nexus-agents 9.2.0 → 9.4.0

package/dist/{chunk-MXYKMQ53.js → chunk-TQEXRC5C.js}

@@ -5,7 +5,7 @@ import {
 } from "./chunk-WDAND5YU.js";
 import {
   executeExpert
-} from "./chunk-ZNXWR6V6.js";
+} from "./chunk-AFAM6GK3.js";
 import {
   JobStatusSchema,
   RawFindingSchema,
@@ -27,6 +27,7 @@ import {
   defaultPendingEnvelope,
   defaultReplayEnvelope,
   dispatchFieldDefaultSync,
+  evaluateThreshold,
   heartbeatJob,
   initTaskState,
   isAbandonedJob,
@@ -40,6 +41,7 @@ import {
   readTaskState,
   recordCompletedVote,
   recordDecisionCost,
+  recordVoteDecisionCost,
   registerIdempotentJob,
   release,
   resolveAdapter,
@@ -56,11 +58,11 @@ import {
   updateStage,
   withFileLock,
   writeJobCancelled
-} from "./chunk-VS3C3L63.js";
+} from "./chunk-ONWH4UGD.js";
 import {
   normalizeTopicToCanonical,
   synthesizeResearch
-} from "./chunk-PSZQ657B.js";
+} from "./chunk-Q7RFJSR5.js";
 import {
   IssueTriage,
   createAuditTrail,
@@ -69,16 +71,17 @@ import {
   createGraphAuditBridge,
   emitPipelinePolicyEvent,
   readActionRefusal
-} from "./chunk-DYVYV7NZ.js";
+} from "./chunk-DYTB2XW2.js";
 import {
   sanitizeInput
-} from "./chunk-3JRQWWBD.js";
+} from "./chunk-JNRDNE26.js";
 import {
   withPrerequisite
-} from "./chunk-WDSRUC3H.js";
+} from "./chunk-AI6LKFGU.js";
 import {
   NOOP_NOTIFIER,
   RateLimiter,
+  VOTING_THRESHOLDS,
   abortSignalStorage,
   checkPolicyForDispatchedTool,
   coarsenFailureCategory,
@@ -102,10 +105,10 @@ import {
   toolSuccess,
   withProgressHeartbeat,
   wrapToolWithTimeout
-} from "./chunk-5IMXQQQX.js";
+} from "./chunk-ETGNAHY3.js";
 import {
   generateSecurityPlan
-} from "./chunk-JZSKEIQF.js";
+} from "./chunk-6WPXQTQY.js";
 import {
   analyzeGitHubRepo
 } from "./chunk-4GDMHCKX.js";
@@ -149,18 +152,18 @@ import {
   parseRegistry,
   sourceExistsInRegistry,
   summarizeContextForPrompt
-} from "./chunk-XPQ2RDMV.js";
+} from "./chunk-XJ65J3O5.js";
 import {
   REGISTRY_PATH,
   getProjectRoot,
   loadPapersRegistry,
   loadTechniquesRegistry,
   resolveRegistryRoot
-} from "./chunk-GNGKWFC3.js";
+} from "./chunk-HESQ746B.js";
 import {
   getTokenEnvVars,
   resolveToken
-} from "./chunk-UNIRQWHT.js";
+} from "./chunk-RI4IXOZT.js";
 import {
   DEFAULT_RELEVANCE_CONFIG,
   MemoryImportance,
@@ -168,7 +171,7 @@ import {
   calculateTextJaccardSimilarity,
   getToolMemory,
   memoryTrustTierTag
-} from "./chunk-M43A5MDJ.js";
+} from "./chunk-2AN5NGCQ.js";
 import {
   EXTERNAL_CONTENT_TRUST_TIER,
   resolveContentTrustProvenance,
@@ -184,7 +187,7 @@ import {
 import {
   DEFAULT_TASK_TTL_MS,
   clampTaskTtl
-} from "./chunk-GTWTVDLP.js";
+} from "./chunk-II4XITQ6.js";
 import {
   allOf,
   anyOf
@@ -193,16 +196,16 @@ import {
   VERSION,
   createRequestContext,
   measuredTrustTier
-} from "./chunk-GNGIZJAC.js";
+} from "./chunk-LWLFWWA7.js";
 import {
   isGatewayModelAdapter
-} from "./chunk-DJ7QTY5J.js";
+} from "./chunk-C5WECFBR.js";
 import {
   EventTopics,
   createEvent,
   getGlobalEventBus,
   getGlobalRegistry
-} from "./chunk-PDT6QYKY.js";
+} from "./chunk-TFQMVUWQ.js";
 import {
   BWRAP_READ_ONLY_ARGS,
   CliDetectionCache,
@@ -210,13 +213,13 @@ import {
   extractRequestSystemPrompt,
   getAvailableClis,
   isAbsentSeat
-} from "./chunk-KLDUWDNU.js";
+} from "./chunk-ONYCBTOH.js";
 import {
   ensureGatewayDiscovered,
   getAvailabilityCache,
   getCliForModelId,
   resolveFallback
-} from "./chunk-ETW6QNVI.js";
+} from "./chunk-VQGHQVD2.js";
 import {
   DEFAULTS
 } from "./chunk-PRX4ERTK.js";
@@ -234,13 +237,13 @@ import {
   parseGatewayExtraHeaders,
   requireApiKey,
   validateApiKeyPresence
-} from "./chunk-GAJRBRED.js";
+} from "./chunk-HK4LBUYY.js";
 import {
   resolveGatewayEnv
-} from "./chunk-ZVSJPKEZ.js";
+} from "./chunk-Q5F4OBOK.js";
 import {
   createSessionMemory
-} from "./chunk-KWQ5IR2A.js";
+} from "./chunk-FKMBZ53Y.js";
 import {
   TrustTierSchema
 } from "./chunk-CJKHQ6MV.js";
@@ -254,17 +257,17 @@ import {
   terminateProcessTree,
   trackProcessTree,
   withTimeout
-} from "./chunk-TJ4VWR32.js";
+} from "./chunk-TMHCN5EY.js";
 import {
   generateHyphenId,
   generateUUID
-} from "./chunk-KJ46Q24G.js";
+} from "./chunk-DEQRRCHK.js";
 import {
   getDefaultCliCircuitBreakerRegistry
-} from "./chunk-4ROIBRK5.js";
+} from "./chunk-AYBOQE2Y.js";
 import {
   sanitizeErrorDetails
-} from "./chunk-A5D7666X.js";
+} from "./chunk-2AW2VHMK.js";
 import {
   ARCHITECTURE_KEYWORDS,
   AUTHORITY_TIERS,
@@ -384,7 +387,7 @@ import {
   toExpertTaskAnalysisResult,
   truncateWithInfo,
   withStep
-} from "./chunk-SU47CN4Q.js";
+} from "./chunk-7XJZTSHW.js";
 import {
   SUPPORTED_EXTENSIONS
 } from "./chunk-XBEKMUTO.js";
@@ -1020,13 +1023,6 @@ var NexusEnvSchema = z10.object({
   // Scratch root for short-lived working files (#4412, getNexusTmpDir). Unset
   // resolves to `<dataDir>/tmp`; set it to relocate scratch off the repo.
   NEXUS_TMPDIR: z10.string().optional(),
-  // ClawGuard access-policy mode. NO READER since #5108 deleted the
-  // access-constraint deriver; the secret-path denylist it carried is now the
-  // PolicyFirewall `secret-paths` rule (enforce behind #4988). Still registered
-  // so a value an operator set from the AGENTS.md table is not reported as a
-  // typo (#4722 class); the row and this entry are retired together under
-  // #6303 / #6319, since that table is governor-owned.
-  NEXUS_ACCESS_POLICY_MODE: z10.enum(["off", "audit", "confirm_risky", "enforce"]).optional(),
   // Sandbox FLAVOR string (`docker-opencode`, `codex`, …), set by the host
   // image so sandbox-detection knows it is inside one (epic #2500, #5026). It
   // was registered as a boolean while every producer and reader used a flavor
@@ -1043,6 +1039,8 @@ var NexusEnvSchema = z10.object({
   // Drives the auto-remediation cycle (resolveAutoRemediateMode); default audit
   // (zero-write soak, #3769) when unset, explicit `off` disables.
   NEXUS_AUTO_REMEDIATE: z10.enum(["off", "audit", "enforce"]).optional(),
+  // Run-layer consensus verdict enforcement (#4464); default audit.
+  NEXUS_CONSENSUS_ENFORCE: z10.enum(["off", "audit", "enforce"]).optional(),
   // Stage-boundary policy gate enforcement mode (getGateEnforcementMode); warn by
   // default. Read by dev-pipeline's consensus→execute gate, and by any compiled
   // gate node whose caller supplies a `policyEnforcement` bundle without a mode
@@ -1097,6 +1095,10 @@ var NexusEnvSchema = z10.object({
   // a typo; their use is reported in `deprecatedVars` instead.
   NEXUS_CUSTOM_API_BASE_URL: z10.string().optional(),
   NEXUS_CUSTOM_API_KEY: z10.string().optional(),
+  // Deprecated no-op since #6321 removed the ClawGuard deriver. Keep the
+  // accept-set and registration for compatibility with the AGENTS.md table
+  // (#4722); report its use in deprecatedVars until removal in 10.0 (#6319).
+  NEXUS_ACCESS_POLICY_MODE: z10.enum(["off", "audit", "confirm_risky", "enforce"]).optional(),
   NEXUS_CUSTOM_MODEL: z10.string().optional(),
   // #6645: the OpenAI API surface the single-model custom-openai adapter calls.
   // Default `chat` (/chat/completions); `responses` opts into /responses. The
@@ -1290,7 +1292,7 @@ function classifyEnvKeys(nexusKeys, env) {
   }
   return { knownRecord, unknownVars };
 }
-function logValidationWarnings(logger58, unknownVars, invalidVars, ineffectiveVars) {
+function logValidationWarnings(logger58, unknownVars, invalidVars, ineffectiveVars, deprecatedVars) {
   for (const u of unknownVars) {
     const hint = u.suggestion !== null ? ` (did you mean ${u.suggestion}?)` : "";
     logger58.warn(`Unknown environment variable: ${u.name}${hint}`);
@@ -1304,6 +1306,21 @@ function logValidationWarnings(logger58, unknownVars, invalidVars, ineffectiveVa
       `Environment variable ${ineff.name} had no effect: requested ${String(ineff.requestedMs)}ms, using ${String(ineff.effectiveMs)}ms. ${ineff.reason}`
     );
   }
+  for (const deprecated of deprecatedVars) {
+    if (deprecated.notice !== void 0) logger58.warn(deprecated.notice);
+  }
+}
+function findDeprecatedVars() {
+  const deprecatedVars = [...resolveGatewayEnv(process.env).deprecated];
+  if (process.env["NEXUS_ACCESS_POLICY_MODE"] !== void 0) {
+    deprecatedVars.push({
+      name: "NEXUS_ACCESS_POLICY_MODE",
+      replacement: "",
+      shadowed: false,
+      notice: "NEXUS_ACCESS_POLICY_MODE is deprecated, has no effect, and will be removed in 10.0. Remove it from your environment."
+    });
+  }
+  return deprecatedVars;
 }
 function findIneffectiveVars() {
   const classNames = Object.keys(OPERATION_CLASSES);
@@ -1345,9 +1362,9 @@ function validateNexusEnv(logger58) {
     }
   }
   const ineffectiveVars = findIneffectiveVars();
-  const deprecatedVars = resolveGatewayEnv(process.env).deprecated;
+  const deprecatedVars = findDeprecatedVars();
   if (logger58 !== void 0) {
-    logValidationWarnings(logger58, unknownVars, invalidVars, ineffectiveVars);
+    logValidationWarnings(logger58, unknownVars, invalidVars, ineffectiveVars, deprecatedVars);
   }
   return { unknownVars, invalidVars, ineffectiveVars, deprecatedVars };
 }
@@ -30430,7 +30447,7 @@ function execIdFields(executionId) {
 async function populateUnifiedContextOnState(state, options) {
   const taskCandidate = state["task"];
   if (typeof taskCandidate !== "string" || taskCandidate === "") return;
-  const { getContextForTask: getContextForTask2, inferTaskCategory: inferTaskCategory2 } = await import("./context-retriever-NKP73OSE.js");
+  const { getContextForTask: getContextForTask2, inferTaskCategory: inferTaskCategory2 } = await import("./context-retriever-YM2PPNSY.js");
   const category = inferTaskCategory2(taskCandidate);
   const executionId = options?.executionId;
   const execFields = execIdFields(executionId);
@@ -46901,7 +46918,7 @@ async function tryIssueTriage(task) {
   try {
     const issueMatch = task.match(/github\.com\/([^/]+\/[^/]+)\/issues\/(\d+)/);
     if (issueMatch === null) return null;
-    const { createIssueTriage } = await import("./issue-triage-UUD53JH3.js");
+    const { createIssueTriage } = await import("./issue-triage-KF47ZHU7.js");
     const triage = createIssueTriage();
     const owner = issueMatch[1] ?? "";
     const num2 = issueMatch[2] ?? "";
@@ -46929,7 +46946,7 @@ var VALID_TEMPLATES = /* @__PURE__ */ new Set([
 ]);
 async function classifyWithLLM(task) {
   try {
-    const { executeExpert: executeExpert2 } = await import("./expert-bridge-3WL6X37T.js");
+    const { executeExpert: executeExpert2 } = await import("./expert-bridge-CXHYMQRL.js");
     const prompt = [
       "Classify this task into exactly one pipeline template.",
       "Templates: dev (implementation/bug fix/refactor), research (investigate/evaluate/compare),",
@@ -47303,7 +47320,7 @@ function buildVotingInput(plan, config) {
 }
 async function executeSingleVote(plan, config, log) {
   try {
-    const { executeVoting } = await import("./consensus-vote-2BEOCYGU.js");
+    const { executeVoting } = await import("./consensus-vote-RD3SME3K.js");
     const input = buildVotingInput(plan, config);
     const result = await executeVoting(input, log);
     return parseVotingResult(result);
@@ -48851,7 +48868,7 @@ var memoryInitPromise = null;
 async function initPipelineMemory() {
   if (cachedMemory !== null) return cachedMemory;
   try {
-    const { createSessionMemory: createSessionMemory2 } = await import("./session-memory-6FGTXRCN.js");
+    const { createSessionMemory: createSessionMemory2 } = await import("./session-memory-6NUK6ZAG.js");
     const { getLearningDir } = await import("./learning-persistence-FB4U5AX2.js");
     const mem = createSessionMemory2(getLearningDir());
     mem.startSession(`pipeline-${String(getTimeProvider().now())}`);
@@ -48913,7 +48930,7 @@ function recordRoutingExperience(category, success, durationMs, tokensUsed = 0,
     callRecord(routingMemoryCache);
     return;
   }
-  routingMemoryInitPromise ??= import("./routing-memory-KKBKCISC.js").then(({ createRoutingMemory }) => {
+  routingMemoryInitPromise ??= import("./routing-memory-PBZIE5NX.js").then(({ createRoutingMemory }) => {
     routingMemoryCache ??= createRoutingMemory();
     return routingMemoryCache;
   }).catch((error) => {
@@ -49132,7 +49149,7 @@ function createVoteStage({ config, startStage }) {
     const strategy = config.votingStrategy ?? "higher_order";
     await postProgress(config, "Vote", `Running consensus with ${strategy} strategy...`);
     try {
-      const { executeVoting } = await import("./consensus-vote-2BEOCYGU.js");
+      const { executeVoting } = await import("./consensus-vote-RD3SME3K.js");
       const proposal = buildVoteProposal(plan, research);
       const votingResult = await executeVoting(
         {
@@ -49939,7 +49956,7 @@ ${text}` : "";
 }
 async function getWeatherContext() {
   try {
-    const { generateWeatherReport: generateWeatherReport2 } = await import("./weather-report-CTT5O7MR.js");
+    const { generateWeatherReport: generateWeatherReport2 } = await import("./weather-report-TQ6KM2F2.js");
     const report = generateWeatherReport2({ includeAdaptive: true });
     const mappings = "recommendedMappings" in report ? report.recommendedMappings : [];
     if (!Array.isArray(mappings) || mappings.length === 0) return "";
@@ -49957,7 +49974,7 @@ ${lines}
 }
 async function getMemoryContext(task) {
   try {
-    const { createSessionMemory: createSessionMemory2 } = await import("./session-memory-6FGTXRCN.js");
+    const { createSessionMemory: createSessionMemory2 } = await import("./session-memory-6NUK6ZAG.js");
     const { getLearningDir } = await import("./learning-persistence-FB4U5AX2.js");
     const memory = createSessionMemory2(getLearningDir(), { maxLearningsInContext: 10 });
     const learnings = memory.searchLearnings(task.slice(0, 200));
@@ -50674,7 +50691,7 @@ async function searchCodebaseForTask(task) {
 }
 async function queryResearchRegistry(task) {
   try {
-    const { synthesizeResearch: synthesizeResearch2 } = await import("./research-helpers-synthesize-RFOFNS5W.js");
+    const { synthesizeResearch: synthesizeResearch2 } = await import("./research-helpers-synthesize-XE3RMFQT.js");
     const topic = task.split(/[.!?\n]/).filter((s) => s.trim().length > 10)[0]?.trim();
     if (topic === void 0) return null;
     const result = await synthesizeResearch2(topic.slice(0, 50));
@@ -50745,7 +50762,7 @@ function createScanStageWrapper() {
       try {
         const slug = ctx.task.match(/([a-zA-Z0-9._-]+\/[a-zA-Z0-9._-]+)/)?.[1];
         if (slug !== void 0) {
-          const { generateSecurityPlan: generateSecurityPlan2 } = await import("./repo-security-plan-66VLAFUR.js");
+          const { generateSecurityPlan: generateSecurityPlan2 } = await import("./repo-security-plan-AP3QEWJ5.js");
           const plan = await generateSecurityPlan2({ repo: slug, maxScanners: 10 });
           const recs = plan.recommendations.slice(0, 5).map((r) => `${r.priority}: ${r.displayName} (${r.category})`).join("; ");
           return output(PIPELINE_STATE_KEYS.FINDINGS, recs, getTimeProvider().now() - start, true);
@@ -53461,7 +53478,104 @@ function registerSuggestResearchTasksTool(server, deps) {
 
 // src/mcp/tools/run-tool.ts
 import { z as z117 } from "zod";
-import { randomUUID as randomUUID18 } from "node:crypto";
+import { randomUUID as randomUUID19 } from "node:crypto";
+
+// src/orchestration/consensus-enforcement-mode.ts
+function resolveConsensusEnforcementMode(raw) {
+  if (raw === "off") return "off";
+  if (raw === "enforce") return "enforce";
+  return "audit";
+}
+
+// src/mcp/tools/run-tool-consensus.ts
+import { randomUUID as randomUUID15 } from "node:crypto";
+function getConsensusEnforcement(result) {
+  if (typeof result !== "object" || result === null) return void 0;
+  return result.enforcement;
+}
+function assessPanel(result, mode, attempts) {
+  if (mode === "off") {
+    return { ...result, enforcement: { mode, attempts, reason: "unmeasured" } };
+  }
+  const decision = result.decision ?? "no_quorum";
+  const denominator = result.votes.filter(
+    (seat) => seat.source === "error" || seat.source === "unverifiable" || seat.vote.decision !== "abstain"
+  ).length;
+  const outageInvariant = denominator > 0 && evaluateThreshold(
+    result.result.voteCounts.approve,
+    denominator,
+    VOTING_THRESHOLDS.simple_majority,
+    false
+  ).approved;
+  const reason = decision === "approved" && !outageInvariant ? "not_outage_invariant" : decision;
+  return {
+    ...result,
+    enforcement: { mode, attempts, wouldBlock: reason !== "approved", reason }
+  };
+}
+async function recordFinalPanel(goal, result, logger58, signal) {
+  let voteRecord;
+  let reason;
+  try {
+    ({ voteRecord } = await recordCompletedVote(goal, result, logger58, {
+      options: void 0,
+      signal
+    }));
+    if (!voteRecord.persisted) reason = `Vote ledger ${voteRecord.reason}`;
+  } catch (error) {
+    if (signal?.aborted === true) throw error;
+    reason = getErrorMessage(error);
+  }
+  const recorded = { ...result, voteRecord };
+  if (reason === void 0) return recorded;
+  logger58.warn("run: consensus vote recording failed", {
+    error: reason,
+    mode: result.enforcement.mode
+  });
+  if (result.enforcement.mode === "off") return recorded;
+  const enforcement = {
+    ...result.enforcement,
+    wouldBlock: true,
+    recordingError: reason
+  };
+  if (result.enforcement.mode === "audit") return { ...recorded, enforcement };
+  return {
+    ...recorded,
+    success: false,
+    error: `Consensus recording failed: ${reason}`,
+    enforcement
+  };
+}
+async function runConsensusWithEnforcement(goal, options) {
+  const logger58 = options.logger ?? createLogger({ tool: "run", strategy: "consensus" });
+  const runPanel = async (attempts) => {
+    options.signal?.throwIfAborted();
+    const result2 = await runConsensusForGoal(
+      goal,
+      void 0,
+      options.gatewayAdapters,
+      options.onProgress,
+      options.signal
+    );
+    options.signal?.throwIfAborted();
+    return assessPanel(result2, options.mode, attempts);
+  };
+  let result = await runPanel(1);
+  const retryable = /* @__PURE__ */ new Set(["no_quorum", "not_outage_invariant"]);
+  if (options.mode === "enforce" && retryable.has(result.enforcement.reason)) {
+    recordVoteDecisionCost({
+      decisionId: `consensus-${randomUUID15()}`,
+      gate: "consensus_vote",
+      votes: result.votes,
+      proposal: goal,
+      declaredOptions: void 0,
+      logger: logger58
+    });
+    logger58.info("run: retrying consensus panel once", { reason: result.enforcement.reason });
+    result = await runPanel(2);
+  }
+  return recordFinalPanel(goal, result, logger58, options.signal);
+}
 
 // src/orchestration/meta-dispatcher.ts
 var MetaDispatchError = class extends Error {
@@ -53486,23 +53600,45 @@ function createAuditLogOutcomeSink(logger58) {
 function errorMessage(err2) {
   return err2 instanceof Error ? err2.message : String(err2);
 }
-function classifyEngineResult(result) {
+function resultError(record, fallback) {
+  return typeof record["error"] === "string" ? record["error"] : fallback;
+}
+function consensusReason(record) {
+  const enforcement = record["enforcement"];
+  if (typeof enforcement === "object" && enforcement !== null) {
+    const reason = enforcement["reason"];
+    if (typeof reason === "string") return reason;
+  }
+  return String(record["decision"]);
+}
+var BLOCKING_CONSENSUS_DECISIONS = /* @__PURE__ */ new Set(["rejected", "no_quorum"]);
+function classifyConsensusResult(record, mode) {
+  const enforcement = record["enforcement"];
+  const wouldBlock = typeof enforcement === "object" && enforcement !== null && enforcement["wouldBlock"] === true;
+  if (mode === "enforce" && (BLOCKING_CONSENSUS_DECISIONS.has(record["decision"]) || wouldBlock)) {
+    const reason = consensusReason(record);
+    return {
+      success: false,
+      failureReason: reason === record["decision"] ? `Consensus ${reason}` : `Consensus ${String(record["decision"])}: ${reason}`
+    };
+  }
+  return { success: true };
+}
+function classifyEngineResult(result, mode = "audit") {
   if (typeof result !== "object" || result === null) {
     return { success: true };
   }
   const record = result;
   if (record["success"] === false) {
-    const reason = typeof record["error"] === "string" ? record["error"] : "no error message";
-    return { success: false, failureReason: reason };
+    return { success: false, failureReason: resultError(record, "no error message") };
   }
   if (record["completed"] === false) {
     if (record["dryRun"] === true && record["planStatus"] === void 0) {
       return { success: true };
     }
-    const reason = typeof record["error"] === "string" ? record["error"] : "pipeline did not complete";
-    return { success: false, failureReason: reason };
+    return { success: false, failureReason: resultError(record, "pipeline did not complete") };
   }
-  return { success: true };
+  return classifyConsensusResult(record, mode);
 }
 function recordOutcome2(deps, decision, start, success, failureReason) {
   const record = {
@@ -53740,6 +53876,26 @@ function describeIncompletePipeline(record) {
   }
   return `${FAILURE_PREFIX} the dev pipeline did not complete`;
 }
+function detectEngineFailure(result, mode) {
+  const classification = classifyEngineResult(result, mode);
+  if (classification.success) return null;
+  const record = typeof result === "object" && result !== null ? result : void 0;
+  if (record?.["completed"] === false) {
+    return { message: describeIncompletePipeline(record), detail: record };
+  }
+  if (record?.["enforcement"] !== void 0) {
+    return {
+      message: `Engine reported failure: ${classification.failureReason ?? "no error message"}`,
+      detail: {
+        decision: record["decision"],
+        enforcement: record["enforcement"],
+        voteRecord: record["voteRecord"]
+      }
+    };
+  }
+  const detail = classification.failureReason ?? "no error message";
+  return { message: `Engine reported failure: ${detail}` };
+}
 
 // src/mcp/tools/run-tool-policy.ts
 var RunPolicyDeniedError = class extends Error {
@@ -53764,7 +53920,7 @@ function assertExecutePolicy(strategy, input, logger58, requestContext) {
 }
 
 // src/orchestration/meta-orchestrator.ts
-import { randomUUID as randomUUID15 } from "node:crypto";
+import { randomUUID as randomUUID16 } from "node:crypto";
 
 // src/orchestration/meta-orchestrator-routing.ts
 function reasoningFor(selection, routing) {
@@ -53916,7 +54072,7 @@ function createMetaOrchestrator(options) {
       const classification = classifyTask(input.goal);
       const forced = input.forceStrategy !== void 0;
       const base = input.forceStrategy !== void 0 ? buildForcedDecision(input.forceStrategy, routing, classification) : buildSelectedDecision(routing, classification);
-      const decision = { ...base, decisionId: randomUUID15() };
+      const decision = { ...base, decisionId: randomUUID16() };
       if (input.requiredAuthority !== void 0) {
         guardAuthority(decision.strategy, input.requiredAuthority);
       }
@@ -54436,7 +54592,7 @@ function evaluateMetaStrategyReadiness(result, config = DEFAULT_META_STRATEGY_RE
 // src/mcp/tools/dev-pipeline-tool.ts
 import { z as z115 } from "zod";
 import * as fs10 from "node:fs";
-import { randomUUID as randomUUID16 } from "node:crypto";
+import { randomUUID as randomUUID17 } from "node:crypto";
 
 // src/mcp/tools/dev-pipeline-output.ts
 function buildStructuredOutput(result, simulated) {
@@ -54532,7 +54688,7 @@ var GitHubTaskTracker = class {
   cachedProvider = null;
   async getProvider() {
     if (this.cachedProvider !== null) return this.cachedProvider;
-    const { createScmProvider } = await import("./factory-IAH3XPHY.js");
+    const { createScmProvider } = await import("./factory-KH2MJQ5U.js");
     const result = await createScmProvider({ repo: this.config.repo ?? "" });
     if (!result.ok) throw new Error(`SCM provider error: ${result.error.message}`);
     this.cachedProvider = result.value;
@@ -54910,7 +55066,7 @@ function dispatchAsyncDevPipeline(input, run, logger58) {
     return runAsJob({
       toolName: "run_dev_pipeline",
       input,
-      freshJobId: () => `dp-${randomUUID16()}`,
+      freshJobId: () => `dp-${randomUUID17()}`,
       // #5393 / #6305: arity 3 — `runDevPipeline` checks the signal before every stage.
       run: (_jobId, _input, signal) => run(signal),
       logger: logger58
@@ -54968,7 +55124,7 @@ function registerDevPipelineTool(server, deps) {
 // src/mcp/tools/pipeline-tool.ts
 import { z as z116 } from "zod";
 import * as fs11 from "node:fs";
-import { randomUUID as randomUUID17 } from "node:crypto";
+import { randomUUID as randomUUID18 } from "node:crypto";
 var PIPELINE_ASYNC_HINT = "A full run_pipeline run can exceed the synchronous MCP request timeout. Retry with `dispatch: 'async'` to get a jobId immediately, then poll get_job_result({ jobId }) for the result.";
 var PipelineInputSchema = z116.object({
   /** The task to execute. */
@@ -55145,7 +55301,7 @@ async function runPipelineHandler(args, logger58, callerTrustTier, sanitization)
       return runAsJob({
         toolName: "run_pipeline",
         input,
-        freshJobId: () => `rp-${randomUUID17()}`,
+        freshJobId: () => `rp-${randomUUID18()}`,
         // #5393 / #6305: arity 3 — the graph executor checks the signal before every
         // super-step, so a cancel stops the run at the next stage boundary.
         run: (_jobId, _input, signal) => executePipelineBody(task, stages, { ...body, signal }),
@@ -55189,7 +55345,7 @@ function registerPipelineTool(server, deps) {
 }
 
 // src/mcp/tools/run-tool-executors.ts
-function buildDefaultExecutors(trustTier, gatewayAdapters, devPipeline, onProgress, signal) {
+function buildDefaultExecutors(trustTier, gatewayAdapters, options, onProgress, signal) {
   const gated = (strategy, executor) => cancellableExecutor(strategy, executor, signal);
   return {
     "dev-pipeline": gated(
@@ -55197,9 +55353,9 @@ function buildDefaultExecutors(trustTier, gatewayAdapters, devPipeline, onProgre
       (_decision, metaInput) => runDevPipelineForGoal(
         metaInput.goal,
         trustTier,
-        devPipeline?.dryRun,
+        options?.dryRun,
         signal,
-        devPipeline?.sourceTrustTier
+        options?.sourceTrustTier
       )
     ),
     pipeline: gated(
@@ -55219,7 +55375,13 @@ function buildDefaultExecutors(trustTier, gatewayAdapters, devPipeline, onProgre
     ),
     consensus: gated(
       "consensus",
-      (_decision, metaInput) => runConsensusForGoal(metaInput.goal, void 0, gatewayAdapters, onProgress, signal)
+      (_decision, metaInput) => runConsensusWithEnforcement(metaInput.goal, {
+        mode: options?.consensusEnforcementMode ?? "audit",
+        logger: options?.logger,
+        gatewayAdapters,
+        onProgress,
+        signal
+      })
     )
   };
 }
@@ -55238,9 +55400,14 @@ function assertDispatchNotCancelled(signal, strategy) {
 function cancellableExecutor(strategy, executor, signal) {
   if (signal === void 0) return executor;
   return async (decision, metaInput) => {
-    const result = await executor(decision, metaInput);
-    throwIfRunCancelled(signal, `run cancelled during the ${strategy} strategy`);
-    return result;
+    try {
+      const result = await executor(decision, metaInput);
+      throwIfRunCancelled(signal, `run cancelled during the ${strategy} strategy`);
+      return result;
+    } catch (error) {
+      throwIfRunCancelled(signal, `run cancelled during the ${strategy} strategy`);
+      throw error;
+    }
   };
 }
 
@@ -55375,6 +55542,8 @@ function buildShadowTrainObserver(logger58) {
   };
 }
 async function executeGoal(input, opts = {}) {
+  const mode = opts.consensusEnforcementMode ?? resolveConsensusEnforcementMode(process.env["NEXUS_CONSENSUS_ENFORCE"]);
+  const { dryRun, sourceTrustTier } = input;
   const decision = selectDecision(input, "execute", opts.logger);
   assertDryRunSupported(input.dryRun, decision.strategy);
   assertExecutePolicy(decision.strategy, input, opts.logger, opts.requestContext);
@@ -55383,45 +55552,34 @@ async function executeGoal(input, opts = {}) {
     executors: opts.executors ?? buildDefaultExecutors(
       opts.trustTier,
       opts.gatewayAdapters,
-      { dryRun: input.dryRun, sourceTrustTier: input.sourceTrustTier },
+      { consensusEnforcementMode: mode, logger: opts.logger, dryRun, sourceTrustTier },
       opts.onProgress,
       opts.signal
     ),
     ...opts.logger !== void 0 ? { logger: opts.logger } : {},
     ...opts.outcomeSink !== void 0 ? { outcomeSink: opts.outcomeSink } : {},
     ...onOutcome !== void 0 ? { onOutcome } : {},
-    ...opts.classifyResult !== void 0 ? { classifyResult: opts.classifyResult } : {}
+    classifyResult: opts.classifyResult ?? ((result) => classifyEngineResult(result, mode))
   });
   assertDispatchNotCancelled(opts.signal, decision.strategy);
   const dispatch = await dispatcher.dispatch(decision, toMetaInput(input, "execute"));
   return {
-    strategy: dispatch.strategy,
-    decisionId: dispatch.decisionId,
+    ...dispatch,
     reasoning: decision.reasoning,
     executed: true,
-    durationMs: dispatch.durationMs,
-    result: dispatch.result
+    ...dispatch.strategy === "consensus" ? { enforcement: getConsensusEnforcement(dispatch.result) } : {}
   };
 }
-function detectEngineFailure(result) {
-  const classification = classifyEngineResult(result);
-  if (classification.success) return null;
-  const record = typeof result === "object" && result !== null ? result : void 0;
-  if (record?.["completed"] === false) {
-    return { message: describeIncompletePipeline(record), detail: record };
-  }
-  const detail = classification.failureReason ?? "no error message";
-  return { message: `Engine reported failure: ${detail}` };
-}
 async function executeRunBody(input, logger58, body = {}) {
+  const mode = resolveConsensusEnforcementMode(process.env["NEXUS_CONSENSUS_ENFORCE"]);
   try {
-    const exec2 = await executeGoal(input, { logger: logger58, ...body });
+    const exec2 = await executeGoal(input, { logger: logger58, ...body, consensusEnforcementMode: mode });
     logger58.info("run: executed goal", {
       decisionId: exec2.decisionId,
       strategy: exec2.strategy,
       durationMs: exec2.durationMs
     });
-    const engineFailure = detectEngineFailure(exec2.result);
+    const engineFailure = detectEngineFailure(exec2.result, mode);
     if (engineFailure !== null) {
       logger58.warn("run: engine reported failure", {
         decisionId: exec2.decisionId,
@@ -55462,7 +55620,7 @@ async function runHandler(args, logger58, trustTier, gatewayAdapters, requestCon
       return runAsJob({
         toolName: "run",
         input,
-        freshJobId: () => `rn-${randomUUID18()}`,
+        freshJobId: () => `rn-${randomUUID19()}`,
         // #5393 / #6305: arity 3 — every wired strategy executor hands the
         // signal to its engine. #6162: heartbeats by jobId.
         run: (jobId, _input, signal) => executeRunBodyOrThrow(input, logger58, {
@@ -55577,7 +55735,7 @@ function withCatalogueCaveat(report) {
 var GATEWAY_TRANSPORT = "gateway";
 var GATEWAY_API_ARM = "api:custom-openai";
 async function gatewaySource(apiArm) {
-  const { discoverModels, readOpenAICompatEnv } = await import("./openai-compat-adapter-YTSKOE4F.js");
+  const { discoverModels, readOpenAICompatEnv } = await import("./openai-compat-adapter-PQ3JKWPZ.js");
   const config = readOpenAICompatEnv();
   if (config !== null) {
     return {
@@ -55596,7 +55754,7 @@ async function gatewaySource(apiArm) {
 }
 async function defaultSources(includeOpenRouter, adaptersFactory) {
   const adapters = new Map(
-    adaptersFactory !== void 0 ? adaptersFactory() : (await import("./factory-X7XECZ3D.js")).createAllAdapters()
+    adaptersFactory !== void 0 ? adaptersFactory() : (await import("./factory-3Z46455N.js")).createAllAdapters()
   );
   const apiArm = adapters.get(GATEWAY_API_ARM);
   adapters.delete(GATEWAY_API_ARM);
@@ -55727,7 +55885,7 @@ var VoterEvalVerdictQuerySchema = z119.object({
 
 // src/mcp/tools/supply-chain-tradeoff-panel.ts
 import { z as z120 } from "zod";
-import { randomUUID as randomUUID19 } from "node:crypto";
+import { randomUUID as randomUUID20 } from "node:crypto";
 var DEFAULT_AXES = [
   "build_time_determinism",
   "supply_chain_risk",
@@ -55998,7 +56156,7 @@ async function tradeoffPanelHandler(args, ctx) {
       return runAsJob({
         toolName: "supply_chain_tradeoff_panel",
         input,
-        freshJobId: () => `sc-${randomUUID19()}`,
+        freshJobId: () => `sc-${randomUUID20()}`,
         // #5393: arity 4 — signal + #6162 progress. `runAsJob` derives
         // `signalAccepted` from `run.length`. The signal reaches `collectRealVotes`,
         // so a cancel stops the un-launched seats; `progress` heartbeats per seat.
@@ -58968,4 +59126,4 @@ export {
   initializeSandbox,
   getSandboxMode
 };
-//# sourceMappingURL=chunk-MXYKMQ53.js.map
+//# sourceMappingURL=chunk-TQEXRC5C.js.map