orizu 0.5.15 → 0.5.16

package/dist/artifact-archive.js

@@ -11,7 +11,9 @@ const ARTIFACT_EXCLUDED_PATH_NAMES = new Set([
 function isNodeError(error) {
     return error instanceof Error;
 }
-function expandHomePath(path) {
+/** Exported for runner-dir-verify (ALI-1159): the pre-exec scan must resolve
+ * the same directory this module hashes and the runner later executes. */
+export function expandHomePath(path) {
     if (path.startsWith('~/')) {
         const home = process.env.HOME || '';
         return `${home}/${path.slice(2)}`;
@@ -123,7 +125,13 @@ export function createStoredZip(entries) {
     endOfCentralDirectory.writeUInt16LE(0, 20);
     return Buffer.concat([...localParts, centralDirectory, endOfCentralDirectory]);
 }
-export function zipDirectoryToBase64(dirArg) {
+/**
+ * Read the exact entry set the deterministic archive covers (sorted relative
+ * paths + bytes). Exported for runner-dir-verify (ALI-1159): the verified
+ * snapshot must be materialized from the SAME in-memory bytes that were
+ * hashed, so a post-hash mutation of the directory cannot change what runs.
+ */
+export function readArtifactEntries(dirArg) {
     const sourceDir = expandHomePath(dirArg);
     try {
         const stats = statSync(sourceDir);
@@ -141,12 +149,20 @@ export function zipDirectoryToBase64(dirArg) {
     if (files.length === 0) {
         throw new Error(`Directory contains no artifact files: ${sourceDir}`);
     }
-    const bytes = createStoredZip(files.map(relativePath => ({
+    return files.map(relativePath => ({
         path: relativePath,
         data: readFileSync(join(sourceDir, relativePath)),
-    })));
+        mode: statSync(join(sourceDir, relativePath)).mode,
+    }));
+}
+/** Deterministic archive of an already-read entry set. */
+export function archiveArtifactEntries(entries) {
+    const bytes = createStoredZip(entries);
     return {
         zipBase64: bytes.toString('base64'),
         contentSha256: createHash('sha256').update(bytes).digest('hex'),
     };
 }
+export function zipDirectoryToBase64(dirArg) {
+    return archiveArtifactEntries(readArtifactEntries(dirArg));
+}

package/dist/egress-allowlist-cli.js

@@ -13,6 +13,12 @@
  * with an injected fetcher.
  */
 import { authedFetch } from './http.js';
+/** Mirrors MAX_TEAM_EGRESS_DOMAINS in the shared read-side validator
+ *  (workers/session-coordinator/src/egress-domains.ts). The coordinator only
+ *  applies the first this-many UNIQUE valid domains at policy compose; the
+ *  CLI is a standalone package and cannot import the worker module, so the
+ *  cap constant is duplicated here (kept in sync via that file's tests). */
+const MAX_ADDITIVE_EGRESS_DOMAINS = 100;
 function fetcherFrom(io) {
     return io.fetcher ?? authedFetch;
 }
@@ -55,22 +61,72 @@ function splitDomains(value) {
         .map(d => d.trim())
         .filter(d => d.length > 0);
 }
+function stringArray(value) {
+    return Array.isArray(value) ? value.filter((d) => typeof d === 'string') : [];
+}
+/**
+ * Re-derive the "beyond the 100-domain cap" entries from a stored set the
+ * SAME way the GET route does (positional over UNIQUE VALID domains): the
+ * coordinator applies only the first MAX_ADDITIVE_EGRESS_DOMAINS valid
+ * domains, so every valid entry past that index is configured-but-inert.
+ * Stored entries are already canonical + deduped by the write RPC, and the
+ * invalid (grandfathered) ones — flagged by the server — are not "valid"
+ * and so never consume a cap slot. Used for the PUT response, where a
+ * shrink-by-one on an oversized legacy row leaves the returned set still
+ * over-cap and the server does not send cappedDomains back.
+ */
+function deriveCapped(stored, invalid) {
+    const invalidSet = new Set(invalid);
+    const capped = [];
+    let validCount = 0;
+    for (const d of stored) {
+        if (invalidSet.has(d))
+            continue;
+        validCount += 1;
+        if (validCount > MAX_ADDITIVE_EGRESS_DOMAINS)
+            capped.push(d);
+    }
+    return capped;
+}
 async function fetchCurrent(fetcher, path) {
     const response = await fetcher(path, { method: 'GET' });
     if (!response.ok) {
         throw new Error(`show failed (${response.status}): ${await responseMessage(response)}`);
     }
     const data = (await response.json());
-    return Array.isArray(data.extraDomains) ? data.extraDomains.filter((d) => typeof d === 'string') : [];
+    return {
+        domains: stringArray(data.extraDomains),
+        invalid: stringArray(data.invalidDomains),
+        capped: stringArray(data.cappedDomains),
+    };
 }
-function emit(io, teamSlug, domains) {
+function emit(io, teamSlug, current) {
     if (io.json) {
-        io.print(JSON.stringify({ teamSlug, extraDomains: domains }));
+        io.print(JSON.stringify({
+            teamSlug,
+            extraDomains: current.domains,
+            invalidDomains: current.invalid,
+            cappedDomains: current.capped,
+        }));
         return;
     }
-    io.print(domains.length === 0
+    const invalid = new Set(current.invalid);
+    const capped = new Set(current.capped);
+    const lines = current.domains.map((d) => {
+        // Round 4 (P3): re-adding a non-grandfathered invalid entry is
+        // guaranteed to fail the write RPC's tightened validator (grandfathering
+        // is retention-only — see set_team_egress_allowlist), so "remove and
+        // re-add" was actively misleading. The only viable remediation is
+        // removal.
+        if (invalid.has(d))
+            return `${d} (invalid — will not take effect; remove it (this value is no longer valid and cannot be re-added))`;
+        if (capped.has(d))
+            return `${d} (beyond the 100-domain cap — will not take effect)`;
+        return d;
+    });
+    io.print(lines.length === 0
         ? `${teamSlug}: no additive egress domains (base allowlist only)`
-        : `${teamSlug} additive egress domains:\n  ${domains.join('\n  ')}`);
+        : `${teamSlug} additive egress domains:\n  ${lines.join('\n  ')}`);
 }
 export async function egressAllowlistCommand(args, io) {
     const teamSlug = firstPositional(args);
@@ -100,7 +156,7 @@ export async function egressAllowlistCommand(args, io) {
         }
         else {
             const current = await fetchCurrent(fetcher, path);
-            const set = new Set(current);
+            const set = new Set(current.domains);
             if (addValue)
                 for (const d of splitDomains(addValue))
                     set.add(d);
@@ -119,10 +175,16 @@ export async function egressAllowlistCommand(args, io) {
             return 1;
         }
         const data = (await response.json());
-        const stored = Array.isArray(data.extraDomains)
-            ? data.extraDomains.filter((d) => typeof d === 'string')
-            : next;
-        emit(io, teamSlug, stored);
+        const stored = Array.isArray(data.extraDomains) ? stringArray(data.extraDomains) : next;
+        const invalid = stringArray(data.invalidDomains);
+        // Grandfathered retention: a successful PUT may still STORE legacy
+        // invalid entries the admin retained — the server flags them and we show
+        // it. Round 5 (P2): a >100-entry legacy row can only shrink one entry per
+        // PUT (the write RPC's GREATEST(100, stored-1) bound), so the returned
+        // set can still be OVER the cap. Re-derive the cap annotations from the
+        // returned set — same positional logic GET uses — instead of assuming
+        // the RPC left it at/under 100.
+        emit(io, teamSlug, { domains: stored, invalid, capped: deriveCapped(stored, invalid) });
         return 0;
     }
     catch (error) {

package/dist/help.js

@@ -394,6 +394,12 @@ export const COMMAND_DOCS = [
         summary: 'Submit score results for a scorer against a prompt version or optimization candidate.',
         group: 'Scorers and runners',
     },
+    {
+        path: ['scores', 'accept'],
+        usage: 'orizu scores accept <score-run-id> [--project <team/project>] [--json]',
+        summary: 'Record a human curator acceptance of an agent-reported score as trusted evidence (human-only).',
+        group: 'Scorers and runners',
+    },
     {
         path: ['runners', 'push'],
         usage: 'orizu runners push <dir> [--project <team/project>] [--name <name>] [--label <label>] [--json]',
@@ -415,7 +421,7 @@ export const COMMAND_DOCS = [
     {
         path: ['runners', 'exec'],
         usage: 'orizu runners exec (--prompt <prompt-version-id> | --prompt-version <id> --runner-version <id> | --scorer-version <id>) --dataset-version <id> --split-set <id-or-name> --split <name> [--runner-dir <dir>] --out <results.jsonl|results.jsonl.gz>',
-        summary: 'Execute a runner locally against a dataset split and write row results.',
+        summary: 'Execute a runner locally against a dataset split and write row results. --runner-dir bytes must match the registered runner version (ADR-007) — register with `orizu runners push` first.',
         group: 'Scorers and runners',
     },
     {
@@ -450,8 +456,8 @@ export const COMMAND_DOCS = [
     },
     {
         path: ['optimizations', 'run-gepa'],
-        usage: 'orizu optimizations run-gepa --project <team/project> --optimizer-version-id <id> --candidate-version-id <id> --runner-version-id <id> --candidate-runner-dir <dir> --scorer-version-id <id> --scorer-runner-version-id <id> --scorer-runner-dir <dir> --dataset-version-id <id> --split-set-id <id> [--train-split train] [--val-split validation] [--budget auto|light|medium|heavy | --max-metric-calls <n> | --max-full-evals <n> | --max-iterations <n>] [--num-threads auto|N] [--reflection-retry-attempts N] [--reflection-http-timeout-seconds N] [--log-dir logs]',
-        summary: 'Run the bundled GEPA-style optimizer locally and stream events.',
+        usage: 'orizu optimizations run-gepa --project <team/project> --optimizer-version-id <id> --candidate-version-id <id> --runner-version-id <id> --candidate-runner-dir <dir> --scorer-version-id <id> --scorer-runner-version-id <id> --scorer-runner-dir <dir> [--scorer-input-contract gepa|flat_row] [--scorer-candidate-field <row-field>] [--allow-degenerate-seed] --dataset-version-id <id> --split-set-id <id> [--train-split train] [--val-split validation] [--budget auto|light|medium|heavy | --max-metric-calls <n> | --max-full-evals <n> | --max-iterations <n>] [--num-threads auto|N] [--reflection-retry-attempts N] [--reflection-http-timeout-seconds N] [--log-dir logs]',
+        summary: 'Run the bundled GEPA-style optimizer locally and stream events. Validates the scorer contract on the seed before iterating; judge runners built for flat-row score runs need --scorer-input-contract flat_row (ALI-1158).',
         group: 'Optimizations',
     },
     {
@@ -747,7 +753,7 @@ export const COMMAND_DOCS = [
     },
     {
         path: ['session', 'start'],
-        usage: 'orizu session start [--project <team/project>] [--workspace <dir>] [--json] | orizu session start --hosted (--task <prompt> | --task-file <path>) [--duration <min>] [--project <team/project>] [--tail]',
+        usage: 'orizu session start [--project <team/project>] [--workspace <dir>] [--json] | orizu session start --hosted (--task <prompt> | --task-file <path>) [--duration <min>] [--project <team/project>] [--tail [--quiet]]',
         summary: 'Start a durable workspace session, or add --hosted with a task prompt to start a coordinator-managed hosted agent. Plain sessions check out their remote session branch locally when run inside the workbench clone (or with --workspace).',
         group: 'Sessions',
         options: [
@@ -760,7 +766,8 @@ export const COMMAND_DOCS = [
             { name: '--model <provider/model>', help: 'Optional hosted model override.' },
             { name: '--reasoning-effort <level>', help: 'Optional hosted model reasoning-effort override.' },
             { name: '--title <title>', help: 'Optional hosted run title.' },
-            { name: '--tail', help: 'Follow the hosted run until it reaches a terminal state.' },
+            { name: '--tail', help: 'Follow the hosted run until it reaches a terminal state, streaming compact per-event digests (agent text, tool calls with args, results).' },
+            { name: '--quiet', help: 'With --tail: stream event types only (the pre-digest output).' },
             { name: '--json', help: 'Emit the machine-readable session payload.' },
         ],
         examples: [
@@ -835,7 +842,7 @@ export const COMMAND_DOCS = [
     {
         path: ['run', 'tail'],
         usage: 'orizu run tail --run <id> [--after <seq>] [--interval <seconds>] [--once] [--json]',
-        summary: 'Cursor-poll a workbench run event log; JSON mode emits one event object per line.',
+        summary: 'Cursor-poll a workbench run event log as compact per-event digest lines; JSON mode emits one full event object per line.',
         group: 'Workbench runs',
         options: [
             { name: '--run <id>', help: 'Workbench run id.', required: true },

package/dist/hosted-runtime-assets.js

@@ -101,7 +101,14 @@ export function parsePrebakedMarker(raw) {
         typeof claudeSdkVersion !== 'string') {
         return null;
     }
-    return { cliVersion, opencodeVersion, claudeSdkVersion, builtFor: 'vercel-sandbox' };
+    const marker = { cliVersion, opencodeVersion, claudeSdkVersion, builtFor: 'vercel-sandbox' };
+    // Optional Braintrust pins (ALI-1048): carried through when present as strings;
+    // absent/odd-typed values are simply omitted (never invalidate the marker).
+    if (typeof rec.braintrustPyVersion === 'string')
+        marker.braintrustPyVersion = rec.braintrustPyVersion;
+    if (typeof rec.braintrustNpmVersion === 'string')
+        marker.braintrustNpmVersion = rec.braintrustNpmVersion;
+    return marker;
 }
 export function serializeBootContext(ctx) {
     return `${JSON.stringify(ctx, null, 2)}\n`;

package/dist/hosted-session-cli.js

@@ -50,6 +50,7 @@ import { findUnknownOption } from './option-validation.js';
 import { getWorkspaceRoot } from './workspace.js';
 import { attachedWorkspaceId } from './workspace-sync.js';
 import { tailWorkbenchRun } from './workbench-cli.js';
+import { formatRunEventDigest, formatRunEventTypeLine } from './run-event-digest.js';
 // Default hosted model — SINGLE source of truth in hosted-loop-lifecycle.ts
 // (ALI-1086); re-exported here so existing importers keep working.
 export { DEFAULT_HOSTED_MODEL };
@@ -621,7 +622,9 @@ function numFlag(args, flag) {
 }
 const HOSTED_USAGE = 'Usage: orizu session start --hosted (--task "<prompt>" | --task-file <path>) [--duration <min> (default 60, max 1440)] ' +
     '[--model <provider/model>] [--reasoning-effort <level>] [--project <team/project>] ' +
-    '[--title <title>] [--tail]\n' +
+    '[--title <title>] [--tail [--quiet]]\n' +
+    '--tail streams compact per-event digests (agent text, tool calls + args, results); ' +
+    '--quiet restores the types-only stream; --json keeps full event payloads.\n' +
     'Default: the Orizu server provisions the sandbox (no VERCEL_* or model key needed on your machine); ' +
     'the session coordinator owns its lifetime (ALI-1055).\n' +
     'DEPRECATED escape hatch: --operator provisions from THIS machine (requires VERCEL_* + ANTHROPIC_API_KEY ' +
@@ -640,6 +643,7 @@ const HOSTED_START_OPTIONS = new Set([
     '--project',
     '--title',
     '--tail',
+    '--quiet',
     '--operator',
     '--provider',
     '--runtime',
@@ -673,7 +677,24 @@ export const OPERATOR_DEPRECATION_WARNING = '! DEPRECATED: --operator (operator-
  * route and let the Durable Object coordinator own the sandbox lifetime. The
  * CLI never reads VERCEL_* or a model key on this path — the server holds them.
  */
-export async function startHostedViaServer(args, workspaceId, task, tail, io, fetcher = (path, init) => authedFetch(path, init)) {
+/** Bounded reconcile of a start that the coordinator reported still-in-flight
+ *  (R7 P4). Each retry re-pokes the SAME session by its returned sessionId, so
+ *  a race that momentarily answers start_pending never spawns a duplicate.
+ *
+ *  R8 P2 — the retry budget must OUTLIVE a stale start lease. If a start-lease
+ *  owner crashed WITHOUT running its release, the lease lingers until its TTL
+ *  (the coordinator's START_LEASE_TTL_MS = 3 × CALLBACK_TIMEOUT_MS = 30s), and
+ *  every duplicate poke sees it and answers start_pending. So the CLI's OWN
+ *  cumulative backoff (independent of server-side watch time) must exceed that
+ *  TTL plus margin, so the CLI keeps polling until the lease expires and a
+ *  retry then wins — rather than giving up while the crashed owner's lease
+ *  still lingers. COORDINATOR_START_LEASE_TTL_MS mirrors the worker constant
+ *  and is pinned to it by a contract test in the CLI suite. */
+export const COORDINATOR_START_LEASE_TTL_MS = 30_000;
+export const HOSTED_START_PENDING_RETRY_MS = 2_000;
+const HOSTED_START_PENDING_TTL_MARGIN_MS = 6_000;
+export const HOSTED_START_PENDING_MAX_RETRIES = Math.ceil((COORDINATOR_START_LEASE_TTL_MS + HOSTED_START_PENDING_TTL_MARGIN_MS) / HOSTED_START_PENDING_RETRY_MS);
+export async function startHostedViaServer(args, workspaceId, task, tail, io, fetcher = (path, init) => authedFetch(path, init), sleep = ms => new Promise(resolve => setTimeout(resolve, ms))) {
     const durationMinutes = numFlag(args, '--duration');
     const model = argVal(args, '--model') ?? undefined;
     const reasoningEffort = argVal(args, '--reasoning-effort') ?? undefined;
@@ -727,19 +748,39 @@ export async function startHostedViaServer(args, workspaceId, task, tail, io, fe
             io.printErr?.(message);
         return 1;
     }
+    // R7 P4: the coordinator may momentarily answer start_pending (a start for
+    // this session is racing). It returns the sessionId so we RECONCILE the SAME
+    // session — re-poking by that id rather than blindly re-initing a duplicate.
     let response;
-    try {
-        response = await fetcher('/api/cli/hosted-sessions', {
-            method: 'POST',
-            headers: { 'Content-Type': 'application/json' },
-            body: serializedPayload,
-        });
-    }
-    catch (error) {
-        io.printErr?.(`hosted session request failed: ${error instanceof Error ? error.message : String(error)}`);
-        return 1;
+    let body = {};
+    let reconcileSessionId;
+    for (let attempt = 0;; attempt++) {
+        const attemptBody = reconcileSessionId
+            ? JSON.stringify({ ...payload, sessionId: reconcileSessionId })
+            : serializedPayload;
+        try {
+            response = await fetcher('/api/cli/hosted-sessions', {
+                method: 'POST',
+                headers: { 'Content-Type': 'application/json' },
+                body: attemptBody,
+            });
+        }
+        catch (error) {
+            io.printErr?.(`hosted session request failed: ${error instanceof Error ? error.message : String(error)}`);
+            return 1;
+        }
+        body = (await response.json().catch(() => ({})));
+        const stillPending = response.status === 409 &&
+            body.coordinator === 'start_pending' &&
+            typeof body.sessionId === 'string' &&
+            body.sessionId.length > 0;
+        if (stillPending && attempt < HOSTED_START_PENDING_MAX_RETRIES) {
+            reconcileSessionId = body.sessionId;
+            await sleep(HOSTED_START_PENDING_RETRY_MS);
+            continue;
+        }
+        break;
     }
-    const body = (await response.json().catch(() => ({})));
     const errorMessage = typeof body.error === 'string' ? body.error : `${response.status}`;
     if (response.status === 503) {
         io.printErr?.(errorMessage);
@@ -764,12 +805,20 @@ export async function startHostedViaServer(args, workspaceId, task, tail, io, fe
             io.print(`stream it: orizu run tail --run ${runId}`);
     }
     if (tail && runId) {
+        // ALI-1045: the attached tail renders the SAME compact per-event digests
+        // `run tail` uses (agent text, tool + args, result + first output line) so
+        // the operator watching live sees what is happening without a second
+        // terminal. `--quiet` keeps the old types-only stream; `--json` keeps full
+        // fidelity.
+        const quiet = hasFlag(args, '--quiet');
         await tailWorkbenchRun({
             fetcher,
             runId,
             onEvent: event => io.print(io.json
                 ? JSON.stringify(event)
-                : `#${String(event.sequence ?? '?')} ${String(event.eventType ?? '')}`),
+                : quiet
+                    ? formatRunEventTypeLine(event)
+                    : formatRunEventDigest(event)),
         });
     }
     return 0;
@@ -882,7 +931,13 @@ export async function hostedCommand(args, io, deps = {}) {
         // fail-fast in startHostedSession throws before any session/sandbox is made.
         modelApiKey: argVal(args, '--model-key') ?? (process.env.ANTHROPIC_API_KEY || undefined),
         logLine: line => io.print(line),
-        onTailEvent: event => io.print(io.json ? JSON.stringify(event) : `#${String(event.sequence ?? '?')} ${String(event.eventType ?? '')}`),
+        // ALI-1045: compact per-event digests (shared with `run tail`); `--quiet`
+        // keeps the old types-only stream, `--json` keeps full fidelity.
+        onTailEvent: event => io.print(io.json
+            ? JSON.stringify(event)
+            : hasFlag(args, '--quiet')
+                ? formatRunEventTypeLine(event)
+                : formatRunEventDigest(event)),
         tailImpl: tail
             ? async ({ fetcher, runId, onEvent }) => {
                 await tailWorkbenchRun({ fetcher, runId, onEvent: event => onEvent?.(event) });

package/dist/index.js

@@ -29,6 +29,8 @@ import { connectorsCommand } from './connectors-cli.js';
 import { ARTIFACT_MAX_BYTES, runnerOptimizerCommand } from './artifact-pull.js';
 import { killSwitchCommand } from './kill-switch-cli.js';
 import { egressAllowlistCommand } from './egress-allowlist-cli.js';
+import { acceptScoreRunCommand } from './scores-accept-cli.js';
+import { listOptimizationRunsCommand } from './optimizations-list-cli.js';
 import { teamConnectorsCommand } from './team-connectors-cli.js';
 import { manifestsCommand } from './manifests-cli.js';
 import { workbenchCommand } from './workbench-cli.js';
@@ -36,6 +38,7 @@ import { hostedCommand } from './hosted-session-cli.js';
 import { workspaceSyncCommand } from './workspace-sync.js';
 import { runGitCredential } from './git-credential.js';
 import { pushPromptDraft } from './prompt-draft-push.js';
+import { assertSnapshotManifestConfined, verifyGepaRunnerDirsFromArgs, verifyRunnerDirRegistered } from './runner-dir-verify.js';
 import { runScorersRegister } from './scorer-draft-push.js';
 import { runZipArtifactPush } from './zip-draft-push.js';
 import { runGithubLink, runInteractiveHostedSetup } from './github-setup.js';
@@ -1504,8 +1507,10 @@ async function submitScoreResults() {
         printJson(data);
         return;
     }
+    // ALI-1175: label the stored provenance — a submitted score is a client-reported claim.
     printLine(`Submitted score ${sanitizeTerminalText(data.scoreRun.id)} ` +
-        `(${formatPercent(data.scoreRun.scoreValue)})`);
+        `(${formatPercent(data.scoreRun.scoreValue)})` +
+        (data.scoreRun.provenance ? ` [${sanitizeTerminalText(String(data.scoreRun.provenance).replace(/_/g, '-'))}]` : ''));
 }
 function looksLikeAggregateScoreObject(value) {
     return (value.scoreValue !== undefined ||
@@ -1640,11 +1645,23 @@ async function execScorer() {
         : scoreResult
             ? scoreResult.scoreValue
             : null;
+    // ALI-1175 (round 5 thread 6 + round 6 thread 2): a scorers-exec score is an
+    // agent-reported claim whether or not it was submitted — label both the
+    // submitted (scoreRun.provenance) and the --no-submit (top-level provenance)
+    // outputs, so a displayed value is never presented as unlabeled evidence.
+    const execProvenance = scoreRun && typeof scoreRun.provenance === 'string'
+        ? scoreRun.provenance
+        : typeof data.provenance === 'string'
+            ? data.provenance
+            : null;
+    const provenanceSuffix = execProvenance
+        ? ` [${sanitizeTerminalText(execProvenance.replace(/_/g, '-'))}]`
+        : '';
     if (scoreRun && typeof scoreRun.id === 'string') {
-        printLine(`Executed scorer ${sanitizeTerminalText(scorerVersionId)} -> score ${sanitizeTerminalText(scoreRun.id)} (${formatPercent(numberFromUnknown(scoreValue))})`);
+        printLine(`Executed scorer ${sanitizeTerminalText(scorerVersionId)} -> score ${sanitizeTerminalText(scoreRun.id)} (${formatPercent(numberFromUnknown(scoreValue))})${provenanceSuffix}`);
     }
     else {
-        printLine(`Executed scorer ${sanitizeTerminalText(scorerVersionId)} (${formatPercent(numberFromUnknown(scoreValue))})`);
+        printLine(`Executed scorer ${sanitizeTerminalText(scorerVersionId)} (${formatPercent(numberFromUnknown(scoreValue))})${provenanceSuffix}`);
     }
     if (outPath) {
         printLine(`Wrote scorer result to ${sanitizeTerminalText(outPath)}`);
@@ -1866,34 +1883,8 @@ async function exportOptimizationRun() {
     writeTextFileEnsuringDir(filename, `${JSON.stringify(data, null, 2)}\n`);
     printLine(`Saved optimization export to ${sanitizeTerminalText(filename)}`);
 }
-// ALI-1073: enumerate the project's optimization runs (id, status, refs, and the
-// promoted-version link if any) so an agent/human can discover a prior run.
-async function listOptimizationRuns() {
-    const project = getArg('--project') || await resolveProjectSlug(null);
-    const response = await authedFetch(`/api/cli/optimization-runs?project=${encodeURIComponent(project)}`);
-    if (!response.ok) {
-        throw new Error(`Failed to list optimization runs: ${await response.text()}`);
-    }
-    const data = await parseJsonResponse(response, 'Optimization runs list');
-    if (hasJsonFlag()) {
-        printJson(data);
-        return;
-    }
-    const rows = data.optimizationRuns || [];
-    if (rows.length === 0) {
-        printLine('No optimization runs found for this project.');
-        return;
-    }
-    const idWidth = Math.max(2, ...rows.map(row => String(row.id).length));
-    const statusWidth = Math.max(6, ...rows.map(row => String(row.status).length));
-    printLine(`${'ID'.padEnd(idWidth)}  ${'STATUS'.padEnd(statusWidth)}  BEST   PROMOTED_VERSION`);
-    printLine(`${'-'.repeat(idWidth)}  ${'-'.repeat(statusWidth)}  ${'-'.repeat(5)}  ${'-'.repeat('PROMOTED_VERSION'.length)}`);
-    for (const row of rows) {
-        const best = row.bestScore === null || row.bestScore === undefined ? '-' : String(row.bestScore);
-        const promoted = row.resultPromptVersionId || '-';
-        printLine(`${String(row.id).padEnd(idWidth)}  ${String(row.status).padEnd(statusWidth)}  ${best.padEnd(5)}  ${promoted}`);
-    }
-}
+// ALI-1073 list moved to optimizations-list-cli.ts (line ratchet, ALI-976);
+// ALI-1175 labels its best scores as agent-reported evidence there.
 function removeFlagWithValue(args, flag) {
     const filtered = [];
     for (let index = 0; index < args.length; index += 1) {
@@ -1915,31 +1906,50 @@ function bundledOrizuGepaPythonPath() {
 async function runGepaOptimization() {
     const project = getArg('--project') || await resolveProjectSlug(null);
     const baseUrl = getBaseUrl();
-    // Uniform resolution (ALI-1090): honors ORIZU_TOKEN / ORIZU_TOKEN_FILE before
-    // credentials.json so hosted sandboxes can run optimizations. Read at spawn
-    // time — the child gets the freshest bearer available at launch.
-    const token = resolveAuthTokenForBaseUrl(baseUrl);
     const python = getArg('--python') || process.env.PYTHON || 'python3';
     const bundledPythonPath = bundledOrizuGepaPythonPath();
     let forwardedArgs = removeFlagWithValue(cliArgs.slice(2), '--python');
-    if (!forwardedArgs.includes('--project')) {
-        forwardedArgs = ['--project', project, ...forwardedArgs];
-    }
-    const pythonPathEntries = [
-        bundledPythonPath,
-        process.env.PYTHONPATH,
-    ].filter((entry) => Boolean(entry));
-    const result = spawnSync(python, ['-m', 'orizu_gepa.cli', ...forwardedArgs], {
-        stdio: 'inherit',
-        env: {
-            ...process.env,
-            ORIZU_API_URL: baseUrl,
-            ORIZU_TOKEN: token,
-            ORIZU_PROJECT: project,
-            PYTHONPATH: pythonPathEntries.join(delimiter),
-            PYTHONUNBUFFERED: process.env.PYTHONUNBUFFERED || '1',
-        },
-    });
+    // ALI-1159 (ADR-007): GEPA executes ad-hoc local runner dirs while
+    // attributing records to registered runner version ids — verify the bytes
+    // ARE those versions before the optimizer spawns. Scans the forwarded argv
+    // itself (both argparse flag forms), fail-closed on half-populated pairs,
+    // and REWRITES the dir flags to verified snapshots (the exact hashed bytes)
+    // so a post-hash mutation of the original dirs cannot change what runs.
+    const verified = await verifyGepaRunnerDirsFromArgs(forwardedArgs);
+    forwardedArgs = verified.args;
+    let result;
+    try {
+        // Uniform resolution (ALI-1090): honors ORIZU_TOKEN / ORIZU_TOKEN_FILE before
+        // credentials.json so hosted sandboxes can run optimizations. Read at spawn
+        // time — AFTER the verification awaits above, so a hosted token-file
+        // rotation crossing the hash + lookup round-trips cannot hand the child a
+        // stale bearer.
+        const token = resolveAuthTokenForBaseUrl(baseUrl);
+        if (!forwardedArgs.includes('--project')) {
+            forwardedArgs = ['--project', project, ...forwardedArgs];
+        }
+        const pythonPathEntries = [
+            bundledPythonPath,
+            process.env.PYTHONPATH,
+        ].filter((entry) => Boolean(entry));
+        result = spawnSync(python, ['-m', 'orizu_gepa.cli', ...forwardedArgs], {
+            stdio: 'inherit',
+            env: {
+                ...process.env,
+                ORIZU_API_URL: baseUrl,
+                ORIZU_TOKEN: token,
+                ORIZU_PROJECT: project,
+                // Integrity handshake (ALI-1159): the Python entrypoint refuses
+                // runner dirs that are not in this wrapper-verified list.
+                ORIZU_VERIFIED_RUNNER_DIRS: JSON.stringify(verified.verifiedDirs),
+                PYTHONPATH: pythonPathEntries.join(delimiter),
+                PYTHONUNBUFFERED: process.env.PYTHONUNBUFFERED || '1',
+            },
+        });
+    }
+    finally {
+        verified.cleanup();
+    }
     if (result.error) {
         throw result.error;
     }
@@ -4635,10 +4645,7 @@ async function materializeRunnerVersion(runnerVersionId) {
         rmSync(tempDir, { recursive: true, force: true });
         throw new Error(`unzip failed: ${sanitizeTerminalText(result.stderr || result.stdout || '')}`);
     }
-    return {
-        runnerDir,
-        cleanup: () => rmSync(tempDir, { recursive: true, force: true }),
-    };
+    return { runnerDir, cleanup: () => rmSync(tempDir, { recursive: true, force: true }) };
 }
 async function runnersExec() {
     const prompt = getArg('--prompt');
@@ -4680,12 +4687,28 @@ async function runnersExec() {
         throw new Error(`Failed to fetch runner execution context: ${await contextResponse.text()}`);
     }
     const context = await parseJsonResponse(contextResponse, 'Runner exec context');
+    const resolvedRunnerVersionId = runnerVersion || context.prompt.runnerVersionId;
+    if (!resolvedRunnerVersionId) {
+        throw new Error('Runner exec context did not resolve a runner version id; pass --runner-version explicitly');
+    }
+    // ALI-1159 (ADR-007): results stamp the registered runner_version_id, so
+    // ad-hoc --runner-dir bytes must BE that registered version — and execution
+    // runs the verified SNAPSHOT (exact hashed bytes), never the mutable dir.
     const materializedRunner = runnerDirArg
-        ? { runnerDir: expandHomePath(runnerDirArg), cleanup: () => { } }
-        : await materializeRunnerVersion(runnerVersion || context.prompt.runnerVersionId);
+        ? await (async () => {
+            const verified = await verifyRunnerDirRegistered({
+                runnerVersionId: resolvedRunnerVersionId,
+                dir: runnerDirArg,
+                flag: '--runner-dir',
+            });
+            return { runnerDir: verified.snapshotDir, cleanup: verified.cleanup };
+        })()
+        : await materializeRunnerVersion(resolvedRunnerVersionId);
     const runnerDir = materializedRunner.runnerDir;
-    const manifest = readRunnerManifest(runnerDir);
     try {
+        assertSnapshotManifestConfined(runnerDir, runnerDirArg ? '--runner-dir' : '--runner-version');
+        // Inside the try (codex round-6 P3): a bad manifest must not leak the dir.
+        const manifest = readRunnerManifest(runnerDir);
         if (manifest.supports_body_kind && !manifest.supports_body_kind.includes(context.prompt.bodyKind)) {
             throw new Error(`Runner does not support prompt body kind '${context.prompt.bodyKind}'. Supported kinds: ${manifest.supports_body_kind.join(', ')}`);
         }
@@ -4996,6 +5019,10 @@ export async function main(rawArgs = process.argv.slice(2)) {
         await submitScoreResults();
         return;
     }
+    if (command === 'scores' && subcommand === 'accept') {
+        await acceptScoreRunCommand(cliArgs.slice(2), { json: hasJsonFlag(), print: printLine, resolveProjectSlug });
+        return;
+    }
     if (command === 'optimizations' && subcommand === 'start') {
         await startOptimizationRun();
         return;
@@ -5009,7 +5036,7 @@ export async function main(rawArgs = process.argv.slice(2)) {
         return;
     }
     if (command === 'optimizations' && subcommand === 'list') {
-        await listOptimizationRuns();
+        await listOptimizationRunsCommand(cliArgs.slice(2), { json: hasJsonFlag(), print: printLine, resolveProjectSlug });
         return;
     }
     if (command === 'optimizations' &&

package/dist/kill-switch-cli.js

@@ -8,6 +8,16 @@
  * (killed sessions stay ended). Human ADMIN only: the server rejects agent
  * bearers and non-admins. Pure command logic with an injected fetcher so the
  * entry point owns argument parsing and human/JSON output.
+ *
+ * Containment (ALI-1166): the guarantee is session-end + per-request
+ * verification + token-row revocation at engage — a bearer bound to an ended
+ * session can never verify again, and ended sessions are terminal
+ * (DB-enforced; no post-kill resurrection).
+ * `tokensRevoked` in the summary counts the persisted agent token rows the
+ * engage revoked (trigger cascade + belt, one transaction); it may include
+ * expired or already-ended-session stragglers that were never live bearers at
+ * kill time. `--json` output is the server's summary passed through, including
+ * `containment: "session-end"`.
  */
 import { authedFetch } from './http.js';
 async function responseMessage(response) {