jules-orchestrator-kit 0.32.3 → 0.32.5

package/README.md

@@ -108,13 +108,19 @@ Autonomous coding agents can write software at 100× human speed—but unconstra
 
 * **💻 Native Interactive UX & Command Palette (`v0.30.0`):** Features a zero-dependency full-screen Terminal Engine (`capabilities`, `key-decoder`, `renderer`, `layout`, `widgets`), interactive diagnostic matrix (`agentctl doctor`), task queue/swarm managers (`agentctl queue`, `agentctl swarm`), and a searchable Command Palette.
 
-* **🌐 Universal Polyglot Spine:** Natively auto-detects 24+ tech stacks (PHP/Laravel/WordPress, .NET/C#, Python, Go, Rust, C/C++, Flutter/Swift, Node/Deno/Bun) and transparently wraps verification suites in Docker Compose or Devcontainer sandboxes.
+* **🌐 Universal Polyglot Spine:** Natively auto-detects 26+ tech stacks (PHP/Laravel/WordPress, .NET/C#, Python, Go, Rust, C/C++, Flutter/Swift, Node/Deno/Bun, Solidity/Foundry/Hardhat) and transparently wraps verification suites in Docker Compose or Devcontainer sandboxes.
+
+* **🧩 DAG-Ordered Task Queue & Specialist Agent Roles:** `agentctl queue --dag` resolves inter-task dependencies via Kahn's algorithm with cycle detection instead of linear FIFO order, and `--role <overseer|bolt|sentinel|janitor>` binds a task to a pre-defined specialist prompt persona resolved from `.agent/prompts/`.
+
+* **🔏 Cryptographic Evidence Ledger (`agentctl evidence`):** Generates a SHA-256 manifest of changed files, test-file hashes, and tamper-detection locks for every verified task — a portable, offline-verifiable audit trail toward the roadmap's SOC2 compliance exporter.
+
+* **💸 Dynamic Complexity & Cost Router (`router:` in `.agent/config.yml`, opt-in):** A zero-dependency, rule-based heuristic classifier (`src/router.mjs`) routes trivial tasks (typos, lint fixes, single-file lockfile bumps) to a cheap/fast provider — e.g. the built-in `gemini-flash` (Gemini CLI, headless mode) preset — while reserving your primary provider for complex, multi-file, or safety-sensitive work. Tasks touching `scope.deny`, `auth/**`, `migrations/**`, secrets, or using the `sentinel` role always force the primary provider regardless of score. Fully provider-agnostic: swap in any exec/HTTP provider spec for `router.fast`/`router.complex`, and override per-task with `--tier fast|complex`.
 
 * **📂 Scoped Monorepo Boundary Resolver:** Statically maps changed files up directory ancestry to invoke isolated subshell test suites (`(cd backend && pytest) && (cd cli && cargo test)`), eliminating global test thrashing.
 
 * **🚀 Zero-Test Bootstrapping (`agentctl bootstrap`):** Synthesizes deterministic syntax-check and smoke-test verification oracles for untested legacy repositories so agents always operate against a falsifiable feedback loop.
 
-* **📈 Proven Scale & Reliability:** Empirically tested with **368 unit tests across 52 suites passing in < 3.0s**, supporting 300+ daily agent sessions per repository.
+* **📈 Proven Scale & Reliability:** Empirically tested with **421 unit tests across 59 suites passing in < 8.0s**, supporting 300+ daily agent sessions per repository.
 
 <br/>
 
@@ -166,7 +172,7 @@ To ensure maximum merge success, dispatch tasks according to our deterministic t
 | **Self-Healing Loop** | ❌ None (Crashes on test error) | ❌ None (Fails build; notifies human) | ✅ **Autonomous OODA Loop** (Max 3 repair turns with error fingerprinting) |
 | **Interactive UX Engine**| ❌ Raw unformatted CLI dumps | ❌ Non-interactive log outputs | ✅ **Native TUI Engine & Command Palette** (Zero-dependency alternate-screen TUI) |
 | **Scope Isolation** | ❌ None (Can modify CI files or lockfiles) | 🟡 Post-commit branch rules only | ✅ **Fail-Closed Scope Guard** (Deny-first evaluation; blocks protected paths) |
-| **Polyglot Stack Detection**| ❌ Manual prompt instructions | 🟡 Hardcoded YAML workflow steps | ✅ **Universal 24+ Stack Detector** (`src/config.mjs`) |
+| **Polyglot Stack Detection**| ❌ Manual prompt instructions | 🟡 Hardcoded YAML workflow steps | ✅ **Universal 26+ Stack Detector** (`src/config.mjs`) |
 | **Flaky Test Quarantine** | ❌ Fails session randomly | ❌ Breaks CI pipeline randomly | ✅ **Wilson-Score Statistical Quarantine** (Oscillation ≥ 0.40 quarantined automatically) |
 | **Monorepo Scoping** | ❌ Runs full global test suite | 🟡 Requires custom Nx/Turbo scripting | ✅ **Scoped Subshell Boundary Resolver** (`resolveWorkspaceBoundary`) |
 | **Zero-Test Bootstrapping**| ❌ Halts without verification oracle | ❌ Fails build if no tests exist | ✅ **Instant Oracle Synthesis** (`php -l`, `compileall`, `dotnet build`, `tsc`, `smoke`) |
@@ -227,7 +233,7 @@ npx jules-orchestrator-kit queue --interactive
 <br/>
 
 <details>
-<summary><b>🔍 View All 24+ Supported Ecosystems & Stack Triggers</b></summary>
+<summary><b>🔍 View All 26+ Supported Ecosystems & Stack Triggers</b></summary>
 
 <br/>
 
@@ -242,6 +248,8 @@ Ecosystems Natively Supported by src/config.mjs:
 ├── Systems / Rust Cargo (Cargo.toml)
 ├── Systems / Go (go.mod)
 ├── Systems / Make (Makefile)
+├── Web3 / Solidity Foundry (foundry.toml, remappings.txt) — offline-enforced forge test/build/fmt
+├── Web3 / Solidity Hardhat (hardhat.config.js, hardhat.config.ts)
 ├── Python / FastAPI / Django (pyproject.toml, requirements.txt, setup.py)
 ├── Elixir / Phoenix (mix.exs)
 ├── Ruby / Rails (Gemfile)
@@ -269,7 +277,7 @@ Ecosystems Natively Supported by src/config.mjs:
 # .agent/config.yml — Universal Orchestrator Configuration
 
 version: 1
-provider: "jules"        # Provider key ("jules" | "claude-code" | "local")
+provider: "jules"        # Provider key ("jules" | "claude-code" | "codex" | "gemini-flash")
 baseBranch: "main"       # Default target base branch
 branchPrefix: "agent/"   # Prefix for task branches
 
@@ -292,6 +300,15 @@ limits:
   dailyTasks: 300        # Daily task session quota limit
   repairAttempts: 3      # Maximum OODA repair iterations
   concurrency: 1         # Worker slot concurrency limit
+
+# Dynamic Complexity & Cost Router — opt-in, disabled by default.
+# Provider-agnostic: "fast"/"complex" accept any provider key ("jules" |
+# "claude-code" | "codex" | "gemini-flash") or an inline custom provider spec.
+router:
+  enabled: false
+  fast: "gemini-flash"    # Trivial/mechanical tasks (score <= threshold)
+  complex: "jules"        # Complex/multi-file/safety-sensitive tasks; defaults to `provider`
+  threshold: 0            # Heuristic score above which a task escalates to `complex`
 ```
 
 <br/>
@@ -369,15 +386,15 @@ Native stdio server exposing task dispatch, gate verification, and risk auditing
 | Command | Usage | Description | Exit Codes |
 | :--- | :--- | :--- | :--- |
 | `init` | `agentctl init [--interactive] [--tier pro]` | Interactive onboarding wizard & stack oracle inspector generating `.agent/config.yml`. | `0` (Created) |
-| `task create` | `agentctl task create [--title <t>] [--prompt <p>] [--template <id>]` | Interactively authors & scopes falsifiable task envelopes with secret scrubbing & preflight gate checks. | `0` (Queued), `1` (Unfalsifiable / Secret leak) |
+| `task create` | `agentctl task create [--title <t>] [--prompt <p>] [--template <id>] [--role <name>] [--tier fast\|complex] [--depends-on <id,...>]` | Interactively authors & scopes falsifiable task envelopes with secret scrubbing, preflight gate checks, specialist role resolution, DAG dependency wiring, and an optional Cost Router tier override. | `0` (Queued), `1` (Unfalsifiable / Secret leak) |
 | `task template` | `agentctl task template [<id>] [--list] [--json]` | Lists and synthesizes specialized web task envelopes (`web-cwv`, `web-wcag`, `web-seo`, `web-playwright`, `web-flaky-heal`). | `0` (Synthesized/Listed) |
 | `task optimize` | `agentctl task optimize "<prompt>" [--fix] [--web] [--json]` | Linter & optimizer injecting Google Labs 3-phase exploration budgets, critic steering, and web oracles. | `0` (Scored/Fixed) |
 | `test-gen` | `agentctl test-gen --title <t> --spec <s> [--run]` | Scaffolds falsifiable unit tests, verifies **RED** failure state, and locks test in `scope.deny`. | `0` (Scaffolded/Red) |
 | `rollback` | `agentctl rollback [sessionId \| --latest]` | Restores exact commit, uncommitted files, and cleans orphan task worktrees from pre-flight checkpoints. | `0` (Restored), `1` (Error) |
 | `resume` | `agentctl resume <sessionId> --response "<reply>"` | Streams engineer response back into active Google Jules warm session context window. | `0` (Resumed), `1` (Error) |
-| `dispatch` | `agentctl dispatch --title <t> --prompt <p>` | Dispatches a single task to an AI agent in an isolated worktree. | `0` (Success), `1` (Arg error), `2` (429 Rate limit), `3` (Scope deny), `4` (OODA exhausted), `5` (Diff > 75KB), `6` (Secret leak) |
+| `dispatch` | `agentctl dispatch --title <t> --prompt <p> [--role <name>] [--tier fast\|complex]` | Dispatches a single task to an AI agent in an isolated worktree, optionally binding a specialist role prompt (`overseer`\|`bolt`\|`sentinel`\|`janitor`) and/or overriding the Cost Router tier. | `0` (Success), `1` (Arg error), `2` (429 Rate limit), `3` (Scope deny), `4` (OODA exhausted), `5` (Diff > 75KB), `6` (Secret leak) |
 | `doctor` | `agentctl doctor [--interactive] [--fix safe]` | Diagnostic DAG check runner & automated transactional repair planner. | `0` (Healthy) |
-| `queue` | `agentctl queue [--interactive] [--json]` | Consumes, inspects, and executes task envelopes in `.agent/jules-queue/` (supports `--json`). | `0` (Complete) |
+| `queue` | `agentctl queue [--interactive] [--dag] [--concurrency <n>] [--json]` | Consumes, inspects, and executes task envelopes in `.agent/jules-queue/`; `--dag` resolves inter-task dependencies via Kahn's algorithm with cycle detection instead of linear FIFO order (supports `--json`). | `0` (Complete) |
 | `swarm` | `agentctl swarm [--interactive] [--json]` | Runs parallel multi-agent swarm across worker slots with process PID liveness detection (supports `--json`). | `0` (Complete) |
 | `scan` | `agentctl scan` | Scans codebase for TODO/FIXME annotations to seed task authoring. | `0` (Scanned) |
 | `review-repair`| `agentctl review-repair <pr-comments.json>`| Parses GitHub PR review comments and synthesizes actionable OODA repair tasks. | `0` (Parsed), `1` (Missing file) |
@@ -386,9 +403,10 @@ Native stdio server exposing task dispatch, gate verification, and risk auditing
 | `bootstrap` | `agentctl bootstrap [--force] [--json]` | Inspects an untested repository and synthesizes `.agent/config.yml` with a zero-test verification oracle (`php -l`, `compileall`, `dotnet build`, `tsc`, `smoke`). | `0` (Bootstrapped / Existing) |
 | `lock` | `agentctl lock <acquire\|release\|status>`| Manages VFS mutex locks for multi-agent non-overlapping file ownership. | `0` (Locked/Released), `1` (Conflict) |
 | `clean` | `agentctl clean` | Prunes stale git worktrees, lockfiles, and temporary ledgers. | `0` (Clean) |
+| `evidence` | `agentctl evidence <generate\|verify\|show> [--manifest <path>] [--json]` | Generates, verifies, or prints a SHA-256 cryptographic evidence manifest (changed-file hashes + test-file tamper lock) for audit trails. | `0` (Verified/Generated), `1` (Tamper detected / Verification failed) |
 | `mcp` | `agentctl mcp` | Starts stdio Model Context Protocol (MCP) server for tool integration. | `0` / Stdio stream |
 | `mcp init` | `agentctl mcp init [--target cursor\|vscode\|claude\|all]` | 1-click scaffolding for Cursor (`.cursor/mcp.json`), VS Code tasks (`tasks.json`), and Claude Desktop. | `0` (Scaffolded) |
-| `version` | `agentctl version` | Outputs orchestrator kit semantic version (`v0.32.3`). | `0` |
+| `version` | `agentctl version` | Outputs orchestrator kit semantic version (`v0.32.5`). | `0` |
 
 <br/>
 
@@ -419,7 +437,23 @@ const result = await provider.dispatch(
 );
 ```
 
-### 3. Model Context Protocol (MCP) Server
+### 3. Dynamic Complexity & Cost Router (`resolveRoutedProvider`)
+Opt-in, config-driven routing between a cheap/fast provider and your primary provider — see [Configuration Reference](#configuration) for the `router:` block. Programmatic usage mirrors `createFailoverProvider`:
+
+```javascript
+import { resolveRoutedProvider, loadConfig } from "jules-orchestrator-kit";
+
+const config = loadConfig(process.cwd()); // router.enabled must be true in .agent/config.yml
+const { provider, classification } = resolveRoutedProvider(
+  { title: "Fix typo", prompt: "Fix a typo in the README." },
+  config
+);
+console.log(classification.tier); // "fast" | "complex"
+```
+
+Ships with a `gemini-flash` preset (Gemini CLI headless mode, `gemini-3.6-flash`) as a batteries-included fast tier, but any provider key or custom spec works for `router.fast`/`router.complex` — the router is provider-agnostic by design, not tied to any single vendor.
+
+### 4. Model Context Protocol (MCP) Server
 Expose orchestrator gates and queue controls over stdio to client tools (Antigravity, Claude, Cursor):
 ```bash
 npx jules-orchestrator-kit mcp
@@ -436,6 +470,8 @@ npx jules-orchestrator-kit mcp
 
 | Feature | Module / Command | Architectural Description | Target Release |
 | :--- | :--- | :--- | :---: |
+| **Dynamic Complexity & Cost Router** | `src/router.mjs`, `router:` in `.agent/config.yml` | Provider-agnostic, zero-dependency heuristic classifier routing trivial tasks to a fast/cheap provider (`gemini-flash` preset included) and complex/safety-sensitive tasks to the primary provider; opt-in, `--tier` override. | **Unreleased** *(main)* |
+| **DAG Task Queue, Specialist Roles & Evidence Ledger** | `src/dag-engine.mjs`, `src/evidence.mjs`, `agentctl evidence` | Kahn's-algorithm dependency-ordered queue execution (`queue --dag`), `--role` specialist prompt resolution, and SHA-256 cryptographic evidence manifests with test-tamper locking. | **Unreleased** *(main)* |
 | **Warm Session Resumption & PR Bundler** | `src/provider.mjs`, `src/engine.mjs` | Multi-turn warm session context streaming via `POST /v1alpha/sessions/{id}:sendMessage` & evidence PR descriptions. | **v0.31.0** *(Shipped)* |
 | **TDD Harness & Prompt Falsifiability Linter** | `agentctl test-gen`, `agentctl task optimize` | Automated RED-state test generator, `scope.deny` test locking, and prompt testability linter with fuzzy path resolution. | **v0.31.0** *(Shipped)* |
 | **Atomic Git Checkpoint & Rollback** | `agentctl rollback` (`src/ops/checkpoint.mjs`) | Pre-flight git HEAD/stash snapshotting, atomic rollback restoration, and 10-session pruning rotation. | **v0.31.0** *(Shipped)* |

package/bin/agentctl.mjs

@@ -12,16 +12,18 @@ import { reapOrphanedIntents, reapStaleMutexDirs } from "../src/journal.mjs";
 const args = process.argv.slice(2);
 const command = args[0];
 
-function printHelp() {
+export const VERSION = "0.32.5";
+
+export function printHelp() {
   console.log(`
-🚀 agentctl v0.32.3 — Universal Agent Orchestrator & Safety Gatekeeper
+🚀 agentctl v0.32.5 — Universal Agent Orchestrator & Safety Gatekeeper
 
 Usage: agentctl <command> [options]
 
 Commands:
-  dispatch | create     Dispatch a single task to an AI agent
+  dispatch | create     Dispatch a single task to an AI agent (--role <name>, --tier fast|complex)
   gate | audit          Run CI security and verification gate against current branch
-  queue                 Run pending task queue
+  queue                 Run pending task queue (--dag, --concurrency <n>)
   swarm                 Run parallel task swarm
   mcp                   Start stdio Model Context Protocol (MCP) server
   clean                 Clean stale branches, worktrees, locks, and ledgers
@@ -31,7 +33,7 @@ Commands:
   review-repair         Parse PR review comments and synthesize OODA repair tasks
   dashboard             Start local HTTP telemetry and audit dashboard
   init                  Scaffold .agent/ config and run onboarding wizard
-  task create           Interactively author and scope a Jules task envelope (--template <name>)
+  task create           Interactively author and scope a Jules task envelope (--template <name>, --role <name>, --tier fast|complex)
   task optimize         Linter & optimizer for Jules task prompts (--fix, --json, --web)
   task template         List and generate web development task templates (--list, --json)
   test-gen              Scaffold & run automated TDD Red-to-Green test cycle (--run)
@@ -43,9 +45,13 @@ Commands:
   hydrate [prompt]      Prepend active system learnings and baton-pass state to a prompt
   harvest               Harvest failure traces and record/quarantine resolution rules
   learning add          Record a system learning rule into .agent/knowledge/
+  evidence <action>     Manage cryptographic audit evidence (generate | verify | show)
   version               Output agentctl version
 
 Options:
+  --role, -r            Specify specialist agent role (overseer | bolt | sentinel | janitor)
+  --tier                Force routing tier when router.enabled (fast | complex) — see .agent/config.yml router:
+  --dag                 Execute queue tasks via DAG dependency resolution
   --dry-run, -d         Simulate action without making API calls or modifying git
   --mode, -m            Gate evaluation mode (working-tree | committed | staged)
   --repoless            Dispatch task in repoless execution mode
@@ -63,7 +69,7 @@ async function main() {
   }
 
   if (command === "version" || command === "--version" || command === "-v") {
-    console.log("agentctl v0.32.3");
+    console.log("agentctl v0.32.5");
     process.exit(0);
   }
 
@@ -81,6 +87,8 @@ async function main() {
           title: { type: "string", short: "t" },
           prompt: { type: "string", short: "p" },
           "prompt-file": { type: "string", short: "f" },
+          role: { type: "string", short: "r" },
+          tier: { type: "string" },
           source: { type: "string", short: "s" },
           branch: { type: "string", short: "b" },
           repoless: { type: "boolean" },
@@ -109,6 +117,8 @@ async function main() {
       const task = {
         title: values.title || "CLI Dispatch Task",
         prompt: promptContent,
+        role: values.role,
+        tier: values.tier === "fast" || values.tier === "complex" ? values.tier : undefined,
         source: values.source,
         branch: values.branch,
         repoless: values.repoless,
@@ -131,6 +141,9 @@ async function main() {
           console.log(`\n✅ Task Dispatched Successfully!`);
           console.log(`   Session ID  : ${session.id}`);
           console.log(`   Session URL : ${session.url || "N/A"}`);
+          if (session._routeTier) {
+            console.log(`   Router Tier : ${session._routeTier} (${session._routeReason || "n/a"})`);
+          }
         }
         process.exit(0);
       } catch (err) {
@@ -200,17 +213,34 @@ async function main() {
     }
 
     case "queue": {
+      const { values } = parseArgs({
+        args: args.slice(1),
+        options: {
+          dag: { type: "boolean" },
+          concurrency: { type: "string", short: "c" },
+          "dry-run": { type: "boolean", short: "d" },
+          json: { type: "boolean", short: "j" },
+        },
+        allowPositionals: true,
+      });
+
       const queueDir = getQueueDir(root);
       const files = readdirSync(queueDir).filter((f) => isTaskFile(f, queueDir));
       console.log(`Found ${files.length} queued task(s) in .agent/queue/`);
       if (files.length > 0) {
-        const tasks = files.map((f) => ({
-          id: f,
-          title: f.replace(/\.md$/, ""),
-          prompt: readFileSync(join(queueDir, f), "utf-8"),
-        }));
-        const results = await run(tasks, { root, config });
-        console.log(`\nProcessed ${results.length} tasks.`);
+        const concurrency = values.concurrency ? Number(values.concurrency) : undefined;
+        const results = await run(null, {
+          root,
+          config,
+          dag: values.dag,
+          concurrency,
+          dryRun: values["dry-run"],
+        });
+        if (values.json) {
+          console.log(JSON.stringify(results, null, 2));
+        } else {
+          console.log(`\nProcessed ${results.processed || results.results?.length || 0} task(s).`);
+        }
       }
       process.exit(0);
       break;
@@ -372,7 +402,11 @@ async function main() {
           options: {
             title: { type: "string", short: "t" },
             prompt: { type: "string", short: "p" },
+            role: { type: "string", short: "r" },
+            tier: { type: "string" },
             template: { type: "string" },
+            depends: { type: "string" },
+            "depends-on": { type: "string" },
             "verify-cmd": { type: "string", short: "v" },
             "auto-pr": { type: "boolean" },
             "require-plan-approval": { type: "boolean" },
@@ -386,7 +420,10 @@ async function main() {
         const res = await runTaskCreateWizard(root, {
           title: values.title,
           prompt: values.prompt,
+          role: values.role,
+          tier: values.tier,
           template: values.template,
+          dependsOn: values["depends-on"] || values.depends,
           verifyCmd: values["verify-cmd"],
           autoPr: values["auto-pr"],
           requirePlanApproval: values["require-plan-approval"],
@@ -399,6 +436,9 @@ async function main() {
           console.log(`✅ Task synthesized & queued at ${res.taskFile}`);
           console.log(`   Task ID  : ${res.plan.taskId}`);
           console.log(`   Title    : ${res.plan.title}`);
+          if (res.plan.role) console.log(`   Role     : ${res.plan.role}`);
+          if (res.plan.tier) console.log(`   Tier     : ${res.plan.tier} (routing override)`);
+          if (res.plan.dependsOn && res.plan.dependsOn.length > 0) console.log(`   DependsOn: ${res.plan.dependsOn.join(", ")}`);
           console.log(`   Auto-PR  : ${res.plan.flags.autoPr}`);
         }
         process.exit(0);
@@ -748,6 +788,77 @@ async function main() {
       process.exit(1);
     }
 
+    case "evidence": {
+      const subAction = args[1] || "show";
+      const { planEvidenceGenerate, planEvidenceVerify, planEvidenceShow } = await import("../src/ops/evidence-actions.mjs");
+      const { values } = parseArgs({
+        args: args.slice(2),
+        options: {
+          output: { type: "string", short: "o" },
+          manifest: { type: "string", short: "m" },
+          markdown: { type: "string" },
+          json: { type: "boolean", short: "j" },
+        },
+        allowPositionals: true,
+      });
+
+      if (subAction === "generate" || subAction === "create") {
+        const res = planEvidenceGenerate(root, {
+          output: values.output,
+          markdownOutput: values.markdown,
+        });
+        if (values.json) {
+          console.log(JSON.stringify(res, null, 2));
+        } else {
+          console.log(`\n🛡️ Cryptographic Evidence Manifest Generated!`);
+          console.log(`   Manifest ID : ${res.manifest.manifestId}`);
+          console.log(`   Signature   : ${res.manifest.evidenceHash}`);
+          console.log(`   Location    : ${res.manifestPath}`);
+          console.log(`   Test Files  : ${res.manifest.testIntegrity.testFileCount}`);
+          console.log(`   Tampered    : ${res.manifest.testIntegrity.tamperDetected ? "YES (FAILED)" : "NO (VERIFIED)"}\n`);
+        }
+        process.exit(res.manifest.testIntegrity.tamperDetected ? 1 : 0);
+      } else if (subAction === "verify" || subAction === "check") {
+        const res = planEvidenceVerify(root, {
+          manifest: values.manifest,
+        });
+        if (values.json) {
+          console.log(JSON.stringify(res, null, 2));
+        } else {
+          if (res.ok) {
+            console.log(`\n✅ Evidence Verification PASSED`);
+            console.log(`   Manifest ID : ${res.manifestId}`);
+            console.log(`   Signature   : ${res.evidenceHash}\n`);
+          } else {
+            console.error(`\n❌ Evidence Verification FAILED`);
+            console.error(`   Reason      : ${res.reason}`);
+            if (res.details) {
+              console.error(`   Details     : ${JSON.stringify(res.details)}\n`);
+            }
+          }
+        }
+        process.exit(res.ok ? 0 : 1);
+      } else if (subAction === "show" || subAction === "print") {
+        const res = planEvidenceShow(root, {
+          manifest: values.manifest,
+        });
+        if (values.json) {
+          console.log(JSON.stringify(res, null, 2));
+        } else {
+          if (res.ok) {
+            console.log(`\n${res.markdown}\n`);
+          } else {
+            console.error(`\n❌ Failed to show evidence: ${res.reason}\n`);
+          }
+        }
+        process.exit(res.ok ? 0 : 1);
+      } else {
+        console.error(`Unknown evidence subaction: ${subAction}. Use generate | verify | show.`);
+        process.exit(1);
+      }
+      break;
+    }
+
     default:
       console.error(`Unknown command: ${command}`);
       printHelp();

package/index.mjs

@@ -13,6 +13,8 @@ export {
   matchesGlob,
   checkScope,
   scanDiff,
+  checkEdgeRuntimeImports,
+  checkCrossPackageImports,
 } from "./src/security.mjs";
 export { sanitizeUntrustedData, buildAgentEnvelope } from "./src/prompt-guard.mjs";
 export { isolateMcpStdout, writeMcpFrame } from "./src/mcp.mjs";
@@ -29,7 +31,14 @@ export {
   ProviderSchemaError,
   parseRetryAfter,
 } from "./src/provider.mjs";
-export { detectPolyglotStack, resolveWorkspaceBoundary, bootstrapZeroTestRepo } from "./src/stack-detector.mjs";
+export {
+  detectPolyglotStack,
+  resolveWorkspaceBoundary,
+  bootstrapZeroTestRepo,
+  findSubprojectRoot,
+  detectCrossPackageBoundaryViolations,
+  detectCircularDependencies,
+} from "./src/stack-detector.mjs";
 export {
   appendLedger,
   readLedger,
@@ -100,9 +109,24 @@ export { synthesizePrDescription, probeDevServer } from "./src/engine.mjs";
 // Automated TDD Red-to-Green Harness
 export { scaffoldTddTest, runTddCycle, TddError } from "./src/ops/tdd-generator.mjs";
 
-// IDE Native MCP Scaffolder
-export { scaffoldIdeConfig, IdeScaffoldError } from "./src/ops/ide-scaffold.mjs";
-
+// SPORE Memory & System Learnings
+export { recordLearning, loadLearnings, hydratePrompt, harvestFailure, getLearningsPath, getSystemLearningsMdPath } from "./src/memory.mjs";
 
+// Specialist Role Resolution & DAG Queue Execution
+export { resolveRolePrompt } from "./src/wizard-task.mjs";
+export { executeQueueDag, resolveAffectedTests } from "./src/dag-engine.mjs";
 
+// IDE Native MCP Scaffolder
+export { scaffoldIdeConfig, IdeScaffoldError } from "./src/ops/ide-scaffold.mjs";
 
+// Cryptographic Evidence & Test Integrity Manifests
+export {
+  computeFileHash,
+  computeDirectoryHash,
+  generateEvidenceManifest,
+  writeEvidenceManifest,
+  loadEvidenceManifest,
+  verifyEvidenceManifest,
+  generateEvidenceMarkdown,
+  computeEvidenceHash,
+} from "./src/evidence.mjs";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "jules-orchestrator-kit",
-  "version": "0.32.3",
+  "version": "0.32.5",
   "description": "Orchestration kit for running Google Jules autonomous agents.",
   "repository": {
     "type": "git",
@@ -70,7 +70,7 @@
   "author": "FullThrottle83",
   "license": "MIT",
   "devDependencies": {
-    "eslint": "^9.39.5",
-    "globals": "^17.8.0"
+    "eslint": "^10.8.1",
+    "globals": "^17.11.0"
   }
 }

package/scripts/command-resolver.mjs

@@ -22,7 +22,13 @@ export function parseYamlConfig(root = process.cwd()) {
         if (parsed && (parsed.test_cmd || parsed.build_cmd || parsed.verify)) {
           return {
             testCmd: parsed.verify?.test || parsed.test_cmd || "",
+            lintCmd: parsed.verify?.lint || parsed.lint_cmd || "",
+            fuzzCmd: parsed.verify?.fuzz || parsed.fuzz_cmd || "",
+            invariantCmd: parsed.verify?.invariant || parsed.invariant_cmd || "",
+            e2eCmd: parsed.verify?.e2e || parsed.e2e_cmd || "",
             buildCmd: parsed.verify?.build || parsed.build_cmd || "",
+            policy: parsed.verify?.policy || { networkAccess: "allow", offline: false },
+            stages: parsed.verify?.stages || null,
             source: configPath.endsWith("jules.yml") ? ".agent/jules.yml" : ".agent/config.yml",
           };
         }
@@ -50,8 +56,16 @@ export function detectFrameworkCommands(root = process.cwd()) {
   const res = detectStack(root);
   return {
     testCmd: res.testCmd,
+    lintCmd: res.fmtCmd || "",
+    fuzzCmd: res.fuzzCmd || "",
+    invariantCmd: res.invariantCmd || "",
+    e2eCmd: res.e2eCmd || "",
     buildCmd: res.buildCmd,
-    source: `package.json (${res.stack})`,
+    policy: {
+      networkAccess: res.stack === "foundry" ? "forbidden" : "allow",
+      offline: res.stack === "foundry",
+    },
+    source: `${res.triggerFile || "stack"} (${res.stack})`,
   };
 }
 

package/scripts/jules-merge-swarm.mjs

@@ -10,7 +10,7 @@ import { join } from "node:path";
 import { tmpdir } from "node:os";
 import { spawnSync } from "node:child_process";
 import { classifyRiskTier, RISK_TIERS } from "../src/risk.mjs";
-import { changedFiles, git, resolveBase } from "../src/git.mjs";
+import { git, resolveBase } from "../src/git.mjs";
 import { normalizePath } from "../src/config.mjs";
 
 export const EXIT = Object.freeze({

package/src/config.mjs

@@ -185,9 +185,23 @@ export function detectPackageManager(root = process.cwd(), pkg = {}) {
   return "npm";
 }
 
-import { detectPolyglotStack, resolveWorkspaceBoundary, bootstrapZeroTestRepo } from "./stack-detector.mjs";
-
-export { detectPolyglotStack, resolveWorkspaceBoundary, bootstrapZeroTestRepo };
+import {
+  detectPolyglotStack,
+  resolveWorkspaceBoundary,
+  bootstrapZeroTestRepo,
+  findSubprojectRoot,
+  detectCrossPackageBoundaryViolations,
+  detectCircularDependencies,
+} from "./stack-detector.mjs";
+
+export {
+  detectPolyglotStack,
+  resolveWorkspaceBoundary,
+  bootstrapZeroTestRepo,
+  findSubprojectRoot,
+  detectCrossPackageBoundaryViolations,
+  detectCircularDependencies,
+};
 
 /**
  * Autodetects verification test/build commands across 24+ polyglot tech stacks.
@@ -200,9 +214,19 @@ export function resolveVerify(root = process.cwd(), userVerify = {}) {
   const s = detectStack(root);
   return {
     setup: userVerify.setup ?? s.setupCmd ?? "",
+    lint: userVerify.lint ?? s.fmtCmd ?? "",
     test: userVerify.test ?? s.testCmd ?? "",
+    unit: userVerify.unit ?? userVerify.test ?? s.testCmd ?? "",
+    fuzz: userVerify.fuzz ?? s.fuzzCmd ?? "",
+    invariant: userVerify.invariant ?? s.invariantCmd ?? "",
+    e2e: userVerify.e2e ?? s.e2eCmd ?? "",
     teardown: userVerify.teardown ?? s.teardownCmd ?? "",
     build: userVerify.build ?? s.buildCmd ?? "",
+    policy: {
+      networkAccess: userVerify.policy?.networkAccess || (s.stack === "foundry" ? "forbidden" : "allow"),
+      offline: userVerify.policy?.offline ?? (s.stack === "foundry"),
+    },
+    stages: Array.isArray(userVerify.stages) ? userVerify.stages : null,
     server: userVerify.server ? {
       command: userVerify.server.command || "",
       url: userVerify.server.url || "http://localhost:3000",
@@ -259,6 +283,10 @@ export function loadConfig(root = resolveRoot(), explicitPath = null) {
 
   const setupCmd = parsed.setup_cmd || parsed.verify?.setup || "";
   const testCmd = parsed.test_cmd || parsed.verify?.test || "";
+  const lintCmd = parsed.lint_cmd || parsed.verify?.lint || "";
+  const fuzzCmd = parsed.fuzz_cmd || parsed.verify?.fuzz || "";
+  const invariantCmd = parsed.invariant_cmd || parsed.verify?.invariant || "";
+  const e2eCmd = parsed.e2e_cmd || parsed.verify?.e2e || "";
   const teardownCmd = parsed.teardown_cmd || parsed.verify?.teardown || "";
   const buildCmd = parsed.build_cmd || parsed.verify?.build || "";
   const verifyTimeoutMs = parsed.verify?.timeoutMs ?? parsed.verify?.timeout_ms ?? 60000;
@@ -289,11 +317,28 @@ export function loadConfig(root = resolveRoot(), explicitPath = null) {
     tier: activeTier,
     verify: {
       setup: setupCmd || autoVerify.setup || "",
+      lint: lintCmd || autoVerify.lint || "",
       test: testCmd || autoVerify.test,
+      unit: parsed.verify?.unit || testCmd || autoVerify.unit || autoVerify.test,
+      fuzz: fuzzCmd || autoVerify.fuzz || "",
+      invariant: invariantCmd || autoVerify.invariant || "",
+      e2e: e2eCmd || autoVerify.e2e || "",
       teardown: teardownCmd || autoVerify.teardown || "",
       build: buildCmd || autoVerify.build,
+      stages: parsed.verify?.stages || autoVerify.stages || null,
+      policy: parsed.verify?.policy || autoVerify.policy,
       timeoutMs: Number.isFinite(Number(verifyTimeoutMs)) ? Number(verifyTimeoutMs) : 60000,
     },
+    evidence: {
+      enabled: parsed.evidence?.enabled ?? true,
+      strictTestLock: parsed.evidence?.strict_test_lock ?? parsed.evidence?.strictTestLock ?? true,
+    },
+    router: {
+      enabled: parsed.router?.enabled ?? false,
+      fast: parsed.router?.fast || "gemini-flash",
+      complex: parsed.router?.complex || "",
+      threshold: Number.isFinite(Number(parsed.router?.threshold)) ? Number(parsed.router.threshold) : 0,
+    },
     scope: normalizeScope(parsed),
     limits: {
       ...DEFAULTS.limits,