swarm-orchestrator 14.3.0 → 16.0.0

package/CHANGELOG.md

@@ -1,528 +1,210 @@
-# Changelog
+# Changelog: swarm-orchestrator
 
-## 1.3.0 - 2026-09-29
+The agent. The verifier it consumes, `swarm-verify`, has its own changelog in
+[moonrunnerkc/swarm-verify](https://github.com/moonrunnerkc/swarm-verify/blob/main/CHANGELOG.md).
 
-Defects found by the sixteen-repository rollout of 1.2.0, each reproduced from a recorded run
-and fixed at the root. The verdicts that change are named below. The minor version is for the
-new attribution rule, `failure-identity-v3`, which new records carry; a record written under
-`failure-identity-v2` or v1 re-derives under the rule that wrote it.
+## 16.0.0 - 2026-11-01
 
-### Fixed
-
-- **Build runs before every check that can read its output.** 1.2.0 moved the build ahead of
-  tests only. A pnpm workspace whose per-package `tsc --noEmit` resolves its siblings through the
-  `dist/index.d.ts` that `tsc --build` writes, as its own CI builds first, read a failed typecheck
-  on a clean tree. The build now runs first, then typecheck, lint, format and tests. **Verdict
-  change:** such a project reads its real typecheck and lint results instead of a failure caused
-  by the order.
-- **A failed check records what its runner printed.** Node checks ran as `npm run --silent`,
-  and npm hands that log level to the script as `npm_config_loglevel=silent`. pnpm reads it, so a
-  failed `pnpm -r run typecheck` recorded an exit code with empty output. Checks now run as
-  `npm run --loglevel=error`, which keeps npm's notices out of the record and every tool's errors
-  in it; `swarm init` writes the same form. No verdict changes: the failure is still a failure,
-  now with its reason.
-- **The base control sees nothing the patched tree's run produced.** The base was measured in
-  the same checkout after a forced checkout and a clean that keeps ignored files, so the base's
-  checks ran beside the patched tree's build output. depose's base typecheck passed on the `dist/`
-  the patched build wrote, and a workflow-only patch read **Regression: fail**; a module only the
-  patched build emitted stayed in `dist/` and failed the base's suite the same way, so a real
-  regression read as inherited. The ignored tree is now recorded once dependencies are prepared,
-  and every switch between the two sides removes what was added since; a prepared entry a run
-  changed refuses the comparison. Where the patch changes a lockfile, nothing installed is shared:
-  the base installs its own dependencies from its own lockfile. **Verdict changes:** such a
-  workflow-only patch reads its real regression result, and a patch whose build output or
-  dependency change broke the suite reads **Regression: fail** instead of an inherited failure.
-- **A failure that differs only in a temporary directory's random name is inherited.** The base
-  and the patch failed the same three tests, and two causes differed only in pre-commit's random
-  repository directory (`...eponyx5xidu` against `...epoc90ac5y6`), so the failures could not be
-  matched and the regression read unmeasured. Causes and outputs are now compared with generated
-  names set aside: platform temporary roots, digit-bearing directory names under them, and a
-  generated name's tail where a reporter elided the rest. A file's own name, a path outside a
-  temporary root and every other word still count, so a changed message still reads as changed.
-  New records carry `failure-identity-v3`; a record written under v2 re-derives under v2. The
-  advice for an unmatched failure now says why it could not be matched, instead of saying the
-  output names no tests when it names them. **Verdict change:** such inherited failures read
-  inherited, so the regression dimension is measured instead of unmeasured.
-- **A base control whose worker crashed on exit still shows a regression.** quantproof's base
-  ran its whole suite, failed no test, and exited 1 when a Vitest worker aborted on exit (a
-  better-sqlite3 assertion under Node 24), leaving one file's tests pending. Its report no longer
-  reconciled, so the two tests the patch broke, which that report names as passing, read
-  unmeasured. Where the base names no failure and was not killed by the harness, a test it names
-  passing once and the patch fails is now newly failing. A test the base never finished, a killed
-  or cut run, or a base that names a failure of its own stays unmeasured, and nothing is ever
-  inherited this way. **Verdict change:** such a run reads **Regression: fail** instead of
-  unmeasured.
-- **The advice for a run that measured nothing says the right thing.** Where the install already
-  ran (the Action's `install: true` is passed as `--install`), a runner still missing was followed
-  by "pass --install"; it now says the environment does not carry that toolchain and names the
-  image setting for each route. Where it did not run, it names both routes' setting. A run that
-  planned no check printed "every check stood down ()"; it now says no check was planned and why,
-  and no longer suggests a `--command` flag the verifier does not have. No verdict changes.
-
-## 1.2.0 - 2026-09-29
-
-Fixes found by running the published 1.1.0 where a stranger would: fresh virtual machines, the
-real pre-commit framework, hooks installed through `npx`, and a sixteen-repository rollout.
-The verdicts that change are named below. The minor version is for two additive outputs: an `excludedEnvironments` field in the
-`check` JSON report and an `excluded-environments-v1` record; no existing record field, exit code
-or rule name changes meaning.
-
-### Fixed
-
-- **Build runs before tests.** Checks ran a Node project's `test` script before its `build`
-  script. A suite that reads build output (a Vite and Workers project whose test script reads the
-  built asset directory, found in a fresh-VM onboarding run) failed on a clean tree, where its own
-  CI, which builds first, passes. The build check now runs first. **Verdict change:** such a
-  project reads its real test result instead of a failure caused by the order.
-- **The pre-commit framework hook works.** The distribution declared a `node` language hook. The
-  framework installs that from git, which npm 11 refuses (`EALLOWGIT`), blocking every commit,
-  good or bad; under npm 10 the install linked no `swarm-verify` binary, so whichever binary was
-  on `PATH` answered. The hook now runs `npx --yes swarm-verify@<version> pre-commit`. Exercised
-  against the framework on npm 11.12.1 and 10.9.8: a bad staged change is refused and a good one
-  committed. Use `rev: v1.2.0` or later.
-- **Installed hooks survive npm clearing its npx cache.** Run as `npx swarm-verify hook install`
-  or `npx swarm-verify pre-commit install`, the installers wrote an absolute path inside the npx
-  cache. From there they now write the pinned `npx` invocation; a project or global install is
-  still called directly.
-- **The Claude Code hook routes a piped test command.** `npm test 2>&1 | tail -5` and the same
-  through `head` or `grep` with plain arguments are routed through `check` with the filters kept;
-  any other pipeline stage or shell syntax is still left alone.
-- **A bundle whose required challenge refused verifies.** The bundle's own verifier failed the
-  "independent goal bound" check of a `--challenges required` run that refused for
-  `challenges-unmet`, although the refusal was correct.
-- **A formatter check runs only where the project declares that formatter.** Any `[tool.ruff]`
-  table used to add `ruff format --check .`, so projects that lint with ruff and format with black
-  or not at all read `fail` on a clean checkout (four real repositories, 4 to 151 files each). The
-  format check now runs `ruff format --check .` only for a `[tool.ruff.format]` table or a
-  `ruff-format` pre-commit hook, and `black --check .` for a `[tool.black]` table or a `black`
-  hook, unavailable with the tool named when the project's environment does not hold it. Verdict
-  change: a project with ruff lint configuration and no declared formatter no longer fails `check`
-  on formatting; its format check reads not run, with the reason.
-- **mypy keeps the scope the project's mypy configuration names.** Only `pyproject.toml` and
-  `setup.cfg` `files` were read, so a project scoping mypy in `mypy.ini` (`files = src`) was
-  checked with `mypy .` and failed on 180 errors in tests it never type-checks. Targets are now
-  read from `files`, `packages` or `modules` in the one file mypy itself reads, in its documented
-  order (`mypy.ini`, `.mypy.ini`, `pyproject.toml` with `[tool.mypy]`, `setup.cfg` with
-  `[mypy]`). Verdict change: such a project's typecheck runs plain `mypy` and can pass; a project
-  whose `pyproject.toml` names targets while a `mypy.ini` without them takes precedence now runs
-  `mypy .` instead of a bare `mypy` that exited asking for a target.
-- **An untracked virtual environment is not the change `check` measures.** A `.venv` made by
-  `python3 -m venv` before Python 3.13 carries no `.gitignore`, and in a project that does not
-  ignore `.venv/` its every file counted as changed: a clean tavern checkout read 81 changed files
-  and failed the placeholder, secret and diff-budget checks on the environment's own files. An
-  untracked directory whose root holds a `pyvenv.cfg` with a `home` key is now left out of the
-  change and named (`excluded` in the output, `excludedEnvironments` in the JSON report, an
-  `excluded-environments-v1` record in the evidence). A tracked or staged `pyvenv.cfg`, a
-  directory holding anything tracked, and every file a `ci` patch adds are still checked. Verdict
-  change: such a tree no longer fails `check` on its environment's files.
-- **A dependency whose install script builds its native binding is measurable under
-  `--install`.** With scripts off, `better-sqlite3` never had its binding, so every test that
-  opened a database failed at base and head alike and the verdict read incomplete. The install
-  scripts `npm ci --ignore-scripts` skipped now run as a deferred phase with `npm rebuild`, where
-  the checks run, only after a probe shows a check-time command cannot connect, and with
-  node-gyp pointed at the running node's own headers so the build needs no download. Registry
-  code still never runs with network access: on the host, or wherever the probe cannot show the
-  network is off, the deferred scripts do not run and the install detail says why. A script
-  that tries the network there is refused and its output is reported.
-- **A uv project in src layout is installed before its tests run.** `uv sync
-  --no-install-project` left the project itself out, so tests could not import the package or
-  call its console scripts. The project is now installed editable in the deferred offline phase:
-  the build backend's requirements are fetched as wheels without being run, the backend builds
-  the editable wheel offline, and uv installs it offline.
-- **A script that calls pnpm finds the pnpm that installed.** Where the image has no pnpm and
-  the install fetched the declared version for its own command, a script such as
-  `pnpm -r run typecheck` read `pnpm: not found` and the check was unmeasured. The same version
-  is kept in the checkout's `node_modules` and put first on the checks' PATH through the built
-  environment.
-- **The uv install no longer builds anything while the registry is reachable.** `uv sync
-  --no-install-project` still built every dependency that ships only a source archive (the
-  real `docopt==0.6.2` is one) and every workspace member, which runs that package's setup.py
-  or build backend with the network on: a fixture archive whose setup.py tries a connection got
-  through and wrote into the checkout. The install now runs with `--no-build` and leaves those
-  packages out by name; in the deferred offline phase a source archive's bytes are fetched and
-  checked against the lockfile's sha256 (`stage: source-archive`, nothing executed), unpacked
-  and built offline, and a workspace member or local directory is built offline from the
-  checkout, each step recorded. A setup.py that tries the network there is refused and its
-  output reported. A git source or an archive whose hash cannot be checked is left out of the
-  install with its reason named, so a check that needs it reads what it is rather than a pass.
-
-Each deferred step is its own intent and completion on the `dependency-install` record, naming
-its stage and its network (`none` with the probe's result for offline work), so a reader sees
-which scripts ran offline and which fetch reached the registry. A deferred step that fails is
-reported and the checks still run; one that changes source files fails setup.
-
-### Documentation
-
-- Every documented Action workflow shows `install: true`, without which a repository with
-  dependencies reads incomplete.
-
-## 1.1.0 - 2026-09-29
-
-Two false passes reported against the published 1.0.7, reproduced on it and fixed at the root,
-and four more found while building real controls for every attack family. Some verdicts change
-because of these repairs: each change is named below, a pass that was not shown now reads
-incomplete or unmeasured rather than passed, and none of them turns an old refusal into a pass.
-Additive record fields and one additive flag take the minor version; no field, exit code or rule
-name changes meaning, and records written before a rule keep re-deriving under the rule that
-wrote them.
-
-### Fixed
-
-- **A pass the candidate's own instrument reported is not a pass.** On 1.0.7 a
-  `vitest.config.mjs` that wrote a passing report to Vitest's `--outputFile` and exited before
-  any test ran read `result: pass` from `check`, and a `test` script replaced by an `echo` of a
-  passing summary read as a pass from `check` and as a regression pass from `ci`. The 1.0.6 fix
-  read a list of configuration file names; it could not see a configuration importing a changed
-  helper, a setup file named another way, the package scripts npm reads from the working tree,
-  or a runner substituted through the manifest, the lockfile or `node_modules/.bin`. Each
-  command check now observes its instrument (`instrument-identity-v1`): the scripts its command
-  reaches, each tool's configuration by the names the tool discovers, every file those import or
-  name, where the tool's packages come from, and the runner as installed, compared with the
-  reference commit before and after the run. A pass reported under an instrument the change
-  altered is withheld: `check` reads incomplete (exit 4) naming the altered files, and `ci`
-  reruns the check with the base's instrument restored, where only that reading can let the pass
-  stand. The observation is on the `gate-run` record and the offline verifier applies the same
-  rule. A registry release of a tool at another version is recorded and trusted; a tool from a
-  path, URL, git source or another package's name is not.
-- **Two failing tests with the same title are two failures.** On 1.0.7 two node tests both named
-  `works`, the first already failing at the base, collapsed to one TAP identity, so a patch that
-  broke the second read as the first's inherited failure: `inheritedFromBase: true`,
-  `regression: pass`, and the Action's `regression-only`. Under `failure-identity-v2` a node
-  failure is named by its TAP location, depth and title, a Vitest test by file and full name, a
-  pytest test by node id; failures are counted, compared with their cause, and never inherited
-  from a run that was cancelled, truncated, cut short of its plan, contradicts its own counters,
-  or repeats an identity. Checks carry `attributionRule`; a record without it re-derives under
-  the title-only rule that wrote it.
-- **A patch cannot pass `ci` by editing the test that would catch it.** A patch that broke the
-  code and marked the catching test `skip`, deleted its file or rewrote its assertion read as a
-  regression pass. Where a patch changes or deletes test files, the checks run again with the
-  base's versions of those files over the patch's source; a test the base passed that fails
-  there is named (`weakenedTests`) and the pass is withheld. A correct change that edits, renames
-  or adds tests still passes.
-- **A node suite whose every test was skipped measured nothing.** It read as passed.
-- **The pre-commit hook measured the staged commit against itself**, so the change read as empty
-  and a staged configuration was its own reference. It is now measured against `HEAD`.
-- **A workspace pattern from a checked repository's package.json is no longer compiled into a
-  regular expression**; a crafted pattern made discovery take exponential time. Patterns keep
-  `*` and `**`; any other shape is refused with the fix named.
-
-### Added
-
-- `verdict --head <sha>` refuses a verdict made for another head than the one being decided.
-- Quoted and space-bearing Git patch paths (`my file.js`, `café "x".js`, renames and copies
-  between them) are read instead of refused, with every unsafe path still refused after decoding.
-- The ci report and the Markdown summary name the failing tests beside every attribution, so a
-  failure excused as inherited stays in view.
+Swarm Orchestrator is the coding product again, and `swarm-verify` 2.0.0 is the verifier it
+consumes at an exact version. A task runs on a local model found on this machine, every
+requirement is checked against executed evidence, and the delivered patch comes with a signed
+attestation an independent replay can rerun. 15.0.0 was tagged but never published to npm.
 
 ### Changed
 
-- The front door, package README and claims index say what the command runs and records and
-  what it does not judge, and correct three statements: `check` briefly writes its own
-  falsification-bond fixtures into the repository and removes them; `regression: pass` can include
-  a proven inherited failure; locally commands run on the host under a built environment, and
-  containers are the Action's default. The 1.0.0 release note's statement that the basic command
-  runs in a container when one is available was wrong and is corrected on that release.
-
-## 1.0.7 - 2026-09-28
-
-### Fixed
+- **The verifier is a dependency, not a copy.** The embedded `src/verify`, its CLI modules and
+  `packages/swarm-verify` moved with their history to moonrunnerkc/swarm-verify (ADR 0015).
+  The agent depends on an exact `swarm-verify` version and calls its public API;
+  `swarm verify`, `swarm init` and `swarm ci` are the installed verifier's own commands. A
+  packed-consumer test installs both tarballs into a fresh prefix and runs a task through them.
+- Verification artifacts of `swarm run` are written into the session directory, outside the
+  workspace, one directory per verification.
+- `swarm verify` judges a declared test check test by test. It recognizes pytest, jest,
+  vitest, mocha and go test in the command, or in the `package.json` script the command names,
+  appends the runner's machine-readable report at base and with the change, and reads each
+  test as fixed, regressed, pre-existing, deleted or newly failing. A regression, a deletion
+  outside test files the change may edit, or a newly failing test fails the check; a test that
+  fails at both commits is reported and does not block. The verdict is measured whenever both
+  reports parse, whatever the command's exit code; it is unmeasured only when the command could
+  not run, its report could not be parsed, or no test in it passes with the change. A command
+  with no recognized runner is judged by exit code as before, and the verdict says so. See
+  [docs/verifying.md](https://github.com/moonrunnerkc/swarm-verify/blob/main/docs/verifying.md).
 
-- **An inherited failure in Vitest's text reporters can be proven.** A project whose test
-  script adds flags the structured runner does not take (`vitest run --coverage
-  --reporter=verbose`) prints a coverage table that differs between the base and the patch
-  whenever the patch changes code, so 1.0.6 could never show its failures were inherited and left
-  the dimension unmeasured: cronproof#2, which 1.0.4 and 1.0.5 passed on an unproven inheritance.
-  Vitest names every failed test and every file that failed to load on a `FAIL` line beside its
-  `Test Files` summary; those lines are now the failure identities, in the verifier and in the
-  offline re-deriver alike. They name failures only, so they can prove an inheritance or a new
-  failure and never a pass. cronproof#2 now reads a proven inheritance and a regression pass.
-
-## 1.0.6 - 2026-09-28
+### Added
 
-Two false passes reported against 1.0.5 and reproduced on it, and a third defect found while
-fixing them. Each is fixed at the root.
+- **`swarm run` finds a local model itself.** With no `--model` or `--endpoint`, it lists
+  Ollama's installed models, estimates each one's memory at the context it would use (65,536
+  tokens, then 32,768), probes the ones that fit with a real turn of the shell protocol, and
+  chooses by the share of finished tasks each completed on this machine, recorded in
+  `~/.swarm/profiles/`; with too few recorded, the largest that fits. The reason is printed and
+  reported. `swarm doctor --models` shows the same survey; when nothing fits, it says what would.
+- **A requirement record**: R1 is the user's task verbatim; the model may add R2 and on and map
+  tests, checks, structure and package versions to each, and only the verifier sets a status.
+  The report lists every requirement with its evidence, the changed files (deletions named), the
+  model and why it was chosen, and the run's tokens, turns, inference and wall time.
+- **Repository instructions** (`AGENTS.md`, `CLAUDE.md`) load deterministically, digested into the
+  evidence, within a byte budget; they are input to the task, never to the security policy.
+- `--authorize-behavior-change` lets a test the base passes change its expectation where the change
+  witnesses the new behavior, and the report says so. `--review` adds one fresh-context review of a
+  completed change; it is off by default. `--host --linked-dependencies` verifies on the host with
+  the workspace's installed dependencies, reported as not isolated and not reproducible.
 
 ### Fixed
 
-- **A patch cannot pass its own suite by changing the runner's configuration.** A patch that
-  broke `sum.js` and added a `vitest.config.js` read the report path from `process.argv`, wrote a
-  passing report there and exited before any test ran, and 1.0.5 read a regression pass. The
-  commands already came from the base commit; the rest of the instrument now does too. Where a
-  patch changes runner configuration (Vitest, Jest, Mocha, Babel, ESLint, Prettier, Biome,
-  TypeScript, pytest and their setup files), every check runs a second time with the base's
-  configuration restored. A check that passes only under the patch's configuration fails where
-  the base's configuration fails a test the base itself passed, and measures nothing otherwise.
-  Both readings are kept on the check (`configurationObservation`, `configurationStatus`,
-  `configurationFiles`, `regressedUnderBaseConfiguration`). A configuration that imports a
-  helper module the patch changed, or a setup file named outside the listed patterns, is not
-  caught by this and is named as a residual.
-- **A newly broken test behind an old failure is a regression.** A check that failed both with
-  and without the patch was read as inherited whatever else failed inside it: a base with one
-  failing test and a patch that broke a second read as a regression pass wherever another check
-  passed. A failure is now inherited only where every test the patched run failed also failed at
-  the base (read from a structured report or TAP), or where both runs printed the same output
-  once times and durations are set aside. A patched run that fails a test the base did not is a
-  regression, and the new failures are named (`newFailures`). A failure that can be shown neither
-  way (`attribution: "unattributed"`) leaves the regression dimension unmeasured, never passed.
-- **The offline verifier re-derives these rules with its own implementation.** Since 1.0.3 the
-  live verdict read an inherited failure beside a passing check as a regression pass, while the
-  offline re-deriver still read it as unmeasured, so every such bundle failed its own
-  "independent regression re-derived" check. The re-deriver now recomputes each failed check's
-  attribution and each base-configuration reading from the recorded observations, requires them
-  to match, and applies the new rule to records that carry them. Records from 1.0.3 to 1.0.5 that
-  read an unproven inheritance as a pass still do not re-derive; that pass was not shown.
-- **Vitest test names are relative to the checkout**, so a test is named the same wherever the
-  checkout sits and a verdict posted publicly does not carry the machine's session path.
-
-## 1.0.5 - 2026-09-28
-
-What Comparison B and the study's replay on 1.0.4 found, fixed at the root: an oracle that ran
-outside the project environment and left no record of why it refused, a container removal
-judged on one sample, and two test-check details that named nothing to fix.
+Root causes found running real tasks on local models (docs/acceptance/2026-10-31/):
+
+- **The agent pushed a branch to the repository its workspace came from**, in auto approval, and
+  cloned it to `/tmp` inside a `$(...)` command whose paths nothing checked. Pushes and package
+  publishes are refused in every approval mode; a command the shell reader cannot read is refused
+  under auto approval and asked of a person otherwise; `git stash`, which took a whole change out
+  of the delivered tree on a run's last step, is refused with how to see the base instead. The
+  reader now reads backslashes in double quotes and comments as the shell does.
+- **A slow model's last turn ran past the deadline** and final verification never ran: no turn
+  starts that the time left cannot pay for, measured by the longest turn so far. The model is told
+  once when a fifth of its turns or of its time remains.
+- **A Rapid-MLX reasoning parser moved the reply into `reasoning_content`**, which was dropped;
+  the reply is read from it where the content holds no reply form.
+- Ollama connections dropped mid-turn are sent again and counted; a non-JSON reply stops the run
+  with what to do instead of crashing it; SIGTERM and SIGHUP finalize a run as Ctrl-C does.
+- Compaction no longer tells the model to reread every file; a discovered model gets the largest
+  context it fits; the token budget defaults to what the steps could use at that context.
+- A completion repeated on an unchanged tree is answered once with the open findings, and a
+  command repeated while findings are open points back at them.
+- A blocked run stops with the verifier's reason; a run where no check ran says why; the summary
+  printed "0 s of inference" for an endpoint that reports none, and now says so.
+- The managed worktree sits beside the repository, so relative dependencies resolve.
+- **A run wrote into the user's repository through its git worktree.** A worktree shares the
+  repository's refs and config, so `git branch`, `git tag` and `git config` in auto approval
+  changed the user's own `.git`. The workspace is now a clone that reads the user's objects and
+  shares no refs, config or remote.
+- **"The latest 9.x" was delivered as Stryker 10.1.1 and reported complete**, twice: the only
+  version read was the model's own claim. The version constraints a task's wording states are
+  read into its first requirement by code, no proposal can change them, and the verifier holds
+  the lockfile to them. The summary and report show each requirement as worded, as the model read
+  it, the versions it is held to, and its status.
+- **The prompt grew with every turn**, the whole history resent on each: the
+  task and requirements stay at the front, recent turns are sent whole and older output as a
+  bounded excerpt with a reference to the whole, kept readable under `.swarm/outputs/`, and old
+  exploration is compacted without a model call only under measured pressure. `report.json`
+  records each turn's tokens.
+- **Path-shaped text in a quoted script was refused as a path** (a sed address, test source
+  written through printf): only the words a program opens are offered to the path check, sed and
+  awk scripts are read for the files they open, and a redirect target is checked wherever it is
+  written. A path after an option's equals sign (`--git-dir=/elsewhere`) is checked; it was not.
+- **A copied `.venv` ran the user's unchanged source.** The workspace's environment is built from
+  `uv.lock` (or the declared setup command, or, with no lock, `uv lock` first as the verifier
+  does) and the report names its interpreter.
+
+### Known limits
+
+- The cross-module refactor acceptance task (tracemantle: move two modules into a new package with
+  shims, and move their tests) has no complete run on the local models tried. The best attempt
+  broke the module it moved and the verifier found the regression; a narrower attempt changed
+  nothing. docs/acceptance/2026-10-31/t6-comparison/ holds the task, its base and a fixed
+  requirement record, so another agent's patch can be judged by the same verifier.
+
+### Migration
+
+- `swarm run` no longer needs `--model` and `--endpoint`; they still name a model and an
+  OpenAI-compatible endpoint where given. `--context` sets the context for a named model.
+- Commands that were run in auto approval and contained `$(...)`, backticks, subshells, brace
+  groups or `sh -c` are refused: write the inner command first and its result literally.
+- `swarm verify`, `swarm init` and `swarm ci` are the installed `swarm-verify` 2.0.0 commands; their
+  states, exit codes and predicate are described in swarm-verify's docs/migration-2.md.
+- The report is `swarm-orchestrator.report/v1` in `report.json` beside `report.md`, in the
+  session directory.
+
+## 15.0.0 - 2026-10-29
+
+The verifier-first rebuild ([ADR 0014](docs/adr/0014-verifier-first-rebuild.md)). The unreleased
+14.5.0 work (the adaptive controller, planned checks, repair and review stages) is superseded and
+remains in the history of pull request #101.
 
 ### Changed
 
-- **The oracle runs in the project environment the verifier prepared.** `.venv/bin` and
-  `node_modules/.bin` come first on PATH for the oracle, as `uv run` and `npm exec` would. The
-  repository's own checks already call those interpreters by path. An oracle written
-  `python -m pytest ...` otherwise reached the container image's interpreter, which has none of
-  the project's packages, and a patch read as rejected. A directory that does not exist changes
-  nothing.
-- **Every oracle run is kept in the verdict** (`oracleRuns`: the tree it ran on, the command,
-  its exit code, duration and the last 4000 characters of its output). The task dimension was
-  decided from runs whose output was not recorded anywhere.
-
-### Fixed
-
-- **A late container removal no longer refuses the run.** Removal is asked for and observed up
-  to three times with a growing pause before cleanup is called unconfirmed. Under load the
-  runtime finished removals after its 15-second client deadline, and a container gone moments
-  later refused twelve study rows in a row. A container still present after the last round, or
-  one whose creation was uncertain, still refuses.
-
-- **A failed TAP run names the tests that failed**, up to five, quoted as the runner printed
-  them, after the counts. "2 failed" alone named nothing a repair could act on: in Comparison B
-  the model changed nothing in six invocations fed that line for three koa patches.
-- **A failed test check says why when no counted test failed.** jest and vitest summaries count
-  tests, so a file that fails to load or exits the process, or a command the test script runs
-  after the runner, left a failed check reading "978 passed, 978 total". The detail now quotes
-  the runner's test-file line and names the files it marked FAIL, or says the exit came from
-  outside the counted tests. Found on commander.js#1671 in Comparison B.
-
-## 1.0.4 - 2026-09-28
+- `swarm run "<task>"` is a single-bash-tool loop: one command per turn through the chokepoint
+  and path policy, the task, `git status --short` and the last verifier failure verbatim at the
+  top of every turn, and the verifier as the only judge of completion. It stops on a verified
+  tree, the step budget or the token budget, and says which. Every turn sends `max_tokens`
+  (`--turn-tokens`, 16,384 by default). A permanent endpoint failure (a refused connection, a
+  4xx other than 429, a third 5xx in a row) stops the run as `model-error`; the verifier still
+  judges the tree and the outcome block prints the reason and the verdict, and a `mutant` line
+  when the mutant of a changed line survived.
+- `swarm verify` and `swarm ci` rerun the declared checks on a change (working tree, ref range
+  or patch) in a clean checkout of the base, refuse protected paths changed together with
+  source, run held-out checks sealed with `swarm init --seal`, measure changed-line coverage
+  and one mutation, and write an in-toto Statement in a DSSE envelope inside a Sigstore bundle.
+  `packages/swarm-verify/verify.mjs` checks it with no dependencies; so does
+  `cosign verify-blob-attestation`.
+- Every check runs at the base commit first: one that fails there and still fails is a
+  `pre-existing-failure` and leaves the verdict unmeasured, one that passes there and fails with
+  the change is a regression. Held-out checks run with a judge loaded before any project module
+  that fails them when the code under test patches `node:assert`, `node:test`, `unittest`,
+  pytest's hooks, the builtins they compare with, or the project's own test helpers.
+  [docs/verifying.md](docs/verifying.md) has the details and the limits.
+- Checks run with `PYTHONDONTWRITEBYTECODE=1`: the base run, the change and the mutant rewrite
+  one file within a second, often at the same size, and Python would otherwise run the bytecode
+  cached from the previous version.
 
-Two findings from the 1.0.3 rollout and the study's replay on 1.0.3, fixed at the root: an
-Action headline that contradicted its own regression dimension, and one more install gap.
-
-### Changed
+### Added
 
-- **The Action's result follows the regression dimension when every failed check is
-  inherited.** Three of sixteen dogfood repositories read "Not verified" while their verdict
-  said "Regression: pass": their only failures were ones the base commit already had. Such a
-  run is now a regression-only pass with exit status 0; the reason line still says the failure
-  is inherited. A failure the base did not have still refuses. The verdict document's format is
-  unchanged.
+- The evaluation: Harbor runs of mini-SWE-agent, OpenCode and `swarm run` on frozen SWE-bench
+  Verified and Terminal-Bench 2.0 lists, a committed results store, a nightly workflow for a
+  self-hosted runner ([docs/eval.md](docs/eval.md)), and the tamper evaluation of the verifier.
+  [docs/results.md](docs/results.md) is the only page with measured numbers.
 
-### Fixed
+### Removed
 
-- **A uv project's extras are installed too** by the authorized lockfile install
-  (`uv sync --locked --all-groups --all-extras --no-install-project`). 1.0.3 left extras out on
-  the reasoning that they are runtime features. The study's replay on 1.0.3 showed that reasoning
-  wrong for the older layout that keeps pytest, ruff and mypy in a `dev` extra: every row from
-  those projects read "no test ran", and the held-back check was reported as failing on heads
-  where it passes once pytest is present. A lockfile declaring conflicting extras makes uv refuse,
-  and that is reported as a failed install.
+- The parallel worker layer, model selection and calibration, the research evaluation code, the
+  terminal interface, the old gates engine, the custom evidence bundle format and its verifier,
+  the container isolation backend, and every subcommand except `verify`, `init`, `ci` and
+  `doctor`.
+- The research evidence, campaigns, red-team passes, fuzz targets and research scripts, moved to
+  the archive named in [docs/evidence/README.md](docs/evidence/README.md).
 
-## 1.0.3 - 2026-09-28
+## 14.4.0 - 2026-10-08
 
-What the AI-authored pull request study's first complete run through 1.0.2 established, fixed
-at the root: one change of verdict semantics, named as such, and one install gap.
+Swarm Orchestrator is the product of this repository again. 14.3.0's README and repository
+description presented Swarm Verify as the product and the coding agent as an optional beta mode
+of it; this release reverses that ([ADR 0013](docs/adr/0013-two-products-one-verifier.md)) and
+gives the verifier its own product home. No runtime behaviour of the agent changed; the verifier
+carried is `swarm-verify` 1.3.1, whose engine is 1.3.0's.
 
 ### Changed
 
-- **A failure the base already had no longer leaves the regression dimension unmeasured.**
-  The base control ran the same check at the base commit and found it failing there, which
-  is a measurement about the base, not about the patch; with the patch's other checks
-  passing, the regression dimension now passes and the inherited failure is named beside it.
-  In the AI-authored pull request study, ten of twenty-two adjudicated-correct pull requests
-  had read as refused for a lint or format failure their base carried. A failure the base did
-  not have is still a regression, and a required check that measured nothing still leaves the
-  dimension unmeasured.
-
-### Fixed
-
-- **A uv project's every dependency group is installed** by the authorized lockfile install
-  (`uv sync --locked --all-groups --no-install-project`). Groups are development-only by
-  definition, and a project that keeps pytest in a `test` group rather than `dev` had no
-  runner after a default sync, so its suite read as not run. Extras stay uninstalled.
-
-## 1.0.2 - 2026-09-28
-
-Two more findings from the study's run through 1.0.1, fixed at the root.
-
-### Fixed
-
-- **The container's scratch space is a directory on the host, not a tmpfs.** A tmpfs is
-  charged to the container's memory limit, so with the cap at 2 GB every large lockfile
-  install was killed (exit 137) once its cache passed the cap; sizing the tmpfs in 1.0.1 could
-  not help. Each run now mounts its own directory under the person's `~/.swarm/scratch` at
-  `/tmp`, executable, removed when the run ends, and removed by runtime repair for a run that
-  died between creating and removing it.
-- **A base commit that exists but cannot be checked out is reported with git's own line.**
-  Two paths differing only in case, on a case-insensitive filesystem, leave the fresh checkout
-  dirty and git refuses to switch; the refusal read as "the base commit is not in the checkout",
-  which was false. The last line git printed is now the reason.
-
-## 1.0.1 - 2026-09-28
-
-Four gaps the AI-authored pull request study exposed on its first run through the stable
-release, each on real repositories, each fixed at the root.
-
-### Fixed
-
-- **The container's scratch space holds a real install.** HOME and TMPDIR inside the container
-  are the `/tmp` tmpfs, so npm's and uv's caches live there, and its 256 MB left a lockfile
-  with a native wheel or a large dependency tree failing with "no space left on device". It
-  is now 4 GB, of which only what is written is used.
-- **A pnpm lockfile with no `packageManager` pin installs.** The image carries no pnpm; the
-  lockfile's own format now names the major that reads it (9.0: pnpm 10, 6.0: pnpm 8, 5.x:
-  pnpm 7), that major's latest is fetched through npm for the install command, and the
-  command records which.
-- **A configured Python tool the environment does not hold reads as a check that measured
-  nothing.** `ci` assembles its checks before the install, so the environment could not be
-  read then; when the interpreter itself refuses to start a module, exits 1, and prints only
-  its one-line "No module named", the gate is not applicable with the module named. A test's
-  own output beside those words is a test's words, and the exit code decides as before.
-- **pytest absent from the environment is said as such.** The runner script says so and exits
-  127, and the reading is "measured nothing" with the reason, not "malformed runner output".
-
-## 1.0.0 - 2026-09-28
-
-The first stable release of `swarm-verify`. Everything below shipped through nine prerelease
-candidates, each rolled out across sixteen owned repositories and three README-only onboarding
-simulations, with every defect they found fixed at its root and named here.
+- **The README, package description and repository description describe the coding agent**:
+  what it does, why it is not an ordinary coding agent, install, one task, what verification
+  happens, what evidence is produced, what it does not prove, and how Swarm Verify relates to
+  it. `docs/agent.md` is the long form of that page rather than a beta notice.
+- **The changelog is split.** This file holds the agent's releases; the verifier's 1.x entries
+  moved whole to `packages/swarm-verify/CHANGELOG.md`, which ships in that package.
+- **The Action manifest lives beside the package it ships**, at `packages/swarm-verify/action.yml`,
+  so this repository no longer presents itself as a GitHub Action; the control workflow runs it
+  from there. The Action is branded Swarm Verify.
+- **The verifier's product repository is generated whole**: README, changelog, an Action
+  reference rendered from the manifest, the example workflows, the hook manifest, the license
+  and the source record, by `scripts/build-action-distribution.mjs`, which refuses a README that
+  links to a file it does not write.
+- Issue forms: an agent bug form beside the verifier's; the setup form takes either version.
+  `SUPPORT.md` and `SECURITY.md` name both products.
 
 ### Added
 
-- **`swarm-verify` with no subcommand is `check`**: discover the declared checks from the
-  manifests, run them unattended (no terminal on stdin, `CI=true` in the child environment),
-  and report five conclusions apart: whether the command ran, what the checks found, how
-  commands were contained, whether any requirement was judged, whether any check was
-  challenged. Exit codes: 0 regression-only pass, 1 a failed check, 2 an unreadable command
-  line, 3 cancelled, 4 incomplete. `--explain` previews, `--json` emits `swarm.check.v1`.
-- **Requirement-level challenges** for goal contracts: `ci --challenges off|report|required`
-  runs a base control per requirement, mechanical mutations of the changed lines witnessed by
-  the repository suite, sealed fixtures the contract declares, and names missing obligations.
-  Records `challenge-plan-v1`, `challenge-run-v1` and `challenge-verdict-v1`; the bundle's own
-  verifier re-derives every verdict independently. `required` refuses with `challenges-unmet`.
-- **Python changes are challenged too**: the mutation set reads Python's statement forms
-  (comparison inversion, condition negation, operand swap, `return None`, `= None`), masks
-  literals and comments, sets test files aside, and every Python mutant is shown to parse with
-  Python's own parser before it runs.
-- **The GitHub Action as a client of the installed verifier**: `swarm-verify action
-  verify|comment|retain`. The verdict document is signed as a GitHub artifact attestation, the
-  pull request comment is one per PR, updated in place, bound to the head, escaped and
-  mention-free, and a delayed run for an older head posts nothing.
-- **Coverage on Node 22.8 and newer**: the coverage arm names process isolation in the spelling
-  the running Node takes; the floor moves from 24 to 22.8.
-- A verifier platform matrix workflow installs the packed package on Linux, macOS and Windows
-  under Node 22.0.0, 22 and 24.
-- **`swarm-verify verdict`** binds a signed verdict document to the report, summary and bundle
-  beside it and hands the signer question to `gh attestation verify`.
-- **Three integrations, each a client of the installed verifier**: a Claude Code hook that
-  rewrites the agent's recognised test command to `swarm-verify check` (`hook install`,
-  `uninstall`, `run`); a local MCP server over stdio with three bounded tools (`mcp`); and a
-  pre-commit hook that verifies the staged tree in a detached worktree without touching the
-  working tree (`pre-commit`, `pre-commit install`, `uninstall`). Documented in
-  `docs/integrations.md`, each with real positive and negative runs in its tests.
-
-- An authorized lockfile install inside a container reaches the registry for that one
-  command, with lifecycle scripts off, recorded with `network: registry`; the checks that
-  follow run with the network off. Where the image carries no pnpm and the manifest pins
-  `packageManager: pnpm@X`, that exact pnpm is fetched through npm for the install command.
-  The install record is written whether or not a goal contract was supplied.
-- The twelve attack families of the verifier-first assignment are bound to executed controls
-  in `docs/verifier-first/attack-controls.md`, with four new ones: an outside-package change
-  refused by name, a mismatched goal tree refused before any record, an unfinished challenge
-  intent refusing the next challenge, and a revised contract deriving a fresh verdict.
-- The stable 1.x contract is written down in `docs/verifier-first/contract.md`.
-
-### Fixed
-
-- **A container image that is not on the machine is pulled once, before the first container.**
-  `docker create` against an absent image pulled it inside the command's own deadline, and a
-  probe's deadline is seconds, so on a fresh machine (a GitHub runner with the Action) every
-  container timed out while the image downloaded and the run stopped as "cleanup could not be
-  confirmed" without saying why. The backend now inspects the image and pulls it with its own
-  ten-minute allowance before the command's deadline starts (a pull inside the deadline left a
-  containment probe no time at all and the run refused as "isolation unknown"), names a pull
-  that fails, and a creation that timed out or did not start is named in the cleanup message
-  with the runtime's last line. A probe that timed out is named as such rather than as one
-  that "could not start (null)".
-- **The vitest runner reports to a file and prints only that file.** Four of sixteen rollout
-  repositories had their whole suite read as "malformed runner output" because their tests
-  logged, or their test script printed its own verdicts, into the stdout the JSON reporter
-  used. Stdout is muted while the suite runs; the report's bytes are all that is printed,
-  whole: the first cut of this wrote at exit and lost everything past the pipe's 64 KiB
-  buffer, so every large suite read as malformed instead.
-- **Manifest scripts run through npm whichever manager installed the lockfile.** pnpm is
-  fetched for the install command alone and is not in a trusted image, so every pnpm
-  project's typecheck, lint and build read "the command is not installed" in a container. A
-  script that itself calls pnpm still needs pnpm and says so. Both the `check` plan and the
-  `ci` gate set compose the scripts this way.
-- **When every check stood down, the advice lists why each did**, and distinguishes a runner
-  that is not installed (install the dependencies) from a toolchain the verifier does not
-  drive (unmeasured, not a pass) and from a manifest that declares no check.
-- **Containment probes are shell scripts.** An image built for a Python project carries no
-  node, so every probe "could not start" and the run refused with isolation unknown. The read
-  and write probes use `cat` and `printf`; the network probe attempts the connection with node,
-  else python3, else bash's `/dev/tcp`, and an image with none of them is recorded as
-  unmeasured, never as contained.
-- **The verdict's advice names what happened.** A failed or unmeasured required check was
-  advised as "the repository's own suite passed"; it now names the check that failed on the
-  patch and passed at the base, or the required check that measured nothing.
-- **A configured Python tool the environment does not hold is an unavailable check, not a
-  failed one.** tavern configures mypy, its synced environment holds none, and `python -m
-  mypy` exited 1 with "No module named mypy", read as the typecheck failing on a clean
-  checkout. Presence is read from `.venv`'s site-packages without running anything; the
-  check then says which tool to add and sync. Without a `.venv` nothing is claimed.
-- **A failed check shows the last lines the command printed**, in `check`'s report and its
-  JSON (`output`), so "the command exited 1" comes with what a terminal would have shown.
-- **Two messages a stranger met on a first run say what they mean.** The file-set check in a
-  run with no declared file set no longer speaks of "no planner" and "no agent"; it says no
-  file set was declared and what changed. The per-run signing key notice says what a per-run
-  key means and that it is ordinary on a headless machine.
-- **A vitest file that repeats a test title no longer makes the whole suite unmeasured.**
-  The second occurrence is named by its position; the runner accepted the title and so does
-  the reading. Found on depose, where one repeated `it` hid 383 tests.
-- **The tests reading says what its counts are and are not** in words a first-time reader
-  can follow, instead of "ratchet counts" and "base-control attribution".
-- **An image pull is attempted three times** before the run stops, since a hosted runner saw
-  Docker Hub reset the connection once; the last failure's own line is what the error names.
-- **A Python checkout whose ignored caches exist no longer fails to stage.** The scratch
-  index named `__pycache__`, `.pytest_cache`, `.mypy_cache` and `.ruff_cache` as exclude
-  pathspecs on `git add -A`, which git refuses with "paths are ignored" (exit 1) as soon as one
-  of them exists and is gitignored, the ordinary state after one test run; the verifier then
-  told the reader the repository "is not a git working tree". Everything is staged and the
-  caches are removed from the index afterwards. Found by the README-only python simulation.
-- **A git failure inside a repository quotes git's own last line** rather than the command
-  line, and no longer sends the reader to `git init` unless git said the directory is not a
-  repository.
-- **A uv project without a synced environment is a missing prerequisite, not four failed
-  checks.** `uv run --no-sync` exits at once without a `.venv`; `check` now names
-  `uv sync --locked` as the remedy and exits 4, as it does for a missing `node_modules`.
-
-### Changed
-
-- Both binaries exit 2 for a command line they cannot read, as the exit code taxonomy said.
-- The container's scratch mount is executable, so a fetched package manager can run from it.
-- The README leads with the verifier; the coding agent's page is `docs/agent.md`.
+- `src/product-boundary.test.ts` holds each product's package metadata, binary, dependencies,
+  changelog and README front matter to the product it names, and keeps the inverted phrasing
+  out of the documents a reader is pointed at.
+- The standalone verifier's import-boundary test now also refuses any bare import outside Node
+  and the two packages `swarm-verify` declares, so a model SDK cannot enter the published
+  verifier through a module the build allows.
+- `scripts/build-action-distribution.test.mjs` holds the generated distribution to the source
+  manifest, the package README and the examples.
 
 ## 14.3.0 - 2026-09-30
 
 The coding agent, `swarm-orchestrator`, released for the first time since the verifier-first
 work began. The `swarm` binary shares its verifier with `swarm-verify`, so every change published
-for `swarm-verify` 1.0.0 through 1.3.0 above is in this release too. What follows is what the
+for `swarm-verify` 1.0.0 through 1.3.0 (now in [swarm-verify's changelog](https://github.com/moonrunnerkc/swarm-verify/blob/main/CHANGELOG.md))
+is in this release too. What follows is what the
 agent itself gained; the verifier stays the primary product and the agent its advanced mode.
 
 ### Added
@@ -729,10 +411,10 @@ agent itself gained; the verifier stays the primary product and the agent its ad
   difference 0.0 points, 95% CI [-4.0, +4.0]. Three repairs changed bytes, none narrowed the
   implementation, two left scratch files behind. Six of the nine refusals named a tsd type-test
   file no runner executes. The protocol, rows, patches and a report that re-derives from the rows
-  are in [`docs/evidence/2026-09-17/reach-pressure-experiment/`](docs/evidence/2026-09-17/reach-pressure-experiment/report.md).
+  are in the archive's [docs/evidence/2026-09-17/reach-pressure-experiment/](https://github.com/moonrunnerkc/swarm-orchestrator-archive/blob/main/docs/evidence/2026-09-17/reach-pressure-experiment/report.md).
   Two earlier generations were stopped on instrument defects and are kept beside it. The instrument
   defects it exposed, and what closed each without touching a row, are in
-  [`docs/evidence/2026-09-18/reach-pressure-hardening/`](docs/evidence/2026-09-18/reach-pressure-hardening/README.md).
+  the archive's [docs/evidence/2026-09-18/reach-pressure-hardening/](https://github.com/moonrunnerkc/swarm-orchestrator-archive/blob/main/docs/evidence/2026-09-18/reach-pressure-hardening/README.md).
 
 ### Changed
 
@@ -1286,290 +968,12 @@ agent itself gained; the verifier stays the primary product and the agent its ad
   reason, at the line that carries the finding. Under the workflow's own command it now reports
   zero and exits 0, so the weekly issue means something arrived that nobody has looked at.
 
-## 13.1.9
-
-### Added
-
-- **A line that says the run is alive, and what it is doing.** A spinner that turns, the current
-  activity, how long it has been going, and while the model is talking, the tail of what it is
-  saying. Nothing on the screen moved before this: the status said `thinking (step 3)` and
-  stayed there, and the only thing that changed was a seconds counter the layout hides below 80
-  columns or 12 rows, so a run taking a minute looked exactly like one that had hung.
-- **The model's words as they arrive.** The stream was already being drained to time the first
-  token and every piece of text was discarded. It is handed on now. One line of it: the whole
-  response lands in the action stream when it arrives and in the ledger for ever, and repeating
-  it as it streams would be the same text three times.
-- **The tool that is running, named while it runs.** Between a tool starting and finishing
-  nothing was emitted, which for a shell command is a screen sitting still for a minute and a
-  half. A tool that finishes inside a frame still draws nothing, which is the right amount.
-
-## 13.1.8
-
-### Added
-
-- **`swarm doctor`, and `swarm doctor --fix`.** What owns the `swarm` command, and repairing it
-  when the answer is wrong. The same failure has happened on two machines months apart and
-  presented as something else both times: an `ENOTDIR` during a global install on one, and on
-  the other a `swarm` with no `select` command. Both were a development checkout linked into the
-  global prefix with `npm link`, which owns the command until it is removed and which npm cannot
-  install over. Nothing here can intercept that at install time, because npm fails before any
-  script of ours would run, so this answers the question afterwards instead. It reports the link
-  and what it shadows, every `swarm` on PATH since the first one wins silently, an executable
-  whose package a failed install removed, and whether the registry is ahead of what is running.
-
-### Fixed
-
-- **A bare word that is nearly a subcommand is refused.** A bare word is the task, which is what
-  makes `swarm fix the parser` work. The cost is that a subcommand a build does not have becomes
-  a task: running `swarm doctor` against a version predating it started an agent on the
-  repository, declared its uncommitted files and wrote a bundle. Nothing was damaged and nothing
-  about it looked wrong. One word that is nearly a command is now refused with the nearest match
-  named, and a task of more than one word is untouched.
-
-## 13.1.7
-
-Found by driving the session through a real terminal rather than a pipe.
-
-### Fixed
-
-- **Enter did not submit at the prompt.** A terminal hands over what it buffered in one read, so
-  the newline arrived inside a longer chunk with no key flag set, and the whole chunk including
-  the control character was typed into the task being composed. A pasted task arrives the same
-  way, so everything before the newline is now typed and the newline still means run it.
-- **The screen still showed a plain `DONE` for a run that changed nothing.** The gate strip
-  cannot tell passes over work from passes over an empty diff, and a model answering in prose
-  stops for the honest reason `completed` having done nothing. It now reads `DONE, but no files
-  changed`. The plain path already said this above its gate table.
-
-## 13.1.6
-
-A session, and the evidence a person reads.
-
-### Added
-
-- **`swarm` with no task opens a session.** One process, one ledger, tasks typed one after
-  another, each continuing the conversation the last one left. The screen keeps what each
-  finished turn came to, so it does not forget between them. `swarm "task"` is unchanged.
-- **Each turn is measured on its own.** A turn ends by recording where it left the tree, so the
-  next turn's gates see that turn's changes and not the ones before it. Without it the second
-  turn is charged with the first's diff and the file-set check calls the first turn's files
-  out-of-set.
-- **The review page says what happened.** The header carries the tasks, the model, whether the
-  loop completed, how long it took and what it cost, above the identifiers it used to open with.
-- **The gate table is in the bundle.** It was printed to a terminal and never written into the
-  page, where the gates had been indistinguishable cards among the model calls.
-- **The change itself is recorded and shown.** Nothing recorded a patch, so the question the
-  page exists to answer, what did this do to my code, meant leaving the evidence and running git.
-
-### Fixed
-
-- **A run that changed nothing reported `DONE`.** The gates run after the loop and each gate
-  event rewrote the status, so the last gate to pass over an empty diff became the last word on
-  a run that built nothing. The stop reason is now its own field, and a cycle that measured no
-  changed files says so before the table.
-- **A second turn measured its own edits as deletions.** `git diff <base>` from the person's
-  index calls a file that is in the base and untracked here deleted. Changes are now measured
-  through a scratch index, which makes the comparison tree to tree and counts a file the agent
-  just wrote as added.
-- **`q` did not leave the view.** It set a flag that three things read after the fact; nothing
-  unmounted the screen, which kept painting. It now comes down and the run reports the way it
-  does off a terminal.
-- **A refused bundle named nothing.** The failing check was read off stderr and the verifier
-  reports through stdout, so every real refusal said "no detail given" at the one moment the
-  panel exists for.
-- Six record types rendered as their own bare name on the page, including the one holding what
-  the run cost.
-
-## 13.1.5
-
-Three fixes, all found by running the tool rather than by reading it.
-
-### Fixed
-
-- **A routed model the backend does not serve reached dispatch.** The router picks from what a
-  calibration measured, and a calibration is a record of a machine at a moment; the backend
-  answering today is a separate fact, and the two drift. A model pulled into Ollama, discovery
-  preferring rapid-mlx, and the router handed over a name that endpoint had never heard of. It
-  answered `Not Found` three times and the run stopped at zero steps. The served list is now
-  asked before dispatch, and a served local model, then a frontier provider whose key is set,
-  answers instead. Substitutions are announced and recorded.
-- **A run that built nothing reported `DONE`.** The gates run after the loop and every gate
-  event rewrote the status line, so the last gate to pass became the last word on the run. A
-  loop that stopped at step zero displayed `DONE gate diff-budget: passed` in the success
-  colour, over an empty diff. The stop reason is now its own field and the outcome leads with it.
-- **`git diff` outside a repository printed its whole option list.** One line of diagnosis
-  followed by a hundred lines about `--dirstat`, with the sentence saying what to do at the
-  bottom. Now one line, and it says to run `git init`.
-
-## 13.1.4
-
-### Fixed
-
-- **The readme printed an install command that cannot work.** It offered
-  `npm install -g github:owner/repo#tag` beside the registry line. `dist/` is not committed, so a
-  git ref builds itself on install and needs this package's devDependencies to do it, and npm
-  does not install those under `-g`: it carries the global context into its git-dependency
-  preparation, places the clone as a root package rather than building a tree inside it, and runs
-  `prepare` without the compiler. The same ref installed without `-g` works and always did. Found
-  by a person running the line the readme printed.
-- **That failure surfaced as `ENOENT` on a path the reader never typed.** The build now names the
-  cause and the two commands that do work, rather than reporting a missing file.
-
-## 13.1.3
-
-The first 13.x on the npm registry. No behaviour changed: this is 13.1.1 with a manifest the
-registry accepts and install instructions that are true.
-
-### Fixed
-
-- **The manifest named no repository, so a signed publish was refused.** `npm publish
-  --provenance` signs a statement naming the repository the tarball was built from, and the
-  registry checks it against `repository.url` before it accepts the write. That field was
-  absent, so the statement said one thing and the manifest said `""`, and the registry answered
-  `E422` after the provenance had already been written to the transparency log. Nothing in the
-  source tree can show this, so a test now asserts the field.
-- **The package told its own readers it was not published.** The install section named a git ref
-  and said the registry served 12.0.0, because that is what was true while the credential was
-  missing. Those words ship inside the tarball, so publishing 13.1.1 as it stood would have put
-  a package on the registry whose first section denies being there. `npm install -g
-  swarm-orchestrator` is the first line again.
-
-### Added
-
-- A description, keywords, a homepage and a bug-tracker link, which is what the registry page
-  renders around the readme and what a search on the registry matches against.
-- Three flags the readme never listed, `--base`, `--max-steps` and `--local-endpoint`, and a
-  pointer to `swarm --help` for the calibration flags it still does not list.
-
-`13.1.2` was tagged and refused by the registry for the manifest reason above. The tag is left
-where it is rather than moved, because it names a real tree and the refusal is part of the
-record.
-
-## 13.1.1
-
-A packaging fix. Nothing about how the tool runs changed.
-
-### Fixed
-
-- **Installing from a git ref produced a package with no binary.** `dist/` is not committed and
-  is built by a script, and npm runs `prepare` for a git install but never `prepublishOnly`.
-  Only the latter was declared, so `npm install github:moonrunnerkc/swarm-orchestrator#v13.1.0`
-  resolved, reported no error, and left a directory with no `dist/` and no `swarm`. This is the
-  install path that matters while the registry publish is blocked, and it was the one that did
-  not work.
-
-## 13.1.0
-
-A run you can watch and drive, and an end-of-run panel that shows you what it produced.
-Everything below is additive: no flag, command or output changed meaning, and the plain-line
-stream a pipe or a CI job reads is byte-for-byte what it was.
-
-### Added
-
-- **An interactive terminal interface.** On a TTY, a run draws a single screen: the task and
-  the model in a header, the plan, the action stream, the gate strip, and a status line.
-  Scroll it, expand a row to the whole tool input and output and the ledger record it came
-  from, filter it, freeze the render without touching the run, and press `?` for the keymap.
-  Two exits that are not the same thing: `q` leaves the view and lets the run finish, `ctrl+c`
-  cancels the run.
-- **An end-of-run evidence panel.** What the run produced, named by what each artifact is for,
-  with the record count and how many claims the harness verified against how many it refused.
-  One keystroke opens the review page, another the bundle directory. It says the bundle
-  verified only if the bundle's own verifier ran in that session and exited 0, and it names the
-  exit code; otherwise it says "not verified in this run" and prints the command.
-- **`swarm review <bundle directory>`**, which shows that same panel for any bundle already on
-  disk, running the same verifier. Nothing is re-run.
-- **`swarm --help`**, which used to report that `--help` needs a value.
-- **Screen flags**: `--no-tui` for plain lines even on a terminal, `--color` and `--no-color`,
-  `--open-evidence` and `--no-open-evidence`. Opening is opt-in and never happens off a
-  terminal.
-- **Three `swarm.toml` tables**: `[interface]` (`tui`, `color`, `open_evidence`), `[theme]`
-  (a colour per slot), and `[keys]` (a key per action). Flags win over the file, as everything
-  else does. An unknown key, colour or action is a typed error naming what was wrong and what
-  would have been accepted.
-- **Sampling settings on the wire for a calibration run**: temperature and top-p pinned and
-  recorded in every model-call record, with a seed per repeat. An ordinary task run sends
-  nothing and is unchanged.
-
-### Fixed
-
-- **Two consumers of one stdin.** The CLI built a readline interface on `process.stdin` while
-  Ink held the same stdin in raw mode. A confirmation firing mid-run raced them, which is the
-  least acceptable place to drop a keystroke. Confirmation is now a component inside the
-  running screen, answered by the same key dispatcher.
-- **The curated model shortlist and pricing table answered 404.** Both URLs named the branch
-  `main`, which is the v12 lineage and carries neither file, so `swarm select` fell back to the
-  bundled snapshot on every machine.
-- **A missing verifier read as a refused bundle.** Node exits 1 on a module it cannot find,
-  which at the exit code is the same as a verifier that ran and said no. One is the absence of
-  a verdict.
-- **Local models reported no tokens, and so cost nothing.** An OpenAI-compatible server streams
-  a usage chunk only when the request carries `stream_options.include_usage`, and the local
-  provider was not built to send it. Every local run recorded `outputTokens: 0`, so throughput
-  was unmeasurable and every run priced at `$0.0000`, which the routing reward is built from.
-  The router had been learning that local models are free.
-- **One keychain message for three different failures.** A key that could not be read, an entry
-  holding something that is not a key, and a keychain that would not accept a new one now say
-  which happened and what to do about it. The middle one names the service and the account, and
-  says the entry can be deleted.
-
-## 13.0.0
-
-Same package name, different product. If you installed `swarm-orchestrator` before this
-release, read this before upgrading: v13 is not a newer v12, and nothing in v12's interface
-survives.
-
-### What v12 was, and what v13 is
-
-v12 was a PR auditor. It ran as a GitHub Action, read pull requests opened by AI coding
-agents, looked for cheat patterns (test relaxation, mock-of-hallucination, assertion strip,
-no-op fix), posted findings as a comment, and gated merges.
-
-v13 is a coding agent. It does the work rather than auditing somebody else's, and every
-claim it makes about that work resolves to machine-captured evidence in a tamper-evident
-ledger. The two share a name and nothing else: no shared history, no shared interface, no
-migration path from one to the other, because there is nothing to migrate.
-
-### Breaking
-
-- **The `swarm-audit` and `swarm-orchestrator` binaries are gone.** One binary now, `swarm`.
-- **The GitHub Action is retired.** v13 ships no `action.yml`. There is no v13 equivalent of
-  the merge gate, and none is planned.
-- **Node 24 or newer.** v12 asked for 20. The floor is not stylistic: the coverage cycle
-  spawns the test runner with `--test-isolation=process`, which Node 22 rejects as a bad
-  option, so on anything older that arm measures nothing.
-- **The histories share no merge base.** v13 is a separate lineage. `git log` will not show
-  you v12's commits from here.
-
-### If you are using v12
-
-Stay on it. It is tagged `v12-final` and that tag is not going away.
-
-    npm install swarm-orchestrator@12.0.0
-
-That is the newest v12 the registry carries. The `v12-final` tag is at 12.1.1, which was
-tagged but never published, so `@12.1.1` does not resolve; install from the tag if you need
-exactly that tree.
-
-For the Action, pin the tag rather than a branch, since the default branch is moving to the
-v13 lineage:
-
-    uses: moonrunnerkc/swarm-orchestrator@v12-final
-
-### What v13 does
-
-One task, start to finish, in a git workspace: plan, edit through a chokepoint that records
-every tool call, run the gates, auto-resolve failures under a numeric ratchet, and export a
-signed evidence bundle a stranger can verify without installing anything.
-
-The parts worth knowing before you try it:
-
-- Gate results, claim verdicts and bundle status are computed by the harness. Model prose
-  renders as unverified narrative and cannot render green.
-- The ledger is append-only and hash-chained, signed with a key from the OS keychain.
-- The bundle carries its own verifier. `node verify.mjs <bundle>` needs Node and nothing
-  else.
-- Local model selection is measured on your hardware rather than guessed from model cards.
+## History
 
-`README.md` links each of those to a committed artifact of it happening. `docs/claims.md`
-maps every claim to its evidence, and lists what this tree cannot back.
+Versions 13.0.0 through 13.1.9 turned the package from v12's pull request auditor into a coding
+agent whose every completion claim resolved to harness-captured evidence in a hash-chained,
+signed ledger: a single tool chokepoint under a lexical path policy, gates declared as data, a
+numeric ratchet across retries, measured local model selection, and an offline verifier. Earlier
+major versions (v6 to v12) were a pull request auditor for AI-authored changes and share nothing
+with the current interface. The full entries are in this file's git history before the
+verifier-first rebuild.