failproofai 1.0.3 → 1.0.4-beta.2

package/.next/standalone/node_modules/next/dist/experimental/testmode/fetch.js

@@ -83,11 +83,19 @@ function buildResponse(proxyResponse) {
         headers: new Headers(headers)
     });
 }
+function passthroughFetch(originalFetch, request) {
+    // Mark the request so the ClientRequest interception in `httpget.ts` sends it
+    // to the real server instead of intercepting it again. @mswjs/interceptors
+    // intercepts at the TCP level, so an unmarked passthrough would re-enter the
+    // interception listener from within itself, recursing indefinitely.
+    request.headers.set('next-test-internal', '1');
+    return originalFetch(request);
+}
 async function handleFetch(originalFetch, request) {
     const testInfo = (0, _context.getTestReqInfo)(request, reader);
     if (!testInfo) {
         // Passthrough non-test requests.
-        return originalFetch(request);
+        return passthroughFetch(originalFetch, request);
     }
     const { testData, proxyPort } = testInfo;
     const proxyRequest = await buildProxyRequest(testData, request);
@@ -118,7 +126,7 @@ async function handleFetch(originalFetch, request) {
     const { api } = proxyResponse;
     switch(api){
         case 'continue':
-            return originalFetch(request);
+            return passthroughFetch(originalFetch, request);
         case 'abort':
         case 'unhandled':
             throw Object.defineProperty(new Error(`Proxy request aborted [${request.method} ${request.url}]`), "__NEXT_ERROR_CODE", {

package/.next/standalone/node_modules/next/dist/lib/patch-incorrect-lockfile.js

@@ -72,7 +72,7 @@ async function fetchPkgInfo(pkg) {
         });
     }
     const data = await res.json();
-    const versionData = data.versions["16.3.2"];
+    const versionData = data.versions["16.3.4"];
     return {
         os: versionData.os,
         cpu: versionData.cpu,
@@ -100,7 +100,7 @@ async function patchIncorrectLockfile(dir) {
     const expectedSwcPkgs = Object.keys(_packagejson.optionalDependencies || {}).filter((pkg)=>pkg.startsWith('@next/swc-'));
     const patchDependency = (pkg, pkgData)=>{
         lockfileParsed.dependencies[pkg] = {
-            version: "16.3.2",
+            version: "16.3.4",
             resolved: pkgData.tarball,
             integrity: pkgData.integrity,
             optional: true
@@ -108,7 +108,7 @@ async function patchIncorrectLockfile(dir) {
     };
     const patchPackage = (pkg, pkgData)=>{
         lockfileParsed.packages[pkg] = {
-            version: "16.3.2",
+            version: "16.3.4",
             resolved: pkgData.tarball,
             integrity: pkgData.integrity,
             cpu: pkgData.cpu,

package/.next/standalone/node_modules/next/dist/lib/typescript/runTypeScriptCli.js

@@ -44,7 +44,7 @@ function _interop_require_default(obj) {
     };
 }
 function getTypeScriptPackageInfo(baseDir) {
-    var _packageJson_bin;
+    var _packageJson_bin, _Object_entries_find;
     let packageJsonPath;
     try {
         packageJsonPath = (0, _resolvefrom.resolveFrom)(baseDir, 'typescript/package.json');
@@ -54,7 +54,7 @@ function getTypeScriptPackageInfo(baseDir) {
     const packageJson = JSON.parse((0, _nodefs.readFileSync)(packageJsonPath, 'utf8'));
     const packageDir = _nodepath.default.dirname(packageJsonPath);
     const apiPath = _nodepath.default.join(packageDir, 'lib', 'typescript.js');
-    const tscBin = typeof packageJson.bin === 'string' ? packageJson.bin : (_packageJson_bin = packageJson.bin) == null ? void 0 : _packageJson_bin.tsc;
+    const tscBin = typeof packageJson.bin === 'string' ? packageJson.bin : ((_packageJson_bin = packageJson.bin) == null ? void 0 : _packageJson_bin.tsc) ?? ((_Object_entries_find = Object.entries(packageJson.bin ?? {}).find(([name])=>/^tsc\d+$/.test(name))) == null ? void 0 : _Object_entries_find[1]);
     const tscBinPath = tscBin ? _nodepath.default.resolve(packageDir, tscBin) : undefined;
     let tscPath = tscBinPath;
     if (tscBinPath && (0, _nodefs.existsSync)(tscBinPath) && packageJson.type === 'module' && _nodepath.default.extname(tscBinPath) === '') {

package/.next/standalone/node_modules/next/dist/lib/verify-typescript-setup.js

@@ -86,7 +86,9 @@ const typescriptApiPackage = {
     exportsRestrict: true
 };
 const typescriptCliPackage = {
-    file: 'typescript/bin/tsc',
+    // The CLI path is resolved from the package's bin metadata after this initial
+    // package-presence check, since aliased TypeScript packages may rename it.
+    file: 'typescript/package.json',
     pkg: 'typescript',
     exportsRestrict: true
 };

package/.next/standalone/node_modules/next/dist/server/config.js

@@ -1305,7 +1305,7 @@ async function applyModifyConfig(config, phase, silent, dir) {
             }
             config = await adapterMod.modifyConfig(config, {
                 phase,
-                nextVersion: "16.3.2",
+                nextVersion: "16.3.4",
                 projectDir: dir
             });
         }

package/.next/standalone/node_modules/next/dist/server/dev/hot-reloader-turbopack.js

@@ -302,7 +302,7 @@ async function createHotReloaderTurbopack(opts, serverFields, distDir, resetFetc
     }
     const hasRewrites = opts.fsChecker.rewrites.afterFiles.length > 0 || opts.fsChecker.rewrites.beforeFiles.length > 0 || opts.fsChecker.rewrites.fallback.length > 0;
     const hotReloaderSpan = (0, _trace.trace)('hot-reloader', undefined, {
-        version: "16.3.2"
+        version: "16.3.4"
     });
     // Ensure the hotReloaderSpan is flushed immediately as it's the parentSpan for all processing
     // of the current `next dev` invocation.
@@ -362,7 +362,7 @@ async function createHotReloaderTurbopack(opts, serverFields, distDir, resetFetc
         writeRoutesHashesManifest: false,
         currentNodeJsVersion,
         isPersistentCachingEnabled: (0, _utils2.isFileSystemCacheEnabledForDev)(opts.nextConfig),
-        nextVersion: "16.3.2",
+        nextVersion: "16.3.4",
         serverHmr: serverFastRefresh
     }, {
         turbopackMemoryEviction: opts.nextConfig.experimental.turbopackMemoryEvictionMode,

package/.next/standalone/node_modules/next/dist/server/dev/hot-reloader-webpack.js

@@ -234,7 +234,7 @@ class HotReloaderWebpack {
         this.previewProps = previewProps;
         this.rewrites = rewrites;
         this.hotReloaderSpan = (0, _trace.trace)('hot-reloader', undefined, {
-            version: "16.3.2"
+            version: "16.3.4"
         });
         // Ensure the hotReloaderSpan is flushed immediately as it's the parentSpan for all processing
         // of the current `next dev` invocation.

package/.next/standalone/node_modules/next/dist/server/lib/app-info-log.js

@@ -79,7 +79,7 @@ function _interop_require_wildcard(obj, nodeInterop) {
 }
 function logStartInfo({ networkUrl, appUrl, envInfo, logBundler }) {
     const versionSuffix = logBundler ? ` (${(0, _bundler.bundlerName)((0, _bundler.getBundlerFromEnv)())})` : '';
-    _log.bootstrap(`${(0, _picocolors.bold)((0, _picocolors.purple)(`${_log.prefixes.ready} Next.js ${"16.3.2"}`))}${versionSuffix}`);
+    _log.bootstrap(`${(0, _picocolors.bold)((0, _picocolors.purple)(`${_log.prefixes.ready} Next.js ${"16.3.4"}`))}${versionSuffix}`);
     if (appUrl) {
         _log.bootstrap(`- Local:         ${appUrl}`);
     }

package/.next/standalone/node_modules/next/dist/server/lib/incremental-cache/file-system-cache.js

@@ -310,18 +310,22 @@ class FileSystemCache {
         // Wait for all FS operations to complete.
         await writer.wait();
     }
-    getFilePath(pathname, kind) {
+    getFilePath(key, kind) {
+        let rootDir;
         switch(kind){
             case _responsecache.IncrementalCacheKind.FETCH:
                 // we store in .next/cache/fetch-cache so it can be persisted
                 // across deploys
-                return _path.default.join(this.serverDistDir, '..', 'cache', 'fetch-cache', pathname);
+                rootDir = _path.default.join(this.serverDistDir, '..', 'cache', 'fetch-cache');
+                break;
             case _responsecache.IncrementalCacheKind.PAGES:
-                return _path.default.join(this.serverDistDir, 'pages', pathname);
+                rootDir = _path.default.join(this.serverDistDir, 'pages');
+                break;
             case _responsecache.IncrementalCacheKind.IMAGE:
             case _responsecache.IncrementalCacheKind.APP_PAGE:
             case _responsecache.IncrementalCacheKind.APP_ROUTE:
-                return _path.default.join(this.serverDistDir, 'app', pathname);
+                rootDir = _path.default.join(this.serverDistDir, 'app');
+                break;
             default:
                 throw Object.defineProperty(new Error(`Unexpected file path kind: ${kind}`), "__NEXT_ERROR_CODE", {
                     value: "E479",
@@ -329,6 +333,15 @@ class FileSystemCache {
                     configurable: true
                 });
         }
+        const filePath = _path.default.join(rootDir, key);
+        if (!(filePath.startsWith(rootDir + _path.default.sep) || filePath === rootDir)) {
+            throw Object.defineProperty(new Error(`Invalid file path: ${filePath}`), "__NEXT_ERROR_CODE", {
+                value: "E1468",
+                enumerable: false,
+                configurable: true
+            });
+        }
+        return filePath;
     }
 }
 

package/.next/standalone/node_modules/next/dist/server/lib/start-server.js

@@ -177,7 +177,7 @@ async function getRequestHandlers({ dir, port, isDev, onDevServerCleanup, server
 async function startServer(serverOptions) {
     const { dir, isDev, hostname, minimalMode, allowRetry, keepAliveTimeout, selfSignedCertificate, serverFastRefresh } = serverOptions;
     let { port } = serverOptions;
-    process.title = `next-server (v${"16.3.2"})`;
+    process.title = `next-server (v${"16.3.4"})`;
     let handlersReady = ()=>{};
     let handlersError = ()=>{};
     let handlersPromise = new Promise((resolve, reject)=>{

package/.next/standalone/node_modules/next/dist/shared/lib/router/utils/escape-path-delimiters.js

@@ -10,7 +10,7 @@ Object.defineProperty(exports, "default", {
     }
 });
 function escapePathDelimiters(segment, escapeEncoded) {
-    return segment.replace(new RegExp(`([/#?]${escapeEncoded ? '|%(2f|23|3f|5c)' : ''})`, 'gi'), (char)=>encodeURIComponent(char));
+    return segment.replace(new RegExp(`([/#?\\\\]${escapeEncoded ? '|%(2f|23|3f|5c)' : ''})`, 'gi'), (char)=>encodeURIComponent(char));
 }
 
 //# sourceMappingURL=escape-path-delimiters.js.map

package/.next/standalone/node_modules/next/dist/telemetry/anonymous-meta.js

@@ -82,7 +82,7 @@ async function getAnonymousMeta() {
         isWsl: _iswsl.default,
         isCI: _ciinfo.isCI,
         ciName: _ciinfo.isCI && _ciinfo.name || null,
-        nextVersion: "16.3.2",
+        nextVersion: "16.3.4",
         agentName: await (0, _agentname.getAgentName)()
     };
     return traits;

package/.next/standalone/node_modules/next/dist/telemetry/events/swc-load-failure.js

@@ -38,7 +38,7 @@ async function eventSwcLoadFailure(event) {
     telemetry.record({
         eventName: EVENT_PLUGIN_PRESENT,
         payload: {
-            nextVersion: "16.3.2",
+            nextVersion: "16.3.4",
             glibcVersion,
             installedSwcPackages,
             arch: process.arch,

package/.next/standalone/node_modules/next/dist/telemetry/events/version.js

@@ -12,12 +12,12 @@ const EVENT_VERSION = 'NEXT_CLI_SESSION_STARTED';
 function eventCliSession(nextConfig, event) {
     var _nextConfig_experimental, _nextConfig_experimental_staleTimes, _nextConfig_experimental_staleTimes1, _nextConfig_reactCompiler, _nextConfig_reactCompiler1;
     // This should be an invariant, if it fails our build tooling is broken.
-    if (typeof "16.3.2" !== 'string') {
+    if (typeof "16.3.4" !== 'string') {
         return [];
     }
     const { images, i18n } = nextConfig || {};
     const payload = {
-        nextVersion: "16.3.2",
+        nextVersion: "16.3.4",
         nodeVersion: process.version,
         cliCommand: event.cliCommand,
         isSrcDir: event.isSrcDir,

package/.next/standalone/node_modules/next/package.json

@@ -1,6 +1,6 @@
 {
   "name": "next",
-  "version": "16.3.2",
+  "version": "16.3.4",
   "description": "The React Framework",
   "main": "./dist/server/next.js",
   "license": "MIT",
@@ -81,7 +81,7 @@
     "next": "./dist/bin/next"
   },
   "dependencies": {
-    "@next/env": "16.3.2",
+    "@next/env": "16.3.4",
     "@swc/helpers": "0.5.23",
     "baseline-browser-mapping": "^2.9.19",
     "caniuse-lite": "^1.0.30001579",
@@ -111,15 +111,15 @@
     }
   },
   "optionalDependencies": {
-    "sharp": "^0.35.3",
-    "@next/swc-darwin-arm64": "16.3.2",
-    "@next/swc-darwin-x64": "16.3.2",
-    "@next/swc-linux-arm64-gnu": "16.3.2",
-    "@next/swc-linux-arm64-musl": "16.3.2",
-    "@next/swc-linux-x64-gnu": "16.3.2",
-    "@next/swc-linux-x64-musl": "16.3.2",
-    "@next/swc-win32-arm64-msvc": "16.3.2",
-    "@next/swc-win32-x64-msvc": "16.3.2"
+    "sharp": "^0.35.4",
+    "@next/swc-darwin-arm64": "16.3.4",
+    "@next/swc-darwin-x64": "16.3.4",
+    "@next/swc-linux-arm64-gnu": "16.3.4",
+    "@next/swc-linux-arm64-musl": "16.3.4",
+    "@next/swc-linux-x64-gnu": "16.3.4",
+    "@next/swc-linux-x64-musl": "16.3.4",
+    "@next/swc-win32-arm64-msvc": "16.3.4",
+    "@next/swc-win32-x64-msvc": "16.3.4"
   },
   "keywords": [
     "react",

package/.next/standalone/package.json

@@ -1,6 +1,6 @@
 {
   "name": "failproofai",
-  "version": "1.0.3",
+  "version": "1.0.4-beta.2",
   "description": "Observability and enforcement for AI agent harnesses. 39 built-in policies hooked into 12 of them — Claude Code, Codex, Cursor, Hermes, OpenClaw and more — blocking the tool call before it runs. Local dashboard included, no account needed.",
   "bin": {
     "failproofai": "./dist/cli.mjs",
@@ -80,14 +80,14 @@
     "access": "public"
   },
   "devDependencies": {
-    "@anthropic-ai/sdk": "^0.120.0",
+    "@anthropic-ai/sdk": "^0.123.0",
     "@mdx-js/mdx": "^3.1.1",
     "@tailwindcss/postcss": "^4.3.1",
     "@tanstack/react-virtual": "^3.14.10",
     "@testing-library/jest-dom": "^7.0.0",
     "@testing-library/react": "^16.3.2",
     "@testing-library/user-event": "^14.6.5",
-    "@types/node": "26.2.0",
+    "@types/node": "26.4.1",
     "@types/react": "19.2.18",
     "@types/react-dom": "^19.2.3",
     "@vitejs/plugin-react": "^6.1.0",
@@ -102,7 +102,7 @@
     "tailwind-merge": "^3.4.0",
     "tailwindcss": "^4.3.1",
     "typescript": "6.0.3",
-    "vitest": "^4.1.11"
+    "vitest": "^5.0.0"
   },
   "dependencies": {
     "html-to-image": "^1.11.13",
@@ -117,18 +117,19 @@
     "vite": "8.0.16",
     "undici": "7.29.0",
     "brace-expansion": "5.0.9",
-    "sharp": "0.35.0"
+    "sharp": "0.35.0",
+    "browserslist": "4.28.8"
   },
   "optionalDependencies": {
-    "@failproofai/failproofaid-linux-x64": "1.0.3",
-    "@failproofai/failproofaid-linux-arm64": "1.0.3",
-    "@failproofai/failproofaid-darwin-x64": "1.0.3",
-    "@failproofai/failproofaid-darwin-arm64": "1.0.3"
+    "@failproofai/failproofaid-linux-x64": "1.0.4-beta.2",
+    "@failproofai/failproofaid-linux-arm64": "1.0.4-beta.2",
+    "@failproofai/failproofaid-darwin-x64": "1.0.4-beta.2",
+    "@failproofai/failproofaid-darwin-arm64": "1.0.4-beta.2"
   },
   "failproofaidBinaries": {
-    "linux-x64": "2a4164e88792f2cd8616868eb63a52011e110b8b13643e1082ad3af982730226",
-    "linux-arm64": "c995f896183ba54b596535687b94bfd52efaa56736a36016d2de987bccdaa810",
-    "darwin-x64": "a56c871ce0d460683a2e57cb6eed2f91a329c2f03889612fef62191fcb57868a",
-    "darwin-arm64": "dab3246a917dc32869dfb36b5b682beaa87330c8cd2797027c9b9adc4084ceab"
+    "linux-x64": "3039575242ff240c68a79c4ebd4e0e35e865da99c6d8a46d1a17b2d7962cb47b",
+    "linux-arm64": "02fe993dca0faccb528c48472ca1d637274c562992ba7da1bc8d439103dbcc13",
+    "darwin-x64": "2be5a422007a773253611f24f2ad9e2a301f075392ed7bc2dc0f6354d3186696",
+    "darwin-arm64": "5882a4acd7317289346934290ac8277ca79edadb009e284c9fc0b23b74d321d7"
   }
 }

package/.next/standalone/sdk/python/CHANGELOG.md

@@ -9,6 +9,13 @@ in `failproofai_sdk/_version.py` becomes that release's GitHub Release body. A
 release whose section is missing or empty is refused before anything is built —
 see `scripts/changelog-section.py`.
 
+## 0.0.1b3 — 2026-09-08
+
+Open for the next release. `0.0.1b2` published on 2026-09-08 and the `bump` job
+moved the version here automatically; nothing has landed against `0.0.1b3` yet.
+Add entries as changes merge — this section becomes the GitHub Release body when
+it ships.
+
 ## 0.0.1b2 — 2026-08-25
 
 Open for the next release. `0.0.1b1` published on 2026-08-24 and the `bump` job
@@ -16,6 +23,154 @@ moved the version here automatically; nothing has landed against `0.0.1b2` yet.
 Add entries as changes merge — this section becomes the GitHub Release body when
 it ships.
 
+- Retire the old inbound evaluator boundary and add evaluator authoring plus the
+  outbound-only v2 worker runtime under the lazy `failproofai_sdk.evaluator`
+  namespace.
+- Harden the managed-evaluator source sandbox against a class of escapes an
+  adversarial review found: `str.format`/`format_map` C-level field traversal,
+  generator/frame introspection (`gi_frame.f_globals`) that reached the eval
+  globals and could poison a process-shared namespace across evaluations, and
+  `type.mro()` type-object reach. Attribute access is now **default-deny** (an
+  allowlist of the transcript data surface plus pure string/collection methods,
+  so every current and future introspection attribute is rejected), each eval
+  runs with **fresh per-call globals**, and a result whose text embeds a runtime
+  object repr (`<... at 0x...>`, a heap-pointer/ASLR disclosure that falls out of
+  any bound method's repr) is rejected at the output boundary. `enumerate` and
+  bare generator expressions are no longer permitted — both were gratuitous
+  pointer-repr sources; use `range(len(...))` and list/set/dict comprehensions.
+- Report **why** a server-authored definition was rejected. Every failure
+  collapsed to `evaluation raised <TypeName>`, so a hosted definition that can
+  never run reported only `evaluation raised UnsafeEvaluatorSource` — on every
+  session, forever, with nothing telling the author what was wrong. It matters
+  because the server accepts any source passing its size and key checks and does
+  not validate the sandbox's single-expression grammar, so a structurally
+  unrunnable definition is published successfully and then fails silently.
+  `UnsafeEvaluatorSource` now carries its detail (`evaluator_source must be one
+  expression`), bounded to `MAX_ERROR_MESSAGE_BYTES`. Deliberately narrower than
+  the generic handler, which still reports the type name only: this exception is
+  raised by our own validator before any customer source executes and describes
+  the source's shape, so it embeds no transcript content.
+- Scrub the sandbox child's environment. `subprocess.Popen` inherited
+  `os.environ`, so the process executing untrusted server-authored source ran
+  with `FAILPROOFAI_EVALUATOR_TOKEN` in its environment — on the managed pod,
+  the cross-tenant credential. Defence in depth rather than a live escape (the
+  AST allowlist and empty `__builtins__` already stop a managed expression
+  reaching `os.environ`): a future gap there can no longer be escalated into
+  credential theft. Only what the interpreter needs is forwarded, `PYTHONPATH`
+  included.
+- Contain a poison managed definition to its own run: source is now compiled
+  lazily inside the per-run executor, so a definition the sandbox rejects
+  dead-letters as one bounded `failed`/`eval_error` run instead of crashing the
+  assignment task and forcing it to be reclaimed until its attempt budget runs
+  out.
+- Run managed (server-authored) evaluations in a **killable fork+exec'd
+  subprocess** with hard `RLIMIT_CPU` + `RLIMIT_AS` + a parent wall-clock kill —
+  so a compute/memory bomb in a hosted definition (`sum(range(10**20))`) can no
+  longer exhaust the worker (SEC-001). Cancelling an in-process thread does not
+  stop it; a fresh subprocess the kernel bounds and the parent terminates does. A
+  plain `os.fork()` would deadlock — the worker is multi-threaded (asyncio loop,
+  executor, writer) and forking one hangs the child on an inherited lock — so the
+  sandbox execs a fresh `python -m ..._sandbox_runner` that sets its own limits;
+  the transcript crosses in via `to_wire`, only the result crosses back. The
+  effective budget is **clamped to a hard ceiling** (`MAX_SANDBOX_TIMEOUT_SECONDS`,
+  60s) so a large server-provided `timeout_seconds` cannot remove the bound.
+  Managed conditions, which previously ran with no timeout at all, are sandboxed
+  the same way. The result crossing back is **bounded on both sides** — the child
+  validates it (`result_items`, the 25-result limit) and refuses to serialize
+  anything over 1 MiB, and the parent reads at most that before killing the child
+  — so an oversized result (`metrics={str(x): 1 for x in range(100000)}`) cannot
+  OOM the worker either. The per-sandbox address space is capped (512 MiB) and the number of concurrent sandbox processes is bounded (a semaphore), so the AGGREGATE memory is bounded independent of the worker's `max_concurrency` — a fleet of concurrent runs can't OOM the host. Fails **closed** (`EvaluationSandboxUnavailable`) if the
+  sandbox cannot be spawned or the transcript cannot be serialized. Defense in depth at
+  compile time: reject `**` with a large/non-constant exponent and cap total AST
+  size. A managed condition the sandbox rejects now dead-letters as
+  `condition_error` instead of stranding the assignment. Only server-authored
+  source is isolated this way; customer evaluators still run in-process.
+- Require `execution_mode` on the wire instead of coercing a falsy/missing value
+  to `local` — a malformed value silently ran a `python` definition down the
+  customer path (or vice-versa); it is now a hard protocol error.
+- Count the sandbox-slot wait against the execution timeout (SEC-001). `_run_sandboxed`
+  acquired the `MAX_CONCURRENT_SANDBOXES` slot with an UNBOUNDED wait and only started
+  its wall-clock deadline afterward — so a run queued behind busy slots could, after the
+  runtime's `asyncio.wait_for` already reported it timed out (that cancels only the
+  awaiter, not the executor thread), still acquire a slot and launch a sandbox; 28
+  threads could pile up behind 4 long sandboxes and starve the worker (conditions have
+  no runtime-level wait at all). One wall-clock deadline now covers BOTH the slot wait
+  and execution: the slot is acquired with the remaining budget, and on timeout the run
+  raises `EvaluationTimeout` **without spawning a child**. Regression test: more
+  concurrent compute bombs than slots all resolve within ~one budget, not N serialized
+  budgets.
+- A managed (`python`) definition's applicability is now governed by the SERVER's
+  `condition_source`, never a colliding local condition (COR-001). `process_assignment`
+  keyed the local-definition lookup on `(eval_key, eval_version)` alone and selected
+  `local.condition` whenever a local definition with that key existed — so a managed
+  definition whose server condition was false could be forced to run anyway if the
+  worker had also registered a local definition under the same key whose condition was
+  true, executing server-managed source against the operator's intent. Condition
+  selection now branches on `execution_mode`, mirroring the evaluator branch: `LOCAL`
+  uses `local.condition`, `PYTHON` compiles and runs the server's `condition_source`
+  regardless of any key collision. Regression test: identical local+managed keys, local
+  condition true and managed false, asserts the definition is skipped and no managed run
+  is submitted.
+- Recognize the server's `incomplete_plan` terminal error (API-001). The server rejects a
+  plan that fails to cover every snapshotted definition with `422 incomplete_plan`; that
+  code is now in the SDK's `ERROR_SPECS` mirror and the shared `contract.json` fixture
+  (byte-identical with the server's), so a worker no longer treats a valid server-defined
+  failure as an unrecognized error. The fixture-equality test covers it.
+- Close a heap-address disclosure bypass in the managed-source sandbox
+  (adversarial-audit SEC). The output-boundary guard that rejects a `<obj at 0xADDR>`
+  repr in a result field was anchored on the literal `<`, so an allow-listed
+  `str(payload.get).replace("<", "")` — or an f-string / `%`-format of a bare bound
+  method — kept the live heap address while stripping the match, leaking an
+  ASLR/memory-layout primitive of the sandbox process into a persisted result. The fix
+  moves the defense to compile time: a bound method (the only reachable value with a
+  pointer repr — the transcript and result types are all frozen, pointer-free
+  dataclasses) may now only be **called**, never referenced as a bare value, so no
+  reachable value can carry a pointer repr through `str()`, an f-string, or `%`. The
+  output-boundary scan is kept and broadened (no longer requires the leading `<`) as
+  defense in depth. Legitimate evaluations — which call methods and read data
+  attributes — are unaffected; regression tests cover the `.replace("<","")`, f-string,
+  and `%` bypasses and confirm called-method/data-attribute stringification still works.
+- Switch the worker from long-polling to **normal (short) polling**, matching the
+  cadence of our other cloud surfaces. `claim` no longer sends `wait_seconds` and
+  the server returns immediately; when a claim comes back empty the worker sleeps
+  the server-advertised `poll_interval_seconds` (from the register response,
+  default 10 s) before polling again, instead of holding a request open for up to
+  25 s. Removes the `claim_wait_seconds` config knob and the
+  `request_timeout_seconds > claim_wait_seconds` constraint; the poll cadence is
+  now tuned centrally by the server, not per worker.
+- Bound the pre-plan condition phase by the assignment lease (hermes advisory).
+  Conditions were evaluated serially with no lease awareness before the plan was
+  created, and a managed condition could run its full sandbox budget — so a few
+  near-budget conditions could burn the whole lease before the plan request and
+  the server would fence the plan as `lease_lost`, reclaiming the assignment in a
+  loop instead of submitting a result. Each condition is now capped to the lease
+  time remaining before a plan-submission margin (using `lease_expires_at` when it
+  is in the future, else the negotiated lease duration), and once that budget is
+  gone the remaining conditions are skipped as `lease_exhausted` rather than run.
+  Local conditions, which previously had no timeout at all, are bounded the same
+  way. The complete fix — renewing the lease *during* the condition phase — needs
+  a server-side pre-plan heartbeat and is tracked separately.
+- Make a timed-out **synchronous** evaluator observable and stop it starving the
+  worker (hermes advisory). A synchronous evaluator that overruns its timeout runs
+  in the executor thread and cannot be cancelled (CPython cannot interrupt a
+  running thread), so its thread was permanently lost; with the pool sized to the
+  concurrency limit, one such orphan on a single-slot worker silently stopped all
+  further local evaluation. The eval executor now carries headroom over the
+  semaphore so an orphaned thread does not immediately starve live capacity — the
+  semaphore stays the real concurrency bound — and each orphan increments
+  `sync_evaluations_orphaned` and logs a warning naming the evaluator, so a hung
+  one is findable. This is a finite cushion, not a cure for a permanently-blocked
+  evaluator; prefer `async def` evaluators (cooperatively cancellable) or managed
+  `python` evaluators (subprocess-isolated, hard-killed) for long or untrusted work.
+- Let a managed source's list/set/dict comprehension read `session` on CPython
+  3.10/3.11 (hermes COR-001). The sandbox eval put `session` in the eval *locals*,
+  but a comprehension runs in its own scope and resolves a free name like
+  `session` from *globals* — so on 3.10 (a supported version) an allowed source
+  such as `all([session.event_count > 0 for i in range(1)])` raised `NameError`.
+  `session` now goes in a fresh per-call globals mapping and both eval paths use
+  empty locals, which keeps isolation and works across 3.10–3.14. Regression test
+  runs on the whole version matrix.
+
 ## 0.0.1b1 — 2026-08-24
 
 The first release under this name. Everything below describes the package as it

package/.next/standalone/sdk/python/README.md

@@ -10,6 +10,14 @@ the platform.
 - **Dependencies:** none. Standard library only, so installing it constrains
   nothing else in your environment.
 
+## Evaluator v2 status
+
+The legacy inbound `agenteye-evaluator` package has been retired; do not build new
+evaluator services against its server-push HTTP contract. Evaluator v2 authoring
+and its customer-hosted, outbound-only worker runtime live under the lazy
+`failproofai_sdk.evaluator` namespace. Importing the top-level tracing SDK does not
+import or start the evaluator runtime.
+
 ## Installation
 
 ```bash