nexus-agents 12.2.0 → 12.3.0

package/dist/{chunk-TOQ7HR2R.js → chunk-77KDH7HO.js}

@@ -62,7 +62,7 @@ import {
   updateStage,
   withFileLock,
   writeJobCancelled
-} from "./chunk-MDLDQCYX.js";
+} from "./chunk-LJ2QVML4.js";
 import {
   allOf,
   anyOf
@@ -70,7 +70,7 @@ import {
 import {
   normalizeTopicToCanonical,
   synthesizeResearch
-} from "./chunk-7H2SQVVG.js";
+} from "./chunk-HDPHH44Y.js";
 import {
   IssueTriage,
   createAuditTrail,
@@ -79,13 +79,13 @@ import {
   createGraphAuditBridge,
   emitPipelinePolicyEvent,
   readActionRefusal
-} from "./chunk-7NCAEQWG.js";
+} from "./chunk-DVFIL66Y.js";
 import {
   sanitizeInput
 } from "./chunk-RYDTFPVI.js";
 import {
   withPrerequisite
-} from "./chunk-XODHLPFS.js";
+} from "./chunk-2KTKBUPW.js";
 import {
   NOOP_NOTIFIER,
   RateLimiter,
@@ -117,7 +117,7 @@ import {
   toolSuccess,
   withProgressHeartbeat,
   wrapToolWithTimeout
-} from "./chunk-JZQ4XZKS.js";
+} from "./chunk-VBO6SHQY.js";
 import {
   generateSecurityPlan
 } from "./chunk-KMGKOF5P.js";
@@ -163,7 +163,7 @@ import {
   parseRegistry,
   sourceExistsInRegistry,
   summarizeContextForPrompt
-} from "./chunk-6QUSTQ57.js";
+} from "./chunk-OFNVIVCB.js";
 import {
   REGISTRY_PATH,
   computeSourceQualityScore,
@@ -171,11 +171,11 @@ import {
   loadPapersRegistry,
   loadTechniquesRegistry,
   resolveRegistryRoot
-} from "./chunk-X3ZVXL5R.js";
+} from "./chunk-LLO7ZOAY.js";
 import {
   getTokenEnvVars,
   resolveToken
-} from "./chunk-4HXQJ5CA.js";
+} from "./chunk-DBPWDYNB.js";
 import {
   DEFAULT_RELEVANCE_CONFIG,
   MemoryImportance,
@@ -183,7 +183,7 @@ import {
   calculateTextJaccardSimilarity,
   getToolMemory,
   memoryTrustTierTag
-} from "./chunk-ITUUK6GW.js";
+} from "./chunk-3TETLWLB.js";
 import {
   EXTERNAL_CONTENT_TRUST_TIER,
   resolveContentTrustProvenance,
@@ -192,7 +192,7 @@ import {
 } from "./chunk-RGB5OTRZ.js";
 import {
   createSessionMemory
-} from "./chunk-ZQJ74T3F.js";
+} from "./chunk-47X2J6KX.js";
 import {
   TrustTierSchema
 } from "./chunk-BFO2NZPO.js";
@@ -207,7 +207,7 @@ import {
 } from "./chunk-MZWHXERV.js";
 import {
   executeExpert
-} from "./chunk-D23AGH2N.js";
+} from "./chunk-7G6I4ZFK.js";
 import {
   CliDetectionCache,
   EventTopics,
@@ -218,7 +218,7 @@ import {
   getAvailableClis,
   getGlobalEventBus,
   getGlobalRegistry
-} from "./chunk-KEU6X3MM.js";
+} from "./chunk-5KVV2YOI.js";
 import {
   DEFAULTS
 } from "./chunk-L47UF7ET.js";
@@ -235,7 +235,7 @@ import {
   getAvailabilityCache,
   getCliForModelId,
   resolveFallback
-} from "./chunk-HTWXUN4F.js";
+} from "./chunk-623SVONB.js";
 import {
   BaseAdapter,
   createStream,
@@ -243,11 +243,11 @@ import {
   parseGatewayExtraHeaders,
   requireApiKey,
   validateApiKeyPresence
-} from "./chunk-HFL4QVDQ.js";
+} from "./chunk-AYRH643O.js";
 import {
   BWRAP_READ_ONLY_ARGS,
   createBwrapPreflight
-} from "./chunk-I2SLK5RS.js";
+} from "./chunk-EPQRMZ4Y.js";
 import {
   getMemoryRegistry
 } from "./chunk-ROYGBFVE.js";
@@ -255,14 +255,14 @@ import {
   SIGKILL_GRACE_MS,
   terminateProcessTree,
   trackProcessTree
-} from "./chunk-JG6RTOEO.js";
+} from "./chunk-2RC6VK33.js";
 import {
   generateHyphenId,
   generateUUID
-} from "./chunk-I527FJJZ.js";
+} from "./chunk-L2XP2P6Q.js";
 import {
   getDefaultCliCircuitBreakerRegistry
-} from "./chunk-DNBNM35J.js";
+} from "./chunk-MOLTWE32.js";
 import {
   sanitizeErrorDetails,
   sanitizeOutput
@@ -312,6 +312,7 @@ import {
   canonicalModelKey,
   clamp,
   clamp01,
+  classifyRegisteredTool,
   classifyRequestTier,
   classifyStallTick,
   computeTokenCost,
@@ -372,7 +373,7 @@ import {
   truncateWithInfo,
   withStep,
   withTimeout
-} from "./chunk-MQYBHIOL.js";
+} from "./chunk-ZKWBLGZN.js";
 import {
   SUPPORTED_EXTENSIONS
 } from "./chunk-XBEKMUTO.js";
@@ -387,13 +388,13 @@ import {
   lookupInTreeCapability,
   modelSupportsAll,
   resolveOwnerCli
-} from "./chunk-YD3Y55SM.js";
+} from "./chunk-7GAUB763.js";
 import {
   deriveEntry,
   getDefaultRegistry,
   resolveModelIdentity,
   resolveModelIdentitySync
-} from "./chunk-RY6ICQME.js";
+} from "./chunk-VF6BUZLS.js";
 import {
   ensureLearningDir,
   getMetaOutcomesFile,
@@ -31312,7 +31313,7 @@ function execIdFields(executionId) {
 async function populateUnifiedContextOnState(state, options) {
   const taskCandidate = state["task"];
   if (typeof taskCandidate !== "string" || taskCandidate === "") return;
-  const { getContextForTask: getContextForTask2, inferTaskCategory: inferTaskCategory2 } = await import("./context-retriever-DJQ6WK5U.js");
+  const { getContextForTask: getContextForTask2, inferTaskCategory: inferTaskCategory2 } = await import("./context-retriever-TLEEMPE5.js");
   const category = inferTaskCategory2(taskCandidate);
   const executionId = options?.executionId;
   const execFields = execIdFields(executionId);
@@ -32091,6 +32092,23 @@ function customReducer(defaultValue, merge) {
 
 // src/pipeline/task-contract.ts
 import { z as z60 } from "zod";
+import semver from "semver";
+var EnforcementModeSchema = z60.enum(["advisory", "enforcing"]);
+var CapabilityRequirementSchema = z60.object({
+  id: z60.string().min(1),
+  operation: z60.string().min(1),
+  resourceRef: z60.string().min(1).optional(),
+  scope: z60.string().min(1).optional(),
+  mode: EnforcementModeSchema.default("enforcing")
+});
+var EvidenceObligationSchema = z60.object({
+  id: z60.string().min(1),
+  artifactRef: z60.string().min(1),
+  claim: z60.string().min(1).optional(),
+  required: z60.boolean().default(true),
+  mode: EnforcementModeSchema.default("enforcing"),
+  receiptIssuer: z60.string().min(1).optional()
+});
 var TASK_STATUSES = [
   "intake",
   "clarifying",
@@ -32176,7 +32194,10 @@ var TaskContractSchema = z60.object({
   createdAt: z60.number(),
   updatedAt: z60.number(),
   completedAt: z60.number().optional(),
-  error: z60.string().optional()
+  error: z60.string().optional(),
+  contractVersion: z60.string().optional(),
+  capabilityRequirements: z60.array(CapabilityRequirementSchema).optional(),
+  evidenceObligations: z60.array(EvidenceObligationSchema).optional()
 });
 var StageSpecSchema = z60.object({
   id: z60.string().min(1),
@@ -33060,11 +33081,289 @@ function extractWaveAttribution(event) {
   return { ...base, durationMs: event.durationMs, workerCount: event.successes + event.errors };
 }
 
+// src/pipeline/worker-readiness.ts
+import { createHash as createHash2 } from "node:crypto";
+import { isAbsolute as isAbsolute2 } from "node:path";
+var DEFAULT_PROOF_TTL_MS = 3e5;
+var DEFAULT_PROBE_TIMEOUT_MS = 3e4;
+var WRITE_TOKEN_SET = new Set(
+  "write,mutate,publish,push,delete,remove,create,update,modify,edit,save,patch,commit,merge,append,overwrite,drop,alter,truncate,upload,insert,upsert,replace,rename,move,unlink,rm,mkdir,rmdir,chmod,chown,exec,execute,spawn,bash,sh,zsh,shell,powershell,cmd,terminal,send,post,put".split(
+    ","
+  )
+);
+function isWriteOperation(operation) {
+  const trimmed = operation.trim();
+  if (trimmed.length === 0) return false;
+  const manifestClass = classifyRegisteredTool(trimmed);
+  if (manifestClass !== "unclassified") return manifestClass === "mutation";
+  const tokens = trimmed.replace(/([a-z0-9])([A-Z])/g, "$1 $2").replace(/([A-Z]+)([A-Z][a-z])/g, "$1 $2").split(/[^a-zA-Z0-9]+/).filter(Boolean);
+  return tokens.some((t) => WRITE_TOKEN_SET.has(t.toLowerCase()));
+}
+function contextTuple(c) {
+  return JSON.stringify([
+    c.workerId,
+    c.sessionId,
+    c.adapterId,
+    c.toolSchemaDigest,
+    c.grantDigest,
+    c.subjectRevision,
+    c.policyVersion
+  ]);
+}
+function reqTuple(r) {
+  return JSON.stringify([r.id, r.operation, r.resourceRef ?? null, r.scope ?? null]);
+}
+function proofReqTuple(p) {
+  return JSON.stringify([p.requirementId, p.operation, p.resourceRef ?? null, p.scope ?? null]);
+}
+function isSufficientProofLevel(level) {
+  return level === "probed" || level === "used";
+}
+function isProofValidForContext(p, c, req, now, revokedProofIds) {
+  if (!isSufficientProofLevel(p.level) || revokedProofIds?.has(p.proofId) === true) return false;
+  if (now >= p.expiresAt || p.issuedAt > now) return false;
+  if (isWriteOperation(req.operation) && p.probedInScratch !== true) return false;
+  return contextTuple(p) === contextTuple(c) && proofReqTuple(p) === reqTuple(req);
+}
+function makeFailure(req, workerId, levelReached, errorClass, message) {
+  return {
+    requirementId: req.id,
+    operation: req.operation,
+    resourceRef: req.resourceRef,
+    mode: req.mode,
+    workerId,
+    levelReached,
+    errorClass,
+    message
+  };
+}
+function isSafeScratchPath(scratchDir) {
+  if (scratchDir === void 0) return false;
+  const trimmed = scratchDir.trim();
+  return trimmed.length > 0 && isAbsolute2(trimmed) && !trimmed.split(/[\\/]+/).includes("..");
+}
+function buildProbeOptions(req, ctx, signal) {
+  const sigOpt = signal !== void 0 ? { signal } : {};
+  if (!isWriteOperation(req.operation)) return { isScratchProbe: false, ...sigOpt };
+  if (!isSafeScratchPath(ctx.approvedScratchDir)) {
+    const msg = `Write capability "${req.operation}" cannot be probed without a safe absolute approvedScratchDir on worker "${ctx.workerId}"`;
+    return makeFailure(req, ctx.workerId, "bound-to-worker", "UnsafeWriteProbeRejectedError", msg);
+  }
+  return { isScratchProbe: true, scratchDir: ctx.approvedScratchDir.trim(), ...sigOpt };
+}
+function createVerifiedProof(req, ctx, probeOptions, issuedAt, ttlMs) {
+  const tuple = JSON.stringify([ctx.workerId, ctx.sessionId, reqTuple(req), issuedAt]);
+  const digest = createHash2("sha256").update(tuple).digest("hex").slice(0, 12);
+  const scratch = probeOptions.isScratchProbe ? { probedInScratch: true, narrowerThanTargetWrite: true } : {};
+  const { advertisedOperations: _a, authorizedOperations: _b, approvedScratchDir: _c, ...id } = ctx;
+  return {
+    ...id,
+    proofId: `proof-${ctx.workerId}-${req.id}-${digest}-${String(issuedAt)}`,
+    requirementId: req.id,
+    operation: req.operation,
+    resourceRef: req.resourceRef,
+    scope: req.scope,
+    level: "probed",
+    issuedAt,
+    expiresAt: issuedAt + ttlMs,
+    ...scratch
+  };
+}
+async function invokeProbeSafely(req, config, probeOptions, signal) {
+  try {
+    return await config.probe(req, config.context, { ...probeOptions, signal });
+  } catch (err2) {
+    const hasName = err2 instanceof Error && err2.name !== "" && err2.name !== "Error";
+    const errorClass = hasName ? err2.name : "ProbeExecutionError";
+    return { ok: false, errorClass, message: err2 instanceof Error ? err2.message : String(err2) };
+  }
+}
+async function runBoundedProbe(req, config, probeOptions, effectiveTimeoutMs) {
+  const controller = new AbortController();
+  const onAbort = () => {
+    controller.abort();
+  };
+  config.signal?.addEventListener("abort", onAbort, { once: true });
+  let timer;
+  const timeoutRace = new Promise((resolve16) => {
+    timer = setTimeout(() => {
+      controller.abort();
+      const message = `Worker probe for "${req.id}" timed out after ${String(effectiveTimeoutMs)}ms`;
+      resolve16({ ok: false, errorClass: "ProbeTimeoutError", message });
+    }, effectiveTimeoutMs);
+  });
+  const abortRace = new Promise((resolve16) => {
+    const onSig = () => {
+      const message = `Worker probe for "${req.id}" aborted during execution`;
+      resolve16({ ok: false, errorClass: "ProbeAbortedError", message });
+    };
+    config.signal?.addEventListener("abort", onSig, { once: true });
+  });
+  try {
+    return await Promise.race([
+      invokeProbeSafely(req, config, probeOptions, controller.signal),
+      timeoutRace,
+      abortRace
+    ]);
+  } finally {
+    if (timer !== void 0) clearTimeout(timer);
+    config.signal?.removeEventListener("abort", onAbort);
+  }
+}
+function resolveClock(nowConfig) {
+  if (typeof nowConfig === "function") return nowConfig;
+  if (typeof nowConfig === "number") {
+    const startWall = getTimeProvider().now();
+    return () => nowConfig + Math.max(0, getTimeProvider().now() - startWall);
+  }
+  return () => getTimeProvider().now();
+}
+function checkPreStepBounds(req, config, stepStart, deadlineAt) {
+  const { workerId, advertisedOperations, authorizedOperations } = config.context;
+  if (config.signal?.aborted === true) {
+    const msg = `Worker probe for "${req.id}" aborted before invocation`;
+    return makeFailure(req, workerId, "bound-to-worker", "ProbeAbortedError", msg);
+  }
+  if (deadlineAt !== void 0 && stepStart >= deadlineAt) {
+    const msg = `Worker preflight deadline exhausted before evaluating "${req.id}"`;
+    return makeFailure(req, workerId, "bound-to-worker", "ProbeTimeoutError", msg);
+  }
+  if (!advertisedOperations.includes(req.operation)) {
+    const msg = `Operation "${req.operation}" is not advertised on worker "${workerId}"`;
+    return makeFailure(req, workerId, "unadvertised", "UnadvertisedOperationError", msg);
+  }
+  if (!authorizedOperations.includes(req.operation)) {
+    const msg = `Operation "${req.operation}" is advertised but not authorized for worker "${workerId}"`;
+    return makeFailure(req, workerId, "advertised", "UnauthorizedOperationError", msg);
+  }
+  return null;
+}
+function evaluateProbeOutcome(req, config, outcome, elapsedMs, budgetMs) {
+  const wId = config.context.workerId;
+  if (config.signal?.aborted === true) {
+    const msg = `Worker probe for "${req.id}" aborted during execution`;
+    return makeFailure(req, wId, "bound-to-worker", "ProbeAbortedError", msg);
+  }
+  if (elapsedMs > budgetMs) {
+    const msg = `Worker probe for "${req.id}" timed out (${String(elapsedMs)}ms > ${String(budgetMs)}ms)`;
+    return makeFailure(req, wId, "bound-to-worker", "ProbeTimeoutError", msg);
+  }
+  if (!outcome.ok) {
+    return makeFailure(req, wId, "bound-to-worker", outcome.errorClass, outcome.message);
+  }
+  return null;
+}
+async function evaluateSingleRequirement(req, config, clock, ttlMs, deadlineAt) {
+  const stepStart = clock();
+  const preStepFailure = checkPreStepBounds(req, config, stepStart, deadlineAt);
+  if (preStepFailure !== null) return { failure: preStepFailure };
+  const cached = config.cache?.getValidProof(config.context, req, stepStart);
+  if (cached !== void 0) return { proof: cached };
+  const probeOptionsOrFailure = buildProbeOptions(req, config.context, config.signal);
+  if ("errorClass" in probeOptionsOrFailure) return { failure: probeOptionsOrFailure };
+  const perProbe = config.probeTimeoutMs ?? DEFAULT_PROBE_TIMEOUT_MS;
+  const budgetMs = deadlineAt !== void 0 ? Math.min(perProbe, deadlineAt - stepStart) : perProbe;
+  const outcome = await runBoundedProbe(req, config, probeOptionsOrFailure, budgetMs);
+  const stepEnd = clock();
+  const fail = evaluateProbeOutcome(req, config, outcome, stepEnd - stepStart, budgetMs);
+  if (fail !== null) return { failure: fail };
+  const proof = createVerifiedProof(req, config.context, probeOptionsOrFailure, stepEnd, ttlMs);
+  config.cache?.putProof(proof);
+  return { proof };
+}
+function revalidateProofsAtCompletion(entries, config, completionTime, failures, advisoryWarnings) {
+  const validProofs = [];
+  const wId = config.context.workerId;
+  for (const { req, proof } of entries) {
+    const selfValid = isProofValidForContext(proof, config.context, req, completionTime);
+    const cacheCurrent = config.cache?.getValidProof(config.context, req, completionTime);
+    if (selfValid && (config.cache === void 0 || cacheCurrent?.proofId === proof.proofId)) {
+      validProofs.push(proof);
+      continue;
+    }
+    if (cacheCurrent !== void 0 && cacheCurrent.proofId !== proof.proofId) {
+      validProofs.push(cacheCurrent);
+      continue;
+    }
+    const msg = `Cached readiness proof "${proof.proofId}" expired before preflight completed`;
+    const fail = makeFailure(req, wId, "bound-to-worker", "ProofExpiredDuringPreflightError", msg);
+    (req.mode === "enforcing" ? failures : advisoryWarnings).push(fail);
+  }
+  return validProofs;
+}
+async function verifyWorkerReadiness(requirements, config) {
+  const clock = resolveClock(config.now);
+  const startTime = clock();
+  const ttlMs = config.proofTtlMs ?? DEFAULT_PROOF_TTL_MS;
+  const deadlineAt = config.totalTimeoutMs !== void 0 ? startTime + config.totalTimeoutMs : void 0;
+  const entries = [];
+  const failures = [];
+  const advisoryWarnings = [];
+  for (const req of requirements) {
+    const evaluation = await evaluateSingleRequirement(req, config, clock, ttlMs, deadlineAt);
+    if (evaluation.proof !== void 0) entries.push({ req, proof: evaluation.proof });
+    else if (evaluation.failure !== void 0) {
+      (req.mode === "enforcing" ? failures : advisoryWarnings).push(evaluation.failure);
+    }
+  }
+  const proofs = revalidateProofsAtCompletion(entries, config, clock(), failures, advisoryWarnings);
+  return {
+    ready: failures.length === 0,
+    workerId: config.context.workerId,
+    proofs,
+    failures,
+    advisoryWarnings
+  };
+}
+
 // src/pipeline/pipeline-runner.ts
 var pipelineLogger = createLogger({ component: "PipelineRunner" });
 function getDefaultRunsDir() {
   return nexusDataPath("runs");
 }
+function resolvePreflightConfig(workerReadiness, pipelineTimeoutMs, pipelineSignal) {
+  const effectiveSignal = pipelineSignal !== void 0 && workerReadiness.signal !== void 0 ? AbortSignal.any([pipelineSignal, workerReadiness.signal]) : workerReadiness.signal ?? pipelineSignal;
+  const totalBudgetMs = Math.min(
+    pipelineTimeoutMs,
+    workerReadiness.totalTimeoutMs ?? pipelineTimeoutMs
+  );
+  const effectiveProbeMs = Math.min(workerReadiness.probeTimeoutMs ?? totalBudgetMs, totalBudgetMs);
+  return { effectiveSignal, totalBudgetMs, effectiveProbeMs };
+}
+function formatReadinessOutcome(report, effectiveSignal, startTime, totalBudgetMs) {
+  if (effectiveSignal?.aborted === true) return "Pipeline aborted during preflight readiness";
+  if (!report.ready) {
+    const details = report.failures.map((f) => `${f.requirementId} (${f.errorClass}: ${f.message})`).join("; ");
+    return `WorkerNotReadyError [${report.workerId}]: ${details}`;
+  }
+  if (Date.now() - startTime >= totalBudgetMs) {
+    return `PipelineTimeoutError [${report.workerId}]: Preflight readiness exhausted timeout budget (${String(totalBudgetMs)}ms)`;
+  }
+  return null;
+}
+async function checkPreflightReadiness(pipeline, task, options, startTime) {
+  if (options?.workerReadiness === void 0) return null;
+  const { effectiveSignal, totalBudgetMs, effectiveProbeMs } = resolvePreflightConfig(
+    options.workerReadiness,
+    options.timeout ?? pipeline.plan.timeoutMs,
+    options.signal
+  );
+  if (effectiveSignal?.aborted === true) return "Pipeline aborted before preflight readiness";
+  const report = await verifyWorkerReadiness(task.capabilityRequirements ?? [], {
+    ...options.workerReadiness,
+    probeTimeoutMs: effectiveProbeMs,
+    totalTimeoutMs: totalBudgetMs,
+    ...effectiveSignal !== void 0 ? { signal: effectiveSignal } : {}
+  });
+  for (const w of report.advisoryWarnings) {
+    pipelineLogger.warn("Worker readiness advisory warning", { ...w });
+  }
+  return formatReadinessOutcome(report, effectiveSignal, startTime, totalBudgetMs);
+}
+function computeRemainingTimeout(pipeline, options, startTime) {
+  const totalTimeoutMs = options?.timeout ?? pipeline.plan.timeoutMs;
+  return Math.max(1, totalTimeoutMs - (Date.now() - startTime));
+}
 var PipelineRunner = class {
   /** Compiles a PlanContract into a CompiledPipeline. */
   compile(plan, options) {
@@ -33090,10 +33389,18 @@ var PipelineRunner = class {
     if (options?.signal?.aborted === true) {
       return okResult(failedResult(startTime, "Pipeline aborted before execution"));
     }
+    const readinessError = await checkPreflightReadiness(pipeline, task, options, startTime);
+    if (readinessError !== null) {
+      return okResult(failedResult(startTime, readinessError));
+    }
+    const remainingTimeoutMs = computeRemainingTimeout(pipeline, options, startTime);
     const trace = createTraceContext(task, options);
     emitPipelineStarted(trace, task);
     try {
-      const graphOpts = buildGraphOptions(pipeline, options);
+      const graphOpts = buildGraphOptions(pipeline, {
+        ...options,
+        timeout: remainingTimeoutMs
+      });
       const graphResult = await executeGraph(pipeline.graph, { task }, graphOpts);
       if (!graphResult.ok) {
         emitPipelineCompleted(trace, task.id, false, Date.now() - startTime);
@@ -33401,7 +33708,10 @@ function buildBaseTaskContract(input) {
     artifacts: [],
     metadata: { ...input.metadata },
     createdAt: now,
-    updatedAt: now
+    updatedAt: now,
+    contractVersion: "1.0.0",
+    capabilityRequirements: [],
+    evidenceObligations: []
   };
 }
 
@@ -35821,7 +36131,7 @@ async function maybeRetryAfterTriage(opts) {
 }
 
 // src/orchestration/aorchestra/compose-worker-prompt.ts
-import { createHash as createHash2 } from "node:crypto";
+import { createHash as createHash3 } from "node:crypto";
 
 // src/orchestration/aorchestra/context-distillation.ts
 import { z as z64 } from "zod";
@@ -36190,11 +36500,11 @@ function textEvidence(raw) {
     wellFormedText: raw.isWellFormed() && sanitized.isWellFormed(),
     ...raw.isWellFormed() ? {
       rawBytes: Buffer.byteLength(raw),
-      rawSha256: createHash2("sha256").update(raw).digest("hex")
+      rawSha256: createHash3("sha256").update(raw).digest("hex")
     } : {},
     ...sanitized.isWellFormed() ? {
       sanitizedBytes: Buffer.byteLength(sanitized),
-      sanitizedSha256: createHash2("sha256").update(sanitized).digest("hex")
+      sanitizedSha256: createHash3("sha256").update(sanitized).digest("hex")
     } : {}
   };
 }
@@ -36241,7 +36551,7 @@ function prepareWorkerPrompt(input) {
     evidence: {
       ...evidence,
       promptBytes,
-      promptSha256: createHash2("sha256").update(prompt).digest("hex")
+      promptSha256: createHash3("sha256").update(prompt).digest("hex")
     }
   });
 }
@@ -36945,7 +37255,7 @@ async function warmModelMetadata(adapters, signal) {
 }
 
 // src/orchestration/aorchestra/worker-artifact.ts
-import { createHash as createHash3 } from "node:crypto";
+import { createHash as createHash4 } from "node:crypto";
 import { statSync as statSync2, readFileSync as readFileSync5 } from "node:fs";
 import { basename as basename2 } from "node:path";
 var MAX_INLINE_ARTIFACT_BYTES = 1e5;
@@ -36987,7 +37297,7 @@ function readWorkerArtifact(filePath) {
   } catch {
     return err(`Artifact cannot be decoded as UTF-8: ${filePath}`);
   }
-  const sha256 = createHash3("sha256").update(buffer).digest("hex");
+  const sha256 = createHash4("sha256").update(buffer).digest("hex");
   const name = basename2(filePath);
   return ok({
     name,
@@ -47794,7 +48104,7 @@ function computePrReviewRecordHash(payload) {
 
 // src/audit/pr-review-record-store.ts
 import { appendFileSync as appendFileSync3, existsSync as existsSync8, mkdirSync as mkdirSync5, readFileSync as readFileSync7 } from "node:fs";
-import { dirname as dirname3, isAbsolute as isAbsolute3, join as join11, resolve as resolve7 } from "node:path";
+import { dirname as dirname3, isAbsolute as isAbsolute4, join as join11, resolve as resolve7 } from "node:path";
 var PR_REVIEW_RECORDS_REL_PATH = "governance/pr-review-records.jsonl";
 var PR_REVIEW_RECORDS_PATH_ENV = "NEXUS_PR_REVIEW_RECORDS_PATH";
 var MAX_SUMMARY_RECORD_CHARS = 500;
@@ -47832,7 +48142,7 @@ function buildPrReviewRecord(input) {
 function resolvePrReviewRecordsPath(repoPathOverride) {
   const envPath = process.env[PR_REVIEW_RECORDS_PATH_ENV];
   if (envPath !== void 0 && envPath.trim() !== "") {
-    return isAbsolute3(envPath) ? envPath : resolve7(envPath);
+    return isAbsolute4(envPath) ? envPath : resolve7(envPath);
   }
   if (repoPathOverride !== void 0 && repoPathOverride.trim() !== "") {
     const overrideRoot = findRepoRoot(repoPathOverride);
@@ -48483,7 +48793,7 @@ async function tryIssueTriage(task) {
   try {
     const issueMatch = task.match(/github\.com\/([^/]+\/[^/]+)\/issues\/(\d+)/);
     if (issueMatch === null) return null;
-    const { createIssueTriage } = await import("./issue-triage-B2B4IYDA.js");
+    const { createIssueTriage } = await import("./issue-triage-L43RYWHF.js");
     const triage = createIssueTriage();
     const owner = issueMatch[1] ?? "";
     const num2 = issueMatch[2] ?? "";
@@ -48511,7 +48821,7 @@ var VALID_TEMPLATES = /* @__PURE__ */ new Set([
 ]);
 async function classifyWithLLM(task) {
   try {
-    const { executeExpert: executeExpert2 } = await import("./expert-bridge-ITQMWAKA.js");
+    const { executeExpert: executeExpert2 } = await import("./expert-bridge-ALRWVSSI.js");
     const prompt = [
       "Classify this task into exactly one pipeline template.",
       "Templates: dev (implementation/bug fix/refactor), research (investigate/evaluate/compare),",
@@ -48880,7 +49190,7 @@ function buildVotingInput(plan, config) {
 }
 async function executeSingleVote(plan, config, log) {
   try {
-    const { executeVoting } = await import("./consensus-vote-BUDINEFA.js");
+    const { executeVoting } = await import("./consensus-vote-NHMTEXE7.js");
     const input = buildVotingInput(plan, config);
     const result = await executeVoting(input, log);
     return parseVotingResult(result);
@@ -48914,7 +49224,7 @@ function parseVotingResult(result) {
 
 // src/pipeline/dev-pipeline.ts
 import { realpathSync as realpathSync7 } from "node:fs";
-import { isAbsolute as isAbsolute6, relative as relative6, sep as sep5 } from "node:path";
+import { isAbsolute as isAbsolute7, relative as relative6, sep as sep5 } from "node:path";
 
 // src/orchestration/qa-loop.ts
 var logger40 = createLogger({ component: "qa-loop" });
@@ -49379,7 +49689,7 @@ import {
 } from "node:fs";
 import { realpath } from "node:fs/promises";
 import { homedir as homedir3 } from "node:os";
-import { delimiter, dirname as dirname4, isAbsolute as isAbsolute4, join as join14, relative as relative3, sep as sep3 } from "node:path";
+import { delimiter, dirname as dirname4, isAbsolute as isAbsolute5, join as join14, relative as relative3, sep as sep3 } from "node:path";
 
 // src/cli-adapters/exec-file-tree.ts
 import { execFile } from "node:child_process";
@@ -49451,7 +49761,7 @@ function spawnTracked(command, args, options, onExit) {
 var bwrapPreflight = createBwrapPreflight();
 var bwrapCommand = (() => {
   for (const directory of (process.env["PATH"] ?? "").split(delimiter)) {
-    if (!isAbsolute4(directory)) continue;
+    if (!isAbsolute5(directory)) continue;
     const binary = join14(directory, "bwrap");
     try {
       accessSync(binary, constants.X_OK);
@@ -49566,7 +49876,7 @@ async function createScratchSandbox(scratch, source) {
   const scratchPath = realpathSync4(scratch);
   const contains2 = (parent, child) => {
     const path9 = relative3(parent, child);
-    return path9 === "" || path9 !== ".." && !path9.startsWith(`..${sep3}`) && !isAbsolute4(path9);
+    return path9 === "" || path9 !== ".." && !path9.startsWith(`..${sep3}`) && !isAbsolute5(path9);
   };
   if (contains2(protectedSource, scratchPath) || contains2(scratchPath, protectedSource)) {
     throw new Error("Writable scratch path overlaps protected source");
@@ -49608,10 +49918,10 @@ async function createScratchSandbox(scratch, source) {
 // src/pipeline/pipeline-scratch-root.ts
 import { existsSync as existsSync12, realpathSync as realpathSync5 } from "node:fs";
 import { tmpdir } from "node:os";
-import { isAbsolute as isAbsolute5, relative as relative4, resolve as resolve9, sep as sep4 } from "node:path";
+import { isAbsolute as isAbsolute6, relative as relative4, resolve as resolve9, sep as sep4 } from "node:path";
 function contains(parent, child) {
   const path9 = relative4(parent, child);
-  return path9 === "" || path9 !== ".." && !path9.startsWith(`..${sep4}`) && !isAbsolute5(path9);
+  return path9 === "" || path9 !== ".." && !path9.startsWith(`..${sep4}`) && !isAbsolute6(path9);
 }
 function overlaps(a, b) {
   return contains(a, b) || contains(b, a);
@@ -50246,7 +50556,7 @@ function hasIsolatedImplementWorkspace(workspace) {
 }
 function isWithin2(parent, child) {
   const pathFromParent = relative6(parent, child);
-  return pathFromParent === "" || pathFromParent !== ".." && !pathFromParent.startsWith(`..${sep5}`) && !isAbsolute6(pathFromParent);
+  return pathFromParent === "" || pathFromParent !== ".." && !pathFromParent.startsWith(`..${sep5}`) && !isAbsolute7(pathFromParent);
 }
 async function runQualityGateStage(stages, mode) {
   if (mode === "off" || stages.qualityGate === void 0) {
@@ -50724,7 +51034,7 @@ var memoryInitPromise = null;
 async function initPipelineMemory() {
   if (cachedMemory !== null) return cachedMemory;
   try {
-    const { createSessionMemory: createSessionMemory2 } = await import("./session-memory-EDNBL5AG.js");
+    const { createSessionMemory: createSessionMemory2 } = await import("./session-memory-IOCGYRWZ.js");
     const { getLearningDir } = await import("./learning-persistence-NW5AE222.js");
     const mem = createSessionMemory2(getLearningDir());
     mem.startSession(`pipeline-${String(getTimeProvider().now())}`);
@@ -50786,7 +51096,7 @@ function recordRoutingExperience(category, success, durationMs, tokensUsed = 0,
     callRecord(routingMemoryCache);
     return;
   }
-  routingMemoryInitPromise ??= import("./routing-memory-XFFA6XQW.js").then(({ createRoutingMemory }) => {
+  routingMemoryInitPromise ??= import("./routing-memory-VABGC4UO.js").then(({ createRoutingMemory }) => {
     routingMemoryCache ??= createRoutingMemory();
     return routingMemoryCache;
   }).catch((error) => {
@@ -51356,7 +51666,7 @@ async function prepareCompletePlanVote(plan, research, config, signal) {
   return { proposal, roleAdapters: panel.seats };
 }
 async function executePlanVote(plan, research, config, strategy, signal) {
-  const { executeVoting } = await import("./consensus-vote-BUDINEFA.js");
+  const { executeVoting } = await import("./consensus-vote-NHMTEXE7.js");
   const { proposal, roleAdapters } = await prepareCompletePlanVote(plan, research, config, signal);
   const votingResult = await executeVoting(
     {
@@ -51912,7 +52222,7 @@ function resolveConfidence(rule) {
 // src/mcp/tools/security-scan.ts
 import { access, constants as constants2 } from "node:fs/promises";
 import { readFile as readFile5, realpath as realpath2, writeFile as writeFile2 } from "node:fs/promises";
-import { delimiter as delimiter2, isAbsolute as isAbsolute7, join as join16, parse as parse5, resolve as resolve10 } from "node:path";
+import { delimiter as delimiter2, isAbsolute as isAbsolute8, join as join16, parse as parse5, resolve as resolve10 } from "node:path";
 var logger48 = createLogger({ component: "security-scan" });
 var SCAN_TIMEOUT_MS = 3e5;
 async function probeSemgrepVersion(signal, env, wrapper, binary = "semgrep", cwd) {
@@ -51939,7 +52249,7 @@ async function probeSemgrepVersion(signal, env, wrapper, binary = "semgrep", cwd
 function probeExecutableCandidates(binary, env, cwd) {
   const root = cwd ?? process.cwd();
   const searchPath = (env ?? process.env)["PATH"];
-  return isAbsolute7(binary) || /[/\\]/.test(binary) ? [resolve10(root, binary)] : process.platform === "win32" ? void 0 : searchPath?.split(delimiter2).map((directory) => resolve10(root, directory, binary));
+  return isAbsolute8(binary) || /[/\\]/.test(binary) ? [resolve10(root, binary)] : process.platform === "win32" ? void 0 : searchPath?.split(delimiter2).map((directory) => resolve10(root, directory, binary));
 }
 async function isSemgrepExecutableMissing(binary, env, cwd) {
   const candidates = probeExecutableCandidates(binary, env, cwd);
@@ -52022,7 +52332,7 @@ var COMPLETE_SCAN_FLAGS = [
 ];
 async function resolveSemgrep(env) {
   for (const directory of (env["PATH"] ?? "").split(delimiter2)) {
-    if (!isAbsolute7(directory)) continue;
+    if (!isAbsolute8(directory)) continue;
     const binary = join16(directory, process.platform === "win32" ? "semgrep.exe" : "semgrep");
     try {
       await access(binary, constants2.X_OK);
@@ -52443,21 +52753,21 @@ function mergeOsvChecks(previous, next) {
 }
 
 // src/pipeline/security-baseline.ts
-import { createHash as createHash8 } from "node:crypto";
+import { createHash as createHash9 } from "node:crypto";
 import { mkdtemp, rm, readFile as readFile7, readlink } from "node:fs/promises";
-import { isAbsolute as isAbsolute9, join as join19 } from "node:path";
+import { isAbsolute as isAbsolute10, join as join19 } from "node:path";
 
 // src/pipeline/security-baseline-coverage.ts
-import { createHash as createHash7 } from "node:crypto";
+import { createHash as createHash8 } from "node:crypto";
 import { readFile as readFile6, realpath as realpath3, lstat } from "node:fs/promises";
-import { isAbsolute as isAbsolute8, join as join18, relative as relative7 } from "node:path";
+import { isAbsolute as isAbsolute9, join as join18, relative as relative7 } from "node:path";
 function scanErrors(scan, side) {
   if ("error" in scan) return [`${side}: ${scan.error}`];
   const errors = scan.errors.map((error) => `${side}: ${error}`);
   if (scan.coverageComplete !== true || scan.totalFindings !== scan.findings.length)
     errors.push(`${side}: scan coverage is incomplete`);
   for (const finding of scan.findings) {
-    if (isAbsolute8(finding.file) || finding.file.split("/").includes("..") || /^[a-z]+:/i.test(finding.file))
+    if (isAbsolute9(finding.file) || finding.file.split("/").includes("..") || /^[a-z]+:/i.test(finding.file))
       errors.push(`${side}: finding path outside scanned tree: ${finding.file}`);
     if (ambiguousSnippet(finding))
       errors.push(
@@ -52472,17 +52782,17 @@ function normalizedScan(scan, directory) {
     ...scan,
     scannerDiagnostics: (scan.scannerDiagnostics ?? []).map((diagnostic) => ({
       ...diagnostic,
-      file: isAbsolute8(diagnostic.file) ? relative7(directory, diagnostic.file) : diagnostic.file.replace(/^\.\//, ""),
+      file: isAbsolute9(diagnostic.file) ? relative7(directory, diagnostic.file) : diagnostic.file.replace(/^\.\//, ""),
       message: diagnostic.message.split(join18(directory, "/")).join("")
     })),
     parseDiagnostics: (scan.parseDiagnostics ?? []).map((diagnostic) => ({
       ...diagnostic,
-      file: isAbsolute8(diagnostic.file) ? relative7(directory, diagnostic.file) : diagnostic.file.replace(/^\.\//, ""),
+      file: isAbsolute9(diagnostic.file) ? relative7(directory, diagnostic.file) : diagnostic.file.replace(/^\.\//, ""),
       message: diagnostic.message.split(join18(directory, "/")).join("")
     })),
     findings: scan.findings.map((finding) => ({
       ...finding,
-      file: isAbsolute8(finding.file) ? relative7(directory, finding.file) : finding.file.replace(/^\.\//, "")
+      file: isAbsolute9(finding.file) ? relative7(directory, finding.file) : finding.file.replace(/^\.\//, "")
     }))
   };
 }
@@ -52554,7 +52864,7 @@ async function unchangedFile(input, file) {
   const mode = (stat5) => (stat5.mode & 73) === 0 ? "100644" : "100755";
   const hash = match[2];
   if (hash === void 0 || !oldStat.isFile() || !newStat.isFile()) return false;
-  const digest = (bytes2) => createHash7(hash.length === 64 ? "sha256" : "sha1").update(`blob ${String(bytes2.length)}\0`).update(bytes2).digest("hex");
+  const digest = (bytes2) => createHash8(hash.length === 64 ? "sha256" : "sha1").update(`blob ${String(bytes2.length)}\0`).update(bytes2).digest("hex");
   return mode(oldStat) === match[1] && mode(newStat) === match[1] && digest(oldBytes) === hash && digest(newBytes) === hash;
 }
 async function confinedFile(root, file) {
@@ -52565,7 +52875,7 @@ async function confinedFile(root, file) {
   return path9;
 }
 function outsideTree(file) {
-  return file === "" || hasControlCharacter(file) || file.includes("\\") || isAbsolute8(file) || file.split("/").includes("..") || /^[a-z]+:/i.test(file);
+  return file === "" || hasControlCharacter(file) || file.includes("\\") || isAbsolute9(file) || file.split("/").includes("..") || /^[a-z]+:/i.test(file);
 }
 
 // src/pipeline/security-baseline.ts
@@ -52589,7 +52899,7 @@ function preservedLine(finding, diff) {
 async function introducedFindings(base, worktree, git2, target, sha) {
   const diffs = /* @__PURE__ */ new Map();
   for (const file of new Set(base.map((finding) => finding.file))) {
-    if (isAbsolute9(file) || file.split("/").includes(".."))
+    if (isAbsolute10(file) || file.split("/").includes(".."))
       throw new Error("Finding path outside scanned tree");
     diffs.set(
       file,
@@ -52681,7 +52991,7 @@ async function allocateComparisonDirectory(target, config, options) {
     return mkdtemp(join19(root, "security-baseline-"));
   }
   const path9 = (await execFileTree("mktemp", ["-d"], options)).stdout.trim();
-  if (!isAbsolute9(path9)) throw new Error("Sandbox did not allocate a comparison directory");
+  if (!isAbsolute10(path9)) throw new Error("Sandbox did not allocate a comparison directory");
   return path9;
 }
 async function assessComparison(input) {
@@ -52728,7 +53038,7 @@ async function verifyArchive(directory, tree) {
   for (const entry of tree.split("\0").filter((record) => record !== "")) {
     const { mode, hash, file } = parseTreeEntry(entry);
     const contents = mode === "120000" ? Buffer.from(await readlink(join19(directory, file))) : await readFile7(join19(directory, file));
-    const digest = createHash8(hash.length === 64 ? "sha256" : "sha1").update(`blob ${String(contents.length)}\0`).update(contents).digest("hex");
+    const digest = createHash9(hash.length === 64 ? "sha256" : "sha1").update(`blob ${String(contents.length)}\0`).update(contents).digest("hex");
     if (digest !== hash) throw new Error(`Pinned archive content differs: ${file}`);
   }
 }
@@ -52736,7 +53046,7 @@ function parseTreeEntry(entry) {
   const match = /^(\d+) (\w+) ([a-f0-9]+)\t([\s\S]+)$/.exec(entry);
   if (match === null) throw new Error("Unreadable pinned Git tree");
   const [, mode, type, hash, file] = match;
-  if (mode === void 0 || type !== "blob" || hash === void 0 || file === void 0 || isAbsolute9(file) || file.split("/").includes(".."))
+  if (mode === void 0 || type !== "blob" || hash === void 0 || file === void 0 || isAbsolute10(file) || file.split("/").includes(".."))
     throw new Error("Pinned tree coverage incomplete: unsupported tree entry");
   return { mode, hash, file };
 }
@@ -52767,7 +53077,7 @@ async function archiveBaseline(input) {
   const { target, directory, baseline, sha, git: git2, execOptions } = input;
   const baseDir = join19(directory, "base");
   const prefix = (await git2(target, ["rev-parse", "--show-prefix"])).trim();
-  if (isAbsolute9(prefix) || prefix.split("/").includes(".."))
+  if (isAbsolute10(prefix) || prefix.split("/").includes(".."))
     throw new Error("Invalid scan subtree");
   const { mkdir: mkdir2 } = await import("node:fs/promises");
   await mkdir2(baseDir);
@@ -53167,7 +53477,7 @@ ${text}` : "";
 }
 async function getWeatherContext() {
   try {
-    const { generateWeatherReport: generateWeatherReport2 } = await import("./weather-report-MJWGQNR3.js");
+    const { generateWeatherReport: generateWeatherReport2 } = await import("./weather-report-KFSIUHPD.js");
     const report = generateWeatherReport2({ includeAdaptive: true });
     const mappings = "recommendedMappings" in report ? report.recommendedMappings : [];
     if (!Array.isArray(mappings) || mappings.length === 0) return "";
@@ -53185,7 +53495,7 @@ ${lines}
 }
 async function getMemoryContext(task) {
   try {
-    const { createSessionMemory: createSessionMemory2 } = await import("./session-memory-EDNBL5AG.js");
+    const { createSessionMemory: createSessionMemory2 } = await import("./session-memory-IOCGYRWZ.js");
     const { getLearningDir } = await import("./learning-persistence-NW5AE222.js");
     const memory = createSessionMemory2(getLearningDir(), { maxLearningsInContext: 10 });
     const learnings = memory.searchLearnings(task.slice(0, 200));
@@ -53944,7 +54254,7 @@ async function searchCodebaseForTask(task) {
 }
 async function queryResearchRegistry(task) {
   try {
-    const { synthesizeResearch: synthesizeResearch2 } = await import("./research-helpers-synthesize-JRWNQZR7.js");
+    const { synthesizeResearch: synthesizeResearch2 } = await import("./research-helpers-synthesize-IBLF6E3G.js");
     const topic = task.split(/[.!?\n]/).filter((s) => s.trim().length > 10)[0]?.trim();
     if (topic === void 0) return null;
     const result = await synthesizeResearch2(topic.slice(0, 50));
@@ -54063,7 +54373,7 @@ function createScanStageWrapper() {
       try {
         const repo = await selectAuditRepository(ctx.task);
         if (!repo.ok) return failOutput(PIPELINE_STATE_KEYS.FINDINGS, repo.error, getTimeProvider().now() - start);
-        const { generateSecurityPlan: generateSecurityPlan2 } = await import("./repo-security-plan-QPI4B4UQ.js");
+        const { generateSecurityPlan: generateSecurityPlan2 } = await import("./repo-security-plan-K63AG6CZ.js");
         const plan = await generateSecurityPlan2({ repo: repo.value, maxScanners: 10 });
         const recs = plan.recommendations.slice(0, 5).map((r) => `${r.priority}: ${r.displayName} (${r.category})`).join("; ");
         return output(PIPELINE_STATE_KEYS.FINDINGS, recs, getTimeProvider().now() - start, true);
@@ -57436,7 +57746,7 @@ var GitHubTaskTracker = class {
   cachedProvider = null;
   async getProvider() {
     if (this.cachedProvider !== null) return this.cachedProvider;
-    const { createScmProvider } = await import("./factory-XWEHISQV.js");
+    const { createScmProvider } = await import("./factory-ERJ5N6KH.js");
     const result = await createScmProvider({ repo: this.config.repo ?? "" });
     if (!result.ok) throw new Error(`SCM provider error: ${result.error.message}`);
     this.cachedProvider = result.value;
@@ -58555,7 +58865,7 @@ function withCatalogueCaveat(report) {
 var GATEWAY_TRANSPORT = "gateway";
 var GATEWAY_API_ARM = "api:custom-openai";
 async function gatewaySource(apiArm) {
-  const { discoverModels, readOpenAICompatEnv } = await import("./openai-compat-adapter-OINWDEMM.js");
+  const { discoverModels, readOpenAICompatEnv } = await import("./openai-compat-adapter-3GXAUQHR.js");
   const config = readOpenAICompatEnv();
   if (config !== null) {
     return {
@@ -58574,7 +58884,7 @@ async function gatewaySource(apiArm) {
 }
 async function defaultSources(includeOpenRouter, adaptersFactory) {
   const adapters = new Map(
-    adaptersFactory !== void 0 ? adaptersFactory() : (await import("./factory-7KG4FG7V.js")).createAllAdapters()
+    adaptersFactory !== void 0 ? adaptersFactory() : (await import("./factory-4HF6KCS2.js")).createAllAdapters()
   );
   const apiArm = adapters.get(GATEWAY_API_ARM);
   adapters.delete(GATEWAY_API_ARM);
@@ -61845,4 +62155,4 @@ export {
   initializeSandbox,
   getSandboxMode
 };
-//# sourceMappingURL=chunk-TOQ7HR2R.js.map
+//# sourceMappingURL=chunk-77KDH7HO.js.map