swarm-orchestrator 14.3.0 → 14.4.0

package/CHANGELOG.md

@@ -1,528 +1,52 @@
-# Changelog
+# Changelog: swarm-orchestrator
 
-## 1.3.0 - 2026-09-29
+The coding agent. The standalone verifier it is built on, `swarm-verify`, has its own changelog at
+[packages/swarm-verify/CHANGELOG.md](packages/swarm-verify/CHANGELOG.md); an agent release names
+the verifier version it carries rather than repeating those entries.
 
-Defects found by the sixteen-repository rollout of 1.2.0, each reproduced from a recorded run
-and fixed at the root. The verdicts that change are named below. The minor version is for the
-new attribution rule, `failure-identity-v3`, which new records carry; a record written under
-`failure-identity-v2` or v1 re-derives under the rule that wrote it.
+## 14.4.0 - 2026-10-08
 
-### Fixed
-
-- **Build runs before every check that can read its output.** 1.2.0 moved the build ahead of
-  tests only. A pnpm workspace whose per-package `tsc --noEmit` resolves its siblings through the
-  `dist/index.d.ts` that `tsc --build` writes, as its own CI builds first, read a failed typecheck
-  on a clean tree. The build now runs first, then typecheck, lint, format and tests. **Verdict
-  change:** such a project reads its real typecheck and lint results instead of a failure caused
-  by the order.
-- **A failed check records what its runner printed.** Node checks ran as `npm run --silent`,
-  and npm hands that log level to the script as `npm_config_loglevel=silent`. pnpm reads it, so a
-  failed `pnpm -r run typecheck` recorded an exit code with empty output. Checks now run as
-  `npm run --loglevel=error`, which keeps npm's notices out of the record and every tool's errors
-  in it; `swarm init` writes the same form. No verdict changes: the failure is still a failure,
-  now with its reason.
-- **The base control sees nothing the patched tree's run produced.** The base was measured in
-  the same checkout after a forced checkout and a clean that keeps ignored files, so the base's
-  checks ran beside the patched tree's build output. depose's base typecheck passed on the `dist/`
-  the patched build wrote, and a workflow-only patch read **Regression: fail**; a module only the
-  patched build emitted stayed in `dist/` and failed the base's suite the same way, so a real
-  regression read as inherited. The ignored tree is now recorded once dependencies are prepared,
-  and every switch between the two sides removes what was added since; a prepared entry a run
-  changed refuses the comparison. Where the patch changes a lockfile, nothing installed is shared:
-  the base installs its own dependencies from its own lockfile. **Verdict changes:** such a
-  workflow-only patch reads its real regression result, and a patch whose build output or
-  dependency change broke the suite reads **Regression: fail** instead of an inherited failure.
-- **A failure that differs only in a temporary directory's random name is inherited.** The base
-  and the patch failed the same three tests, and two causes differed only in pre-commit's random
-  repository directory (`...eponyx5xidu` against `...epoc90ac5y6`), so the failures could not be
-  matched and the regression read unmeasured. Causes and outputs are now compared with generated
-  names set aside: platform temporary roots, digit-bearing directory names under them, and a
-  generated name's tail where a reporter elided the rest. A file's own name, a path outside a
-  temporary root and every other word still count, so a changed message still reads as changed.
-  New records carry `failure-identity-v3`; a record written under v2 re-derives under v2. The
-  advice for an unmatched failure now says why it could not be matched, instead of saying the
-  output names no tests when it names them. **Verdict change:** such inherited failures read
-  inherited, so the regression dimension is measured instead of unmeasured.
-- **A base control whose worker crashed on exit still shows a regression.** quantproof's base
-  ran its whole suite, failed no test, and exited 1 when a Vitest worker aborted on exit (a
-  better-sqlite3 assertion under Node 24), leaving one file's tests pending. Its report no longer
-  reconciled, so the two tests the patch broke, which that report names as passing, read
-  unmeasured. Where the base names no failure and was not killed by the harness, a test it names
-  passing once and the patch fails is now newly failing. A test the base never finished, a killed
-  or cut run, or a base that names a failure of its own stays unmeasured, and nothing is ever
-  inherited this way. **Verdict change:** such a run reads **Regression: fail** instead of
-  unmeasured.
-- **The advice for a run that measured nothing says the right thing.** Where the install already
-  ran (the Action's `install: true` is passed as `--install`), a runner still missing was followed
-  by "pass --install"; it now says the environment does not carry that toolchain and names the
-  image setting for each route. Where it did not run, it names both routes' setting. A run that
-  planned no check printed "every check stood down ()"; it now says no check was planned and why,
-  and no longer suggests a `--command` flag the verifier does not have. No verdict changes.
-
-## 1.2.0 - 2026-09-29
-
-Fixes found by running the published 1.1.0 where a stranger would: fresh virtual machines, the
-real pre-commit framework, hooks installed through `npx`, and a sixteen-repository rollout.
-The verdicts that change are named below. The minor version is for two additive outputs: an `excludedEnvironments` field in the
-`check` JSON report and an `excluded-environments-v1` record; no existing record field, exit code
-or rule name changes meaning.
-
-### Fixed
-
-- **Build runs before tests.** Checks ran a Node project's `test` script before its `build`
-  script. A suite that reads build output (a Vite and Workers project whose test script reads the
-  built asset directory, found in a fresh-VM onboarding run) failed on a clean tree, where its own
-  CI, which builds first, passes. The build check now runs first. **Verdict change:** such a
-  project reads its real test result instead of a failure caused by the order.
-- **The pre-commit framework hook works.** The distribution declared a `node` language hook. The
-  framework installs that from git, which npm 11 refuses (`EALLOWGIT`), blocking every commit,
-  good or bad; under npm 10 the install linked no `swarm-verify` binary, so whichever binary was
-  on `PATH` answered. The hook now runs `npx --yes swarm-verify@<version> pre-commit`. Exercised
-  against the framework on npm 11.12.1 and 10.9.8: a bad staged change is refused and a good one
-  committed. Use `rev: v1.2.0` or later.
-- **Installed hooks survive npm clearing its npx cache.** Run as `npx swarm-verify hook install`
-  or `npx swarm-verify pre-commit install`, the installers wrote an absolute path inside the npx
-  cache. From there they now write the pinned `npx` invocation; a project or global install is
-  still called directly.
-- **The Claude Code hook routes a piped test command.** `npm test 2>&1 | tail -5` and the same
-  through `head` or `grep` with plain arguments are routed through `check` with the filters kept;
-  any other pipeline stage or shell syntax is still left alone.
-- **A bundle whose required challenge refused verifies.** The bundle's own verifier failed the
-  "independent goal bound" check of a `--challenges required` run that refused for
-  `challenges-unmet`, although the refusal was correct.
-- **A formatter check runs only where the project declares that formatter.** Any `[tool.ruff]`
-  table used to add `ruff format --check .`, so projects that lint with ruff and format with black
-  or not at all read `fail` on a clean checkout (four real repositories, 4 to 151 files each). The
-  format check now runs `ruff format --check .` only for a `[tool.ruff.format]` table or a
-  `ruff-format` pre-commit hook, and `black --check .` for a `[tool.black]` table or a `black`
-  hook, unavailable with the tool named when the project's environment does not hold it. Verdict
-  change: a project with ruff lint configuration and no declared formatter no longer fails `check`
-  on formatting; its format check reads not run, with the reason.
-- **mypy keeps the scope the project's mypy configuration names.** Only `pyproject.toml` and
-  `setup.cfg` `files` were read, so a project scoping mypy in `mypy.ini` (`files = src`) was
-  checked with `mypy .` and failed on 180 errors in tests it never type-checks. Targets are now
-  read from `files`, `packages` or `modules` in the one file mypy itself reads, in its documented
-  order (`mypy.ini`, `.mypy.ini`, `pyproject.toml` with `[tool.mypy]`, `setup.cfg` with
-  `[mypy]`). Verdict change: such a project's typecheck runs plain `mypy` and can pass; a project
-  whose `pyproject.toml` names targets while a `mypy.ini` without them takes precedence now runs
-  `mypy .` instead of a bare `mypy` that exited asking for a target.
-- **An untracked virtual environment is not the change `check` measures.** A `.venv` made by
-  `python3 -m venv` before Python 3.13 carries no `.gitignore`, and in a project that does not
-  ignore `.venv/` its every file counted as changed: a clean tavern checkout read 81 changed files
-  and failed the placeholder, secret and diff-budget checks on the environment's own files. An
-  untracked directory whose root holds a `pyvenv.cfg` with a `home` key is now left out of the
-  change and named (`excluded` in the output, `excludedEnvironments` in the JSON report, an
-  `excluded-environments-v1` record in the evidence). A tracked or staged `pyvenv.cfg`, a
-  directory holding anything tracked, and every file a `ci` patch adds are still checked. Verdict
-  change: such a tree no longer fails `check` on its environment's files.
-- **A dependency whose install script builds its native binding is measurable under
-  `--install`.** With scripts off, `better-sqlite3` never had its binding, so every test that
-  opened a database failed at base and head alike and the verdict read incomplete. The install
-  scripts `npm ci --ignore-scripts` skipped now run as a deferred phase with `npm rebuild`, where
-  the checks run, only after a probe shows a check-time command cannot connect, and with
-  node-gyp pointed at the running node's own headers so the build needs no download. Registry
-  code still never runs with network access: on the host, or wherever the probe cannot show the
-  network is off, the deferred scripts do not run and the install detail says why. A script
-  that tries the network there is refused and its output is reported.
-- **A uv project in src layout is installed before its tests run.** `uv sync
-  --no-install-project` left the project itself out, so tests could not import the package or
-  call its console scripts. The project is now installed editable in the deferred offline phase:
-  the build backend's requirements are fetched as wheels without being run, the backend builds
-  the editable wheel offline, and uv installs it offline.
-- **A script that calls pnpm finds the pnpm that installed.** Where the image has no pnpm and
-  the install fetched the declared version for its own command, a script such as
-  `pnpm -r run typecheck` read `pnpm: not found` and the check was unmeasured. The same version
-  is kept in the checkout's `node_modules` and put first on the checks' PATH through the built
-  environment.
-- **The uv install no longer builds anything while the registry is reachable.** `uv sync
-  --no-install-project` still built every dependency that ships only a source archive (the
-  real `docopt==0.6.2` is one) and every workspace member, which runs that package's setup.py
-  or build backend with the network on: a fixture archive whose setup.py tries a connection got
-  through and wrote into the checkout. The install now runs with `--no-build` and leaves those
-  packages out by name; in the deferred offline phase a source archive's bytes are fetched and
-  checked against the lockfile's sha256 (`stage: source-archive`, nothing executed), unpacked
-  and built offline, and a workspace member or local directory is built offline from the
-  checkout, each step recorded. A setup.py that tries the network there is refused and its
-  output reported. A git source or an archive whose hash cannot be checked is left out of the
-  install with its reason named, so a check that needs it reads what it is rather than a pass.
-
-Each deferred step is its own intent and completion on the `dependency-install` record, naming
-its stage and its network (`none` with the probe's result for offline work), so a reader sees
-which scripts ran offline and which fetch reached the registry. A deferred step that fails is
-reported and the checks still run; one that changes source files fails setup.
-
-### Documentation
-
-- Every documented Action workflow shows `install: true`, without which a repository with
-  dependencies reads incomplete.
-
-## 1.1.0 - 2026-09-29
-
-Two false passes reported against the published 1.0.7, reproduced on it and fixed at the root,
-and four more found while building real controls for every attack family. Some verdicts change
-because of these repairs: each change is named below, a pass that was not shown now reads
-incomplete or unmeasured rather than passed, and none of them turns an old refusal into a pass.
-Additive record fields and one additive flag take the minor version; no field, exit code or rule
-name changes meaning, and records written before a rule keep re-deriving under the rule that
-wrote them.
-
-### Fixed
-
-- **A pass the candidate's own instrument reported is not a pass.** On 1.0.7 a
-  `vitest.config.mjs` that wrote a passing report to Vitest's `--outputFile` and exited before
-  any test ran read `result: pass` from `check`, and a `test` script replaced by an `echo` of a
-  passing summary read as a pass from `check` and as a regression pass from `ci`. The 1.0.6 fix
-  read a list of configuration file names; it could not see a configuration importing a changed
-  helper, a setup file named another way, the package scripts npm reads from the working tree,
-  or a runner substituted through the manifest, the lockfile or `node_modules/.bin`. Each
-  command check now observes its instrument (`instrument-identity-v1`): the scripts its command
-  reaches, each tool's configuration by the names the tool discovers, every file those import or
-  name, where the tool's packages come from, and the runner as installed, compared with the
-  reference commit before and after the run. A pass reported under an instrument the change
-  altered is withheld: `check` reads incomplete (exit 4) naming the altered files, and `ci`
-  reruns the check with the base's instrument restored, where only that reading can let the pass
-  stand. The observation is on the `gate-run` record and the offline verifier applies the same
-  rule. A registry release of a tool at another version is recorded and trusted; a tool from a
-  path, URL, git source or another package's name is not.
-- **Two failing tests with the same title are two failures.** On 1.0.7 two node tests both named
-  `works`, the first already failing at the base, collapsed to one TAP identity, so a patch that
-  broke the second read as the first's inherited failure: `inheritedFromBase: true`,
-  `regression: pass`, and the Action's `regression-only`. Under `failure-identity-v2` a node
-  failure is named by its TAP location, depth and title, a Vitest test by file and full name, a
-  pytest test by node id; failures are counted, compared with their cause, and never inherited
-  from a run that was cancelled, truncated, cut short of its plan, contradicts its own counters,
-  or repeats an identity. Checks carry `attributionRule`; a record without it re-derives under
-  the title-only rule that wrote it.
-- **A patch cannot pass `ci` by editing the test that would catch it.** A patch that broke the
-  code and marked the catching test `skip`, deleted its file or rewrote its assertion read as a
-  regression pass. Where a patch changes or deletes test files, the checks run again with the
-  base's versions of those files over the patch's source; a test the base passed that fails
-  there is named (`weakenedTests`) and the pass is withheld. A correct change that edits, renames
-  or adds tests still passes.
-- **A node suite whose every test was skipped measured nothing.** It read as passed.
-- **The pre-commit hook measured the staged commit against itself**, so the change read as empty
-  and a staged configuration was its own reference. It is now measured against `HEAD`.
-- **A workspace pattern from a checked repository's package.json is no longer compiled into a
-  regular expression**; a crafted pattern made discovery take exponential time. Patterns keep
-  `*` and `**`; any other shape is refused with the fix named.
-
-### Added
-
-- `verdict --head <sha>` refuses a verdict made for another head than the one being decided.
-- Quoted and space-bearing Git patch paths (`my file.js`, `café "x".js`, renames and copies
-  between them) are read instead of refused, with every unsafe path still refused after decoding.
-- The ci report and the Markdown summary name the failing tests beside every attribution, so a
-  failure excused as inherited stays in view.
-
-### Changed
-
-- The front door, package README and claims index say what the command runs and records and
-  what it does not judge, and correct three statements: `check` briefly writes its own
-  falsification-bond fixtures into the repository and removes them; `regression: pass` can include
-  a proven inherited failure; locally commands run on the host under a built environment, and
-  containers are the Action's default. The 1.0.0 release note's statement that the basic command
-  runs in a container when one is available was wrong and is corrected on that release.
-
-## 1.0.7 - 2026-09-28
-
-### Fixed
-
-- **An inherited failure in Vitest's text reporters can be proven.** A project whose test
-  script adds flags the structured runner does not take (`vitest run --coverage
-  --reporter=verbose`) prints a coverage table that differs between the base and the patch
-  whenever the patch changes code, so 1.0.6 could never show its failures were inherited and left
-  the dimension unmeasured: cronproof#2, which 1.0.4 and 1.0.5 passed on an unproven inheritance.
-  Vitest names every failed test and every file that failed to load on a `FAIL` line beside its
-  `Test Files` summary; those lines are now the failure identities, in the verifier and in the
-  offline re-deriver alike. They name failures only, so they can prove an inheritance or a new
-  failure and never a pass. cronproof#2 now reads a proven inheritance and a regression pass.
-
-## 1.0.6 - 2026-09-28
-
-Two false passes reported against 1.0.5 and reproduced on it, and a third defect found while
-fixing them. Each is fixed at the root.
-
-### Fixed
-
-- **A patch cannot pass its own suite by changing the runner's configuration.** A patch that
-  broke `sum.js` and added a `vitest.config.js` read the report path from `process.argv`, wrote a
-  passing report there and exited before any test ran, and 1.0.5 read a regression pass. The
-  commands already came from the base commit; the rest of the instrument now does too. Where a
-  patch changes runner configuration (Vitest, Jest, Mocha, Babel, ESLint, Prettier, Biome,
-  TypeScript, pytest and their setup files), every check runs a second time with the base's
-  configuration restored. A check that passes only under the patch's configuration fails where
-  the base's configuration fails a test the base itself passed, and measures nothing otherwise.
-  Both readings are kept on the check (`configurationObservation`, `configurationStatus`,
-  `configurationFiles`, `regressedUnderBaseConfiguration`). A configuration that imports a
-  helper module the patch changed, or a setup file named outside the listed patterns, is not
-  caught by this and is named as a residual.
-- **A newly broken test behind an old failure is a regression.** A check that failed both with
-  and without the patch was read as inherited whatever else failed inside it: a base with one
-  failing test and a patch that broke a second read as a regression pass wherever another check
-  passed. A failure is now inherited only where every test the patched run failed also failed at
-  the base (read from a structured report or TAP), or where both runs printed the same output
-  once times and durations are set aside. A patched run that fails a test the base did not is a
-  regression, and the new failures are named (`newFailures`). A failure that can be shown neither
-  way (`attribution: "unattributed"`) leaves the regression dimension unmeasured, never passed.
-- **The offline verifier re-derives these rules with its own implementation.** Since 1.0.3 the
-  live verdict read an inherited failure beside a passing check as a regression pass, while the
-  offline re-deriver still read it as unmeasured, so every such bundle failed its own
-  "independent regression re-derived" check. The re-deriver now recomputes each failed check's
-  attribution and each base-configuration reading from the recorded observations, requires them
-  to match, and applies the new rule to records that carry them. Records from 1.0.3 to 1.0.5 that
-  read an unproven inheritance as a pass still do not re-derive; that pass was not shown.
-- **Vitest test names are relative to the checkout**, so a test is named the same wherever the
-  checkout sits and a verdict posted publicly does not carry the machine's session path.
-
-## 1.0.5 - 2026-09-28
-
-What Comparison B and the study's replay on 1.0.4 found, fixed at the root: an oracle that ran
-outside the project environment and left no record of why it refused, a container removal
-judged on one sample, and two test-check details that named nothing to fix.
+Swarm Orchestrator is the product of this repository again. 14.3.0's README and repository
+description presented Swarm Verify as the product and the coding agent as an optional beta mode
+of it; this release reverses that ([ADR 0013](docs/adr/0013-two-products-one-verifier.md)) and
+gives the verifier its own product home. No runtime behaviour of the agent changed; the verifier
+carried is `swarm-verify` 1.3.1, whose engine is 1.3.0's.
 
 ### Changed
 
-- **The oracle runs in the project environment the verifier prepared.** `.venv/bin` and
-  `node_modules/.bin` come first on PATH for the oracle, as `uv run` and `npm exec` would. The
-  repository's own checks already call those interpreters by path. An oracle written
-  `python -m pytest ...` otherwise reached the container image's interpreter, which has none of
-  the project's packages, and a patch read as rejected. A directory that does not exist changes
-  nothing.
-- **Every oracle run is kept in the verdict** (`oracleRuns`: the tree it ran on, the command,
-  its exit code, duration and the last 4000 characters of its output). The task dimension was
-  decided from runs whose output was not recorded anywhere.
-
-### Fixed
-
-- **A late container removal no longer refuses the run.** Removal is asked for and observed up
-  to three times with a growing pause before cleanup is called unconfirmed. Under load the
-  runtime finished removals after its 15-second client deadline, and a container gone moments
-  later refused twelve study rows in a row. A container still present after the last round, or
-  one whose creation was uncertain, still refuses.
-
-- **A failed TAP run names the tests that failed**, up to five, quoted as the runner printed
-  them, after the counts. "2 failed" alone named nothing a repair could act on: in Comparison B
-  the model changed nothing in six invocations fed that line for three koa patches.
-- **A failed test check says why when no counted test failed.** jest and vitest summaries count
-  tests, so a file that fails to load or exits the process, or a command the test script runs
-  after the runner, left a failed check reading "978 passed, 978 total". The detail now quotes
-  the runner's test-file line and names the files it marked FAIL, or says the exit came from
-  outside the counted tests. Found on commander.js#1671 in Comparison B.
-
-## 1.0.4 - 2026-09-28
-
-Two findings from the 1.0.3 rollout and the study's replay on 1.0.3, fixed at the root: an
-Action headline that contradicted its own regression dimension, and one more install gap.
-
-### Changed
-
-- **The Action's result follows the regression dimension when every failed check is
-  inherited.** Three of sixteen dogfood repositories read "Not verified" while their verdict
-  said "Regression: pass": their only failures were ones the base commit already had. Such a
-  run is now a regression-only pass with exit status 0; the reason line still says the failure
-  is inherited. A failure the base did not have still refuses. The verdict document's format is
-  unchanged.
-
-### Fixed
-
-- **A uv project's extras are installed too** by the authorized lockfile install
-  (`uv sync --locked --all-groups --all-extras --no-install-project`). 1.0.3 left extras out on
-  the reasoning that they are runtime features. The study's replay on 1.0.3 showed that reasoning
-  wrong for the older layout that keeps pytest, ruff and mypy in a `dev` extra: every row from
-  those projects read "no test ran", and the held-back check was reported as failing on heads
-  where it passes once pytest is present. A lockfile declaring conflicting extras makes uv refuse,
-  and that is reported as a failed install.
-
-## 1.0.3 - 2026-09-28
-
-What the AI-authored pull request study's first complete run through 1.0.2 established, fixed
-at the root: one change of verdict semantics, named as such, and one install gap.
-
-### Changed
-
-- **A failure the base already had no longer leaves the regression dimension unmeasured.**
-  The base control ran the same check at the base commit and found it failing there, which
-  is a measurement about the base, not about the patch; with the patch's other checks
-  passing, the regression dimension now passes and the inherited failure is named beside it.
-  In the AI-authored pull request study, ten of twenty-two adjudicated-correct pull requests
-  had read as refused for a lint or format failure their base carried. A failure the base did
-  not have is still a regression, and a required check that measured nothing still leaves the
-  dimension unmeasured.
-
-### Fixed
-
-- **A uv project's every dependency group is installed** by the authorized lockfile install
-  (`uv sync --locked --all-groups --no-install-project`). Groups are development-only by
-  definition, and a project that keeps pytest in a `test` group rather than `dev` had no
-  runner after a default sync, so its suite read as not run. Extras stay uninstalled.
-
-## 1.0.2 - 2026-09-28
-
-Two more findings from the study's run through 1.0.1, fixed at the root.
-
-### Fixed
-
-- **The container's scratch space is a directory on the host, not a tmpfs.** A tmpfs is
-  charged to the container's memory limit, so with the cap at 2 GB every large lockfile
-  install was killed (exit 137) once its cache passed the cap; sizing the tmpfs in 1.0.1 could
-  not help. Each run now mounts its own directory under the person's `~/.swarm/scratch` at
-  `/tmp`, executable, removed when the run ends, and removed by runtime repair for a run that
-  died between creating and removing it.
-- **A base commit that exists but cannot be checked out is reported with git's own line.**
-  Two paths differing only in case, on a case-insensitive filesystem, leave the fresh checkout
-  dirty and git refuses to switch; the refusal read as "the base commit is not in the checkout",
-  which was false. The last line git printed is now the reason.
-
-## 1.0.1 - 2026-09-28
-
-Four gaps the AI-authored pull request study exposed on its first run through the stable
-release, each on real repositories, each fixed at the root.
-
-### Fixed
-
-- **The container's scratch space holds a real install.** HOME and TMPDIR inside the container
-  are the `/tmp` tmpfs, so npm's and uv's caches live there, and its 256 MB left a lockfile
-  with a native wheel or a large dependency tree failing with "no space left on device". It
-  is now 4 GB, of which only what is written is used.
-- **A pnpm lockfile with no `packageManager` pin installs.** The image carries no pnpm; the
-  lockfile's own format now names the major that reads it (9.0: pnpm 10, 6.0: pnpm 8, 5.x:
-  pnpm 7), that major's latest is fetched through npm for the install command, and the
-  command records which.
-- **A configured Python tool the environment does not hold reads as a check that measured
-  nothing.** `ci` assembles its checks before the install, so the environment could not be
-  read then; when the interpreter itself refuses to start a module, exits 1, and prints only
-  its one-line "No module named", the gate is not applicable with the module named. A test's
-  own output beside those words is a test's words, and the exit code decides as before.
-- **pytest absent from the environment is said as such.** The runner script says so and exits
-  127, and the reading is "measured nothing" with the reason, not "malformed runner output".
-
-## 1.0.0 - 2026-09-28
-
-The first stable release of `swarm-verify`. Everything below shipped through nine prerelease
-candidates, each rolled out across sixteen owned repositories and three README-only onboarding
-simulations, with every defect they found fixed at its root and named here.
+- **The README, package description and repository description describe the coding agent**:
+  what it does, why it is not an ordinary coding agent, install, one task, what verification
+  happens, what evidence is produced, what it does not prove, and how Swarm Verify relates to
+  it. `docs/agent.md` is the long form of that page rather than a beta notice.
+- **The changelog is split.** This file holds the agent's releases; the verifier's 1.x entries
+  moved whole to `packages/swarm-verify/CHANGELOG.md`, which ships in that package.
+- **The Action manifest lives beside the package it ships**, at `packages/swarm-verify/action.yml`,
+  so this repository no longer presents itself as a GitHub Action; the control workflow runs it
+  from there. The Action is branded Swarm Verify.
+- **The verifier's product repository is generated whole**: README, changelog, an Action
+  reference rendered from the manifest, the example workflows, the hook manifest, the license
+  and the source record, by `scripts/build-action-distribution.mjs`, which refuses a README that
+  links to a file it does not write.
+- Issue forms: an agent bug form beside the verifier's; the setup form takes either version.
+  `SUPPORT.md` and `SECURITY.md` name both products.
 
 ### Added
 
-- **`swarm-verify` with no subcommand is `check`**: discover the declared checks from the
-  manifests, run them unattended (no terminal on stdin, `CI=true` in the child environment),
-  and report five conclusions apart: whether the command ran, what the checks found, how
-  commands were contained, whether any requirement was judged, whether any check was
-  challenged. Exit codes: 0 regression-only pass, 1 a failed check, 2 an unreadable command
-  line, 3 cancelled, 4 incomplete. `--explain` previews, `--json` emits `swarm.check.v1`.
-- **Requirement-level challenges** for goal contracts: `ci --challenges off|report|required`
-  runs a base control per requirement, mechanical mutations of the changed lines witnessed by
-  the repository suite, sealed fixtures the contract declares, and names missing obligations.
-  Records `challenge-plan-v1`, `challenge-run-v1` and `challenge-verdict-v1`; the bundle's own
-  verifier re-derives every verdict independently. `required` refuses with `challenges-unmet`.
-- **Python changes are challenged too**: the mutation set reads Python's statement forms
-  (comparison inversion, condition negation, operand swap, `return None`, `= None`), masks
-  literals and comments, sets test files aside, and every Python mutant is shown to parse with
-  Python's own parser before it runs.
-- **The GitHub Action as a client of the installed verifier**: `swarm-verify action
-  verify|comment|retain`. The verdict document is signed as a GitHub artifact attestation, the
-  pull request comment is one per PR, updated in place, bound to the head, escaped and
-  mention-free, and a delayed run for an older head posts nothing.
-- **Coverage on Node 22.8 and newer**: the coverage arm names process isolation in the spelling
-  the running Node takes; the floor moves from 24 to 22.8.
-- A verifier platform matrix workflow installs the packed package on Linux, macOS and Windows
-  under Node 22.0.0, 22 and 24.
-- **`swarm-verify verdict`** binds a signed verdict document to the report, summary and bundle
-  beside it and hands the signer question to `gh attestation verify`.
-- **Three integrations, each a client of the installed verifier**: a Claude Code hook that
-  rewrites the agent's recognised test command to `swarm-verify check` (`hook install`,
-  `uninstall`, `run`); a local MCP server over stdio with three bounded tools (`mcp`); and a
-  pre-commit hook that verifies the staged tree in a detached worktree without touching the
-  working tree (`pre-commit`, `pre-commit install`, `uninstall`). Documented in
-  `docs/integrations.md`, each with real positive and negative runs in its tests.
-
-- An authorized lockfile install inside a container reaches the registry for that one
-  command, with lifecycle scripts off, recorded with `network: registry`; the checks that
-  follow run with the network off. Where the image carries no pnpm and the manifest pins
-  `packageManager: pnpm@X`, that exact pnpm is fetched through npm for the install command.
-  The install record is written whether or not a goal contract was supplied.
-- The twelve attack families of the verifier-first assignment are bound to executed controls
-  in `docs/verifier-first/attack-controls.md`, with four new ones: an outside-package change
-  refused by name, a mismatched goal tree refused before any record, an unfinished challenge
-  intent refusing the next challenge, and a revised contract deriving a fresh verdict.
-- The stable 1.x contract is written down in `docs/verifier-first/contract.md`.
-
-### Fixed
-
-- **A container image that is not on the machine is pulled once, before the first container.**
-  `docker create` against an absent image pulled it inside the command's own deadline, and a
-  probe's deadline is seconds, so on a fresh machine (a GitHub runner with the Action) every
-  container timed out while the image downloaded and the run stopped as "cleanup could not be
-  confirmed" without saying why. The backend now inspects the image and pulls it with its own
-  ten-minute allowance before the command's deadline starts (a pull inside the deadline left a
-  containment probe no time at all and the run refused as "isolation unknown"), names a pull
-  that fails, and a creation that timed out or did not start is named in the cleanup message
-  with the runtime's last line. A probe that timed out is named as such rather than as one
-  that "could not start (null)".
-- **The vitest runner reports to a file and prints only that file.** Four of sixteen rollout
-  repositories had their whole suite read as "malformed runner output" because their tests
-  logged, or their test script printed its own verdicts, into the stdout the JSON reporter
-  used. Stdout is muted while the suite runs; the report's bytes are all that is printed,
-  whole: the first cut of this wrote at exit and lost everything past the pipe's 64 KiB
-  buffer, so every large suite read as malformed instead.
-- **Manifest scripts run through npm whichever manager installed the lockfile.** pnpm is
-  fetched for the install command alone and is not in a trusted image, so every pnpm
-  project's typecheck, lint and build read "the command is not installed" in a container. A
-  script that itself calls pnpm still needs pnpm and says so. Both the `check` plan and the
-  `ci` gate set compose the scripts this way.
-- **When every check stood down, the advice lists why each did**, and distinguishes a runner
-  that is not installed (install the dependencies) from a toolchain the verifier does not
-  drive (unmeasured, not a pass) and from a manifest that declares no check.
-- **Containment probes are shell scripts.** An image built for a Python project carries no
-  node, so every probe "could not start" and the run refused with isolation unknown. The read
-  and write probes use `cat` and `printf`; the network probe attempts the connection with node,
-  else python3, else bash's `/dev/tcp`, and an image with none of them is recorded as
-  unmeasured, never as contained.
-- **The verdict's advice names what happened.** A failed or unmeasured required check was
-  advised as "the repository's own suite passed"; it now names the check that failed on the
-  patch and passed at the base, or the required check that measured nothing.
-- **A configured Python tool the environment does not hold is an unavailable check, not a
-  failed one.** tavern configures mypy, its synced environment holds none, and `python -m
-  mypy` exited 1 with "No module named mypy", read as the typecheck failing on a clean
-  checkout. Presence is read from `.venv`'s site-packages without running anything; the
-  check then says which tool to add and sync. Without a `.venv` nothing is claimed.
-- **A failed check shows the last lines the command printed**, in `check`'s report and its
-  JSON (`output`), so "the command exited 1" comes with what a terminal would have shown.
-- **Two messages a stranger met on a first run say what they mean.** The file-set check in a
-  run with no declared file set no longer speaks of "no planner" and "no agent"; it says no
-  file set was declared and what changed. The per-run signing key notice says what a per-run
-  key means and that it is ordinary on a headless machine.
-- **A vitest file that repeats a test title no longer makes the whole suite unmeasured.**
-  The second occurrence is named by its position; the runner accepted the title and so does
-  the reading. Found on depose, where one repeated `it` hid 383 tests.
-- **The tests reading says what its counts are and are not** in words a first-time reader
-  can follow, instead of "ratchet counts" and "base-control attribution".
-- **An image pull is attempted three times** before the run stops, since a hosted runner saw
-  Docker Hub reset the connection once; the last failure's own line is what the error names.
-- **A Python checkout whose ignored caches exist no longer fails to stage.** The scratch
-  index named `__pycache__`, `.pytest_cache`, `.mypy_cache` and `.ruff_cache` as exclude
-  pathspecs on `git add -A`, which git refuses with "paths are ignored" (exit 1) as soon as one
-  of them exists and is gitignored, the ordinary state after one test run; the verifier then
-  told the reader the repository "is not a git working tree". Everything is staged and the
-  caches are removed from the index afterwards. Found by the README-only python simulation.
-- **A git failure inside a repository quotes git's own last line** rather than the command
-  line, and no longer sends the reader to `git init` unless git said the directory is not a
-  repository.
-- **A uv project without a synced environment is a missing prerequisite, not four failed
-  checks.** `uv run --no-sync` exits at once without a `.venv`; `check` now names
-  `uv sync --locked` as the remedy and exits 4, as it does for a missing `node_modules`.
-
-### Changed
-
-- Both binaries exit 2 for a command line they cannot read, as the exit code taxonomy said.
-- The container's scratch mount is executable, so a fetched package manager can run from it.
-- The README leads with the verifier; the coding agent's page is `docs/agent.md`.
+- `src/product-boundary.test.ts` holds each product's package metadata, binary, dependencies,
+  changelog and README front matter to the product it names, and keeps the inverted phrasing
+  out of the documents a reader is pointed at.
+- The standalone verifier's import-boundary test now also refuses any bare import outside Node
+  and the two packages `swarm-verify` declares, so a model SDK cannot enter the published
+  verifier through a module the build allows.
+- `scripts/build-action-distribution.test.mjs` holds the generated distribution to the source
+  manifest, the package README and the examples.
 
 ## 14.3.0 - 2026-09-30
 
 The coding agent, `swarm-orchestrator`, released for the first time since the verifier-first
 work began. The `swarm` binary shares its verifier with `swarm-verify`, so every change published
-for `swarm-verify` 1.0.0 through 1.3.0 above is in this release too. What follows is what the
+for `swarm-verify` 1.0.0 through 1.3.0 (now in [packages/swarm-verify/CHANGELOG.md](packages/swarm-verify/CHANGELOG.md))
+is in this release too. What follows is what the
 agent itself gained; the verifier stays the primary product and the agent its advanced mode.
 
 ### Added

package/README.md

@@ -2,118 +2,237 @@
 
 <div align="center">
 
-<h1>Swarm Verify</h1>
+<h1>Swarm Orchestrator</h1>
 
-<p><strong>Swarm Verify runs a project's checks and records evidence showing what passed, what failed, and what remains unverified.</strong></p>
+<p><strong>A coding agent that must prove its work.</strong></p>
+
+<p>
+It makes bounded repository changes, runs the project's real checks, challenges weak evidence,<br />
+retries failures without trading away test quality, and records what actually happened,<br />
+so the agent's own summary is never the source of truth.
+</p>
+
+<p>
+  <a href="docs/README.md"><strong>Explore the docs »</strong></a>
+  ·
+  <a href="docs/evidence/2026-08-18/live-tasks.md">See a real run</a>
+  ·
+  <a href="https://github.com/moonrunnerkc/swarm-verify">Swarm Verify, the standalone verifier</a>
+  ·
+  <a href="https://github.com/moonrunnerkc/swarm-orchestrator/issues/new/choose">Report a bug</a>
+</p>
+
+[![gates](https://img.shields.io/github/actions/workflow/status/moonrunnerkc/swarm-orchestrator/gates.yml?branch=v13-main&style=for-the-badge&label=gates)](https://github.com/moonrunnerkc/swarm-orchestrator/actions/workflows/gates.yml)
+[![npm](https://img.shields.io/npm/v/swarm-orchestrator?style=for-the-badge&label=swarm-orchestrator&color=CB3837)](https://www.npmjs.com/package/swarm-orchestrator)
+[![node](https://img.shields.io/badge/node-%E2%89%A522-5FA04E?style=for-the-badge)](package.json)
+[![license](https://img.shields.io/badge/license-ISC-blue?style=for-the-badge)](LICENSE)
 
 </div>
 
-This is the main source repository for Swarm Verify, maintained under the swarm-orchestrator
-repository name. It also contains the optional beta coding agent. The separate
-[moonrunnerkc/swarm-verify](https://github.com/moonrunnerkc/swarm-verify) repository distributes
-the GitHub Action.
+---
+
+## What it does
+
+`swarm` takes a task and a git repository. It plans, declares the files it intends to touch,
+edits through one recording chokepoint, runs your project's checks as sealed gates, and retries
+failures under a ratchet that refuses a fix which trades away tests, assertions or coverage.
+When the gates pass it exports a signed, hash-chained evidence bundle that carries its own
+dependency-free verifier, so anyone can check what ran, and what passed, with nothing but Node
+and without trusting the machine that produced it.
+
+```text
+task
+  -> the agent plans and declares its files
+  -> a bounded change, every tool call recorded
+  -> the project's checks run as sealed gates
+  -> weak evidence is challenged: a passing check must be shown able to fail
+  -> the ratchet: a retry may not trade away tests, assertions or coverage
+  -> retry, accept, or refuse with the reason on the record
+  -> evidence: a signed bundle anyone can verify offline
+```
+
+Here is a real run, committed: [`live-tasks.md`](docs/evidence/2026-08-18/live-tasks.md),
+with its bundle in [`live-frontier/`](docs/evidence/2026-08-18/live-frontier). And here is the
+packaged tool doing it, installed from a tarball into a directory holding nothing else, against
+a workspace it had never seen, recorded in a real terminal:
+[`installed-package-run.md`](docs/evidence/2026-08-23/installed-package-run.md).
+
+## Why it is not an ordinary coding agent
+
+The model can say whatever it likes. It cannot make a check pass, mark a claim verified, or
+change a record after the fact. Those are the harness's to decide.
 
-![A bundle verifies, one byte is changed, and the verifier refuses it with the broken link named](docs/evidence/2026-09-27/verifier-first/tamper-demo.gif)
+- **A claim is not evidence.** A structured claim the model makes names a predicate and a
+  record; the harness evaluates it against its own records and renders the verdict. Narrative
+  never renders green, and a claim the harness cannot evaluate renders `UNVERIFIED` without
+  stopping the run.
+- **A pass must be able to fail.** Each passing gate is handed one fixture it has to refuse,
+  so a check that cannot fail is caught rather than counted.
+- **A retry cannot buy green by deleting tests.** Tests collected, assertions in touched tests
+  and covered changed lines cannot decrease across retries; skips cannot increase.
+- **Regression and task acceptance are two answers.** A suite passing says nothing broke. Only
+  a requirement contract or an acceptance check you supply can say the work was done, and the
+  tool reports when neither was given.
+- **Unmeasured is a verdict.** Nobody checked is not the same as checked and passed, and it is
+  never rendered as a pass.
 
-The recording is a real run of the published package over a committed evidence bundle: it
-verifies, one byte of one record is changed, and the altered bundle is refused with the broken
-link named. That is integrity. Who signed a bundle, and whether the tests it records measured
-the right thing, are separate questions the verifier answers separately
-([transcript](docs/evidence/2026-09-27/verifier-first/tamper-demo-transcript.txt),
-[script](docs/evidence/2026-09-27/verifier-first/tamper-demo.sh)).
+## Install
 
 ```sh
-npx swarm-verify
+npm install -g swarm-orchestrator
 ```
 
-Run it in a git repository whose dependencies are installed (`npm ci`, `pnpm install
---frozen-lockfile` or `uv sync`; it names the missing step and exits 4 when they are not). It
-reads the checks the project declares, runs them unattended the way a CI job would, and reports
-apart: whether the command ran, what each check found, how the commands were contained, and
-what it did not judge. By default it does not challenge the checks and does not judge whether
-the work is correct: a pass is a regression-only pass, and the result line says so. A failed
-check exits 1 and names the check; a check whose result cannot be trusted, such as a pass
-reported by a test configuration the change itself edited, exits 4 and says why.
-
-It creates no `swarm.toml` and keeps its evidence outside the repository, under
-`~/.swarm/sessions` by default. While it runs it briefly adds, then removes, its own
-`swarm-falsification-bond.*` fixtures to show each passing check can fail, and the project's
-own commands may write build output, caches or other files as they always do. No model, key
-or configuration is needed.
-
-Needs Node 22 or newer, git, and `uv` for a Python project. Linux and macOS run every command;
-Windows runs bundle and verdict verification only. Locally, commands run on the host with a
-built environment and no credentials, which is a policy and not a sandbox; the Action runs
-them in a network-disabled container.
+This installs the registry’s `latest` release and leaves `swarm` on your path.
+The source version is **14.4.0**; publication is tracked in
+[the delivery record](docs/release-delivery-2026-10-10.md). It runs on Node 22 or newer; Node 24 or
+newer is recommended, because the changed-line coverage measurement spawns Node's test runner
+with process isolation, which Node 22 below 22.8 rejects. Below that, the measurement reports
+unmeasured and never counts as a pass. `swarm doctor` says which Node it found and what owns
+the `swarm` command, and `--fix` repairs an install that an older build is shadowing.
 
-[![gates](https://img.shields.io/github/actions/workflow/status/moonrunnerkc/swarm-orchestrator/gates.yml?branch=v13-main&style=for-the-badge&label=gates)](https://github.com/moonrunnerkc/swarm-orchestrator/actions/workflows/gates.yml)
-[![verifier matrix](https://img.shields.io/github/actions/workflow/status/moonrunnerkc/swarm-orchestrator/verifier-matrix.yml?branch=v13-main&style=for-the-badge&label=node%2022%20%7C%2024)](https://github.com/moonrunnerkc/swarm-orchestrator/actions/workflows/verifier-matrix.yml)
-[![npm](https://img.shields.io/npm/v/swarm-verify?style=for-the-badge&label=swarm-verify&color=CB3837)](https://www.npmjs.com/package/swarm-verify)
-[![license](https://img.shields.io/badge/license-ISC-blue?style=for-the-badge)](LICENSE)
+## Run one task
 
-## In CI
-
-One job, one Action, the permissions a signed comment needs
-([the complete workflow](docs/examples/swarm-verification.yml)):
-
-```yaml
-name: swarm-verify
-on:
-  pull_request:
-permissions:
-  contents: read
-  pull-requests: write
-  id-token: write
-  attestations: write
-  artifact-metadata: write
-jobs:
-  verify:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: moonrunnerkc/swarm-verify@v1
-        with:
-          install: true # install from the lockfile, scripts off, then run skipped scripts offline; omit for a project with no dependencies
+```sh
+export ANTHROPIC_API_KEY=...       # or OPENAI_API_KEY, GOOGLE_GENERATIVE_AI_API_KEY,
+                                   # or start Ollama and pass --model local:<id>
+cd your-repository
+swarm "make slugify collapse whitespace and strip punctuation"
 ```
 
-The Action fetches the pull request's head and base by commit id into a checkout it owns, runs
-the project's checks in a network-disabled container, signs the verdict as a GitHub artifact
-attestation, and posts one comment bound to the head that says what was measured and what was
-not. A route for forks and Dependabot is [documented](docs/examples/swarm-verification-forks.yml);
-what has been exercised on a real fork is recorded in
-[the completion index](docs/verifier-first/README.md). Inputs, outputs and how to verify a
-signed verdict from outside the run are in [the broad-use guide](docs/broad-use.md#github-action).
+Keys come from the environment or your OS keychain, never from `swarm.toml`: that file is
+committed and cloned, so a key in it has already been shared with everyone holding the
+repository. The run shows each step, each gate and each retry as it happens, and ends on the
+evidence panel. `swarm review <bundle>` opens a run's review page later; `swarm verify <bundle>`
+checks its integrity and who signed it. Every command and flag is in
+[docs/cli.md](docs/cli.md); sessions, several workers at once and the screen are in
+[docs/using.md](docs/using.md).
+
+<p align="right">(<a href="#readme-top">back to top</a>)</p>
+
+## What verification happens
 
-## What it says, and what it does not
+Every tool call and every check goes through one recording chokepoint, and the record is an
+append-only, hash-chained ledger that lives outside the workspace. The gates, their severities,
+their parsers and the budgets are sealed before the first model call, so nothing the model
+does during the run can change what it is measured against.
 
-`regression: pass` means no check failed because of the change. It does not mean every check
-passed: a failure the base commit already had, the same way and in the same tests, is shown as
-inherited and does not count against the change, and the report names those failing tests. It
-does not mean the work was done either.
+Six words carry most of the weight. A **gate** is a check declared as data: a command, a
+parser, and whether it blocks. The **ratchet** is the rule that a retry may not trade away
+tests, assertions or coverage to turn a gate green. A **bond** is one file a passing gate is
+handed that it must refuse, so a pass that cannot fail is caught. An **oracle** is the check
+you supply that says the task was done, as distinct from nothing broke. **Reach** is whether
+that oracle executed the lines a patch added. And **unmeasured** is a verdict of its own.
 
-A requirement contract (`swarm-verify ci --goal-contract`) defines what the work must do, and
-the contract's checks are the evidence for each requirement. Neither the contract nor a
-signature proves the code is semantically correct. `--challenges report` asks whether each
-requirement's check could have caught wrong work (does it reject the tree before the change,
-mechanical mutations of the change, a fixture sealed as a violation) and reports gaps;
-`--challenges required` refuses on a gap; `off` asks nothing.
+With a goal contract (`--goal-contract`), the contract's own checks are challenged
+(`--challenges report|required`): a base control per requirement, mechanical mutations of the
+changed lines witnessed by the suite, and sealed fixtures, so a check that could not have
+caught wrong work is named. With `--strengthen`, the model may propose one additive check per
+witnessed gap; the harness admits it only where it observes the check reject the counterexample
+and accept every sealed reference, then repairs the code under the revised contract. Nothing is
+asked of the model before the criteria are sealed.
+
+The mechanics, the nine-answer report and worked examples are in
+[docs/verifying.md](docs/verifying.md). The goal contracts, presets and package scope are in
+[docs/broad-use.md](docs/broad-use.md).
+
+## What evidence is produced
+
+A run writes its ledger under `~/.swarm/sessions`, never inside the workspace, and exports a
+bundle: the manifest with the chain head and the signature, the records, every blob by
+SHA-256, the review page, the summary, and `verify.mjs`, a dependency-free verifier that
+re-derives every verdict from the records alone.
+
+```sh
+node <bundle>/verify.mjs <bundle>          # anywhere, nothing installed
+swarm verify <bundle> --signer <fp>        # here, with the signer judged too
+```
 
-Every run exports a bundle carrying its own dependency-free verifier. Integrity, signer
-identity, execution trust, regression, task acceptance and challenge coverage are reported as
-separate answers, and `unmeasured` is one of them.
+Every number here links to the committed artifact of the thing happening; the full table, and
+the list of things that may not be said, is [docs/claims.md](docs/claims.md).
 
-## Where to go next
+- **One changed byte breaks verification.** The same bundle verified and then tampered with in
+  a single byte, exit 0 and exit 1 side by side, with a script to reproduce it:
+  [tamper demo](docs/evidence/2026-08-18/tamper-demo).
+- **A bundle verifies on a machine that has never seen this repository.** Run in a `node:24`
+  container with no network and no mount of this repository:
+  [clean-container-verification.md](docs/evidence/2026-08-23/clean-container-verification.md).
+- **A green verdict is computed by the harness, and the model cannot produce one.** In a real
+  run the model asserted a predicate the language does not parse; the harness rendered it
+  `UNVERIFIED` and carried on, twice: [shakedown results](docs/evidence/2026-08-18/shakedown/results.md).
+- **A suite passing is not the task being done.** Four of eighteen patches this project's own
+  agent and a baseline arm produced over three public TypeScript repositories passed their
+  project's whole suite and failed a hidden acceptance test, which is why `regression` and
+  `task` are two answers: [docs/verifying.md](docs/verifying.md). That is a measurement of
+  those eighteen patches, not a rate for AI-written changes in general.
+- **The oracle is judged too.** Certified tasks turned out to rest on oracles that could not
+  fail; the last false green standing was refused because its oracle accepted a change to a
+  line it had run: [docs/verifying.md](docs/verifying.md#the-oracle-is-judged-too).
+- **The September 6 mined-corpus false-green rate was 0 in 15**, 95% CI [0.0, 20.4], with two
+  oracles per task, one handed to the tool and one held back:
+  [mined-corpus](docs/evidence/2026-09-06/mined-corpus/README.md).
 
-| You want to | Read |
+<p align="right">(<a href="#readme-top">back to top</a>)</p>
+
+## What it does not prove
+
+The five that matter most. The full list is in
+[docs/verifying.md](docs/verifying.md#what-is-not-claimed).
+
+- **It is not production-ready.** The counts above describe the linked campaigns, not a fresh
+  measurement of every gate on this checkout. Each row and what would settle it:
+  [docs/beta-gates.md](docs/beta-gates.md).
+- **Not "fully secure".** The secret detector does known-pattern scrubbing, not secret removal.
+  Zero crashes at a fuzz budget is evidence, not proof.
+- **The default execution mode is `restricted`, not `isolated`.** A lexical path and program
+  policy in front of interpreters unless you pass `--isolation`. Reported before the run starts
+  and recorded on the chain rather than quietly assumed, but it is not containment.
+- **0 in 15 says "under 20%", not "zero".** That upper bound is the honest half of the rate,
+  and it is a rate for that corpus and that build, not for this one.
+- **Shown its oracle, a model still gets past this.** Bonding and challenges ask whether the
+  checks judged what the patch added. They cannot ask what the patch left out, and that is
+  what an adversarial patch does.
+
+Gates prove mechanical quality, not design quality. What a bundle buys you is that reviewing the
+change is fast and its claims are checkable, not that review is unnecessary.
+
+## Swarm Verify, the standalone verifier
+
+The verification the agent is held to is a product of its own. [Swarm Verify](https://github.com/moonrunnerkc/swarm-verify)
+checks a change from any source, this agent, Claude Code, Codex, Copilot, another agent or a
+person, with no model, no key and no configuration:
+
+```sh
+npx swarm-verify                                   # run a repository's declared checks and report what that establishes
+npx swarm-verify ci --pr owner/repo#123            # verify a pull request in a fresh checkout of its base
+npx swarm-verify verify <bundle> --signer <fp>     # check a bundle this agent, or anything else, produced
+```
+
+It also ships as the GitHub Action `moonrunnerkc/swarm-verify@v1`, a Claude Code hook, an MCP
+server and a pre-commit hook. The same commands are in the `swarm` binary: `swarm check`,
+`swarm ci`, `swarm verify`, `swarm verdict` and `swarm gates` need no model, and
+[docs/verify-only.md](docs/verify-only.md) walks through them over committed artifacts.
+
+There is one implementation. The `swarm-verify` package is built from this repository's
+verification modules under [packages/swarm-verify](packages/swarm-verify), behind a build-time
+boundary that refuses any provider, worker or screen module; the agent composes those same
+modules. Swarm Orchestrator uses Swarm Verify. It is not Swarm Verify.
+
+<p align="right">(<a href="#readme-top">back to top</a>)</p>
+
+## Versions
+
+The package name has carried three different programs, and the majors are the boundary:
+
+| Versions | What it was |
 | --- | --- |
-| verify a patch, branch or pull request from any author, with a contract or without | [docs/verify-only.md](docs/verify-only.md), [docs/broad-use.md](docs/broad-use.md) |
-| check what a bundle establishes, and who signed it | [docs/verify-only.md](docs/verify-only.md#swarm-verify-a-bundle-and-who-signed-it) |
-| route an agent's test command through the ledger, from Claude Code, an MCP client or a git hook | [docs/integrations.md](docs/integrations.md) |
-| every command, flag and exit code | [docs/cli.md](docs/cli.md) |
-| every public claim and the artifact behind it, and what may not be said | [docs/claims.md](docs/claims.md) |
-| the coding agent this verifier was built for, an advanced beta mode | [docs/agent.md](docs/agent.md) |
-| the verifier-first campaign, its baseline, evidence and open items | [docs/verifier-first/README.md](docs/verifier-first/README.md) |
+| 8.x | a contract-first coding orchestrator: a goal compiled to typed obligations, persona candidates raced per obligation, verifier-gated commits, a hash-chained ledger |
+| 10.x to 12.x | a pull-request auditor: static cheat-pattern detectors over AI-written diffs, advisory by default, with a merge gate. The last of that line is the `v12-final` tag |
+| 13.x and later | this coding agent, with no migration path from 12.x and nothing of its interface |
+| 14.1.0 | the verification path extracted as the `swarm-verify` package, the same code with none of the agent |
+| 14.3.0 | the README and repository description presented Swarm Verify as this repository's product and the agent as a beta mode; 14.4.0 restores the agent as the product of this repository and gives the verifier its own home |
 
-The full documentation index is [docs/README.md](docs/README.md).
+Pin a major. Each release names the verifier version it carries in [CHANGELOG.md](CHANGELOG.md);
+the verifier's own changelog is [packages/swarm-verify/CHANGELOG.md](packages/swarm-verify/CHANGELOG.md).
 
 ## Contributing
 
@@ -128,4 +247,17 @@ does not establish.
 5. Push (`git push origin feature/amazing-feature`)
 6. Open a pull request
 
+New dependencies need a one-line justification; the standard library is preferred.
+[docs/build-guide.md](docs/build-guide.md) is worth reading before structural work.
+
+## License
+
+Distributed under the ISC License. See [LICENSE](LICENSE).
+
+## Contact
+
+Brad Kinnard, [@KChackerman](https://x.com/KChackerman), bradkinnard@proton.me
+
+Project link: [github.com/moonrunnerkc/swarm-orchestrator](https://github.com/moonrunnerkc/swarm-orchestrator)
+
 <p align="right">(<a href="#readme-top">back to top</a>)</p>

package/dist/gates/oracle-instrumentation.js

@@ -1,4 +1,3 @@
-import { isolatedCoverageShortfall } from "../node-floor.js";
 import { harnessReportingCommand } from "./harness-reporting.js";
 import { commandWords, shellQuoted } from "./node-test-command.js";
 /**

package/dist/gates/oracle-instrumentation.js.map

@@ -1 +1 @@
-{"version":3,"file":"oracle-instrumentation.js","sourceRoot":"","sources":["../../src/gates/oracle-instrumentation.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,yBAAyB,EAAE,MAAM,kBAAkB,CAAC;AAC7D,OAAO,EAAE,uBAAuB,EAAE,MAAM,wBAAwB,CAAC;AACjE,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AAEnE;;;;;;;;;;GAUG;AACH;;;;;;;GAOG;AACH,SAAS,cAAc,CAAC,OAAe;IACrC,IAAI,KAAK,GAAkB,IAAI,CAAC;IAChC,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,OAAO,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QACvD,MAAM,SAAS,GAAG,OAAO,CAAC,KAAK,CAAW,CAAC;QAC3C,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;YACnB,IAAI,SAAS,KAAK,KAAK;gBAAE,KAAK,GAAG,IAAI,CAAC;YACtC,SAAS;QACX,CAAC;QACD,IAAI,SAAS,KAAK,GAAG,IAAI,SAAS,KAAK,GAAG,EAAE,CAAC;YAC3C,KAAK,GAAG,SAAS,CAAC;YAClB,SAAS;QACX,CAAC;QACD,IAAI,aAAa,CAAC,QAAQ,CAAC,SAAS,CAAC;YAAE,OAAO,IAAI,CAAC;IACrD,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;GAMG;AACH,MAAM,eAAe,GAAwB,IAAI,GAAG,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;AAItF,MAAM,cAAc,GAAwB,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC;AAEzF,SAAS,eAAe,CAAC,KAAwB;IAC/C,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;IACzB,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,cAAc,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;QAChC,OAAO,OAAyB,CAAC;IACnC,CAAC;IACD,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;QAClC,OAAO,IAAI,CAAC;IACd,CAAC;IACD,8FAA8F;IAC9F,+EAA+E;IAC/E,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;IACzB,OAAO,OAAO,KAAK,SAAS,IAAI,cAAc,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAE,OAA0B,CAAC,CAAC,CAAC,IAAI,CAAC;AACnG,CAAC;AAsCD,MAAM,UAAU,kBAAkB,CAChC,OAAe,EACf,WAAmB,EACnB,OAAO,GAAsC,EAAE;IAE/C,MAAM,QAAQ,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACrC,MAAM,IAAI,GAAG,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IAC3C,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,cAAc,CAAC,IAAI,CAAC,EAAE,CAAC;QAC9C,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC;IAEtD,8FAA8F;IAC9F,4FAA4F;IAC5F,8EAA8E;IAC9E,MAAM,YAAY,GAAG,uBAAuB,CAAC,IAAI,EAAE,OAAO,CAAC,WAAW,IAAI,OAAO,CAAC,OAAO,CAAC,CAAC;IAC3F,IAAI,YAAY,KAAK,IAAI,EAAE,CAAC;QAC1B,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC;IAC1D,CAAC;IAED,MAAM,KAAK,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;IACjC,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QACnB,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,MAAM,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC;IACtC,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;QACpB,OAAO,IAAI,CAAC;IACd,CAAC;IACD,4FAA4F;IAC5F,2FAA2F;IAC3F,6CAA6C;IAC7C,MAAM,iBAAiB,GAAG,WAAW,CAAC,WAAW,CAAC,CAAC;IACnD,IAAI,iBAAiB,KAAK,IAAI,EAAE,CAAC;QAC/B,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;QACtB,OAAO;YACL,IAAI,EAAE,WAAW;YACjB,KAAK;YACL,OAAO,EAAE,GAAG,IAAI,mCAAmC,iBAAiB,+BAA+B;YACnG,IAAI,EAAE,GAAG,WAAW,YAAY;SACjC,CAAC;IACJ,CAAC;IACD,IAAI,MAAM,KAAK,QAAQ,EAAE,CAAC;QACxB,OAAO;YACL,IAAI,EAAE,WAAW;YACjB,KAAK;YACL,OAAO,EAAE,GAAG,IAAI,wDAAwD,iBAAiB,+BAA+B;YACxH,IAAI,EAAE,GAAG,WAAW,YAAY;SACjC,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC;AAC3D,CAAC"}
+{"version":3,"file":"oracle-instrumentation.js","sourceRoot":"","sources":["../../src/gates/oracle-instrumentation.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,uBAAuB,EAAE,MAAM,wBAAwB,CAAC;AACjE,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AAEnE;;;;;;;;;;GAUG;AACH;;;;;;;GAOG;AACH,SAAS,cAAc,CAAC,OAAe;IACrC,IAAI,KAAK,GAAkB,IAAI,CAAC;IAChC,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,OAAO,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QACvD,MAAM,SAAS,GAAG,OAAO,CAAC,KAAK,CAAW,CAAC;QAC3C,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;YACnB,IAAI,SAAS,KAAK,KAAK;gBAAE,KAAK,GAAG,IAAI,CAAC;YACtC,SAAS;QACX,CAAC;QACD,IAAI,SAAS,KAAK,GAAG,IAAI,SAAS,KAAK,GAAG,EAAE,CAAC;YAC3C,KAAK,GAAG,SAAS,CAAC;YAClB,SAAS;QACX,CAAC;QACD,IAAI,aAAa,CAAC,QAAQ,CAAC,SAAS,CAAC;YAAE,OAAO,IAAI,CAAC;IACrD,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;GAMG;AACH,MAAM,eAAe,GAAwB,IAAI,GAAG,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;AAItF,MAAM,cAAc,GAAwB,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC;AAEzF,SAAS,eAAe,CAAC,KAAwB;IAC/C,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;IACzB,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,cAAc,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;QAChC,OAAO,OAAyB,CAAC;IACnC,CAAC;IACD,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;QAClC,OAAO,IAAI,CAAC;IACd,CAAC;IACD,8FAA8F;IAC9F,+EAA+E;IAC/E,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;IACzB,OAAO,OAAO,KAAK,SAAS,IAAI,cAAc,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAE,OAA0B,CAAC,CAAC,CAAC,IAAI,CAAC;AACnG,CAAC;AAsCD,MAAM,UAAU,kBAAkB,CAChC,OAAe,EACf,WAAmB,EACnB,OAAO,GAAsC,EAAE;IAE/C,MAAM,QAAQ,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACrC,MAAM,IAAI,GAAG,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IAC3C,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,cAAc,CAAC,IAAI,CAAC,EAAE,CAAC;QAC9C,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC;IAEtD,8FAA8F;IAC9F,4FAA4F;IAC5F,8EAA8E;IAC9E,MAAM,YAAY,GAAG,uBAAuB,CAAC,IAAI,EAAE,OAAO,CAAC,WAAW,IAAI,OAAO,CAAC,OAAO,CAAC,CAAC;IAC3F,IAAI,YAAY,KAAK,IAAI,EAAE,CAAC;QAC1B,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC;IAC1D,CAAC;IAED,MAAM,KAAK,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;IACjC,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QACnB,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,MAAM,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC;IACtC,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;QACpB,OAAO,IAAI,CAAC;IACd,CAAC;IACD,4FAA4F;IAC5F,2FAA2F;IAC3F,6CAA6C;IAC7C,MAAM,iBAAiB,GAAG,WAAW,CAAC,WAAW,CAAC,CAAC;IACnD,IAAI,iBAAiB,KAAK,IAAI,EAAE,CAAC;QAC/B,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;QACtB,OAAO;YACL,IAAI,EAAE,WAAW;YACjB,KAAK;YACL,OAAO,EAAE,GAAG,IAAI,mCAAmC,iBAAiB,+BAA+B;YACnG,IAAI,EAAE,GAAG,WAAW,YAAY;SACjC,CAAC;IACJ,CAAC;IACD,IAAI,MAAM,KAAK,QAAQ,EAAE,CAAC;QACxB,OAAO;YACL,IAAI,EAAE,WAAW;YACjB,KAAK;YACL,OAAO,EAAE,GAAG,IAAI,wDAAwD,iBAAiB,+BAA+B;YACxH,IAAI,EAAE,GAAG,WAAW,YAAY;SACjC,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC;AAC3D,CAAC"}

package/dist/swarm-verify.js

@@ -24,7 +24,8 @@ export const usage = [
         .filter((command) => verifyOnlyNames.has(command.name))
         .map((command) => `  swarm-verify ${command.syntax.padEnd(42)} ${command.description}`),
     "",
-    "These need no model, no provider key and no local backend. The full agent is swarm-orchestrator.",
+    "These need no model, no provider key and no local backend. Swarm Orchestrator, the coding agent built on",
+    "this verifier, is the swarm-orchestrator package.",
 ].join("\n");
 async function main() {
     const context = { currentDirectory: process.cwd(), usage };

package/dist/swarm-verify.js.map

@@ -1 +1 @@
-{"version":3,"file":"swarm-verify.js","sourceRoot":"","sources":["../src/swarm-verify.ts"],"names":[],"mappings":";AACA,4DAA4D;AAC5D,OAAO,uBAAuB,CAAC;AAE/B,OAAO,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAC;AACzC,OAAO,EAAE,KAAK,EAAE,MAAM,gBAAgB,CAAC;AACvC,OAAO,EAAE,kBAAkB,EAAE,MAAM,8BAA8B,CAAC;AAClE,OAAO,EAAE,KAAK,EAAE,MAAM,gBAAgB,CAAC;AACvC,OAAO,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AACpD,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AACjD,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAC/C,OAAO,EACL,uBAAuB,EACvB,sBAAsB,EACtB,mBAAmB,GAEpB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAEhD;;;;GAIG;AACH,MAAM,eAAe,GAAG,IAAI,GAAG,CAC7B,kBAAkB,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,KAAK,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAChG,CAAC;AAEF,MAAM,CAAC,MAAM,KAAK,GAAG;IACnB,kCAAkC;IAClC,EAAE;IACF,8GAA8G;IAC9G,GAAG,kBAAkB;SAClB,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,eAAe,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;SACtD,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,kBAAkB,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,OAAO,CAAC,WAAW,EAAE,CAAC;IACzF,EAAE;IACF,kGAAkG;CACnG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAEb,KAAK,UAAU,IAAI;IACjB,MAAM,OAAO,GAAG,EAAE,gBAAgB,EAAE,OAAO,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,CAAC;IAC3D,MAAM,IAAI,GAAG,mBAAmB,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;IACjE,IAAI,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,MAAM,EAAE,CAAC;QACvD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,KAAK,IAAI,CAAC,CAAC;QACnC,OAAO,SAAS,CAAC,UAAU,CAAC;IAC9B,CAAC;IACD,IAAI,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;QAC9B,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,MAAM,CAAC,oBAAoB,CAAC,CAAC,CAAC,YAAY,IAAI,CAAC,CAAC;QAC/E,OAAO,SAAS,CAAC,UAAU,CAAC;IAC9B,CAAC;IACD,2FAA2F;IAC3F,MAAM,MAAM,GAA6B,sBAAsB,CAC7D,IAAI,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,EACxE,OAAO,CACR,CAAC;IACF,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;QACpB,MAAM,IAAI,uBAAuB,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,oCAAoC,EAAE,KAAK,CAAC,CAAC;IAClG,CAAC;IACD,IAAI,MAAM,CAAC,OAAO,KAAK,QAAQ,EAAE,CAAC;QAChC,OAAO,YAAY,CAAC,MAAM,CAAC,CAAC;IAC9B,CAAC;IACD,IAAI,MAAM,CAAC,OAAO,KAAK,OAAO,EAAE,CAAC;QAC/B,OAAO,KAAK,CAAC,MAAM,CAAC,CAAC;IACvB,CAAC;IACD,IAAI,MAAM,CAAC,OAAO,KAAK,OAAO,EAAE,CAAC;QAC/B,OAAO,KAAK,CAAC,MAAM,CAAC,CAAC;IACvB,CAAC;IACD,IAAI,MAAM,CAAC,OAAO,KAAK,QAAQ,EAAE,CAAC;QAChC,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC;IACxB,CAAC;IACD,IAAI,MAAM,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;QACjC,OAAO,aAAa,CAAC,MAAM,CAAC,CAAC;IAC/B,CAAC;IACD,IAAI,MAAM,CAAC,OAAO,KAAK,MAAM,IAAI,MAAM,CAAC,OAAO,KAAK,KAAK,IAAI,MAAM,CAAC,OAAO,KAAK,YAAY,EAAE,CAAC;QAC7F,OAAO,WAAW,CAAC,MAAM,CAAC,CAAC;IAC7B,CAAC;IACD,OAAO,CAAC,MAAM,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;AAC3D,CAAC;AAED,gGAAgG;AAChG,2CAA2C;AAC3C,IAAI,EAAE,CAAC,IAAI,CACT,CAAC,IAAI,EAAE,EAAE;IACP,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC;AAC1B,CAAC,EACD,CAAC,KAAc,EAAE,EAAE;IACjB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACpF,sFAAsF;IACtF,OAAO,CAAC,QAAQ;QACd,KAAK,YAAY,uBAAuB,CAAC,CAAC,CAAC,SAAS,CAAC,cAAc,CAAC,CAAC,CAAC,SAAS,CAAC,aAAa,CAAC;AAClG,CAAC,CACF,CAAC"}
+{"version":3,"file":"swarm-verify.js","sourceRoot":"","sources":["../src/swarm-verify.ts"],"names":[],"mappings":";AACA,4DAA4D;AAC5D,OAAO,uBAAuB,CAAC;AAE/B,OAAO,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAC;AACzC,OAAO,EAAE,KAAK,EAAE,MAAM,gBAAgB,CAAC;AACvC,OAAO,EAAE,kBAAkB,EAAE,MAAM,8BAA8B,CAAC;AAClE,OAAO,EAAE,KAAK,EAAE,MAAM,gBAAgB,CAAC;AACvC,OAAO,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AACpD,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AACjD,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAC/C,OAAO,EACL,uBAAuB,EACvB,sBAAsB,EACtB,mBAAmB,GAEpB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAEhD;;;;GAIG;AACH,MAAM,eAAe,GAAG,IAAI,GAAG,CAC7B,kBAAkB,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,KAAK,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAChG,CAAC;AAEF,MAAM,CAAC,MAAM,KAAK,GAAG;IACnB,kCAAkC;IAClC,EAAE;IACF,8GAA8G;IAC9G,GAAG,kBAAkB;SAClB,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,eAAe,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;SACtD,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,kBAAkB,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,OAAO,CAAC,WAAW,EAAE,CAAC;IACzF,EAAE;IACF,0GAA0G;IAC1G,mDAAmD;CACpD,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAEb,KAAK,UAAU,IAAI;IACjB,MAAM,OAAO,GAAG,EAAE,gBAAgB,EAAE,OAAO,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,CAAC;IAC3D,MAAM,IAAI,GAAG,mBAAmB,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;IACjE,IAAI,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,MAAM,EAAE,CAAC;QACvD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,KAAK,IAAI,CAAC,CAAC;QACnC,OAAO,SAAS,CAAC,UAAU,CAAC;IAC9B,CAAC;IACD,IAAI,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;QAC9B,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,MAAM,CAAC,oBAAoB,CAAC,CAAC,CAAC,YAAY,IAAI,CAAC,CAAC;QAC/E,OAAO,SAAS,CAAC,UAAU,CAAC;IAC9B,CAAC;IACD,2FAA2F;IAC3F,MAAM,MAAM,GAA6B,sBAAsB,CAC7D,IAAI,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,EACxE,OAAO,CACR,CAAC;IACF,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;QACpB,MAAM,IAAI,uBAAuB,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,oCAAoC,EAAE,KAAK,CAAC,CAAC;IAClG,CAAC;IACD,IAAI,MAAM,CAAC,OAAO,KAAK,QAAQ,EAAE,CAAC;QAChC,OAAO,YAAY,CAAC,MAAM,CAAC,CAAC;IAC9B,CAAC;IACD,IAAI,MAAM,CAAC,OAAO,KAAK,OAAO,EAAE,CAAC;QAC/B,OAAO,KAAK,CAAC,MAAM,CAAC,CAAC;IACvB,CAAC;IACD,IAAI,MAAM,CAAC,OAAO,KAAK,OAAO,EAAE,CAAC;QAC/B,OAAO,KAAK,CAAC,MAAM,CAAC,CAAC;IACvB,CAAC;IACD,IAAI,MAAM,CAAC,OAAO,KAAK,QAAQ,EAAE,CAAC;QAChC,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC;IACxB,CAAC;IACD,IAAI,MAAM,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;QACjC,OAAO,aAAa,CAAC,MAAM,CAAC,CAAC;IAC/B,CAAC;IACD,IAAI,MAAM,CAAC,OAAO,KAAK,MAAM,IAAI,MAAM,CAAC,OAAO,KAAK,KAAK,IAAI,MAAM,CAAC,OAAO,KAAK,YAAY,EAAE,CAAC;QAC7F,OAAO,WAAW,CAAC,MAAM,CAAC,CAAC;IAC7B,CAAC;IACD,OAAO,CAAC,MAAM,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;AAC3D,CAAC;AAED,gGAAgG;AAChG,2CAA2C;AAC3C,IAAI,EAAE,CAAC,IAAI,CACT,CAAC,IAAI,EAAE,EAAE;IACP,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC;AAC1B,CAAC,EACD,CAAC,KAAc,EAAE,EAAE;IACjB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACpF,sFAAsF;IACtF,OAAO,CAAC,QAAQ;QACd,KAAK,YAAY,uBAAuB,CAAC,CAAC,CAAC,SAAS,CAAC,cAAc,CAAC,CAAC,CAAC,SAAS,CAAC,aAAa,CAAC;AAClG,CAAC,CACF,CAAC"}

package/docs/README.md

@@ -1,16 +1,25 @@
 # Documentation
 
+Current product boundaries are defined by ADR 0013: Orchestrator is the coding agent;
+[Swarm Verify](../packages/swarm-verify/README.md) is the independent verifier built from shared
+source. Installation resolves the published registry version, not necessarily the source version.
+The [delivery record](release-delivery-2026-10-10.md) distinguishes these states. Dated state
+reports, audit plans and `state/` entries are historical; the verifier completion index tracks
+remaining research, rollout and client work. October relaunch drafts await delivery; older launch
+text is retained for history and must not be reused as current guidance.
+
 | Document | What it holds |
 | --- | --- |
-| [`../README.md`](../README.md#install) | install, and a first run from `npm install -g` to an opened review page |
+| [`../README.md`](../README.md) | Swarm Orchestrator, the coding agent: what it does, install, one task, what is verified, what evidence is produced, what is not proved |
 | [`cli.md`](cli.md) | every command and flag, with what each is for |
 | [`using.md`](using.md) | sessions, several workers, the screen, and `swarm.toml` |
 | [`verifying.md`](verifying.md) | bonds, `swarm ci`, the oracle and its reach, the nine answers, and what is not claimed |
-| [`verify-only.md`](verify-only.md) | `swarm check`, `swarm verify`, `swarm ci` and `swarm gates` with no model, walked through on committed artifacts |
+| [`verify-only.md`](verify-only.md) | `swarm check`, `swarm verify`, `swarm ci` and `swarm gates` with no model, walked through on committed artifacts; the same commands are the standalone [Swarm Verify](https://github.com/moonrunnerkc/swarm-verify) |
 | [`broad-use.md`](broad-use.md) | source inputs, package scope, acceptance instruments, challenges and the GitHub Action |
-| [`agent.md`](agent.md) | the coding agent, an advanced beta mode: install, first run, how it verifies, what is measured and what is not |
+| [`agent.md`](agent.md) | running the coding agent, the long form: install, first run, how it verifies, what is measured, what is not, and the roadmap |
 | [`integrations.md`](integrations.md) | the Claude Code hook, the MCP server and the pre-commit hook, each a client of the same verifier |
 | [`verifier-first/`](verifier-first/README.md) | the verifier-first campaign: the completion index, baseline, Node 22 record and dogfood manifest |
+| [`adr/`](adr/README.md) | the architecture decisions, each with what it replaced and what it does not buy; [0013](adr/0013-two-products-one-verifier.md) is the product boundary between the agent and the verifier |
 | [`claims.md`](claims.md) | every public claim and the committed artifact behind it, and what may not be said |
 | [`build-guide.md`](build-guide.md) | the design, the non-goals, and the residuals that ship open |
 | [`ratchet-inputs.md`](ratchet-inputs.md) | every input the ratchet reads, who can author it, and what was moved |
@@ -24,7 +33,8 @@
 | [`tech-debt.md`](tech-debt.md) | what the tree carries that it would rather not, with what closing each would take |
 | [`evidence/`](evidence) | dated runs, bundles, and reports, each verified by the verifier it carries |
 | [`state/`](state) | the state file of each unattended pass, with what was done and what was not |
-| [`RELEASE-COMPLETION-PROMPT.md`](RELEASE-COMPLETION-PROMPT.md) | the plan an earlier release was built to |
+| [`release-delivery-2026-10-10.md`](release-delivery-2026-10-10.md) | current delivery, cleanup decisions, validation and publication evidence |
+| [`history/RELEASE-COMPLETION-PROMPT-v13.md`](history/RELEASE-COMPLETION-PROMPT-v13.md) | archived v13 execution prompt; historical, not operational guidance |
 
 ## Restoring offloaded artifacts
 

package/docs/claims.md

@@ -62,8 +62,10 @@ Verbatim, because each of these has been tempting at some point in this project'
 - **That swarm-verify catches more wrong work than another tool, or is the only tool that does
   something.** No completed comparison supports either; the advantage is an open hypothesis
   tracked in `verifier-first/README.md`.
-- **That the fork route has been exercised on a real fork**, until the completion index records a
-  real fork pull request run through the published Action.
+- **That fork testing establishes unrestricted safety.** Real fork and Dependabot controls ran
+  on published 1.1.0 and 1.2.0, including hostile code and stale-head refusal; see SV-16 in
+  `verifier-first/README.md`. Those observations apply to their tested container and workflow
+  boundaries, not every runner or hostile program.
 
 - **"Seven red-team laps."** The loop ledger records one completed lap. Six of the seven
   pass directories were human-driven work outside the driver, which
@@ -76,13 +78,15 @@ Verbatim, because each of these has been tempting at some point in this project'
 - **"Fully secure", or any unbounded security claim.** The honest naming is known-pattern
   scrubbing, not secret removal, and there is a four-character floor under it. Zero crashes
   at a given fuzz budget is evidence, not proof.
-- **That a decomposition is checked for whether it satisfies the goal.** It is not. The
-  harness checks that a graph is well formed and that its declared nodes ran and landed. The
-  `--goal` run in `evidence/2026-08-24/swarm.md` passed every structural check on a
-  decomposition that could not work. Say "declared before it runs and checked for structure".
-- **That redundancy picks the best solution.** The comparator picks the most disciplined green
-  attempt. No number it reads tells doing the whole task from doing the minimum that passes
-  its own tests, and a number that could would be a judge, which section 2 refuses.
+- **That a well-formed decomposition proves the user’s goal complete.** The legacy graph run
+  in `evidence/2026-08-24/swarm.md` passed structural checks on an unusable decomposition. The
+  adaptive controller now checks declared executable obligations on the exact integrated tree,
+  with bounded revisions and independent acceptance (`redesign-implementation-2026-09-13.md`).
+  That establishes the tested contract, not that the contract captures all user intent.
+- **That redundancy picks the best solution.** The legacy comparator selects discipline;
+  goal selection first requires applicable executable obligations and integrated checks, then
+  ranks under the sealed objective. Neither establishes semantic completeness beyond those
+  checks, and missing human judgments remain unjudged.
 - **That the oracle-reach check proves an oracle judged the change.** It proves the oracle
   *executed* the lines, which is a necessary condition and not a sufficient one, and for every
   runner but node's own it reads a coverage report the workspace's own processes wrote. Nothing

package/package.json

@@ -1,19 +1,23 @@
 {
   "name": "swarm-orchestrator",
-  "version": "14.3.0",
-  "description": "A coding agent whose claims about its own work resolve to machine-captured evidence: an append-only hash-chained ledger, gates that retry under a numeric ratchet, and a signed bundle carrying its own verifier that anyone can check offline.",
+  "version": "14.4.0",
+  "description": "A coding agent that must prove its work: bounded repository changes, the project's real checks, challenges to weak evidence, retries that cannot trade away test quality, and a signed, hash-chained evidence record anyone can verify offline.",
   "keywords": [
+    "agent-harness",
     "agentic-ai",
     "ai-agents",
     "audit-trail",
     "cli",
     "coding-agent",
+    "coding-agents",
+    "developer-tools",
     "evidence",
     "hash-chain",
     "llm",
     "local-llm",
     "provenance",
     "quality-gates",
+    "software-engineering",
     "tamper-evident",
     "tui",
     "typescript",