pandora-cli-skills 1.1.62 → 1.1.63

package/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: pandora-cli-skills
 summary: Canonical skill and operator guide for Pandora CLI including mirror, polymarket, resolve, and LP flows.
-version: 1.1.62
+version: 1.1.63
 ---
 
 # Pandora CLI & Skills

package/cli/lib/agent_contract_registry.cjs

@@ -1923,7 +1923,7 @@ const commandContracts = [
     name: 'mirror.deploy',
     summary: 'Deploy a mirror market from selector or plan in dry-run or execute mode.',
     usage:
-      'pandora [--output table|json] mirror deploy --plan-file <path>|--polymarket-market-id <id>|--polymarket-slug <slug> --dry-run|--execute [--liquidity-usdc <n>] [--fee-tier <500-50000>] [--max-imbalance <n>] [--arbiter <address>] [--category <n>] [--chain-id <id>] [--rpc-url <url>] [--private-key <hex>] [--oracle <address>] [--factory <address>] [--usdc <address>] [--distribution-yes <parts>] [--distribution-no <parts>] [--sources <url...>] [--manifest-file <path>] [--polymarket-host <url>] [--polymarket-gamma-url <url>] [--polymarket-gamma-mock-url <url>] [--polymarket-mock-url <url>] [--min-close-lead-seconds <n>]',
+      'pandora [--output table|json] mirror deploy --plan-file <path>|--polymarket-market-id <id>|--polymarket-slug <slug> --dry-run|--execute [--liquidity-usdc <n>] [--fee-tier <500-50000>] [--max-imbalance <n>] [--arbiter <address>] [--category <n>] [--chain-id <id>] [--rpc-url <url>] [--private-key <hex>] [--oracle <address>] [--factory <address>] [--usdc <address>] [--distribution-yes <parts>] [--distribution-no <parts>] [--sources <url...>] [--validation-ticket <ticket>] [--manifest-file <path>] [--polymarket-host <url>] [--polymarket-gamma-url <url>] [--polymarket-gamma-mock-url <url>] [--polymarket-mock-url <url>] [--min-close-lead-seconds <n>]',
     emits: ['mirror.deploy', 'mirror.deploy.help'],
     dataSchema: '#/definitions/MirrorDeployPayload',
     mcpExposed: true,
@@ -1933,7 +1933,8 @@ const commandContracts = [
       executeRequiresValidation: true,
       notes: [
         'Mirror deploy dry-run returns the exact Pandora deployment payload and required validation ticket.',
-        'Run agent.market.validate on that final payload before rerunning mirror.deploy with execute mode.',
+        'Mirror deploy never auto-copies Polymarket URLs into sources; pass independent public resolution URLs with --sources.',
+        'Run agent.market.validate on that final payload before rerunning mirror.deploy with execute mode, then pass --validation-ticket locally or agentPreflight in MCP.',
       ],
     },
     mcp: {
@@ -1961,6 +1962,7 @@ const commandContracts = [
           'distribution-yes': numberSchema('Initial YES distribution parts.', { minimum: 0 }),
           'distribution-no': numberSchema('Initial NO distribution parts.', { minimum: 0 }),
           sources: flexibleArraySchema(stringSchema(), 'Source URL list.'),
+          'validation-ticket': stringSchema('Ticket returned by agent.market.validate for the exact final payload (CLI execute mode).'),
           'manifest-file': stringSchema('Mirror manifest path.'),
           'polymarket-host': stringSchema('Polymarket host override.'),
           'polymarket-gamma-url': stringSchema('Polymarket Gamma API base URL.'),
@@ -2089,7 +2091,7 @@ const commandContracts = [
     name: 'mirror.go',
     summary: 'Run mirror deploy, verify, and optional sync workflow.',
     usage:
-      'pandora [--output table|json] mirror go --polymarket-market-id <id>|--polymarket-slug <slug> [--liquidity-usdc <n>] [--fee-tier <500-50000>] [--max-imbalance <n>] [--arbiter <address>] [--category <n>] [--paper|--dry-run|--execute-live|--execute] [--auto-sync] [--sync-once] [--sync-interval-ms <ms>] [--max-open-exposure-usdc <amount>] [--max-trades-per-day <n>] [--polymarket-rpc-url <url>] [--manifest-file <path>] [--dotenv-path <path>] [--rpc-url <url>] [--private-key <hex>]',
+      'pandora [--output table|json] mirror go --polymarket-market-id <id>|--polymarket-slug <slug> [--liquidity-usdc <n>] [--fee-tier <500-50000>] [--max-imbalance <n>] [--arbiter <address>] [--category <n>] [--paper|--dry-run|--execute-live|--execute] [--auto-sync] [--sync-once] [--sync-interval-ms <ms>] [--max-open-exposure-usdc <amount>] [--max-trades-per-day <n>] [--polymarket-rpc-url <url>] [--sources <url...>] [--validation-ticket <ticket>] [--manifest-file <path>] [--dotenv-path <path>] [--rpc-url <url>] [--private-key <hex>]',
     emits: ['mirror.go', 'mirror.go.help'],
     dataSchema: '#/definitions/MirrorDeployPayload',
     mcpExposed: true,
@@ -2099,6 +2101,7 @@ const commandContracts = [
       executeRequiresValidation: true,
       notes: [
         'Mirror go inherits the exact market payload from its deploy stage; use the returned validation ticket from paper/dry-run output.',
+        'When mirror go will execute a fresh deploy, provide independent public --sources and a matching validation ticket.',
         'Run agent.market.validate on that exact payload before rerunning mirror.go with execute or execute-live.',
       ],
     },
@@ -2125,6 +2128,8 @@ const commandContracts = [
           'max-open-exposure-usdc': numberSchema('Maximum open exposure in USDC.', { minimum: 0 }),
           'max-trades-per-day': integerSchema('Maximum daily trade count.', { minimum: 0 }),
           'polymarket-rpc-url': stringSchema('Polygon RPC URL for Polymarket preflight.'),
+          sources: flexibleArraySchema(stringSchema(), 'Independent public source URL list.'),
+          'validation-ticket': stringSchema('Ticket returned by agent.market.validate for the exact final payload (CLI execute mode).'),
           'manifest-file': stringSchema('Mirror manifest path.'),
           'dotenv-path': stringSchema('Env file path.'),
           'rpc-url': commonFlags.rpcUrl,

package/cli/lib/error_recovery_service.cjs

@@ -44,8 +44,14 @@ function buildPolymarketPreflightCommand(cliName) {
   return `${cliName} polymarket preflight`;
 }
 
-function buildMirrorDeployRetryCommand(cliName) {
-  return `${cliName} mirror deploy --dry-run --plan-file <plan-file>`;
+function buildMirrorDeployRetryCommand(cliName, details) {
+  const selectorPlan = cleanToken(details && details.planFile, '')
+    ? `--plan-file ${cleanToken(details && details.planFile, '<plan-file>')}`
+    : '--plan-file <plan-file>';
+  const includeSourcesPlaceholder =
+    details
+    && (details.requiredMinimum || details.invalidSources || details.dependentSources || details.requiredValidation);
+  return `${cliName} mirror deploy --dry-run ${selectorPlan}${includeSourcesPlaceholder ? ' --sources <url1> <url2>' : ''}`;
 }
 
 function buildMirrorVerifyRetryCommand(cliName, details) {
@@ -232,12 +238,27 @@ function createErrorRecoveryService(options = {}) {
           command: buildPolymarketPreflightCommand(cliName),
           retryable: true,
         };
+      case 'MIRROR_VALIDATION_REQUIRED':
+      case 'MIRROR_VALIDATION_MISMATCH':
+        return {
+          action: 'Run market validation for the exact mirror payload and reuse the returned ticket',
+          command: buildAgentMarketValidateCommand(cliName, details),
+          retryable: true,
+        };
+      case 'MIRROR_RULES_FORMAT_INVALID':
+      case 'MIRROR_SOURCES_REQUIRED':
+      case 'MIRROR_SOURCES_INVALID':
+        return {
+          action: 'Rebuild mirror deploy inputs in dry-run mode and provide explicit independent sources',
+          command: buildMirrorDeployRetryCommand(cliName, details),
+          retryable: true,
+        };
       case 'MIRROR_DEPLOY_FAILED':
       case 'MIRROR_GO_FAILED':
       case 'MIRROR_GO_PREFLIGHT_FAILED':
         return {
           action: 'Re-run mirror deploy/verify in dry-run mode',
-          command: buildMirrorDeployRetryCommand(cliName),
+          command: buildMirrorDeployRetryCommand(cliName, details),
           retryable: true,
         };
       case 'MIRROR_GO_VERIFY_FAILED':

package/cli/lib/mcp_tool_registry.cjs

@@ -225,6 +225,7 @@ function toToolDescriptor(definition) {
     canonicalTool: definition.canonicalTool || definition.aliasOf || definition.name,
     aliasOf: definition.aliasOf || null,
     preferred: definition.preferred !== false,
+    compatibilityAlias: Boolean(definition.aliasOf),
     mutating: Boolean(definition.mutating),
     longRunningBlocked: Boolean(definition.longRunningBlocked),
     controlInputNames: Array.isArray(definition.controlInputNames) ? [...definition.controlInputNames] : [],
@@ -238,7 +239,9 @@ function toToolDescriptor(definition) {
 
   return {
     name: definition.name,
-    description: definition.description,
+    description: definition.aliasOf
+      ? `${definition.description} Compatibility alias for ${xPandora.canonicalTool}; prefer ${xPandora.canonicalTool}.`
+      : definition.description,
     inputSchema: {
       ...inputSchema,
       xPandora,

package/cli/lib/mirror_command_service.cjs

@@ -4,7 +4,7 @@
  * @type {string}
  */
 const MIRROR_GO_USAGE =
-  'pandora [--output table|json] mirror go --polymarket-market-id <id>|--polymarket-slug <slug> [--liquidity-usdc <n>] [--fee-tier <500-50000>] [--max-imbalance <n>] [--arbiter <address>] [--category <n>] [--paper|--dry-run|--execute-live|--execute] [--auto-sync] [--sync-once] [--sync-interval-ms <ms>] [--hedge-ratio <n>] [--no-hedge] [--max-rebalance-usdc <n>] [--max-hedge-usdc <n>] [--max-open-exposure-usdc <n>] [--max-trades-per-day <n>] [--cooldown-ms <ms>] [--chain-id <id>] [--rpc-url <url>] [--polymarket-rpc-url <url>] [--private-key <hex>] [--funder <address>] [--usdc <address>] [--oracle <address>] [--factory <address>] [--sources <url...>] [--manifest-file <path>] [--trust-deploy] [--skip-gate] [--polymarket-host <url>] [--polymarket-gamma-url <url>] [--polymarket-gamma-mock-url <url>] [--polymarket-mock-url <url>] [--with-rules] [--include-similarity] [--min-close-lead-seconds <n>]';
+  'pandora [--output table|json] mirror go --polymarket-market-id <id>|--polymarket-slug <slug> [--liquidity-usdc <n>] [--fee-tier <500-50000>] [--max-imbalance <n>] [--arbiter <address>] [--category <n>] [--paper|--dry-run|--execute-live|--execute] [--auto-sync] [--sync-once] [--sync-interval-ms <ms>] [--hedge-ratio <n>] [--no-hedge] [--max-rebalance-usdc <n>] [--max-hedge-usdc <n>] [--max-open-exposure-usdc <n>] [--max-trades-per-day <n>] [--cooldown-ms <ms>] [--chain-id <id>] [--rpc-url <url>] [--polymarket-rpc-url <url>] [--private-key <hex>] [--funder <address>] [--usdc <address>] [--oracle <address>] [--factory <address>] [--sources <url...>] [--validation-ticket <ticket>] [--manifest-file <path>] [--trust-deploy] [--skip-gate] [--polymarket-host <url>] [--polymarket-gamma-url <url>] [--polymarket-gamma-mock-url <url>] [--polymarket-mock-url <url>] [--with-rules] [--include-similarity] [--min-close-lead-seconds <n>]';
 
 /**
  * Canonical usage string for `mirror sync`.
@@ -97,7 +97,7 @@ function createRunMirrorCommand(deps) {
           '  plan   --source polymarket --polymarket-market-id <id>|--polymarket-slug <slug> [--chain-id <id>] [--target-slippage-bps <n>] [--turnover-target <n>] [--depth-slippage-bps <n>] [--safety-multiplier <n>] [--min-liquidity-usdc <n>] [--max-liquidity-usdc <n>] [--with-rules] [--include-similarity] [--polymarket-gamma-url <url>] [--polymarket-gamma-mock-url <url>] [--polymarket-mock-url <url>]',
         );
         console.log(
-          '  deploy --plan-file <path>|--polymarket-market-id <id>|--polymarket-slug <slug> --dry-run|--execute [--liquidity-usdc <n>] [--fee-tier <500-50000>] [--max-imbalance <n>] [--arbiter <address>] [--category <n>] [--chain-id <id>] [--rpc-url <url>] [--private-key <hex>] [--oracle <address>] [--factory <address>] [--usdc <address>] [--distribution-yes <parts>] [--distribution-no <parts>] [--sources <url...>] [--manifest-file <path>] [--polymarket-host <url>] [--polymarket-gamma-url <url>] [--polymarket-gamma-mock-url <url>] [--polymarket-mock-url <url>] [--min-close-lead-seconds <n>]',
+          '  deploy --plan-file <path>|--polymarket-market-id <id>|--polymarket-slug <slug> --dry-run|--execute [--liquidity-usdc <n>] [--fee-tier <500-50000>] [--max-imbalance <n>] [--arbiter <address>] [--category <n>] [--chain-id <id>] [--rpc-url <url>] [--private-key <hex>] [--oracle <address>] [--factory <address>] [--usdc <address>] [--distribution-yes <parts>] [--distribution-no <parts>] [--sources <url...>] [--validation-ticket <ticket>] [--manifest-file <path>] [--polymarket-host <url>] [--polymarket-gamma-url <url>] [--polymarket-gamma-mock-url <url>] [--polymarket-mock-url <url>] [--min-close-lead-seconds <n>]',
         );
         console.log(
           '  verify --pandora-market-address <address>|--market-address <address> --polymarket-market-id <id>|--polymarket-slug <slug> [--trust-deploy] [--manifest-file <path>] [--include-similarity] [--with-rules] [--allow-rule-mismatch] [--polymarket-host <url>] [--polymarket-gamma-url <url>] [--polymarket-gamma-mock-url <url>] [--polymarket-mock-url <url>]',

package/cli/lib/mirror_handlers/deploy.cjs

@@ -24,12 +24,12 @@ module.exports = async function handleMirrorDeploy({ shared, context, deps }) {
         context.outputMode,
         'mirror.deploy.help',
         commandHelpPayload(
-          'pandora [--output table|json] mirror deploy --plan-file <path>|--polymarket-market-id <id>|--polymarket-slug <slug> --dry-run|--execute [--liquidity-usdc <n>] [--fee-tier <500-50000>] [--max-imbalance <n>] [--arbiter <address>] [--category <n>] [--manifest-file <path>] [--min-close-lead-seconds <n>]',
+          'pandora [--output table|json] mirror deploy --plan-file <path>|--polymarket-market-id <id>|--polymarket-slug <slug> --dry-run|--execute [--liquidity-usdc <n>] [--fee-tier <500-50000>] [--max-imbalance <n>] [--arbiter <address>] [--category <n>] [--sources <url...>] [--validation-ticket <ticket>] [--manifest-file <path>] [--min-close-lead-seconds <n>]',
         ),
       );
     } else {
       console.log(
-        'Usage: pandora [--output table|json] mirror deploy --plan-file <path>|--polymarket-market-id <id>|--polymarket-slug <slug> --dry-run|--execute [--liquidity-usdc <n>] [--fee-tier <500-50000>] [--max-imbalance <n>] [--arbiter <address>] [--category <n>] [--manifest-file <path>] [--min-close-lead-seconds <n>]',
+        'Usage: pandora [--output table|json] mirror deploy --plan-file <path>|--polymarket-market-id <id>|--polymarket-slug <slug> --dry-run|--execute [--liquidity-usdc <n>] [--fee-tier <500-50000>] [--max-imbalance <n>] [--arbiter <address>] [--category <n>] [--sources <url...>] [--validation-ticket <ticket>] [--manifest-file <path>] [--min-close-lead-seconds <n>]',
       );
     }
     return;

package/cli/lib/mirror_service.cjs

@@ -10,8 +10,10 @@ const {
   hashRules,
   preloadPandoraMatchCandidates,
 } = require('./mirror_verify_service.cjs');
+const { buildRequiredAgentMarketValidation } = require('./agent_market_prompt_service.cjs');
 const { deployPandoraAmmMarket } = require('./pandora_deploy_service.cjs');
 const { defaultManifestFile, upsertPair } = require('./mirror_manifest_store.cjs');
+const { isMcpMode } = require('./shared/mcp_path_guard.cjs');
 const { round } = require('./shared/utils.cjs');
 
 const MIRROR_PLAN_SCHEMA_VERSION = '1.0.0';
@@ -38,19 +40,310 @@ function normalizeSources(value) {
     .filter(Boolean);
 }
 
+function normalizeComparableText(value) {
+  return String(value || '')
+    .toLowerCase()
+    .replace(/&/g, ' and ')
+    .replace(/[^a-z0-9]+/g, ' ')
+    .replace(/\b(the|fc|cf|sc|ac|club)\b/g, ' ')
+    .replace(/\s+/g, ' ')
+    .trim();
+}
+
+function hasPandoraBinaryRules(value) {
+  const text = String(value || '');
+  return /(^|\n)\s*YES\s*:/i.test(text) && /(^|\n)\s*NO\s*:/i.test(text);
+}
+
+function sanitizeParticipantLabel(value) {
+  return String(value || '')
+    .replace(/^["'`(\[]+/, '')
+    .replace(/["'`)\].,:;!?]+$/, '')
+    .trim();
+}
+
+function extractMatchParticipants(question) {
+  const text = String(question || '').trim();
+  if (!text) return [];
+
+  const patterns = [
+    /\bwill\s+(.+?)\s+(?:beat|defeat|top|topple|upset|outscore)\s+(.+?)(?:\?|$)/i,
+    /^(.+?)\s+(?:vs\.?|v\.?|@|at)\s+(.+?)(?:\?|$)/i,
+    /\bbetween\s+(.+?)\s+and\s+(.+?)(?:\?|$)/i,
+  ];
+
+  for (const pattern of patterns) {
+    const match = text.match(pattern);
+    if (!match) continue;
+    const left = sanitizeParticipantLabel(match[1]);
+    const right = sanitizeParticipantLabel(match[2]);
+    if (left && right) {
+      return Array.from(new Set([left, right]));
+    }
+  }
+
+  return [];
+}
+
+function extractResolveToSelection(description) {
+  const text = String(description || '').trim();
+  if (!text) return null;
+
+  const patterns = [
+    /\b(?:this market )?resolve(?:s|d)?\s+to\s+([^.;\n]+)/i,
+    /\bresolve(?:s|d)?\s+(?:in favor of|for)\s+([^.;\n]+)/i,
+    /\bwinner(?:\s+is)?\s*:\s*([^.;\n]+)/i,
+  ];
+
+  for (const pattern of patterns) {
+    const match = text.match(pattern);
+    if (match && match[1]) {
+      const candidate = sanitizeParticipantLabel(match[1]);
+      if (candidate) return candidate;
+    }
+  }
+
+  return null;
+}
+
+function findBestParticipantMatch(selection, participants) {
+  const normalizedSelection = normalizeComparableText(selection);
+  if (!normalizedSelection || !Array.isArray(participants) || !participants.length) {
+    return null;
+  }
+
+  let best = null;
+  let bestScore = 0;
+  const selectionTokens = new Set(normalizedSelection.split(' ').filter(Boolean));
+  for (const participant of participants) {
+    const normalizedParticipant = normalizeComparableText(participant);
+    if (!normalizedParticipant) continue;
+    if (
+      normalizedSelection === normalizedParticipant ||
+      normalizedSelection.includes(normalizedParticipant) ||
+      normalizedParticipant.includes(normalizedSelection)
+    ) {
+      return participant;
+    }
+    const participantTokens = new Set(normalizedParticipant.split(' ').filter(Boolean));
+    const overlap = [...selectionTokens].filter((token) => participantTokens.has(token)).length;
+    const score = overlap / Math.max(selectionTokens.size, participantTokens.size, 1);
+    if (score > bestScore) {
+      best = participant;
+      bestScore = score;
+    }
+  }
+
+  return bestScore >= 0.5 ? best : null;
+}
+
+function buildWinnerRules(selection, opponent) {
+  const yesBranch = `YES: The official winner of the event described in the market question is ${selection}.`;
+  const noBranch = opponent
+    ? `NO: The official winner is ${opponent}, or the event ends in a draw if an official draw is possible.`
+    : `NO: ${selection} is not the official winner of the event described in the market question.`;
+  const edgeBranch =
+    'EDGE: If the event is canceled, postponed, abandoned, or no official result is declared by targetTimestamp, resolve NO.';
+  return [yesBranch, noBranch, edgeBranch].join('\n');
+}
+
+function buildQuestionFallbackRules(question) {
+  const normalizedQuestion = String(question || '').trim().replace(/\?+$/, '');
+  if (!normalizedQuestion) {
+    return 'YES: The market question resolves true by targetTimestamp.\nNO: The market question does not resolve true by targetTimestamp.\nEDGE: If the event is canceled, postponed, abandoned, or no official result is declared by targetTimestamp, resolve NO.';
+  }
+
+  const affirmative = normalizedQuestion.replace(/^will\s+/i, '').trim();
+  return [
+    `YES: ${affirmative.charAt(0).toUpperCase()}${affirmative.slice(1)}.`,
+    `NO: It is not true that ${affirmative}.`,
+    'EDGE: If the event is canceled, postponed, abandoned, or no official result is declared by targetTimestamp, resolve NO.',
+  ].join('\n');
+}
+
+function assertPandoraBinaryRules(rulesText, details = {}) {
+  if (hasPandoraBinaryRules(rulesText)) {
+    return;
+  }
+  throw createServiceError(
+    'MIRROR_RULES_FORMAT_INVALID',
+    'Mirror rules must use explicit Pandora YES:/NO: branches before deploy. Re-run mirror plan --with-rules or pass --rules with binary Pandora rules.',
+    details,
+  );
+}
+
+function isPolymarketSourceUrl(value) {
+  try {
+    const parsed = new URL(String(value || '').trim());
+    return /(^|\.)polymarket\.com$/i.test(parsed.hostname);
+  } catch {
+    return false;
+  }
+}
+
+function assertIndependentMirrorSources(sources) {
+  const normalized = normalizeSources(sources);
+  const invalidSources = [];
+  const dependentSources = [];
+  const distinctSources = new Set();
+  const distinctHosts = new Set();
+
+  for (const source of normalized) {
+    try {
+      const parsed = new URL(source);
+      if (parsed.protocol !== 'http:' && parsed.protocol !== 'https:') {
+        invalidSources.push(source);
+        continue;
+      }
+      if (isPolymarketSourceUrl(source)) {
+        dependentSources.push(source);
+        continue;
+      }
+      distinctSources.add(parsed.toString());
+      distinctHosts.add(parsed.hostname.toLowerCase());
+    } catch {
+      invalidSources.push(source);
+    }
+  }
+
+  if (!normalized.length) {
+    throw createServiceError(
+      'MIRROR_SOURCES_REQUIRED',
+      'Mirror deploy requires explicit independent resolution sources via --sources. Polymarket URLs are never used automatically.',
+      {
+        requiredMinimum: 2,
+        normalizedCount: 0,
+      },
+    );
+  }
+
+  if (invalidSources.length) {
+    throw createServiceError(
+      'MIRROR_SOURCES_INVALID',
+      '--sources must contain valid http(s) URLs.',
+      {
+        invalidSources,
+      },
+    );
+  }
+
+  if (dependentSources.length) {
+    throw createServiceError(
+      'MIRROR_SOURCES_INVALID',
+      'Mirror deploy requires independent resolution sources. Polymarket URLs are not allowed in --sources.',
+      {
+        dependentSources,
+      },
+    );
+  }
+
+  if (normalized.length < 2) {
+    throw createServiceError(
+      'MIRROR_SOURCES_REQUIRED',
+      'Mirror deploy requires at least two independent resolution sources in --sources.',
+      {
+        requiredMinimum: 2,
+        normalizedCount: normalized.length,
+      },
+    );
+  }
+
+  if (distinctSources.size < 2 || distinctHosts.size < 2) {
+    throw createServiceError(
+      'MIRROR_SOURCES_REQUIRED',
+      'Mirror deploy requires at least two independent resolution sources from different hosts in --sources.',
+      {
+        requiredMinimum: 2,
+        normalizedCount: normalized.length,
+        distinctSourceCount: distinctSources.size,
+        distinctHostCount: distinctHosts.size,
+      },
+    );
+  }
+
+  return normalized;
+}
+
+function assertMirrorValidationTicket({ execute, question, rules, sources, targetTimestamp, validationTicket }) {
+  const requiredValidation = buildRequiredAgentMarketValidation({
+    question,
+    rules,
+    sources,
+    targetTimestamp,
+  });
+
+  if (!execute || isMcpMode()) {
+    return {
+      requiredValidation,
+      agentValidation: null,
+    };
+  }
+
+  const providedTicket = String(validationTicket || '').trim();
+  if (!providedTicket) {
+    throw createServiceError(
+      'MIRROR_VALIDATION_REQUIRED',
+      'mirror execute requires --validation-ticket from agent market validate for the exact final mirror payload.',
+      {
+        requiredValidation,
+      },
+    );
+  }
+
+  if (providedTicket !== requiredValidation.ticket) {
+    throw createServiceError(
+      'MIRROR_VALIDATION_MISMATCH',
+      'Provided --validation-ticket does not match the exact final mirror market payload.',
+      {
+        expectedTicket: requiredValidation.ticket,
+        receivedTicket: providedTicket,
+        requiredValidation,
+      },
+    );
+  }
+
+  return {
+    requiredValidation,
+    agentValidation: {
+      ok: true,
+      ticket: providedTicket,
+      decision: 'PASS',
+      summary: 'Validated via CLI ticket gate.',
+    },
+  };
+}
+
 function buildRuleTemplate(sourceMarket) {
   const diagnostics = [];
+  const sourceQuestion = String(sourceMarket && sourceMarket.question ? sourceMarket.question : '').trim();
   const sourceDescription = String(sourceMarket && sourceMarket.description ? sourceMarket.description : '').trim();
-  if (sourceDescription) {
+  if (sourceDescription && hasPandoraBinaryRules(sourceDescription)) {
     return {
       rulesText: sourceDescription,
       diagnostics,
     };
   }
 
-  diagnostics.push('Source market description/rules missing; generated fallback rule template.');
+  const selectedOutcome = extractResolveToSelection(sourceDescription);
+  if (selectedOutcome) {
+    const participants = extractMatchParticipants(sourceQuestion);
+    const selectedParticipant = findBestParticipantMatch(selectedOutcome, participants) || selectedOutcome;
+    const opposingParticipant =
+      participants.find((participant) => normalizeComparableText(participant) !== normalizeComparableText(selectedParticipant)) || null;
+
+    diagnostics.push('Translated source market resolution text into Pandora YES/NO rules.');
+    if (participants.length >= 2 && !opposingParticipant) {
+      diagnostics.push('Unable to confidently determine the opposing side; NO branch resolves when the selected side does not win.');
+    }
+    return {
+      rulesText: buildWinnerRules(selectedParticipant, opposingParticipant),
+      diagnostics,
+    };
+  }
+
+  diagnostics.push('Source rules were not already in Pandora YES/NO format; generated fallback binary rule template from the source question.');
   return {
-    rulesText: `Resolves YES if \"${String(sourceMarket && sourceMarket.question ? sourceMarket.question : 'the source condition').trim()}\" is true by the deadline. Resolves NO otherwise; canceled/postponed/abandoned/unresolved => NO.`,
+    rulesText: buildQuestionFallbackRules(sourceQuestion || 'the source condition'),
     diagnostics,
   };
 }
@@ -251,15 +544,31 @@ async function deployMirror(options = {}) {
   }
 
   const diagnostics = [];
-  const sourceRulesText = String(
+  const question = String(planData.sourceMarket && planData.sourceMarket.question ? planData.sourceMarket.question : '').trim();
+  const targetTimestamp = Number(planData.sourceMarket && planData.sourceMarket.closeTimestamp);
+  const refreshedRuleTemplate = buildRuleTemplate({
+    ...(planData.sourceMarket || {}),
+    description:
+      (planData.rules && (planData.rules.sourceRules || planData.rules.proposedPandoraRules))
+      || (planData.sourceMarket && planData.sourceMarket.description)
+      || '',
+  });
+  let sourceRulesText = String(
     options.rules ||
       (planData.rules && (planData.rules.proposedPandoraRules || planData.rules.sourceRules)) ||
       (planData.sourceMarket && planData.sourceMarket.description) ||
       '',
   ).trim();
-
-  const question = String(planData.sourceMarket && planData.sourceMarket.question ? planData.sourceMarket.question : '').trim();
-  const targetTimestamp = Number(planData.sourceMarket && planData.sourceMarket.closeTimestamp);
+  if (!options.rules && !hasPandoraBinaryRules(sourceRulesText) && hasPandoraBinaryRules(refreshedRuleTemplate.rulesText)) {
+    sourceRulesText = refreshedRuleTemplate.rulesText;
+    diagnostics.push('Upgraded non-binary source rules to Pandora YES/NO format during deploy.');
+  }
+  assertPandoraBinaryRules(sourceRulesText, {
+    question,
+    sourceRules: planData.rules && planData.rules.sourceRules ? planData.rules.sourceRules : null,
+    suggestedRules: refreshedRuleTemplate.rulesText,
+  });
+  diagnostics.push(...refreshedRuleTemplate.diagnostics);
 
   const liquidityUsdc =
     options.liquidityUsdc !== null && options.liquidityUsdc !== undefined
@@ -275,20 +584,15 @@ async function deployMirror(options = {}) {
       ? Number(options.distributionNo)
       : Number(planData.distributionHint && planData.distributionHint.distributionNo);
 
-  const sources = normalizeSources(options.sources);
-  if (options.sourcesProvided && sources.length < 2) {
-    throw createServiceError(
-      'INVALID_FLAG_VALUE',
-      '--sources requires at least two non-empty URLs when explicitly provided.',
-      {
-        providedCount: Array.isArray(options.sources) ? options.sources.length : 0,
-        normalizedCount: sources.length,
-      },
-    );
-  }
-  if (!options.sourcesProvided && sources.length < 2) {
-    diagnostics.push('Using fallback source URLs because explicit --sources were not provided.');
-  }
+  const sources = assertIndependentMirrorSources(options.sources);
+  const validationGate = assertMirrorValidationTicket({
+    execute: Boolean(options.execute),
+    question,
+    rules: sourceRulesText,
+    sources,
+    targetTimestamp,
+    validationTicket: options.validationTicket,
+  });
 
   let deployPayload;
   try {
@@ -302,7 +606,7 @@ async function deployMirror(options = {}) {
       usdc: options.usdc,
       question,
       rules: sourceRulesText,
-      sources: sources.length >= 2 ? sources : ['https://polymarket.com', 'https://clob.polymarket.com'],
+      sources,
       targetTimestamp,
       minCloseLeadSeconds: Number.isFinite(Number(options.minCloseLeadSeconds))
         ? Number(options.minCloseLeadSeconds)
@@ -393,8 +697,8 @@ async function deployMirror(options = {}) {
     planDigest: planData.planDigest || buildPlanDigest(planData),
     deploymentArgs: deployPayload.deploymentArgs,
     dryRun: deployPayload.mode === 'dry-run',
-    requiredValidation: deployPayload.requiredValidation || null,
-    agentValidation: deployPayload.agentValidation || null,
+    requiredValidation: deployPayload.requiredValidation || validationGate.requiredValidation || null,
+    agentValidation: deployPayload.agentValidation || validationGate.agentValidation || null,
     tx: deployPayload.tx,
     pandora: deployPayload.pandora,
     postDeployChecks,

package/cli/lib/parsers/mirror_deploy_flags.cjs

@@ -120,6 +120,7 @@ function createParseMirrorDeployFlags(deps) {
       distributionYesPct: null,
       distributionNoPct: null,
       rules: null,
+      validationTicket: null,
       polymarketHost: null,
       polymarketGammaUrl: null,
       polymarketGammaMockUrl: null,
@@ -251,6 +252,11 @@ function createParseMirrorDeployFlags(deps) {
         i += 1;
         continue;
       }
+      if (token === '--validation-ticket') {
+        options.validationTicket = requireFlagValue(args, i, '--validation-ticket');
+        i += 1;
+        continue;
+      }
       if (token === '--distribution-yes') {
         options.distributionYes = parseDistributionUnits(
           requireFlagValue(args, i, '--distribution-yes'),

package/cli/lib/parsers/mirror_go_flags.cjs

@@ -133,6 +133,7 @@ function createParseMirrorGoFlags(deps) {
       distributionNoPct: null,
       sources: [],
       sourcesProvided: false,
+      validationTicket: null,
       manifestFile: null,
       trustDeploy: false,
       forceGate: false,
@@ -373,6 +374,11 @@ function createParseMirrorGoFlags(deps) {
         i = j - 1;
         continue;
       }
+      if (token === '--validation-ticket') {
+        options.validationTicket = requireFlagValue(args, i, '--validation-ticket');
+        i += 1;
+        continue;
+      }
       if (token === '--manifest-file') {
         options.manifestFile = requireFlagValue(args, i, '--manifest-file');
         i += 1;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pandora-cli-skills",
-  "version": "1.1.62",
+  "version": "1.1.63",
   "description": "Pandora CLI & Skills",
   "main": "cli/pandora.cjs",
   "bin": {