nexus-agents 8.65.0 → 8.66.0

package/dist/{chunk-AKN5WIPZ.js → chunk-FNMLO4LH.js}

@@ -7,7 +7,7 @@ import {
   toolStructuredError,
   toolSuccessStructured,
   wrapToolWithTimeout
-} from "./chunk-TI7BSNRD.js";
+} from "./chunk-TQQHTM6K.js";
 import {
   JsonlStore,
   SECURITY_KEYWORDS,
@@ -2282,4 +2282,4 @@ export {
   runImprovementReview,
   registerImprovementReviewTool
 };
-//# sourceMappingURL=chunk-AKN5WIPZ.js.map
+//# sourceMappingURL=chunk-FNMLO4LH.js.map

package/dist/{chunk-53DYZCM2.js → chunk-OROLFFSR.js}

@@ -1,6 +1,6 @@
 // src/version.ts
 import semver from "semver";
-var VERSION = true ? "8.65.0" : "dev";
+var VERSION = true ? "8.66.0" : "dev";
 var NODE_ENGINE_RANGE = ">=22.5.0";
 function isNodeVersionSupported(version) {
   return semver.satisfies(version, NODE_ENGINE_RANGE);
@@ -11,4 +11,4 @@ export {
   NODE_ENGINE_RANGE,
   isNodeVersionSupported
 };
-//# sourceMappingURL=chunk-53DYZCM2.js.map
+//# sourceMappingURL=chunk-OROLFFSR.js.map

package/dist/{chunk-ZC4A6XPX.js → chunk-QLS2BA3T.js}

@@ -11,7 +11,7 @@ import {
   NODE_ENGINE_RANGE,
   VERSION,
   isNodeVersionSupported
-} from "./chunk-53DYZCM2.js";
+} from "./chunk-OROLFFSR.js";
 import {
   claimGlobalRegistry
 } from "./chunk-LULJQZFO.js";
@@ -1314,7 +1314,7 @@ async function runDoctorFix(result) {
   writeLine2("\u2500".repeat(40));
   let fixCount = 0;
   if (!result.dataDirectory.rootExists || result.dataDirectory.subdirectories.some((d) => !d.exists || !d.writable)) {
-    const { initDataDirectories: initDataDirectories2, describeDataDirFix: describeDataDirFix2 } = await import("./setup-data-dir-6EMMTING.js");
+    const { initDataDirectories: initDataDirectories2, describeDataDirFix: describeDataDirFix2 } = await import("./setup-data-dir-Y26EMNIU.js");
     const outcome = describeDataDirFix2(initDataDirectories2());
     writeLine2(outcome.line);
     if (outcome.counted) fixCount++;
@@ -1416,4 +1416,4 @@ export {
   startStdioServer,
   closeServer
 };
-//# sourceMappingURL=chunk-ZC4A6XPX.js.map
+//# sourceMappingURL=chunk-QLS2BA3T.js.map

package/dist/{chunk-TI7BSNRD.js → chunk-TQQHTM6K.js}

@@ -1,6 +1,6 @@
 import {
   VERSION
-} from "./chunk-53DYZCM2.js";
+} from "./chunk-OROLFFSR.js";
 import {
   CACHE_TIMEOUTS,
   MCP_TIMEOUTS,
@@ -2186,4 +2186,4 @@ export {
   DEFAULT_CONSENSUS_CONFIG,
   ConsensusMetricsSchema
 };
-//# sourceMappingURL=chunk-TI7BSNRD.js.map
+//# sourceMappingURL=chunk-TQQHTM6K.js.map

package/dist/{chunk-APTCSRVT.js → chunk-UTRXT3GI.js}

@@ -25,10 +25,10 @@ import {
   toolSuccessStructured,
   withProgressHeartbeat,
   wrapToolWithTimeout
-} from "./chunk-TI7BSNRD.js";
+} from "./chunk-TQQHTM6K.js";
 import {
   VERSION
-} from "./chunk-53DYZCM2.js";
+} from "./chunk-OROLFFSR.js";
 import {
   UNRESOLVED_MODEL_ID,
   assessPanelIndependence,
@@ -619,6 +619,14 @@ var VoteRecordErrorPolicySchema = z2.enum([
   "fail_closed",
   "absolute_quorum"
 ]);
+var VOTE_RECORD_SIGNATURE_NAMESPACE = "nexus-vote-record";
+var VoteRecordSignatureSchema = z2.object({
+  /** The allowed_signers principal, e.g. `williamzujkowski@nexus-agents`. */
+  keyId: z2.string().min(1).max(200),
+  namespace: z2.literal(VOTE_RECORD_SIGNATURE_NAMESPACE),
+  /** The armored SSH signature block, verbatim. */
+  sig: z2.string().min(1).max(8192)
+}).strict();
 var VoteRecordSchema = z2.object({
   /**
    * Schema version. '1.1' marked the chain→record-set+sequence model (#3927);
@@ -780,7 +788,27 @@ var VoteRecordSchema = z2.object({
    * the record-set model is position-independent (#3927).
    */
   previousHash: z2.string().length(64).optional(),
-  /** SHA-256 over every field above EXCEPT `previousHash` (and except `hash`). */
+  /**
+   * Detached SSH signature over the committed `hash` (#3927 item 4, phase
+   * 1). The SECOND field outside the self-hash, on `previousHash`'s rule
+   * but for the opposite reason: `previousHash` is excluded because it is
+   * positional, this because it is made OVER the hash and cannot be inside
+   * it. Present-only; absent on every record appended before phase 2 and
+   * on any appended without a configured signing key.
+   *
+   * NOT a schema tier. `version` is hash-covered, and the signature is
+   * applied after the committed hash is final (the append script
+   * re-sequences, re-hashes, then signs), so a signed 1.11 record is still a
+   * 1.11 record and hashes identically with or without this field. A record
+   * that lacks it is `unsigned-record` to the verifier
+   * (`vote-record-signature.ts`), and the gate reports that informationally
+   * until the phase-3 cutover constant makes it a refusal.
+   */
+  signature: VoteRecordSignatureSchema.optional(),
+  /**
+   * SHA-256 over every field above EXCEPT `previousHash` and `signature`
+   * (and except `hash`).
+   */
   hash: z2.string().length(64)
 }).strict().superRefine((record, ctx) => {
   const digestTier = isReasoningDigestTier(record.version);
@@ -9056,4 +9084,4 @@ export {
   CONSENSUS_VOTE_TOOL_SCHEMA,
   registerConsensusVoteTool
 };
-//# sourceMappingURL=chunk-APTCSRVT.js.map
+//# sourceMappingURL=chunk-UTRXT3GI.js.map