swarm-orchestrator 14.1.0 → 14.2.0

package/CHANGELOG.md

@@ -1,5 +1,187 @@
 # Changelog
 
+## 14.2.0 - 2026-09-27
+
+### Fixed
+
+- Rejected acceptance authority for candidate-controlled Playwright JSON. Sealed browser
+  instruments use harness configuration, immutable image dependencies and exact test identities.
+- Retained unavailable package checks through sealing, final assessment and reviewer reports,
+  separating absent optional tools from unavailable required checks.
+- Provisioned Chromium and the isolated browser runtime in clean Linux gate workflows;
+  nightly failure notifications no longer require an optional repository label.
+- Reopened the prior completion claim after the independent audit. Corrective delivery and
+  release status are tracked in [audit corrections](docs/upgrade-audit-corrections.md).
+
+### Added
+
+- Shared model-free branch/PR snapshot verification, reviewer Markdown and versioned JSON source
+  identities alongside patch mode. Standalone source tarballs build and install without providers.
+- Declared npm/pnpm and uv/existing-venv initialization, explicit package scopes, structured
+  Vitest/pytest outcomes, and sealed CLI, local HTTP and optional Playwright behavior checks.
+- Bugfix, refactor and dependency-upgrade presets on the existing engine, with base controls,
+  narrow manifest authorization, locked preparation and recorded installed versions.
+- One explicitly authorized capability escalation with deterministic failure classification,
+  original budget limits and recovery reconciliation. A configured cloud key grants no consent.
+- Trusted-source Action infrastructure and separate good/bad behavioral workflow controls.
+  Source delivery and package publication remain separate; exact validation is tracked in
+  [the upgrade ledger](docs/upgrade-completion.md).
+
+- **An approval mode, asked once per workspace.** The first terminal run asks whether commands
+  off the shell allowlist may be approved automatically and writes the answer to `swarm.toml`
+  as `[tools] approval`; `--approve ask|auto` and `SWARM_APPROVAL` override it. Under `auto` the
+  run answers an allowlist prompt itself and records it as pre-approved; a derivation-heuristic
+  prompt, the injection defence, asks under either mode. Every prompt gains `a`, always: the
+  call runs and its off-list programs are allowed for the rest of that run, recorded as a
+  `run-allowance` ledger record. The screen's header shows the mode.
+- **The default model is the best served local model for this hardware.** With nothing pinned
+  and no calibration, a run discovers the local backends, ranks what they serve by the
+  shortlist's tier for the probed hardware, prints the choice and its reason before the session
+  opens, and records it as a `model-default` ledger record. A frontier key is used only where
+  nothing local is served; with neither, the run stops and names the remedies instead of
+  defaulting to a provider it has no key for.
+- **A preflight card, and a screen that says what became of each step.** Before the screen goes
+  up, `swarm run` and `swarm session` print four lines to stderr naming the repository and base
+  commit, the manifest, the model with the reason it was chosen, and the approval mode. On the
+  screen, the header's second line reads elapsed, step, tokens, attempt, ratchet, model,
+  approval and workspace, and stays at every width; each timeline row starts with a status
+  mark and the clock time it landed; the gate strip counts passed, failed and not-applicable.
+  A finished run ends on a finish card: the verdict, duration, steps, tokens and cost, then the
+  review page and the bundle as rows a terminal that understands OSC 8 shows as clickable
+  links. Marks fall back to ASCII where the locale is not UTF-8. The plain-line stream that CI
+  and pipes read is byte-identical to before.
+- **`swarm-verify`, the verification path as its own package.** `packages/swarm-verify` builds a
+  binary carrying `verify`, `ci` and `gates` from the same modules `swarm` runs under those names,
+  parsed by the same parser, so an invocation reads the same through either. It carries no
+  provider, worker or screen module and none of the agent's run assembly: a test walks its import
+  closure and the build refuses to emit a crossing. A test verifies a committed bundle through
+  both binaries and compares the bytes. Version 0.2.0 has a separate release workflow; the packaged check
+  packs it, installs it beside the full CLI, and runs the tamper demo through it.
+- **An agent can record a file as temporary, and is held to removing it.** `declare_file_set`
+  and `amend_file_set` take `temporary`: paths created only to investigate, such as a probe
+  script. The blocking `file-set` gate fails while one is still in the change and names it. An
+  amendment can keep one on purpose with `retain`, and its reason then shows on the ledger, in the
+  reviewer's claim and in the gate's output on every pass. Nothing is deleted behind the model's
+  back and nothing reads a filename. Two repairs in the reach-pressure run left a scratch script
+  in their final patch, and membership alone had passed both.
+- **Derived evidence packs losslessly inside the tree.** `scripts/evidence-pack.mjs` packs tracked
+  review pages and run transcripts under a root into one `utf8-file-map-brotli` archive with a
+  digest for every original, removes originals only after the written archive has been unpacked
+  and compared, and `npm run checks` verifies every committed pack. Ledgers, DAGs, manifests and
+  verifiers can never be packed. The tracked tree went from 99.8 MB to about 90.5 MB with every
+  cited bundle still verifying, and the weight check now also requires 6 MB of headroom so the next
+  experiment's evidence has somewhere to go.
+- **A repair is read as what it did to the verifier's findings.** Experiment rows record, per
+  invocation, one of `patch-unchanged`, `findings-identical`, `findings-moved`, `findings-shrank`,
+  `findings-grew` or `satisfied`, with both finding sets, both patch digests and the files that
+  entered or left the patch, plus the same from the fork to the final patch. No score is computed.
+  Generation 3's nine "repairs exhausted" split into six unchanged patches, two that grew the
+  findings by leaving a scratch file, and one that changed bytes and no finding.
+
+### Fixed
+
+- **Reach reports `unmeasured`, not `reached`, for a change it could not measure at all.** A
+  change made only of documentation, types and its own tests skipped every file, left nothing
+  unreached and read as a measurement. Certification treats the two alike; a reader does not.
+  The verdict now carries every file reach set aside with its reason (`setAsideByReach`) and
+  `swarm ci` prints them. One path rule serves reach, the mutant planner, the patch metrics and
+  the PR miner, which had each spelled it separately: the miner still read a tsd type test as
+  source. tsd's `test-d/` directory and the `_test` suffix are recognized, and scratch scripts and
+  JavaScript tool configuration stay judged.
+- **Three campaign runners asked whether the model lists, not whether it generates.** A wedged
+  local server answers `/models` and completes nothing. `pr-task-pass` probed `/models`, and only
+  when a patch was empty, so a partial patch left by a server that died was judged as the model's;
+  the pilot campaign's health effect returned the literal `healthy: true`; `run-campaign` had no
+  probe. All three ask the configured model for a bounded completion after every invocation. The
+  probes are `endpointListsModels` and `endpointGenerates` in a module of their own, the second
+  names why it failed, and `pr-task-pass` keeps an infrastructure attempt apart from `runs`, where
+  it used to mark its task done and get re-judged.
+- **A failed model call records whether the harness cancelled it.** A call cut off at the wall
+  budget and a provider that raised were both `call-failed`. Every unknown-usage invocation of the
+  reach-pressure run was the first kind, and nothing on the ledger said so.
+- **Unknown usage is no longer added in as zero.** The experiment analysis summed a null model-call
+  count as 0; arm scoring priced a crashed run at $0 and printed dollars per accepted patch off the
+  sum; calibration divided all tokens by all time, so a model with one call cut off measured
+  slower than it is. A total is a number only where every part was measured, and the known part
+  is kept under its own name. The core loop's token total is unchanged and now travels with
+  `callsWithUnknownUsage`.
+- **The experiment analyzer cannot overwrite what a run published.** `analyze` wrote its summary
+  and page in place. It now refuses where the bytes differ and writes to `--out` with a
+  `derivation.json` naming the acquisition identity, the identities it was derived with, and every
+  value changed, added or removed. `run` and `score` refuse to write beside rows of another
+  protocol identity, which only `analyze` had checked, and identity is read before a row is
+  parsed. Generation 3's published summary re-derives with no value changed.
+- **The router considers every model the table has measured, not only the last sweep's pair.**
+  The calibration pick's candidates were the models the last sweep ran together, so a model with
+  the best evidence of all on a class was never in the running when a later sweep happened not
+  to include it: on one machine qwen3.6 held the best edit share across two sweeps and the router
+  chose between gemma4 and mistral. The candidates are now the pick's own plus every model the
+  competency table has measured on the task's class, on the same golden set, at or above the
+  floor, restricted as before to what the backend serves.
+- **A turn cut off at the output cap is not a completion.** A live run's only turn was the
+  marker `<channel|>` repeated to the 8192-token cap around a fragment of a plan, with no tool
+  called; the loop read the cut-off text as the model's account of finishing, the gates ran
+  green over an unchanged workspace, and the run ended "work accepted" with nothing written.
+  Two of five samples of the same request against gemma4:31b behind Ollama spiral the same way.
+  A turn cut off at the cap before it called a tool is now sampled again, its text never becomes
+  the plan or the claim, and a run whose every sample is cut off stops as `output-cap`. A stream
+  that repeats one short unit 96 times in a row is cut off there and sampled again, rather than
+  running minutes to the cap. The finish card over an unchanged workspace says nothing was done
+  instead of repeating the assessment, and the header's elapsed counter stops when the card
+  goes up.
+- **A run stops before the session where it could never go green.** A directory that is not a
+  repository, a `--base` that does not resolve, and a repository with no manifest each used to be
+  found out after the model had worked: eight steps in one case, three attempts and 112,000
+  tokens in another, then a first gate saying "add the manifest". `run` and `session` now check
+  the base commit and the manifest first. With no manifest, `swarm` on a terminal offers to add
+  a Node harness (`package.json` running `node --test`, and `.gitignore`) and commit it; off a
+  terminal, or declined, it stops with the remedy named.
+- **An interpreter cache is not a change.** Running a Python test writes `__pycache__`, and the
+  file-set gate charged that as an edit outside the declared set, after which the ratchet
+  rejected the attempt for a gate that had passed before and discarded the work. `__pycache__`,
+  `.pytest_cache`, `.mypy_cache` and `.ruff_cache` are excluded from the change set by name.
+- **A stopped run says what stopped it.** A cancellation during a model call reported "model
+  error: This operation was aborted", the transport's words. The signal now carries the reason
+  (cancelled from the keyboard, or the run's wall budget spent) and the loop reports it.
+- **A refused assessment names only what refused.** The status line read "work refused: work
+  refused: required checks passed, lifecycle interrupted, ..." beside four failed gates. It now
+  reads, for example, "work refused: the gates settled escalated; the run was cancelled".
+- **The macOS keychain is asked whether a default keychain exists before a signing key is
+  added.** `security add-generic-password` with no default keychain raises a dialog and blocks
+  until the store kills it; the probe fails cleanly instead and the run signs with a per-run key.
+
+### Measured
+
+- **Enforcing changed-line reach after visible acceptance changed no held-back verdict in 79
+  mined tasks.** A pre-registered shared-prefix experiment ran each task until the visible half of
+  its oracle first accepted, took that patch as the control, and forked a reach condition from the
+  same workspace that was told which added lines the oracle never executed. Thirteen tasks reached
+  visible acceptance, reach triggered on nine, no repair satisfied it, and the held-back half
+  agreed on every pair: 12 pass both, 67 fail both, zero discordant, exact McNemar p = 1, paired
+  difference 0.0 points, 95% CI [-4.0, +4.0]. Three repairs changed bytes, none narrowed the
+  implementation, two left scratch files behind. Six of the nine refusals named a tsd type-test
+  file no runner executes. The protocol, rows, patches and a report that re-derives from the rows
+  are in [`docs/evidence/2026-09-17/reach-pressure-experiment/`](docs/evidence/2026-09-17/reach-pressure-experiment/report.md).
+  Two earlier generations were stopped on instrument defects and are kept beside it. The instrument
+  defects it exposed, and what closed each without touching a row, are in
+  [`docs/evidence/2026-09-18/reach-pressure-hardening/`](docs/evidence/2026-09-18/reach-pressure-hardening/README.md).
+
+### Changed
+
+- **The verify-only commands are command definition data.** `verify`, `ci` and `gates` are marked
+  as needing no model, and a test runs each through the real CLI with no provider key and the
+  local endpoint pinned to a closed port. `docs/verify-only.md` walks all three through on
+  committed artifacts, with every transcript captured from the command it sits under.
+
+- **Node 22 runs the tool; Node 24 is needed only for the coverage measurement.** The whole CLI
+  refused to start below Node 24 because the changed-line coverage arm spawns node's test runner
+  with `--test-isolation=process`, which Node 22 rejects. Now `engines.node` is `>=22`, every
+  command runs there, and on a Node below 24 the tests gate runs the project's own test command
+  while the coverage arm reports `unmeasured` with the reason named in the gate-run record and in
+  the ratchet's abstention. Unmeasured never renders as a pass, so a change touching covered
+  lines fails the ratchet on that runtime rather than passing quietly. `swarm doctor` reports
+  which Node it found and what that disables.
+
 ## 14.1.0 - 2026-09-14
 
 ### Added