@@ -44,6 +44,14 @@ export interface AutoReviewConfig {
      * local-fate dimension before anything reaches the global store.
      */
     promotionPolicy: PromotionPolicy;
+    /**
+     * P1 auto-case capture: a gate run whose planned edits all failed to get
+     * consent captures the attempt as a draft regression scaffold in the
+     * auto-regression container benchmark (never in a user benchmark).
+     */
+    autoCase: boolean;
+    /** Resolved rubric key for the capture's encrypted scaffold rubric. */
+    rubricKey?: Buffer;
 }
 export interface GateState {
     turns: number;
@@ -81,12 +89,6 @@ export interface ReviewRecord {
     rationale?: string;
     refinementId?: string;
 }
-/**
- * Count completed turns from agent/status transitions (running → idle).
- * Exported for unit testing; production counting uses agent/turn-stopping
- * (see registerAutoReview) which empirically carries the agent subject.
- */
-export declare function advanceGateState(state: GateState, status: string): boolean;
 export declare function registerAutoReview(ctx: Context, engine: EvolutionEngine, config: AutoReviewConfig): void;
 /**
  * Gap C1: parse a "provider/model" or "model" string into its components.

package/lib/auto.js

@@ -20,32 +20,16 @@ import { join } from "node:path";
 import { slug } from "./types.js";
 import { planWithLlm } from "./planner.js";
 import { reviewAutoRefine, serializeSurface } from "./review.js";
-import { goalServiceOf } from "./goal.js";
+import { goalDrivesRounds, goalServiceOf } from "./goal.js";
 import { notifyAutoReview } from "./notify.js";
 import { runLocalFatePhase } from "./fate.js";
 import { entrySourceOf } from "./source.js";
 import { mergeHarnessStates } from "./state.js";
 import { questionServiceOf } from "./approval.js";
 import { buildEvolveCompleteEvent, emitEvolveComplete } from "./evolve-event.js";
+import { captureAutoCase } from "./autocase.js";
 /** Turns a rejected skill candidate stays silent before being offered again. */
 export const SKILL_CONSULT_COOLDOWN_TURNS = 10;
-/**
- * Count completed turns from agent/status transitions (running → idle).
- * Exported for unit testing; production counting uses agent/turn-stopping
- * (see registerAutoReview) which empirically carries the agent subject.
- */
-export function advanceGateState(state, status) {
-    if (status === "running") {
-        state.running = true;
-        return false;
-    }
-    if (status === "idle" && state.running) {
-        state.running = false;
-        state.turns += 1;
-        return true;
-    }
-    return false;
-}
 export function registerAutoReview(ctx, engine, config) {
     const perSession = new Map();
     const logger = ctx.logger("continual-evolve");
@@ -79,7 +63,7 @@ export function registerAutoReview(ctx, engine, config) {
         // v3 optional: an active evolution goal drives the gate EVERY round
         // (the goal's round machine keeps the session continuing); without a
         // goal the plain turn interval applies.
-        const goalDriven = goalServiceOf(ctx)?.get(agent)?.phase === "active";
+        const goalDriven = goalDrivesRounds(goalServiceOf(ctx)?.get(agent));
         if (!goalDriven && state.turns - state.lastReviewAt < config.intervalTurns)
             return;
         // Run the gate outside the listener turn: agent is idle, work is auxiliary.
@@ -188,12 +172,26 @@ export function loadGateHarnessView(engine, sessionId) {
  * review's optimistic-concurrency checks.
  */
 async function runGate(ctx, engine, agent, config, state, reason, record) {
-    await runReviewPhase(ctx, engine, agent, config, state, reason, record);
-    // D3: a goal stuck in "blocked" for consecutive gate runs gets one
-    // local-fate assessment (the pipeline below), so whatever led the goal
-    // astray is distilled before the session moves on.
-    await runGoalBlockedFate(ctx, engine, agent, config, state, reason, record);
-    await runLocalFatePhase(ctx, engine, agent, config, state, reason, record);
+    // Reentry guard (review audit 2026-08-28 S3): a gate run holds LLM calls
+    // and possibly a user question for a long time; an idle/compaction
+    // trigger overlapping the run would start a second concurrent pipeline
+    // whose stale whole-file saves clobber the first run's writes.
+    if (state.running) {
+        ctx.logger("continual-evolve").info(`auto-review skipped [${agent.id}]: previous gate run still in flight`);
+        return;
+    }
+    state.running = true;
+    try {
+        await runReviewPhase(ctx, engine, agent, config, state, reason, record);
+        // D3: a goal stuck in "blocked" for consecutive gate runs gets one
+        // local-fate assessment (the pipeline below), so whatever led the
+        // goal astray is distilled before the session moves on.
+        await runGoalBlockedFate(ctx, engine, agent, config, state, reason, record);
+        await runLocalFatePhase(ctx, engine, agent, config, state, reason, record);
+    }
+    finally {
+        state.running = false;
+    }
 }
 /**
  * D3 (goal blocked → wrap-up coupling, reverse direction): count consecutive
@@ -285,7 +283,25 @@ async function runReviewPhase(ctx, engine, agent, config, state, reason, record)
         };
     if (finalProposal.edits.length === 0) {
         const withheld = skillEdits.length > 0 ? " (skill proposal withheld — user not consulted or declined)" : "";
-        logger.info(`auto-review declined (${reason}) [${sessionId}] after ${turnsSinceLastReview} turns: no consented edits${withheld} — ${review.rationale}`);
+        logger.info(`auto-review declined (${reason}) [${sessionId}]: no consented edits${withheld} — ${review.rationale}`);
+        // P1 auto-case capture: an attempted evolution that never landed is a
+        // regression asset. Contained — capture failure must not disturb the gate.
+        if (config.autoCase) {
+            try {
+                const captured = captureAutoCase({
+                    baseDir: engine.baseDir,
+                    rubricKey: config.rubricKey,
+                    source: "gate_no_consent",
+                    sessionId,
+                    summary: finalProposal.summary,
+                    reasons: [review.rationale],
+                });
+                logger.info(`auto-review auto-case captured (${reason}) [${sessionId}]: ${captured.caseId}`);
+            }
+            catch (cause) {
+                logger.warn(`auto-case capture failed for ${sessionId}: ${cause instanceof Error ? cause.message : String(cause)}`);
+            }
+        }
         record({ sessionId, reason, turnsSinceLastReview, outcome: "declined", rationale: `${review.rationale}${withheld}` });
         return;
     }

package/lib/autocase.d.ts

@@ -0,0 +1,38 @@
+/** The dedicated container benchmark every auto-case lands in (sanitizeId-safe). */
+export declare const AUTO_CASE_BENCHMARK_ID = "auto_regression";
+/** Which failed-evolution trigger produced the capture. */
+export type AutoCaseSource = "benchmark_rejection" | "gate_no_consent";
+export interface AutoCaseInput {
+    baseDir: string;
+    /**
+     * Resolved rubric key — captures must decrypt under the installation's
+     * real key. Omitting it silently encrypts with the dev fallback, making
+     * the scaffold unreadable to the real key; callers resolve once and pass.
+     */
+    rubricKey?: Buffer | undefined;
+    source: AutoCaseSource;
+    sessionId?: string | undefined;
+    /** One line for what was being attempted (candidate label / proposal summary). */
+    summary: string;
+    /** Machine-captured failure reasons (decision reasons / gate rationale). */
+    reasons: readonly string[];
+    /** Refinement id when the attempt produced one (e.g. a rolled-back candidate). */
+    refinementId?: string | undefined;
+    now?: number | undefined;
+}
+export interface AutoCaseCapture {
+    bid: string;
+    caseId: string;
+}
+/** The draft statement: a structured scaffold, not an evaluable task yet. */
+export declare function renderAutoCaseStatement(input: AutoCaseInput, stamp: string): string;
+/** The draft rubric: explicitly not scoreable until a human rewrites it. */
+export declare function renderAutoCaseRubric(input: AutoCaseInput): string;
+/**
+ * Capture one failed evolution attempt as a draft case in the container
+ * benchmark, creating the container on first use. Id uniqueness comes from
+ * the millisecond stamp; two captures in the same millisecond throw (the
+ * caller's containment turns that into a warning, never a lost trigger).
+ */
+export declare function captureAutoCase(input: AutoCaseInput): AutoCaseCapture;
+//# sourceMappingURL=autocase.d.ts.map

package/lib/autocase.js

@@ -0,0 +1,76 @@
+/**
+ * Auto-case capture (P1, 2026-08-28): failed evolution attempts become DRAFT
+ * benchmark cases — regression assets for the benchmark loop instead of
+ * discarded failure notes.
+ *
+ * Captures land in a dedicated container benchmark (auto-regression), NEVER
+ * in a user benchmark: a benchmark run evaluates every case in its container
+ * without a status filter, and an auto-case's rubric is a mechanical scaffold
+ * that must never be scored. Humans promote a capture into a real benchmark
+ * by re-authoring statement and rubric there, then casecheck → pilot →
+ * freeze. The container benchmark keeps the staging area visible and
+ * rollback-free (no engine involvement anywhere).
+ *
+ * No LLM call: the capture is deterministic. Callers own containment — a
+ * failed capture must never break the trigger path (benchmark run, gate).
+ */
+import { addCase, createBenchmark, loadBenchmark } from "./benchmark.js";
+/** The dedicated container benchmark every auto-case lands in (sanitizeId-safe). */
+export const AUTO_CASE_BENCHMARK_ID = "auto_regression";
+/** Id-safe compact timestamp (20260828T131934000Z style), unique per capture. */
+function idStamp(now) {
+    return new Date(now)
+        .toISOString()
+        .replace(/[-:]/g, "")
+        .replace(".", "")
+        .replace("Z", "Z");
+}
+/** The draft statement: a structured scaffold, not an evaluable task yet. */
+export function renderAutoCaseStatement(input, stamp) {
+    const lines = [
+        "# Auto-generated regression scaffold",
+        "",
+        `- source: ${input.source}`,
+        `- captured: ${stamp}`,
+        `- session: ${input.sessionId ?? "(unknown)"}`,
+        ...(input.refinementId ? [`- refinement: ${input.refinementId}`] : []),
+        `- attempted: ${input.summary}`,
+        "- failure reasons:",
+        ...(input.reasons.length > 0 ? input.reasons.map((reason) => `  - ${reason}`) : ["  - (none captured)"]),
+        "",
+        "This case was captured mechanically from a failed evolution attempt.",
+        "It lives in the auto-regression container and never enters a user",
+        "benchmark automatically. To promote it: re-author the statement and",
+        "rubric in a real benchmark, then casecheck → pilot → freeze.",
+    ];
+    return `${lines.join("\n")}\n`;
+}
+/** The draft rubric: explicitly not scoreable until a human rewrites it. */
+export function renderAutoCaseRubric(input) {
+    return [
+        "Draft scaffold — the real rubric is authored at calibration time.",
+        `Scoring signal captured from the failure: ${input.reasons.join("; ") || "(none)"}.`,
+        "Scoring against this scaffold is meaningless until a human rewrites it;",
+        "the case stays in the auto-regression container and out of real runs.",
+    ].join("\n");
+}
+/**
+ * Capture one failed evolution attempt as a draft case in the container
+ * benchmark, creating the container on first use. Id uniqueness comes from
+ * the millisecond stamp; two captures in the same millisecond throw (the
+ * caller's containment turns that into a warning, never a lost trigger).
+ */
+export function captureAutoCase(input) {
+    if (!loadBenchmark(input.baseDir, AUTO_CASE_BENCHMARK_ID)) {
+        createBenchmark(input.baseDir, {
+            title: AUTO_CASE_BENCHMARK_ID,
+            description: "Draft regression scaffolds captured mechanically from failed evolution attempts. Not evaluated; promote captures into a real benchmark by hand (re-author statement/rubric, then casecheck → pilot → freeze).",
+        });
+    }
+    const stamp = idStamp(input.now ?? Date.now());
+    // Stamp first: sanitizeId truncates to 40 chars, and the stamp must
+    // survive the truncation for per-millisecond capture uniqueness.
+    const added = addCase(input.baseDir, AUTO_CASE_BENCHMARK_ID, `auto ${stamp} ${input.source}`, renderAutoCaseStatement(input, stamp), renderAutoCaseRubric(input), input.rubricKey);
+    return { bid: AUTO_CASE_BENCHMARK_ID, caseId: added.id };
+}
+//# sourceMappingURL=autocase.js.map

package/lib/benchmark-command.js

@@ -1,6 +1,7 @@
 import { formatHarnessStateForPrompt } from "./render.js";
 import { stripAngleBrackets } from "./command.js";
 import { addCase, caseCheckProblems, createBenchmark, listBenchmarks, listCases, loadBenchmark, loadCaseMeta, loadScoreboard, rollbackRejectedCandidate, saveCaseMeta, saveScoreboard, transitionCaseStatus } from "./benchmark.js";
+import { AUTO_CASE_BENCHMARK_ID, captureAutoCase } from "./autocase.js";
 import { decide, decisionReport, entryFromCells, flagMaterialDrift } from "./score.js";
 import { evaluateState } from "./evaluate.js";
 function success(text) {
@@ -143,7 +144,10 @@ export async function executeBenchmarkCommand(ctx, engine, invocation, rest, run
             const lines = [
                 `evaluation "${label}": ${outcome.cells.length} cells${failedCells > 0 ? `, ${failedCells} failed` : ""}, overall=${entry.overall ?? "?"}`,
                 ...Object.entries(entry.aggregate)
-                    .filter(([key]) => key !== "overall" && key !== "failed" && key !== "total")
+                    // totalDurationMs is metadata, not a case (FAQ #11: the same
+                    // leak class decide/decisionReport already fixed — this
+                    // display path was the remaining one; review audit S4).
+                    .filter(([key]) => key !== "overall" && key !== "failed" && key !== "total" && key !== "totalDurationMs")
                     .map(([key, value]) => `  ${key}: ${value ?? "?"}`),
             ];
             if (failedCells > 0) {
@@ -177,6 +181,26 @@ export async function executeBenchmarkCommand(ctx, engine, invocation, rest, run
                             const outcome = rollbackRejectedCandidate(engine, sessionId, candidateId);
                             lines.push(outcome.message);
                         }
+                        // P1 auto-case capture: the rejected candidate becomes a
+                        // draft regression scaffold. Contained — a failed capture
+                        // must never break the benchmark run's report.
+                        if (runtime.autoCase) {
+                            try {
+                                const captured = captureAutoCase({
+                                    baseDir,
+                                    rubricKey: runtime.rubricKey,
+                                    source: "benchmark_rejection",
+                                    sessionId,
+                                    summary: `${bid} candidate ${candidateId}`,
+                                    reasons: decision.reasons,
+                                    refinementId: candidateId,
+                                });
+                                lines.push(`auto-case captured: ${AUTO_CASE_BENCHMARK_ID}/${captured.caseId} (draft — promote manually if it earns a place)`);
+                            }
+                            catch (cause) {
+                                ctx.logger("continual-evolve").warn(`auto-case capture failed: ${cause instanceof Error ? cause.message : String(cause)}`);
+                            }
+                        }
                     }
                 }
             }

package/lib/benchmark.d.ts

@@ -136,10 +136,6 @@ export declare function loadScoreboard(baseDir: string, bid: string): Scoreboard
 export declare function saveScoreboard(baseDir: string, bid: string, board: Scoreboard): void;
 export declare function loadCaseMeta(baseDir: string, bid: string, cid: string): CaseMeta | undefined;
 export declare function saveCaseMeta(baseDir: string, bid: string, cid: string, meta: CaseMeta): void;
-/** List case metas for all cases in a benchmark (missing meta → defaults). */
-export declare function listCaseMetas(baseDir: string, bid: string): Map<string, CaseMeta>;
-/** Check whether a case is frozen (immutable). */
-export declare function isCaseFrozen(baseDir: string, bid: string, cid: string): boolean;
 /**
  * Transition a case's lifecycle state. Throws on illegal transitions.
  *   draft → calibrating (start pilot)
@@ -152,5 +148,4 @@ export declare function transitionCaseStatus(baseDir: string, bid: string, cid:
  * Returns human-readable problems; empty array means the case passes.
  */
 export declare function caseCheckProblems(baseDir: string, bid: string, cid: string): string[];
-export declare function removeBenchmark(baseDir: string, bid: string): void;
 //# sourceMappingURL=benchmark.d.ts.map

package/lib/benchmark.js

@@ -13,7 +13,7 @@
  * optimizer can read the file and sees ciphertext only. Legacy files that
  * predate encryption carry plaintext and are still readable.
  */
-import { existsSync, mkdirSync, readFileSync, rmSync, writeFileSync } from "node:fs";
+import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
 import { join } from "node:path";
 import { encryptRubric, DEV_RUBRIC_KEY, deriveKey } from "./rubric.js";
 /**
@@ -169,23 +169,6 @@ export function saveCaseMeta(baseDir, bid, cid, meta) {
     mkdirSync(metaDir, { recursive: true });
     writeFileSync(join(metaDir, "meta.json"), `${JSON.stringify(meta, null, 2)}\n`, "utf8");
 }
-/** List case metas for all cases in a benchmark (missing meta → defaults). */
-export function listCaseMetas(baseDir, bid) {
-    const result = new Map();
-    const cases = listCases(baseDir, bid);
-    for (const c of cases) {
-        const meta = loadCaseMeta(baseDir, bid, c.id);
-        if (meta) {
-            result.set(c.id, meta);
-        }
-    }
-    return result;
-}
-/** Check whether a case is frozen (immutable). */
-export function isCaseFrozen(baseDir, bid, cid) {
-    const meta = loadCaseMeta(baseDir, bid, cid);
-    return meta?.status === "frozen";
-}
 /**
  * Transition a case's lifecycle state. Throws on illegal transitions.
  *   draft → calibrating (start pilot)
@@ -255,12 +238,6 @@ export function caseCheckProblems(baseDir, bid, cid) {
     }
     return problems;
 }
-export function removeBenchmark(baseDir, bid) {
-    const dir = benchmarkDir(baseDir, bid);
-    if (existsSync(dir)) {
-        rmSync(dir, { recursive: true, force: true });
-    }
-}
 import { readdirSync } from "node:fs";
 function readdirSafe(dir) {
     try {

package/lib/command.d.ts

@@ -13,6 +13,8 @@ export interface CommandRuntimeOptions {
     rubricKey: Buffer;
     /** When a benchmark decision rejects a candidate, roll the refinement back automatically. */
     autoRollbackOnReject: boolean;
+    /** P1: capture failed evolution attempts as draft cases in the auto-regression benchmark. */
+    autoCase: boolean;
     /** Mechanical promotion guards for wrapup/fate (2026-08-22 policy). */
     promotionPolicy: PromotionPolicy;
 }