nexus-agents 4.3.1 → 4.3.3

package/dist/{chunk-UZUECKIV.js → chunk-TXAWKJWL.js}

@@ -52,7 +52,7 @@ import {
 } from "./chunk-OQLFRJCW.js";
 
 // src/version.ts
-var VERSION = true ? "4.3.1" : "dev";
+var VERSION = true ? "4.3.3" : "dev";
 
 // src/config/schemas-core.ts
 import { z } from "zod";
@@ -2339,7 +2339,7 @@ async function runDoctorFix(result) {
   writeLine2("\u2500".repeat(40));
   let fixCount = 0;
   if (!result.dataDirectory.rootExists || result.dataDirectory.subdirectories.some((d) => !d.exists || !d.writable)) {
-    const { runSetup } = await import("./setup-command-H4XOEBF5.js");
+    const { runSetup } = await import("./setup-command-R6LRVQ7P.js");
     const setupResult = runSetup({
       skipMcp: true,
       skipRules: true,
@@ -2452,4 +2452,4 @@ export {
   startStdioServer,
   closeServer
 };
-//# sourceMappingURL=chunk-UZUECKIV.js.map
+//# sourceMappingURL=chunk-TXAWKJWL.js.map

package/dist/cli.js

@@ -18,7 +18,7 @@ import "./chunk-JV5HRP3S.js";
 import {
   setupCommandAsync,
   verifyCommand
-} from "./chunk-L7Z7ZLM5.js";
+} from "./chunk-BG7IE3V5.js";
 import "./chunk-73U6W5ZU.js";
 import {
   AuthHandler,
@@ -139,7 +139,7 @@ import {
   validateCommand,
   validateWorkflow,
   wrapInMarkdownFence
-} from "./chunk-LSQ6TVSS.js";
+} from "./chunk-GWL7WO64.js";
 import "./chunk-FHXDRCIW.js";
 import "./chunk-HFOQKCD2.js";
 import "./chunk-RSMG2DPB.js";
@@ -166,7 +166,7 @@ import {
   loadConfig,
   runDoctor,
   validateNexusEnv
-} from "./chunk-UZUECKIV.js";
+} from "./chunk-TXAWKJWL.js";
 import {
   buildOpenAICompatAdapters,
   readOpenAICompatEnv
@@ -183,7 +183,7 @@ import {
   executeVoting,
   mapOutcomeToDecision,
   registerConsensusVoteTool
-} from "./chunk-LWB4RR47.js";
+} from "./chunk-CXA4H3PZ.js";
 import {
   loadUsageEvents,
   rollupByModel

package/dist/{consensus-vote-3IHQNBNY.js → consensus-vote-EOXPISAA.js}

@@ -11,7 +11,7 @@ import {
   resetCorrelationTracker,
   runConsensusForGoal,
   unwrapVoteOrThrow
-} from "./chunk-LWB4RR47.js";
+} from "./chunk-CXA4H3PZ.js";
 import "./chunk-3P6N3XZF.js";
 import "./chunk-OQB3XC5O.js";
 import "./chunk-WX5TASVN.js";
@@ -49,4 +49,4 @@ export {
   runConsensusForGoal,
   unwrapVoteOrThrow
 };
-//# sourceMappingURL=consensus-vote-3IHQNBNY.js.map
+//# sourceMappingURL=consensus-vote-EOXPISAA.js.map

package/dist/index.d.ts

@@ -32451,6 +32451,11 @@ declare function createCorrelationTracker(config?: Partial<HigherOrderVotingConf
  *
  * Traditional voting assumes independence between voters. Higher-order voting
  * uses Bayesian-optimal aggregation that handles correlated agents better,
+ * BUT NOTE (#4701): `calculateOutcome` — the `IVotingStrategy` entry point the
+ * `ConsensusEngine` calls — uses `aggregateSimpleInternal` and ignores weights.
+ * `aggregateWithCorrelation` is reached only via `runHigherOrderVoting`, whose
+ * `posteriorApproval` feeds contrarian escalation, not the verdict. So selecting
+ * `higher_order` does not currently buy a correlation-weighted approve/reject.
  * resulting in more accurate consensus decisions.
  *
  * @module consensus/higher-order-voting
@@ -33544,8 +33549,18 @@ interface PipelineStateSnapshot {
      * include `trust-classifier`, `input-sanitizer`, `firewall-pipeline`, and
      * `mcp/middleware/request-context`; threading the value into
      * `TaskContract.metadata.trustTier` is owner-scoped follow-up work — see
-     * the corresponding issue. When absent, `trustTierRule` allows (the
-     * existing fail-open default for unknown trust).
+     * the corresponding issue.
+     *
+     * ABSENT MEANS UNTRUSTED, NOT ALLOWED (#4821). An absent or non-numeric
+     * value is coerced to `4` and DENIES — see `trustTierRule` below. This doc
+     * previously claimed the opposite ("fail-open default for unknown trust"),
+     * describing a pre-hardening behaviour the code no longer has.
+     *
+     * That is the correct default and should stay: fail-closed on unknown
+     * provenance is what `.rules/untrusted-input.md` requires. Do not "fix" the
+     * rule to match the old comment. The practical consequence, worth knowing
+     * before planning enforcement work, is that an UNWIRED producer is the DENY
+     * case rather than the safe one.
      */
     readonly trustTier?: string;
 }

package/dist/index.js

@@ -541,7 +541,7 @@ import {
   withLogging,
   withRetry,
   withRetryWrapper
-} from "./chunk-LSQ6TVSS.js";
+} from "./chunk-GWL7WO64.js";
 import {
   FALLBACK_SCANNER_DATA,
   buildPlanFromAnalysis,
@@ -575,7 +575,7 @@ import {
   getKnownNexusVarNames,
   startStdioServer,
   validateNexusEnv
-} from "./chunk-UZUECKIV.js";
+} from "./chunk-TXAWKJWL.js";
 import {
   OPENAI_MODELS,
   OPENAI_MODEL_ALIASES,
@@ -633,7 +633,7 @@ import {
   generateProposalId,
   parseAgentPairKey,
   registerConsensusVoteTool
-} from "./chunk-LWB4RR47.js";
+} from "./chunk-CXA4H3PZ.js";
 import "./chunk-3P6N3XZF.js";
 import {
   allOf
@@ -4728,7 +4728,7 @@ function buildVotingInput(plan, config) {
 }
 async function executeSingleVote(plan, config, log) {
   try {
-    const { executeVoting } = await import("./consensus-vote-3IHQNBNY.js");
+    const { executeVoting } = await import("./consensus-vote-EOXPISAA.js");
     const input = buildVotingInput(plan, config);
     const result = await executeVoting(input, log);
     return parseVotingResult(result);

package/dist/{setup-command-H4XOEBF5.js → setup-command-R6LRVQ7P.js}

@@ -8,9 +8,9 @@ import {
   runWizard,
   setupCommand,
   setupCommandAsync
-} from "./chunk-L7Z7ZLM5.js";
+} from "./chunk-BG7IE3V5.js";
 import "./chunk-73U6W5ZU.js";
-import "./chunk-UZUECKIV.js";
+import "./chunk-TXAWKJWL.js";
 import "./chunk-ROAVF3S5.js";
 import "./chunk-3P6N3XZF.js";
 import "./chunk-OQB3XC5O.js";
@@ -41,4 +41,4 @@ export {
   setupCommand,
   setupCommandAsync
 };
-//# sourceMappingURL=setup-command-H4XOEBF5.js.map
+//# sourceMappingURL=setup-command-R6LRVQ7P.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "nexus-agents",
-  "version": "4.3.1",
+  "version": "4.3.3",
   "description": "Governance substrate for AI coding agents — adversarial PR review, drift-detected rules, tamper-evident audit, and closed-loop outcome routing for Claude, Codex, Gemini, and OpenCode",
   "mcpName": "io.github.nexus-substrate/nexus-agents",
   "license": "MIT",