swarm-orchestrator 14.0.2 → 14.1.0

package/CHANGELOG.md

@@ -1,6 +1,213 @@
 # Changelog
 
-## Unreleased
+## 14.1.0 - 2026-09-14
+
+### Added
+
+- **Goal runs now complete through adaptive integration.** `swarm parallel --goal` creates one
+  shared run context before planning, resolves each task contract into enforced paths, tools,
+  checks, runtime policy and budget, and schedules ready work without whole-layer barriers. Merge
+  conflicts, behavioral failures and ratchet rejections retain their candidate commits and create
+  bounded repair attempts against the current integration tree. Missing prerequisites, coupled
+  tasks and repair routes use append-only graph revisions that preserve requirement identities.
+  Final status comes from independent checks of the exact integrated tree. `resume` rebuilds the
+  durable controller state and will not duplicate an accepted landing. The pilot driver and its
+  paired evaluation remain descriptive evidence, not a claim of universal correctness or swarm
+  superiority.
+
+- **The oracle bond asks something of ordinary code.** Its five operators each needed a particular
+  token on the line, and a guard clause, an assignment, a `require` and a callback carry none of
+  them, so `not-bonded` was what a bond said when it had nothing to ask rather than when it had
+  found a strong oracle. Both adversarial false greens are that shape and produced zero mutants
+  between them across every line they add. Three more operators cover the statement shapes that
+  went uncovered: an `if` or `while` condition negated whole, the value a plain assignment or
+  declaration writes replaced by a sentinel, and the statement removed. They are read off the
+  language's own `Statement` productions rather than off the patches that exposed the gap, because
+  operators fitted to the cases that motivated them measure the fitting, and the derivation, the
+  ordering and which tasks were in sample were committed before any of it was implemented:
+  [`docs/oracle-bond-operators.md`](docs/oracle-bond-operators.md). All eight fire on the mined
+  corpus and the three new ones account for 25 of the 34 mutants built. `koa#1999`, the patch a
+  rejected stricter option would have cost because nothing here could change any of its added
+  lines, certifies on `held`.
+- **A deleted statement is confirmed to parse before it is read as evidence.** Statement deletion
+  is the one operator that can leave a file which does not compile, and every oracle refuses one of
+  those, so a bond counting that refusal would credit the oracle with a rejection it never made. It
+  runs `node --check` over the file the patch left and over the file with the line blanked. Where
+  the original does not parse, node cannot read the dialect and so cannot tell a syntax error from
+  a mutant: the operator proposes nothing for that file and the other seven still apply, which is
+  what TypeScript and JSX get.
+- **A vacuous bond names what showed the mutant changed anything.** An oracle accepting a mutant
+  means nothing unless the mutant was a change, and what established that was a person reading each
+  mutated line: an audit that found two equivalent mutants, does not scale, and is not evidence
+  anybody else can re-derive. Every mutant the oracle accepted on a line it ran is now adjudicated
+  by a second detector, cheapest first. The oracle runs again under the same instrumentation reach
+  uses, and a line other than the mutated one that ran in one reading and not the other is a
+  demonstrated difference in what the program did; failing that, the repository's own gates that
+  passed with the patch are run again. Neither seeing anything is recorded as such, and a suite run
+  that was never spent says so rather than answering. What the pair cannot see is named: a mutant
+  that changes only a value on a path that runs either way, in code the project did not have
+  before.
+- **`scripts/deadline-overshoot.mjs`, and gate 9 has a number.** Twenty samples with a real child
+  that outlives its deadline and the whole cancellation tree between them. Worst overshoot 3ms,
+  1.20% of a 250ms budget against the 2% the gate asks, and the budget floor is printed beside the
+  percentage because the percentage depends on both. The wall clock rather than an injected one: a
+  driven clock reports zero by construction, which is the one answer this cannot be allowed to
+  give.
+- **`scripts/task-difficulty.mjs`, and gate 7's blocker was misdiagnosed.** That row said the
+  discriminating corpus has three tasks and more would have to be authored by hand. They are
+  already mined: over the pull-request corpus this model solves 11 of 79, 13.9% [8.0, 23.2], spread
+  across fourteen repositories. A set where the model both succeeds and fails is what a paired test
+  needs and what the golden set does not give. What is left is arm selection in the mined pass and
+  a second run of every task, neither of which is authoring.
+- **The adversarial arm's numbers come out of the same script as the rest.** They were in prose and
+  nothing re-derived them. `separateAdversarialRows` also keeps them out of every other rate by a
+  check rather than by which file a row sits in, since a model shown its acceptance test is a
+  different sampling process rather than a harder subset of one.
+
+- **`swarm ci` refuses to certify on an oracle that never ran the change.** An oracle is evidence
+  only about the code it executed, so the run reports `oracleReach`, and a change the oracle
+  demonstrably skipped is not verified. The unreached lines are named, because "extend the oracle
+  to cover the lines the patch added" is not actionable without them. Reach is measured only where
+  the harness can rebuild the oracle's invocation as an argument vector it controls, per invariant
+  7; anywhere else it reads `unmeasured`, which blocks nothing. koa#1946, the first false green
+  this project found, is refused by it: its oracle never executed lines 270-273 of the file it
+  certified. Across both corpora the check produced no false reds.
+
+### Fixed
+
+- Run the deadline measurement tests after competing test processes finish, retaining the
+  existing timing bounds. A hosted macOS run exposed a 255 ms overshoot under concurrent suite
+  load; that failed observation remains recorded in the implementation evidence.
+
+- **A regular expression is masked like the literal it is.** The claim beside the deletion parse
+  check was that no other operator can leave a file which does not parse, and that claim is why
+  only one operator is checked at runtime. Measured across every operator over 186 real files, it
+  was false: `swap-call-arguments` broke 1 of its 105 on a line splitting on a pattern whose own
+  comma is part of it. `withoutLiterals` masked strings and comments and had never masked a
+  pattern, so the argument scan read that comma as an argument separator and swapped halves of a
+  regex; the same blindness reached every operator that looks for a token, since a comparison
+  inside a pattern is not a comparison. Which of two things a slash is gets settled by what
+  precedes it, wrong only in the direction that masks too much and costs a mutant. Re-measured over
+  the same files: 2,702 mutants and every operator but the deletion at zero.
+- **An empty patch is not charged to the model unless the endpoint answered.** An MLX server ran
+  out of GPU memory mid-batch, inside `mx.eval` over its own prompt cache, and every task after it
+  came back with a zero-byte patch recorded as the model writing nothing. That is the
+  misattribution this corpus was already bitten by in the other direction, when twelve rows the
+  agent had failed on were reported as an oracle nobody could run. `scripts/pr-task-pass.mjs` now
+  probes the endpoint before the pass and again after any empty patch, records nothing where it
+  does not answer, and stops, because every task after an endpoint failure records the same wrong
+  thing. Not under `--rejudge`, which re-derives verdicts from recorded patches and asks no model
+  anything.
+- **`swarm ci` stops printing one sentence for two different absences.** `unshown` said "the oracle
+  accepted, and nothing shows it ran the mutated lines" even where it had run them and no detector
+  could show the mutant changed anything, which sends a reader to inspect coverage that is fine. The
+  line names which absence it is, and a gap names what witnessed it, because a refusal resting on an
+  instrument and one resting on the operator alone are different amounts of evidence.
+- **The deadline overshoot test measured the machine rather than the tool.** It went red inside its
+  own suite. Overshoot is scheduling and does not shrink with the budget, so 2% of a 500ms budget is
+  10ms of headroom and the whole suite running in parallel ate it: 3ms idle, 5ms with eight
+  processes spinning, more than 10ms under the suite. The 2% claim is now made at a two-second
+  budget where 40ms stands against a measured 2 to 5, the absolute number is asserted separately,
+  and gate 9's row says the published 1.20% is an idle-machine number.
+- **The bond stops spending detectors once the verdict cannot change.** Which fact the verdict rests
+  on also decides when adjudicating can stop, and the loop read only one of the two, so detectors
+  were spent looking for something that could not change the answer. One coverage reading and at
+  most one suite run per patch now. That also removed a state the record could not describe
+  honestly, a mutant past the bound on suite runs recorded as not adjudicated while coverage had
+  been asked and been silent.
+- **Two imports nothing in `src/cli-select.ts` used**, and an empty shell argument read as a path.
+  `sed -i '' 's/a/b/' file` is the in-place form every macOS invocation uses and it was refused with
+  "the path is empty", because the quoted empty argument reached a check whose whole subject is
+  paths.
+- **Three attacks that got past the policy guard.** Every security case in this repository was
+  written by whoever wrote the defence, so `src/tools/guard-attacks.test.ts` was written the other
+  way round. Casing: macOS and Windows are case-insensitive by default, so `.ENV` opens `.env`, and
+  every pattern in the credential denylist was case-sensitive. Measured on APFS before the fix,
+  `readFileSync('.ENV')` returns what `.env` holds, and `realpathSync` hands back the casing it was
+  given rather than the casing on disk, so nothing upstream normalized it; `SWARM.TOML`,
+  `server.PEM`, `.git/CONFIG` and a differently cased denied root were the same hole. The denial
+  comparisons now fold, whatever the host filesystem does, because a denial whose verdict depends
+  on which machine ran it is the defect. The workspace containment check does not fold: that one
+  decides whether anything is allowed at all, and folding it is the fail-open direction. A revision
+  and a path in one word: `git show HEAD:.env` prints a credential file and the word the guard
+  ruled on matched no pattern. A path inside a word the shell passes whole: `sed -n
+  'w /home/dev/.ssh/authorized_keys'` writes outside the workspace and the operand was the whole
+  script. A word now offers every path it could open, its whitespace-separated pieces and what
+  follows a colon, each through the same guard, with a URL scheme left alone. Two attacks still
+  succeed and are asserted as succeeding, because a residual nobody can point at is not named:
+  `git config --list` reads a denied file without naming it, and `node -e "..."` is an allowlisted
+  interpreter handed a program.
+- **vitest and `@vitest/coverage-v8` to 4.1.11, for GHSA-82fw-gwwq-j7x9.** A path traversal in
+  `@vitest/mocker`'s redirect mock, CVSS 5.9, published 2026-09-08 against every version from
+  2.1.0. Dev-only and inside the range `package.json` already declared, so the lockfile was the
+  only thing holding the tree on 4.1.10. The coverage provider is pinned exactly rather than
+  ranged, so it moves in the same change or it drifts away from the runner it instruments. This is
+  the first finding the weekly scan has produced that was the world changing rather than the tree:
+  it landed a day after the last scheduled run, and the scan caught it on the next.
+- **A dynamic gate the harness ran itself now counts as having executed the change.** Reported from
+  outside against e261c859b: a project declaring a linter and no test runner settled green over a
+  changed source file that nothing had executed, because the check for "was this change measured"
+  asked only whether some command gate had passed and a linter is one. That reading was replaced by
+  what a gate is capable of establishing, and half the old predicate was left behind: it still
+  asked for a command as well, which discards the behaviour probe, an inspection that imports the
+  changed module and calls its functions. So the probe's classification was dead, and with it the
+  two abstentions added to keep a probe that measured nothing from reading as a pass, and a project
+  with no declared runner spent every attempt and escalated saying nothing had run over a change
+  its own probe had just run. Capability decides it now, and the gate's shape decides nothing. The
+  reported case is driven whole in `src/gates/static-only-project.test.ts`, with the changed file
+  instrumented so that executing it leaves a trace: it settles green only where the trace exists.
+- **The weekly scan reports what somebody can act on.** It read 16,731 files, nearly all of them
+  captured evidence, and 171 of its 177 findings were one rule firing once per copy of the
+  re-derivation script that every exported bundle carries. Editing a bundle to quiet a scanner
+  falsifies the record it exists to be, so those paths are data the scan does not read, and the
+  finding was fixed where it lives: the template in `src/evidence/verifier/rederive.mjs` was
+  missing the suppression its mirror in `src/gates/parsers.ts` already carried. The other five in
+  source are dispositioned at the line that carries each, one of them a fix: a `replace` stripping
+  the first `$` of a pattern where every one of them was meant. The scan now reads 1,050 files and
+  reports nothing. It also stops opening a fresh issue every Monday for findings that have not
+  changed: it comments on the open one, since three identical notifications is how a scan teaches
+  people to close it unread.
+- **An invocation the harness could not read, so it could not measure.** The recognizer that
+  decides whether the harness controls a command read quoted text as bare: a title filter's `|`
+  tripped its shell-operator scan and its spaces split one argument into several, so no real
+  oracle could be vouched. Quoting is read now, which is narrower than a shell rather than wider:
+  nothing expands, nothing is escaped, and an operator outside quotes still ends the reading.
+  Vouching those commands then exposed that a flag whose value is the next argument was being
+  separated from it, which asked node to filter titles by a coverage flag and to run a test file
+  named after the titles.
+- **The patch's own tests are not code the oracle skipped.** An acceptance oracle runs its own test
+  file and never the candidate's, so the candidate's tests are absent from every coverage report by
+  construction. Counting them refused patches that both oracles accept, which is nearly every
+  well-behaved change, since a feature is expected to arrive with its tests.
+- **Reach measured the tree the oracle judged.** Two paths reverted the patch and left it reverted:
+  the vacuity check stashed it and popped it back without checking the pop, which fails when the
+  patch adds a file the oracle overwrites, and attribution reverts it to measure the base. Both
+  meant later measurements were taken on the base commit and reported as though they were about the
+  patch. The revert and re-apply are checked now, and a checkout that could not be put back makes
+  reach abstain rather than measure whatever the tree holds.
+- **`swarm ci` stops what it started.** The command installed no signal handler, so a Ctrl-C or a
+  supervisor's SIGTERM ended the CLI and left its test runners reparented and running: two node
+  processes from an oracle were found holding a checkout open five hours after the run that started
+  them had gone. It takes the same cancellation the run commands use, so a stop reaches the process
+  group rather than only the process.
+- **An oracle that cannot judge is not an oracle that refused.** The corner classifier read the
+  held-back verdict as a boolean, folding "accepts the base too" and "could not be run" into a
+  refusal. Both now classify as unjudgeable and leave the denominator, with the count reported
+  beside the rate. This cuts both ways: it stopped charging the tool for certifying work that
+  nothing contradicted, and it removed two tasks that were being counted as opportunities the tool
+  passed.
+- **Re-judging cannot answer worse than scoring did.** `--rejudge` re-derives verdicts from
+  recorded patches after a harness change, and the order-dependence check lived only in the fresh
+  scoring pass, so re-judging winston#2256 turned a task already recorded as order-dependent into a
+  false green. Both passes go through one function, and it calls the rule that was already in src
+  with tests beside it rather than a third hand-rolled copy.
+
+### Measured
+
+- **False-green rate 1 in 19 valid opportunities: 5.3%, 95% CI [0.9, 24.6]**, from 2 in 22. One of
+  the two is now refused by the reach check; the other two changes are corpus defects found while
+  re-judging, where a held-back oracle that accepts the base was counted as an opportunity the tool
+  passed. The bar is zero, so gate 3 still fails, and 19 opportunities is not 400 tasks.
 
 ## 14.0.2 - 2026-09-07