swarm-orchestrator 14.2.0 → 14.4.0

package/CHANGELOG.md

@@ -1,4 +1,96 @@
-# Changelog
+# Changelog: swarm-orchestrator
+
+The coding agent. The standalone verifier it is built on, `swarm-verify`, has its own changelog at
+[packages/swarm-verify/CHANGELOG.md](packages/swarm-verify/CHANGELOG.md); an agent release names
+the verifier version it carries rather than repeating those entries.
+
+## 14.4.0 - 2026-10-08
+
+Swarm Orchestrator is the product of this repository again. 14.3.0's README and repository
+description presented Swarm Verify as the product and the coding agent as an optional beta mode
+of it; this release reverses that ([ADR 0013](docs/adr/0013-two-products-one-verifier.md)) and
+gives the verifier its own product home. No runtime behaviour of the agent changed; the verifier
+carried is `swarm-verify` 1.3.1, whose engine is 1.3.0's.
+
+### Changed
+
+- **The README, package description and repository description describe the coding agent**:
+  what it does, why it is not an ordinary coding agent, install, one task, what verification
+  happens, what evidence is produced, what it does not prove, and how Swarm Verify relates to
+  it. `docs/agent.md` is the long form of that page rather than a beta notice.
+- **The changelog is split.** This file holds the agent's releases; the verifier's 1.x entries
+  moved whole to `packages/swarm-verify/CHANGELOG.md`, which ships in that package.
+- **The Action manifest lives beside the package it ships**, at `packages/swarm-verify/action.yml`,
+  so this repository no longer presents itself as a GitHub Action; the control workflow runs it
+  from there. The Action is branded Swarm Verify.
+- **The verifier's product repository is generated whole**: README, changelog, an Action
+  reference rendered from the manifest, the example workflows, the hook manifest, the license
+  and the source record, by `scripts/build-action-distribution.mjs`, which refuses a README that
+  links to a file it does not write.
+- Issue forms: an agent bug form beside the verifier's; the setup form takes either version.
+  `SUPPORT.md` and `SECURITY.md` name both products.
+
+### Added
+
+- `src/product-boundary.test.ts` holds each product's package metadata, binary, dependencies,
+  changelog and README front matter to the product it names, and keeps the inverted phrasing
+  out of the documents a reader is pointed at.
+- The standalone verifier's import-boundary test now also refuses any bare import outside Node
+  and the two packages `swarm-verify` declares, so a model SDK cannot enter the published
+  verifier through a module the build allows.
+- `scripts/build-action-distribution.test.mjs` holds the generated distribution to the source
+  manifest, the package README and the examples.
+
+## 14.3.0 - 2026-09-30
+
+The coding agent, `swarm-orchestrator`, released for the first time since the verifier-first
+work began. The `swarm` binary shares its verifier with `swarm-verify`, so every change published
+for `swarm-verify` 1.0.0 through 1.3.0 (now in [packages/swarm-verify/CHANGELOG.md](packages/swarm-verify/CHANGELOG.md))
+is in this release too. What follows is what the
+agent itself gained; the verifier stays the primary product and the agent its advanced mode.
+
+### Added
+
+- **The verifier's commands in the `swarm` binary**: `swarm check`, `verdict`, `hook`, `mcp`,
+  `pre-commit` and `action`, as published for `swarm-verify` and documented there.
+- **Requirement-level challenges on the agent's preset path.** `--challenges off|report|required`
+  (with `--preset` and `--goal-contract`) runs the base control, mechanical mutations of the
+  changed lines witnessed by the repository's suite, and the contract's sealed fixtures against
+  the agent's own change; `required` refuses a run whose checks demonstrated no detection. The
+  challenge conclusions are stated the same way in the terminal, the summary and the comment.
+- **Check strengthening and repair.** `--strengthen` (with `--strengthen-rounds` and
+  `--strengthen-per-requirement`, which can only lower the defaults of two rounds and one check
+  per requirement) answers a witnessed gap: the model proposes one additive check, the harness
+  admits it only where it rejects the counterexample and accepts every sealed reference, the
+  admitted checks revise the contract with their lineage, and the implementation is repaired
+  under the same seal with a bounded brief. The JSON result carries `strengthening` (rounds,
+  admitted checks, why it stopped, contract digest). Nothing is asked of the model before the
+  criteria are sealed or after cancellation; a run killed mid-admission resumes with that
+  admission named once and never repeated. The bundle's verifier re-derives every admission and
+  revision offline.
+
+### Fixed
+
+- **Check strengthening reads the token budget before every proposal, and asks for no more than
+  is left.** The controller checked the budget once at the start of a round, then asked one
+  proposal per requirement with a floor of 256 output tokens: with 128 tokens left it asked for
+  256, and after that call it asked the next requirement's proposal against nothing. The budget,
+  the task's allowance less every recorded model call, is now read before each proposal and
+  before the repair; a proposal is asked for at most what is left, never a floor; and a spent
+  budget stops the loop where it stands, with the reason recorded (`budget-spent`) and any check
+  admitted before the stop kept on the revised contract for the final verification. Usage a
+  provider did not report still spends the whole budget, and an uncapped run is unchanged. The
+  cap is on requested output; a provider's actual usage, input included, is what the chain
+  records and the next check reads. Found by review before the feature was published; no
+  released version carried the defect.
+- **Dispatched workers no longer break each other's worktree add**: one worktree command runs at
+  a time against a repository. An unrelated worker counts as running from the moment the
+  controller admits it, not from its first model call.
+- **The Claude Code hook routes a test command piped through `tail`, `head` or `grep`** (such
+  as `npm test 2>&1 | tail -5`) through the verifier and keeps the filters, so the run is
+  recorded rather than left alone; any other pipeline or shell syntax is still untouched.
+- **The goal run's final verification is bound to the worker's own recorded diff**, held by a
+  regression test.
 
 ## 14.2.0 - 2026-09-27
 

package/README.md

@@ -2,13 +2,14 @@
 
 <div align="center">
 
-<h1>swarm-orchestrator</h1>
+<h1>Swarm Orchestrator</h1>
 
-<p><strong>A coding agent for the terminal that leaves a signed, offline-checkable record of what it ran and what passed.</strong></p>
+<p><strong>A coding agent that must prove its work.</strong></p>
 
 <p>
-The model can say whatever it likes.<br />
-It cannot make a check pass, mark a claim verified, or change a record after the fact.
+It makes bounded repository changes, runs the project's real checks, challenges weak evidence,<br />
+retries failures without trading away test quality, and records what actually happened,<br />
+so the agent's own summary is never the source of truth.
 </p>
 
 <p>
@@ -16,11 +17,13 @@ It cannot make a check pass, mark a claim verified, or change a record after the
   ·
   <a href="docs/evidence/2026-08-18/live-tasks.md">See a real run</a>
   ·
-  <a href="https://github.com/moonrunnerkc/swarm-orchestrator/issues/new?labels=bug">Report a bug</a>
+  <a href="https://github.com/moonrunnerkc/swarm-verify">Swarm Verify, the standalone verifier</a>
+  ·
+  <a href="https://github.com/moonrunnerkc/swarm-orchestrator/issues/new/choose">Report a bug</a>
 </p>
 
 [![gates](https://img.shields.io/github/actions/workflow/status/moonrunnerkc/swarm-orchestrator/gates.yml?branch=v13-main&style=for-the-badge&label=gates)](https://github.com/moonrunnerkc/swarm-orchestrator/actions/workflows/gates.yml)
-[![npm](https://img.shields.io/npm/v/swarm-orchestrator?style=for-the-badge&label=npm&color=CB3837)](https://www.npmjs.com/package/swarm-orchestrator)
+[![npm](https://img.shields.io/npm/v/swarm-orchestrator?style=for-the-badge&label=swarm-orchestrator&color=CB3837)](https://www.npmjs.com/package/swarm-orchestrator)
 [![node](https://img.shields.io/badge/node-%E2%89%A522-5FA04E?style=for-the-badge)](package.json)
 [![license](https://img.shields.io/badge/license-ISC-blue?style=for-the-badge)](LICENSE)
 
@@ -28,34 +31,50 @@ It cannot make a check pass, mark a claim verified, or change a record after the
 
 ---
 
-## What it is
-
-`swarm` takes a task and a git repository, makes a bounded change, runs your project's checks
-over it, and writes a record of every command it ran and every check that passed or failed.
-The record is a hash-chained ledger, exported as a signed bundle that carries its own
-dependency-free verifier, so anyone can check it later with nothing but Node and without
-trusting the machine that produced it.
-
-It is for two kinds of people. Engineers who want an agent to make a change and want to review
-what it did from evidence rather than from the agent's own summary. And reviewers who are handed
-somebody else's patch or bundle and need to check it without installing the agent or believing
-its author.
-
-**Upgrading from 12.x?** That was a pull-request auditor; 13 and later are a coding agent under
-the same package name, with no migration path. Stay on the `v12-final` tag, or pin the major.
-
-## Source upgrade workflows
-
-The [broad-use source guide](docs/broad-use.md) covers model-free patch, branch and PR verification;
-Node/Python initialization and selected packages; CLI, local HTTP and optional Playwright checks;
-one explicit escalation; and bugfix, refactor and dependency-upgrade presets. The full and
-standalone CLIs share the verifier. [Delivery evidence](docs/upgrade-completion.md) distinguishes
-implemented source, exact-source validation and remote delivery. These additions are not an
-npm publication; use the documented source tarball installation until a release is verified.
+## What it does
+
+`swarm` takes a task and a git repository. It plans, declares the files it intends to touch,
+edits through one recording chokepoint, runs your project's checks as sealed gates, and retries
+failures under a ratchet that refuses a fix which trades away tests, assertions or coverage.
+When the gates pass it exports a signed, hash-chained evidence bundle that carries its own
+dependency-free verifier, so anyone can check what ran, and what passed, with nothing but Node
+and without trusting the machine that produced it.
+
+```text
+task
+  -> the agent plans and declares its files
+  -> a bounded change, every tool call recorded
+  -> the project's checks run as sealed gates
+  -> weak evidence is challenged: a passing check must be shown able to fail
+  -> the ratchet: a retry may not trade away tests, assertions or coverage
+  -> retry, accept, or refuse with the reason on the record
+  -> evidence: a signed bundle anyone can verify offline
+```
 
-Browser acceptance requires a sealed `instrument` and an immutable Playwright container runtime.
-Project `argv` reports remain unjudged. Unavailable package checks remain visible; missing
-required checks prevent complete verification. See the linked broad-use guide for migration.
+Here is a real run, committed: [`live-tasks.md`](docs/evidence/2026-08-18/live-tasks.md),
+with its bundle in [`live-frontier/`](docs/evidence/2026-08-18/live-frontier). And here is the
+packaged tool doing it, installed from a tarball into a directory holding nothing else, against
+a workspace it had never seen, recorded in a real terminal:
+[`installed-package-run.md`](docs/evidence/2026-08-23/installed-package-run.md).
+
+## Why it is not an ordinary coding agent
+
+The model can say whatever it likes. It cannot make a check pass, mark a claim verified, or
+change a record after the fact. Those are the harness's to decide.
+
+- **A claim is not evidence.** A structured claim the model makes names a predicate and a
+  record; the harness evaluates it against its own records and renders the verdict. Narrative
+  never renders green, and a claim the harness cannot evaluate renders `UNVERIFIED` without
+  stopping the run.
+- **A pass must be able to fail.** Each passing gate is handed one fixture it has to refuse,
+  so a check that cannot fail is caught rather than counted.
+- **A retry cannot buy green by deleting tests.** Tests collected, assertions in touched tests
+  and covered changed lines cannot decrease across retries; skips cannot increase.
+- **Regression and task acceptance are two answers.** A suite passing says nothing broke. Only
+  a requirement contract or an acceptance check you supply can say the work was done, and the
+  tool reports when neither was given.
+- **Unmeasured is a verdict.** Nobody checked is not the same as checked and passed, and it is
+  never rendered as a pass.
 
 ## Install
 
@@ -63,13 +82,15 @@ required checks prevent complete verification. See the linked broad-use guide fo
 npm install -g swarm-orchestrator
 ```
 
-That is **14.1.0**. It runs on Node 22 or newer. Node 24 or newer is recommended, because the
-changed-line coverage measurement spawns node's test runner with `--test-isolation=process`,
-which Node 22 rejects; below 24 that one measurement reports unmeasured and never counts as a
-pass. `swarm doctor` says which Node it found and what owns the `swarm` command, and `--fix`
-repairs an install that an older build is shadowing.
+This installs the registry’s `latest` release and leaves `swarm` on your path.
+The source version is **14.4.0**; publication is tracked in
+[the delivery record](docs/release-delivery-2026-10-10.md). It runs on Node 22 or newer; Node 24 or
+newer is recommended, because the changed-line coverage measurement spawns Node's test runner
+with process isolation, which Node 22 below 22.8 rejects. Below that, the measurement reports
+unmeasured and never counts as a pass. `swarm doctor` says which Node it found and what owns
+the `swarm` command, and `--fix` repairs an install that an older build is shadowing.
 
-## Try it
+## Run one task
 
 ```sh
 export ANTHROPIC_API_KEY=...       # or OPENAI_API_KEY, GOOGLE_GENERATIVE_AI_API_KEY,
@@ -80,43 +101,53 @@ swarm "make slugify collapse whitespace and strip punctuation"
 
 Keys come from the environment or your OS keychain, never from `swarm.toml`: that file is
 committed and cloned, so a key in it has already been shared with everyone holding the
-repository. Every command and flag is in [docs/cli.md](docs/cli.md).
+repository. The run shows each step, each gate and each retry as it happens, and ends on the
+evidence panel. `swarm review <bundle>` opens a run's review page later; `swarm verify <bundle>`
+checks its integrity and who signed it. Every command and flag is in
+[docs/cli.md](docs/cli.md); sessions, several workers at once and the screen are in
+[docs/using.md](docs/using.md).
 
 <p align="right">(<a href="#readme-top">back to top</a>)</p>
 
-## How it verifies
+## What verification happens
 
 Every tool call and every check goes through one recording chokepoint, and the record is an
-append-only, hash-chained ledger that lives outside the workspace. When a run ends it is
-exported as a signed bundle carrying a dependency-free verifier, so the bundle can be checked
-anywhere with plain Node.
+append-only, hash-chained ledger that lives outside the workspace. The gates, their severities,
+their parsers and the budgets are sealed before the first model call, so nothing the model
+does during the run can change what it is measured against.
 
-Five words carry most of the weight. A **gate** is a check declared as data: a command, a
+Six words carry most of the weight. A **gate** is a check declared as data: a command, a
 parser, and whether it blocks. The **ratchet** is the rule that a retry may not trade away
 tests, assertions or coverage to turn a gate green. A **bond** is one file a passing gate is
 handed that it must refuse, so a pass that cannot fail is caught. An **oracle** is the check
 you supply that says the task was done, as distinct from nothing broke. **Reach** is whether
-that oracle executed the lines a patch added. And **unmeasured** is a verdict of its own:
-nobody checked is not the same as checked and passed, and it never renders green.
+that oracle executed the lines a patch added. And **unmeasured** is a verdict of its own.
+
+With a goal contract (`--goal-contract`), the contract's own checks are challenged
+(`--challenges report|required`): a base control per requirement, mechanical mutations of the
+changed lines witnessed by the suite, and sealed fixtures, so a check that could not have
+caught wrong work is named. With `--strengthen`, the model may propose one additive check per
+witnessed gap; the harness admits it only where it observes the check reject the counterexample
+and accept every sealed reference, then repairs the code under the revised contract. Nothing is
+asked of the model before the criteria are sealed.
 
 The mechanics, the nine-answer report and worked examples are in
-[docs/verifying.md](docs/verifying.md). Retries under the ratchet, sessions and several workers
-at once are in [docs/using.md](docs/using.md).
+[docs/verifying.md](docs/verifying.md). The goal contracts, presets and package scope are in
+[docs/broad-use.md](docs/broad-use.md).
 
-## Use it without a model
+## What evidence is produced
 
-Three commands need no model, no API key and no local backend. `swarm gates` measures a
-workspace, `swarm ci --patch <file>` verifies a patch in a fresh checkout of its base, and
-`swarm verify <bundle>` checks a bundle and who signed it. They also ship on their own as the
-`swarm-verify` package under [packages/swarm-verify](packages/swarm-verify), the same code with
-none of the agent. The walkthrough, over the committed tamper demo, and the install for the
-standalone package are in [docs/verify-only.md](docs/verify-only.md).
+A run writes its ledger under `~/.swarm/sessions`, never inside the workspace, and exports a
+bundle: the manifest with the chain head and the signature, the records, every blob by
+SHA-256, the review page, the summary, and `verify.mjs`, a dependency-free verifier that
+re-derives every verdict from the records alone.
 
-<p align="right">(<a href="#readme-top">back to top</a>)</p>
-
-## Measured
+```sh
+node <bundle>/verify.mjs <bundle>          # anywhere, nothing installed
+swarm verify <bundle> --signer <fp>        # here, with the signer judged too
+```
 
-Every number here links to the committed artifact of the thing happening. The full table, and
+Every number here links to the committed artifact of the thing happening; the full table, and
 the list of things that may not be said, is [docs/claims.md](docs/claims.md).
 
 - **One changed byte breaks verification.** The same bundle verified and then tampered with in
@@ -128,32 +159,21 @@ the list of things that may not be said, is [docs/claims.md](docs/claims.md).
 - **A green verdict is computed by the harness, and the model cannot produce one.** In a real
   run the model asserted a predicate the language does not parse; the harness rendered it
   `UNVERIFIED` and carried on, twice: [shakedown results](docs/evidence/2026-08-18/shakedown/results.md).
-- **A suite passing is not the task being done.** Four of eighteen real-repository patches
-  passed their project's whole suite and failed a hidden acceptance test, which is why `swarm ci`
-  reports `regression` and `task` as two answers: [docs/verifying.md](docs/verifying.md).
+- **A suite passing is not the task being done.** Four of eighteen patches this project's own
+  agent and a baseline arm produced over three public TypeScript repositories passed their
+  project's whole suite and failed a hidden acceptance test, which is why `regression` and
+  `task` are two answers: [docs/verifying.md](docs/verifying.md). That is a measurement of
+  those eighteen patches, not a rate for AI-written changes in general.
 - **The oracle is judged too.** Certified tasks turned out to rest on oracles that could not
-  fail. The last false green standing, `commander#1671`, was certified by an oracle that runs
-  every line the patch adds and never tests the precedence those lines decide; it is refused now
-  because that oracle accepted a change to a line it had run:
-  [docs/verifying.md](docs/verifying.md#the-oracle-is-judged-too).
-- **The September 6 mined-corpus false-green rate was 0 in 15**, 0.0%, 95% CI [0.0, 20.4], with
-  two oracles per task, one handed to the tool and one held back:
-  [mined-corpus](docs/evidence/2026-09-06/mined-corpus/README.md). The denominator moved when
-  the tool did: four patches both oracles accept are refused because the tool's own oracle never
-  ran part of what they changed, five because the sealed half rejects work the held-back half
-  accepts, and one because its oracle accepted a change to a line it had run.
-- **Twelve tasks reported as unjudgeable were the agent having written nothing at all**, which
-  is a model failure and is recorded as one. An earlier 0-of-18 was withdrawn rather than
-  corrected quietly: the same test was handed to the tool and then used as the ground truth it
-  was scored against, so it agreed with itself:
-  [false-green-measurement.md](docs/evidence/2026-09-05/false-green-measurement.md).
-- **Of the gates this project agreed not to call itself production-ready without**, the
-  historical assessment records eight passing, two partial, two unproven, and two reported
-  rather than barred: [docs/beta-gates.md](docs/beta-gates.md).
+  fail; the last false green standing was refused because its oracle accepted a change to a
+  line it had run: [docs/verifying.md](docs/verifying.md#the-oracle-is-judged-too).
+- **The September 6 mined-corpus false-green rate was 0 in 15**, 95% CI [0.0, 20.4], with two
+  oracles per task, one handed to the tool and one held back:
+  [mined-corpus](docs/evidence/2026-09-06/mined-corpus/README.md).
 
 <p align="right">(<a href="#readme-top">back to top</a>)</p>
 
-## What is not claimed
+## What it does not prove
 
 The five that matter most. The full list is in
 [docs/verifying.md](docs/verifying.md#what-is-not-claimed).
@@ -168,56 +188,52 @@ The five that matter most. The full list is in
   and recorded on the chain rather than quietly assumed, but it is not containment.
 - **0 in 15 says "under 20%", not "zero".** That upper bound is the honest half of the rate,
   and it is a rate for that corpus and that build, not for this one.
-- **Shown its oracle, a model still gets past this.** A patch written to satisfy a visible test
-  has its added lines tested by that test, so the oracle refuses every mutant of them and is
-  right to. Bonding asks whether the oracle judged what the patch added. It cannot ask what the
-  patch left out, and that is what an adversarial patch does.
+- **Shown its oracle, a model still gets past this.** Bonding and challenges ask whether the
+  checks judged what the patch added. They cannot ask what the patch left out, and that is
+  what an adversarial patch does.
 
 Gates prove mechanical quality, not design quality. What a bundle buys you is that reviewing the
 change is fast and its claims are checkable, not that review is unnecessary.
 
-<p align="right">(<a href="#readme-top">back to top</a>)</p>
+## Swarm Verify, the standalone verifier
+
+The verification the agent is held to is a product of its own. [Swarm Verify](https://github.com/moonrunnerkc/swarm-verify)
+checks a change from any source, this agent, Claude Code, Codex, Copilot, another agent or a
+person, with no model, no key and no configuration:
+
+```sh
+npx swarm-verify                                   # run a repository's declared checks and report what that establishes
+npx swarm-verify ci --pr owner/repo#123            # verify a pull request in a fresh checkout of its base
+npx swarm-verify verify <bundle> --signer <fp>     # check a bundle this agent, or anything else, produced
+```
 
-## Roadmap
-
-The implementation is ahead of the evidence needed to call this production-ready. The audit
-repairs are recorded in [the implementation record](docs/audit-implementation-2026-09-11.md);
-the local campaign and every excluded case are in
-[the September 11 report](docs/evidence/2026-09-11/local-campaign/report.md).
-
-- [x] Connect verification, displayed acceptance, cancellation, budgets and recovery to the
-      records that establish them. Use standard DSSE signing bytes and literal replacement text.
-- [x] Build the campaign machinery: separate case author, checker and solver models; admission
-      controls before grading; frozen schedules; actual baseline dispatch; every failed launch
-      retained; raw evidence that can be checked from the checkout.
-- [x] Run the available Docker security and cleanup matrix. Fourteen declared observations
-      passed, with working attack controls and a separate check that ordinary work still runs.
-      Repair after abrupt harness death was exercised too.
-- [ ] A false-green interval that supports a population claim. The historical 0 in 15 has a
-      20.4% upper bound. The new synthetic pilot admits one evaluation case and cannot narrow
-      that bound for real work. Freeze an independent population and a sufficient sample first.
-- [ ] A denominator the tool did not choose. The new admission pass checks references and
-      predetermined counterexamples, but model authorship alone does not establish independence
-      or complete requirements. Independent admission and review are still needed.
-- [ ] An adversarial verification corpus that covers omitted requirements. Separate local
-      models supplied fresh checks and attacks. Mutation of added lines still cannot establish
-      that a patch implemented something it left out; the report keeps those outcomes visible.
-- [ ] Task success non-inferior to the strongest alternative. The two local baseline arms now
-      execute, with matched tasks and budgets. This pilot is too small to establish which tool
-      is strongest or to support a non-inferiority claim.
-- [ ] Security evidence for every supported backend. Docker was measured here; Podman and
-      nerdctl were unavailable. Independent attacks and those runtime matrices remain open.
-- [ ] No surviving daemons across the supported runtime boundaries. Docker cleanup passed the
-      declared lifecycle cases. Restricted host execution still cannot own a descendant that
-      leaves its process group; abrupt harness death requires supervision or later repair.
-- [ ] A new user productive in under ten minutes. The fixture and observer procedure are ready.
-      No new users were observed, so setup checks cannot close this item.
-
-Each broader claim stays open until its own evidence meets the bar in
-[docs/beta-gates.md](docs/beta-gates.md).
+It also ships as the GitHub Action `moonrunnerkc/swarm-verify@v1`, a Claude Code hook, an MCP
+server and a pre-commit hook. The same commands are in the `swarm` binary: `swarm check`,
+`swarm ci`, `swarm verify`, `swarm verdict` and `swarm gates` need no model, and
+[docs/verify-only.md](docs/verify-only.md) walks through them over committed artifacts.
+
+There is one implementation. The `swarm-verify` package is built from this repository's
+verification modules under [packages/swarm-verify](packages/swarm-verify), behind a build-time
+boundary that refuses any provider, worker or screen module; the agent composes those same
+modules. Swarm Orchestrator uses Swarm Verify. It is not Swarm Verify.
 
 <p align="right">(<a href="#readme-top">back to top</a>)</p>
 
+## Versions
+
+The package name has carried three different programs, and the majors are the boundary:
+
+| Versions | What it was |
+| --- | --- |
+| 8.x | a contract-first coding orchestrator: a goal compiled to typed obligations, persona candidates raced per obligation, verifier-gated commits, a hash-chained ledger |
+| 10.x to 12.x | a pull-request auditor: static cheat-pattern detectors over AI-written diffs, advisory by default, with a merge gate. The last of that line is the `v12-final` tag |
+| 13.x and later | this coding agent, with no migration path from 12.x and nothing of its interface |
+| 14.1.0 | the verification path extracted as the `swarm-verify` package, the same code with none of the agent |
+| 14.3.0 | the README and repository description presented Swarm Verify as this repository's product and the agent as a beta mode; 14.4.0 restores the agent as the product of this repository and gives the verifier its own home |
+
+Pin a major. Each release names the verifier version it carries in [CHANGELOG.md](CHANGELOG.md);
+the verifier's own changelog is [packages/swarm-verify/CHANGELOG.md](packages/swarm-verify/CHANGELOG.md).
+
 ## Contributing
 
 The bar is the one the tool applies to itself: `npm run gates` green with the output shown, new

package/dist/action/artifacts.js

@@ -0,0 +1,72 @@
+import { createHash } from "node:crypto";
+import { copyFileSync, lstatSync, mkdirSync, readdirSync, readFileSync, writeFileSync, } from "node:fs";
+import { join } from "node:path";
+const byteLimit = 32_000_000;
+const fileByteLimit = 8_000_000;
+const fileLimit = 4096;
+const depthLimit = 8;
+/** Copy the named entries of `directory` under `directory/retained`, within the bounds. */
+export function retainActionArtifacts(directory, names = [
+    "bundle",
+    "report.json",
+    "summary.md",
+    "verdict.json",
+    "attestation",
+    "diagnostic.txt",
+]) {
+    const destination = join(directory, "retained");
+    mkdirSync(destination, { mode: 0o700, recursive: true });
+    const inventory = [];
+    let remaining = byteLimit;
+    let complete = true;
+    const visit = (path, relative, depth) => {
+        if (depth > depthLimit || inventory.length >= fileLimit) {
+            complete = false;
+            return;
+        }
+        const stat = lstatSync(path);
+        if (stat.isDirectory()) {
+            mkdirSync(join(destination, relative), { recursive: true, mode: 0o700 });
+            for (const name of readdirSync(path))
+                visit(join(path, name), join(relative, name), depth + 1);
+        }
+        else if (stat.isFile() && stat.size <= fileByteLimit && stat.size <= remaining) {
+            const bytes = readFileSync(path);
+            const digest = `sha256:${createHash("sha256").update(bytes).digest("hex")}`;
+            copyFileSync(path, join(destination, relative));
+            remaining -= bytes.length;
+            inventory.push({ path: relative, bytes: bytes.length, digest, retained: true });
+        }
+        else {
+            complete = false;
+            inventory.push({
+                path: relative,
+                bytes: stat.size,
+                retained: false,
+                reason: "retention bound or unsupported file type",
+            });
+        }
+    };
+    for (const name of names) {
+        try {
+            lstatSync(join(directory, name));
+        }
+        catch {
+            continue;
+        }
+        try {
+            visit(join(directory, name), name, 0);
+        }
+        catch (cause) {
+            complete = false;
+            inventory.push({
+                path: name,
+                retained: false,
+                reason: cause.code ?? "copy failed",
+            });
+        }
+    }
+    writeFileSync(join(destination, "retention.json"), JSON.stringify({ version: 1, complete, byteLimit, fileLimit, inventory }, null, 2), { mode: 0o600 });
+    return { destination, complete, inventory };
+}
+//# sourceMappingURL=artifacts.js.map

package/dist/action/artifacts.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"artifacts.js","sourceRoot":"","sources":["../../src/action/artifacts.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EACL,YAAY,EACZ,SAAS,EACT,SAAS,EACT,WAAW,EACX,YAAY,EACZ,aAAa,GACd,MAAM,SAAS,CAAC;AACjB,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAsBjC,MAAM,SAAS,GAAG,UAAU,CAAC;AAC7B,MAAM,aAAa,GAAG,SAAS,CAAC;AAChC,MAAM,SAAS,GAAG,IAAI,CAAC;AACvB,MAAM,UAAU,GAAG,CAAC,CAAC;AAErB,2FAA2F;AAC3F,MAAM,UAAU,qBAAqB,CACnC,SAAiB,EACjB,KAAK,GAAsB;IACzB,QAAQ;IACR,aAAa;IACb,YAAY;IACZ,cAAc;IACd,aAAa;IACb,gBAAgB;CACjB;IAED,MAAM,WAAW,GAAG,IAAI,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC;IAChD,SAAS,CAAC,WAAW,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACzD,MAAM,SAAS,GAAyB,EAAE,CAAC;IAC3C,IAAI,SAAS,GAAG,SAAS,CAAC;IAC1B,IAAI,QAAQ,GAAG,IAAI,CAAC;IACpB,MAAM,KAAK,GAAG,CAAC,IAAY,EAAE,QAAgB,EAAE,KAAa,EAAQ,EAAE;QACpE,IAAI,KAAK,GAAG,UAAU,IAAI,SAAS,CAAC,MAAM,IAAI,SAAS,EAAE,CAAC;YACxD,QAAQ,GAAG,KAAK,CAAC;YACjB,OAAO;QACT,CAAC;QACD,MAAM,IAAI,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;QAC7B,IAAI,IAAI,CAAC,WAAW,EAAE,EAAE,CAAC;YACvB,SAAS,CAAC,IAAI,CAAC,WAAW,EAAE,QAAQ,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;YACzE,KAAK,MAAM,IAAI,IAAI,WAAW,CAAC,IAAI,CAAC;gBAClC,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC;QAC7D,CAAC;aAAM,IAAI,IAAI,CAAC,MAAM,EAAE,IAAI,IAAI,CAAC,IAAI,IAAI,aAAa,IAAI,IAAI,CAAC,IAAI,IAAI,SAAS,EAAE,CAAC;YACjF,MAAM,KAAK,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;YACjC,MAAM,MAAM,GAAG,UAAU,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;YAC5E,YAAY,CAAC,IAAI,EAAE,IAAI,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC,CAAC;YAChD,SAAS,IAAI,KAAK,CAAC,MAAM,CAAC;YAC1B,SAAS,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;QAClF,CAAC;aAAM,CAAC;YACN,QAAQ,GAAG,KAAK,CAAC;YACjB,SAAS,CAAC,IAAI,CAAC;gBACb,IAAI,EAAE,QAAQ;gBACd,KAAK,EAAE,IAAI,CAAC,IAAI;gBAChB,QAAQ,EAAE,KAAK;gBACf,MAAM,EAAE,0CAA0C;aACnD,CAAC,CAAC;QACL,CAAC;IACH,CAAC,CAAC;IACF,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,CAAC;YACH,SAAS,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC,CAAC;QACnC,CAAC;QAAC,MAAM,CAAC;YACP,SAAS;QACX,CAAC;QACD,IAAI,CAAC;YACH,KAAK,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;QACxC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,QAAQ,GAAG,KAAK,CAAC;YACjB,SAAS,CAAC,IAAI,CAAC;gBACb,IAAI,EAAE,IAAI;gBACV,QAAQ,EAAE,KAAK;gBACf,MAAM,EAAG,KAA2B,CAAC,IAAI,IAAI,aAAa;aAC3D,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IACD,aAAa,CACX,IAAI,CAAC,WAAW,EAAE,gBAAgB,CAAC,EACnC,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,QAAQ,EAAE,SAAS,EAAE,SAAS,EAAE,SAAS,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,EAClF,EAAE,IAAI,EAAE,KAAK,EAAE,CAChB,CAAC;IACF,OAAO,EAAE,WAAW,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC;AAC9C,CAAC"}