swarm-orchestrator 14.4.0 → 16.0.1

package/CHANGELOG.md

@@ -1,8 +1,215 @@
 # Changelog: swarm-orchestrator
 
-The coding agent. The standalone verifier it is built on, `swarm-verify`, has its own changelog at
-[packages/swarm-verify/CHANGELOG.md](packages/swarm-verify/CHANGELOG.md); an agent release names
-the verifier version it carries rather than repeating those entries.
+The agent. The verifier it consumes, `swarm-verify`, has its own changelog in
+[moonrunnerkc/swarm-verify](https://github.com/moonrunnerkc/swarm-verify/blob/main/CHANGELOG.md).
+
+## 16.0.1 - 2026-11-03
+
+A patch release: three agent-loop defects and the swarm-verify 2.0.1 pin, from the follow-ups
+of the 16.0.0 acceptance run. No new option, command or format.
+
+### Fixed
+
+- **A rerun of a passing test command counted as progress.** The no-progress rule compared a
+  command's output byte for byte, and vitest prints its start time and duration on every run, so
+  one model ran the same passing test file 36 times until the step budget. The comparison now
+  takes out colour codes, clock times, timestamps, durations and temporary paths; the model still
+  reads the output as printed.
+- **The same requirements block, sent again without the completion marker, kept the run going.**
+  A model wrote "The task is complete" in prose 29 times running and never sent the marker. A
+  block that leaves the requirement record unchanged, right after another block, now stops the
+  loop as no progress, and finalization judges the tree.
+- **A relative path after `cd` was read from the workspace root.** `cd src/pkg && grep x
+  ../../tests` was refused as outside the workspace, and `cd .git && cat config` was checked as a
+  root file named `config` and allowed, though it reads `.git/config`, which the credential
+  denylist refuses. Each path is now read from the directory the command would open it in,
+  following `cd`, `pushd` and `chdir`; a `cd` the reader cannot name makes the command unreadable.
+- **swarm-verify 2.0.1**, pinned exactly. A refused dependency preparation is recorded as refused
+  and its replay meets the same refusal, where 2.0.0 recorded no preparation and the replay
+  diverged. A test file moved and edited (one more `.parent` to reach its fixtures) is judged by
+  its base version at the new path, where 2.0.0 read it as deleted and ran both copies. A judged
+  process ended by a signal no longer reads as tampering, and a worker thread its runner
+  terminated is named as unchecked rather than failing the held-out check; a relative `SWARM_HOME` keeps its sealed checks; the mutation pass no longer mutates
+  inside multi-line strings and comments. See swarm-verify's changelog.
+
+### Corrected
+
+- 16.0.0's known limit said the best cross-module refactor attempt (tracemantle) "broke the
+  module it moved". It did not: `history_io.py` was a working re-export, and the seven failures
+  are the tests that read fixtures, in a test file moved without the path to them. swarm-verify
+  2.0.0 also refused the correct move, which edits that path; that was the verifier defect fixed
+  in 2.0.1.
+- Rerun once against 2.0.1 with the same local model (gemma4-31b-greedy-128k, isolated, session
+  20261103T175257-900062), the task is still incomplete: the model moved both modules with working
+  shims and moved the three test files byte for byte, so the same seven fixture tests fail. 2.0.1
+  read the three moves and attributed the seven failures to them; the replay agrees. The
+  limitation stands, as a limit of the models tried: no local model has completed the task.
+
+### Added
+
+- docs/acceptance/2026-10-31/: the two isolated fix runs from real bug-fix commits, with the fix
+  commit's test sealed as a held-out check (`f-fix-isolated/`; neither completed, so the fix
+  category stays host-verified only), the comparison of t6 and h2 done by hand with the local
+  runs (`comparison/`), and the t6 rerun against 2.0.1 (`t6-tracemantle/closing-attempt-3/`).
+
+## 16.0.0 - 2026-11-01
+
+Swarm Orchestrator is the coding product again, and `swarm-verify` 2.0.0 is the verifier it
+consumes at an exact version. A task runs on a local model found on this machine, every
+requirement is checked against executed evidence, and the delivered patch comes with a signed
+attestation an independent replay can rerun. 15.0.0 was tagged but never published to npm.
+
+### Changed
+
+- **The verifier is a dependency, not a copy.** The embedded `src/verify`, its CLI modules and
+  `packages/swarm-verify` moved with their history to moonrunnerkc/swarm-verify (ADR 0015).
+  The agent depends on an exact `swarm-verify` version and calls its public API;
+  `swarm verify`, `swarm init` and `swarm ci` are the installed verifier's own commands. A
+  packed-consumer test installs both tarballs into a fresh prefix and runs a task through them.
+- Verification artifacts of `swarm run` are written into the session directory, outside the
+  workspace, one directory per verification.
+- `swarm verify` judges a declared test check test by test. It recognizes pytest, jest,
+  vitest, mocha and go test in the command, or in the `package.json` script the command names,
+  appends the runner's machine-readable report at base and with the change, and reads each
+  test as fixed, regressed, pre-existing, deleted or newly failing. A regression, a deletion
+  outside test files the change may edit, or a newly failing test fails the check; a test that
+  fails at both commits is reported and does not block. The verdict is measured whenever both
+  reports parse, whatever the command's exit code; it is unmeasured only when the command could
+  not run, its report could not be parsed, or no test in it passes with the change. A command
+  with no recognized runner is judged by exit code as before, and the verdict says so. See
+  [docs/verifying.md](https://github.com/moonrunnerkc/swarm-verify/blob/main/docs/verifying.md).
+
+### Added
+
+- **`swarm run` finds a local model itself.** With no `--model` or `--endpoint`, it lists
+  Ollama's installed models, estimates each one's memory at the context it would use (65,536
+  tokens, then 32,768), probes the ones that fit with a real turn of the shell protocol, and
+  chooses by the share of finished tasks each completed on this machine, recorded in
+  `~/.swarm/profiles/`; with too few recorded, the largest that fits. The reason is printed and
+  reported. `swarm doctor --models` shows the same survey; when nothing fits, it says what would.
+- **A requirement record**: R1 is the user's task verbatim; the model may add R2 and on and map
+  tests, checks, structure and package versions to each, and only the verifier sets a status.
+  The report lists every requirement with its evidence, the changed files (deletions named), the
+  model and why it was chosen, and the run's tokens, turns, inference and wall time.
+- **Repository instructions** (`AGENTS.md`, `CLAUDE.md`) load deterministically, digested into the
+  evidence, within a byte budget; they are input to the task, never to the security policy.
+- `--authorize-behavior-change` lets a test the base passes change its expectation where the change
+  witnesses the new behavior, and the report says so. `--review` adds one fresh-context review of a
+  completed change; it is off by default. `--host --linked-dependencies` verifies on the host with
+  the workspace's installed dependencies, reported as not isolated and not reproducible.
+
+### Fixed
+
+Root causes found running real tasks on local models (docs/acceptance/2026-10-31/):
+
+- **The agent pushed a branch to the repository its workspace came from**, in auto approval, and
+  cloned it to `/tmp` inside a `$(...)` command whose paths nothing checked. Pushes and package
+  publishes are refused in every approval mode; a command the shell reader cannot read is refused
+  under auto approval and asked of a person otherwise; `git stash`, which took a whole change out
+  of the delivered tree on a run's last step, is refused with how to see the base instead. The
+  reader now reads backslashes in double quotes and comments as the shell does.
+- **A slow model's last turn ran past the deadline** and final verification never ran: no turn
+  starts that the time left cannot pay for, measured by the longest turn so far. The model is told
+  once when a fifth of its turns or of its time remains.
+- **A Rapid-MLX reasoning parser moved the reply into `reasoning_content`**, which was dropped;
+  the reply is read from it where the content holds no reply form.
+- Ollama connections dropped mid-turn are sent again and counted; a non-JSON reply stops the run
+  with what to do instead of crashing it; SIGTERM and SIGHUP finalize a run as Ctrl-C does.
+- Compaction no longer tells the model to reread every file; a discovered model gets the largest
+  context it fits; the token budget defaults to what the steps could use at that context.
+- A completion repeated on an unchanged tree is answered once with the open findings, and a
+  command repeated while findings are open points back at them.
+- A blocked run stops with the verifier's reason; a run where no check ran says why; the summary
+  printed "0 s of inference" for an endpoint that reports none, and now says so.
+- The managed worktree sits beside the repository, so relative dependencies resolve.
+- **A run wrote into the user's repository through its git worktree.** A worktree shares the
+  repository's refs and config, so `git branch`, `git tag` and `git config` in auto approval
+  changed the user's own `.git`. The workspace is now a clone that reads the user's objects and
+  shares no refs, config or remote.
+- **"The latest 9.x" was delivered as Stryker 10.1.1 and reported complete**, twice: the only
+  version read was the model's own claim. The version constraints a task's wording states are
+  read into its first requirement by code, no proposal can change them, and the verifier holds
+  the lockfile to them. The summary and report show each requirement as worded, as the model read
+  it, the versions it is held to, and its status.
+- **The prompt grew with every turn**, the whole history resent on each: the
+  task and requirements stay at the front, recent turns are sent whole and older output as a
+  bounded excerpt with a reference to the whole, kept readable under `.swarm/outputs/`, and old
+  exploration is compacted without a model call only under measured pressure. `report.json`
+  records each turn's tokens.
+- **Path-shaped text in a quoted script was refused as a path** (a sed address, test source
+  written through printf): only the words a program opens are offered to the path check, sed and
+  awk scripts are read for the files they open, and a redirect target is checked wherever it is
+  written. A path after an option's equals sign (`--git-dir=/elsewhere`) is checked; it was not.
+- **A copied `.venv` ran the user's unchanged source.** The workspace's environment is built from
+  `uv.lock` (or the declared setup command, or, with no lock, `uv lock` first as the verifier
+  does) and the report names its interpreter.
+
+### Known limits
+
+- The cross-module refactor acceptance task (tracemantle: move two modules into a new package with
+  shims, and move their tests) has no complete run on the local models tried. The best attempt
+  broke the module it moved and the verifier found the regression; a narrower attempt changed
+  nothing. docs/acceptance/2026-10-31/t6-comparison/ holds the task, its base and a fixed
+  requirement record, so another agent's patch can be judged by the same verifier.
+
+### Migration
+
+- `swarm run` no longer needs `--model` and `--endpoint`; they still name a model and an
+  OpenAI-compatible endpoint where given. `--context` sets the context for a named model.
+- Commands that were run in auto approval and contained `$(...)`, backticks, subshells, brace
+  groups or `sh -c` are refused: write the inner command first and its result literally.
+- `swarm verify`, `swarm init` and `swarm ci` are the installed `swarm-verify` 2.0.0 commands; their
+  states, exit codes and predicate are described in swarm-verify's docs/migration-2.md.
+- The report is `swarm-orchestrator.report/v1` in `report.json` beside `report.md`, in the
+  session directory.
+
+## 15.0.0 - 2026-10-29
+
+The verifier-first rebuild ([ADR 0014](docs/adr/0014-verifier-first-rebuild.md)). The unreleased
+14.5.0 work (the adaptive controller, planned checks, repair and review stages) is superseded and
+remains in the history of pull request #101.
+
+### Changed
+
+- `swarm run "<task>"` is a single-bash-tool loop: one command per turn through the chokepoint
+  and path policy, the task, `git status --short` and the last verifier failure verbatim at the
+  top of every turn, and the verifier as the only judge of completion. It stops on a verified
+  tree, the step budget or the token budget, and says which. Every turn sends `max_tokens`
+  (`--turn-tokens`, 16,384 by default). A permanent endpoint failure (a refused connection, a
+  4xx other than 429, a third 5xx in a row) stops the run as `model-error`; the verifier still
+  judges the tree and the outcome block prints the reason and the verdict, and a `mutant` line
+  when the mutant of a changed line survived.
+- `swarm verify` and `swarm ci` rerun the declared checks on a change (working tree, ref range
+  or patch) in a clean checkout of the base, refuse protected paths changed together with
+  source, run held-out checks sealed with `swarm init --seal`, measure changed-line coverage
+  and one mutation, and write an in-toto Statement in a DSSE envelope inside a Sigstore bundle.
+  `packages/swarm-verify/verify.mjs` checks it with no dependencies; so does
+  `cosign verify-blob-attestation`.
+- Every check runs at the base commit first: one that fails there and still fails is a
+  `pre-existing-failure` and leaves the verdict unmeasured, one that passes there and fails with
+  the change is a regression. Held-out checks run with a judge loaded before any project module
+  that fails them when the code under test patches `node:assert`, `node:test`, `unittest`,
+  pytest's hooks, the builtins they compare with, or the project's own test helpers.
+  [docs/verifying.md](docs/verifying.md) has the details and the limits.
+- Checks run with `PYTHONDONTWRITEBYTECODE=1`: the base run, the change and the mutant rewrite
+  one file within a second, often at the same size, and Python would otherwise run the bytecode
+  cached from the previous version.
+
+### Added
+
+- The evaluation: Harbor runs of mini-SWE-agent, OpenCode and `swarm run` on frozen SWE-bench
+  Verified and Terminal-Bench 2.0 lists, a committed results store, a nightly workflow for a
+  self-hosted runner ([docs/eval.md](docs/eval.md)), and the tamper evaluation of the verifier.
+  [docs/results.md](docs/results.md) is the only page with measured numbers.
+
+### Removed
+
+- The parallel worker layer, model selection and calibration, the research evaluation code, the
+  terminal interface, the old gates engine, the custom evidence bundle format and its verifier,
+  the container isolation backend, and every subcommand except `verify`, `init`, `ci` and
+  `doctor`.
+- The research evidence, campaigns, red-team passes, fuzz targets and research scripts, moved to
+  the archive named in [docs/evidence/README.md](docs/evidence/README.md).
 
 ## 14.4.0 - 2026-10-08
 
@@ -45,7 +252,7 @@ carried is `swarm-verify` 1.3.1, whose engine is 1.3.0's.
 
 The coding agent, `swarm-orchestrator`, released for the first time since the verifier-first
 work began. The `swarm` binary shares its verifier with `swarm-verify`, so every change published
-for `swarm-verify` 1.0.0 through 1.3.0 (now in [packages/swarm-verify/CHANGELOG.md](packages/swarm-verify/CHANGELOG.md))
+for `swarm-verify` 1.0.0 through 1.3.0 (now in [swarm-verify's changelog](https://github.com/moonrunnerkc/swarm-verify/blob/main/CHANGELOG.md))
 is in this release too. What follows is what the
 agent itself gained; the verifier stays the primary product and the agent its advanced mode.
 
@@ -253,10 +460,10 @@ agent itself gained; the verifier stays the primary product and the agent its ad
   difference 0.0 points, 95% CI [-4.0, +4.0]. Three repairs changed bytes, none narrowed the
   implementation, two left scratch files behind. Six of the nine refusals named a tsd type-test
   file no runner executes. The protocol, rows, patches and a report that re-derives from the rows
-  are in [`docs/evidence/2026-09-17/reach-pressure-experiment/`](docs/evidence/2026-09-17/reach-pressure-experiment/report.md).
+  are in the archive's [docs/evidence/2026-09-17/reach-pressure-experiment/](https://github.com/moonrunnerkc/swarm-orchestrator-archive/blob/main/docs/evidence/2026-09-17/reach-pressure-experiment/report.md).
   Two earlier generations were stopped on instrument defects and are kept beside it. The instrument
   defects it exposed, and what closed each without touching a row, are in
-  [`docs/evidence/2026-09-18/reach-pressure-hardening/`](docs/evidence/2026-09-18/reach-pressure-hardening/README.md).
+  the archive's [docs/evidence/2026-09-18/reach-pressure-hardening/](https://github.com/moonrunnerkc/swarm-orchestrator-archive/blob/main/docs/evidence/2026-09-18/reach-pressure-hardening/README.md).
 
 ### Changed
 
@@ -810,290 +1017,12 @@ agent itself gained; the verifier stays the primary product and the agent its ad
   reason, at the line that carries the finding. Under the workflow's own command it now reports
   zero and exits 0, so the weekly issue means something arrived that nobody has looked at.
 
-## 13.1.9
-
-### Added
-
-- **A line that says the run is alive, and what it is doing.** A spinner that turns, the current
-  activity, how long it has been going, and while the model is talking, the tail of what it is
-  saying. Nothing on the screen moved before this: the status said `thinking (step 3)` and
-  stayed there, and the only thing that changed was a seconds counter the layout hides below 80
-  columns or 12 rows, so a run taking a minute looked exactly like one that had hung.
-- **The model's words as they arrive.** The stream was already being drained to time the first
-  token and every piece of text was discarded. It is handed on now. One line of it: the whole
-  response lands in the action stream when it arrives and in the ledger for ever, and repeating
-  it as it streams would be the same text three times.
-- **The tool that is running, named while it runs.** Between a tool starting and finishing
-  nothing was emitted, which for a shell command is a screen sitting still for a minute and a
-  half. A tool that finishes inside a frame still draws nothing, which is the right amount.
-
-## 13.1.8
-
-### Added
-
-- **`swarm doctor`, and `swarm doctor --fix`.** What owns the `swarm` command, and repairing it
-  when the answer is wrong. The same failure has happened on two machines months apart and
-  presented as something else both times: an `ENOTDIR` during a global install on one, and on
-  the other a `swarm` with no `select` command. Both were a development checkout linked into the
-  global prefix with `npm link`, which owns the command until it is removed and which npm cannot
-  install over. Nothing here can intercept that at install time, because npm fails before any
-  script of ours would run, so this answers the question afterwards instead. It reports the link
-  and what it shadows, every `swarm` on PATH since the first one wins silently, an executable
-  whose package a failed install removed, and whether the registry is ahead of what is running.
-
-### Fixed
-
-- **A bare word that is nearly a subcommand is refused.** A bare word is the task, which is what
-  makes `swarm fix the parser` work. The cost is that a subcommand a build does not have becomes
-  a task: running `swarm doctor` against a version predating it started an agent on the
-  repository, declared its uncommitted files and wrote a bundle. Nothing was damaged and nothing
-  about it looked wrong. One word that is nearly a command is now refused with the nearest match
-  named, and a task of more than one word is untouched.
-
-## 13.1.7
-
-Found by driving the session through a real terminal rather than a pipe.
-
-### Fixed
-
-- **Enter did not submit at the prompt.** A terminal hands over what it buffered in one read, so
-  the newline arrived inside a longer chunk with no key flag set, and the whole chunk including
-  the control character was typed into the task being composed. A pasted task arrives the same
-  way, so everything before the newline is now typed and the newline still means run it.
-- **The screen still showed a plain `DONE` for a run that changed nothing.** The gate strip
-  cannot tell passes over work from passes over an empty diff, and a model answering in prose
-  stops for the honest reason `completed` having done nothing. It now reads `DONE, but no files
-  changed`. The plain path already said this above its gate table.
-
-## 13.1.6
-
-A session, and the evidence a person reads.
-
-### Added
-
-- **`swarm` with no task opens a session.** One process, one ledger, tasks typed one after
-  another, each continuing the conversation the last one left. The screen keeps what each
-  finished turn came to, so it does not forget between them. `swarm "task"` is unchanged.
-- **Each turn is measured on its own.** A turn ends by recording where it left the tree, so the
-  next turn's gates see that turn's changes and not the ones before it. Without it the second
-  turn is charged with the first's diff and the file-set check calls the first turn's files
-  out-of-set.
-- **The review page says what happened.** The header carries the tasks, the model, whether the
-  loop completed, how long it took and what it cost, above the identifiers it used to open with.
-- **The gate table is in the bundle.** It was printed to a terminal and never written into the
-  page, where the gates had been indistinguishable cards among the model calls.
-- **The change itself is recorded and shown.** Nothing recorded a patch, so the question the
-  page exists to answer, what did this do to my code, meant leaving the evidence and running git.
-
-### Fixed
-
-- **A run that changed nothing reported `DONE`.** The gates run after the loop and each gate
-  event rewrote the status, so the last gate to pass over an empty diff became the last word on
-  a run that built nothing. The stop reason is now its own field, and a cycle that measured no
-  changed files says so before the table.
-- **A second turn measured its own edits as deletions.** `git diff <base>` from the person's
-  index calls a file that is in the base and untracked here deleted. Changes are now measured
-  through a scratch index, which makes the comparison tree to tree and counts a file the agent
-  just wrote as added.
-- **`q` did not leave the view.** It set a flag that three things read after the fact; nothing
-  unmounted the screen, which kept painting. It now comes down and the run reports the way it
-  does off a terminal.
-- **A refused bundle named nothing.** The failing check was read off stderr and the verifier
-  reports through stdout, so every real refusal said "no detail given" at the one moment the
-  panel exists for.
-- Six record types rendered as their own bare name on the page, including the one holding what
-  the run cost.
-
-## 13.1.5
-
-Three fixes, all found by running the tool rather than by reading it.
-
-### Fixed
-
-- **A routed model the backend does not serve reached dispatch.** The router picks from what a
-  calibration measured, and a calibration is a record of a machine at a moment; the backend
-  answering today is a separate fact, and the two drift. A model pulled into Ollama, discovery
-  preferring rapid-mlx, and the router handed over a name that endpoint had never heard of. It
-  answered `Not Found` three times and the run stopped at zero steps. The served list is now
-  asked before dispatch, and a served local model, then a frontier provider whose key is set,
-  answers instead. Substitutions are announced and recorded.
-- **A run that built nothing reported `DONE`.** The gates run after the loop and every gate
-  event rewrote the status line, so the last gate to pass became the last word on the run. A
-  loop that stopped at step zero displayed `DONE gate diff-budget: passed` in the success
-  colour, over an empty diff. The stop reason is now its own field and the outcome leads with it.
-- **`git diff` outside a repository printed its whole option list.** One line of diagnosis
-  followed by a hundred lines about `--dirstat`, with the sentence saying what to do at the
-  bottom. Now one line, and it says to run `git init`.
-
-## 13.1.4
-
-### Fixed
-
-- **The readme printed an install command that cannot work.** It offered
-  `npm install -g github:owner/repo#tag` beside the registry line. `dist/` is not committed, so a
-  git ref builds itself on install and needs this package's devDependencies to do it, and npm
-  does not install those under `-g`: it carries the global context into its git-dependency
-  preparation, places the clone as a root package rather than building a tree inside it, and runs
-  `prepare` without the compiler. The same ref installed without `-g` works and always did. Found
-  by a person running the line the readme printed.
-- **That failure surfaced as `ENOENT` on a path the reader never typed.** The build now names the
-  cause and the two commands that do work, rather than reporting a missing file.
-
-## 13.1.3
-
-The first 13.x on the npm registry. No behaviour changed: this is 13.1.1 with a manifest the
-registry accepts and install instructions that are true.
-
-### Fixed
-
-- **The manifest named no repository, so a signed publish was refused.** `npm publish
-  --provenance` signs a statement naming the repository the tarball was built from, and the
-  registry checks it against `repository.url` before it accepts the write. That field was
-  absent, so the statement said one thing and the manifest said `""`, and the registry answered
-  `E422` after the provenance had already been written to the transparency log. Nothing in the
-  source tree can show this, so a test now asserts the field.
-- **The package told its own readers it was not published.** The install section named a git ref
-  and said the registry served 12.0.0, because that is what was true while the credential was
-  missing. Those words ship inside the tarball, so publishing 13.1.1 as it stood would have put
-  a package on the registry whose first section denies being there. `npm install -g
-  swarm-orchestrator` is the first line again.
-
-### Added
-
-- A description, keywords, a homepage and a bug-tracker link, which is what the registry page
-  renders around the readme and what a search on the registry matches against.
-- Three flags the readme never listed, `--base`, `--max-steps` and `--local-endpoint`, and a
-  pointer to `swarm --help` for the calibration flags it still does not list.
-
-`13.1.2` was tagged and refused by the registry for the manifest reason above. The tag is left
-where it is rather than moved, because it names a real tree and the refusal is part of the
-record.
-
-## 13.1.1
-
-A packaging fix. Nothing about how the tool runs changed.
-
-### Fixed
-
-- **Installing from a git ref produced a package with no binary.** `dist/` is not committed and
-  is built by a script, and npm runs `prepare` for a git install but never `prepublishOnly`.
-  Only the latter was declared, so `npm install github:moonrunnerkc/swarm-orchestrator#v13.1.0`
-  resolved, reported no error, and left a directory with no `dist/` and no `swarm`. This is the
-  install path that matters while the registry publish is blocked, and it was the one that did
-  not work.
-
-## 13.1.0
-
-A run you can watch and drive, and an end-of-run panel that shows you what it produced.
-Everything below is additive: no flag, command or output changed meaning, and the plain-line
-stream a pipe or a CI job reads is byte-for-byte what it was.
-
-### Added
-
-- **An interactive terminal interface.** On a TTY, a run draws a single screen: the task and
-  the model in a header, the plan, the action stream, the gate strip, and a status line.
-  Scroll it, expand a row to the whole tool input and output and the ledger record it came
-  from, filter it, freeze the render without touching the run, and press `?` for the keymap.
-  Two exits that are not the same thing: `q` leaves the view and lets the run finish, `ctrl+c`
-  cancels the run.
-- **An end-of-run evidence panel.** What the run produced, named by what each artifact is for,
-  with the record count and how many claims the harness verified against how many it refused.
-  One keystroke opens the review page, another the bundle directory. It says the bundle
-  verified only if the bundle's own verifier ran in that session and exited 0, and it names the
-  exit code; otherwise it says "not verified in this run" and prints the command.
-- **`swarm review <bundle directory>`**, which shows that same panel for any bundle already on
-  disk, running the same verifier. Nothing is re-run.
-- **`swarm --help`**, which used to report that `--help` needs a value.
-- **Screen flags**: `--no-tui` for plain lines even on a terminal, `--color` and `--no-color`,
-  `--open-evidence` and `--no-open-evidence`. Opening is opt-in and never happens off a
-  terminal.
-- **Three `swarm.toml` tables**: `[interface]` (`tui`, `color`, `open_evidence`), `[theme]`
-  (a colour per slot), and `[keys]` (a key per action). Flags win over the file, as everything
-  else does. An unknown key, colour or action is a typed error naming what was wrong and what
-  would have been accepted.
-- **Sampling settings on the wire for a calibration run**: temperature and top-p pinned and
-  recorded in every model-call record, with a seed per repeat. An ordinary task run sends
-  nothing and is unchanged.
-
-### Fixed
-
-- **Two consumers of one stdin.** The CLI built a readline interface on `process.stdin` while
-  Ink held the same stdin in raw mode. A confirmation firing mid-run raced them, which is the
-  least acceptable place to drop a keystroke. Confirmation is now a component inside the
-  running screen, answered by the same key dispatcher.
-- **The curated model shortlist and pricing table answered 404.** Both URLs named the branch
-  `main`, which is the v12 lineage and carries neither file, so `swarm select` fell back to the
-  bundled snapshot on every machine.
-- **A missing verifier read as a refused bundle.** Node exits 1 on a module it cannot find,
-  which at the exit code is the same as a verifier that ran and said no. One is the absence of
-  a verdict.
-- **Local models reported no tokens, and so cost nothing.** An OpenAI-compatible server streams
-  a usage chunk only when the request carries `stream_options.include_usage`, and the local
-  provider was not built to send it. Every local run recorded `outputTokens: 0`, so throughput
-  was unmeasurable and every run priced at `$0.0000`, which the routing reward is built from.
-  The router had been learning that local models are free.
-- **One keychain message for three different failures.** A key that could not be read, an entry
-  holding something that is not a key, and a keychain that would not accept a new one now say
-  which happened and what to do about it. The middle one names the service and the account, and
-  says the entry can be deleted.
-
-## 13.0.0
-
-Same package name, different product. If you installed `swarm-orchestrator` before this
-release, read this before upgrading: v13 is not a newer v12, and nothing in v12's interface
-survives.
-
-### What v12 was, and what v13 is
-
-v12 was a PR auditor. It ran as a GitHub Action, read pull requests opened by AI coding
-agents, looked for cheat patterns (test relaxation, mock-of-hallucination, assertion strip,
-no-op fix), posted findings as a comment, and gated merges.
-
-v13 is a coding agent. It does the work rather than auditing somebody else's, and every
-claim it makes about that work resolves to machine-captured evidence in a tamper-evident
-ledger. The two share a name and nothing else: no shared history, no shared interface, no
-migration path from one to the other, because there is nothing to migrate.
-
-### Breaking
-
-- **The `swarm-audit` and `swarm-orchestrator` binaries are gone.** One binary now, `swarm`.
-- **The GitHub Action is retired.** v13 ships no `action.yml`. There is no v13 equivalent of
-  the merge gate, and none is planned.
-- **Node 24 or newer.** v12 asked for 20. The floor is not stylistic: the coverage cycle
-  spawns the test runner with `--test-isolation=process`, which Node 22 rejects as a bad
-  option, so on anything older that arm measures nothing.
-- **The histories share no merge base.** v13 is a separate lineage. `git log` will not show
-  you v12's commits from here.
-
-### If you are using v12
-
-Stay on it. It is tagged `v12-final` and that tag is not going away.
-
-    npm install swarm-orchestrator@12.0.0
-
-That is the newest v12 the registry carries. The `v12-final` tag is at 12.1.1, which was
-tagged but never published, so `@12.1.1` does not resolve; install from the tag if you need
-exactly that tree.
-
-For the Action, pin the tag rather than a branch, since the default branch is moving to the
-v13 lineage:
-
-    uses: moonrunnerkc/swarm-orchestrator@v12-final
-
-### What v13 does
-
-One task, start to finish, in a git workspace: plan, edit through a chokepoint that records
-every tool call, run the gates, auto-resolve failures under a numeric ratchet, and export a
-signed evidence bundle a stranger can verify without installing anything.
-
-The parts worth knowing before you try it:
-
-- Gate results, claim verdicts and bundle status are computed by the harness. Model prose
-  renders as unverified narrative and cannot render green.
-- The ledger is append-only and hash-chained, signed with a key from the OS keychain.
-- The bundle carries its own verifier. `node verify.mjs <bundle>` needs Node and nothing
-  else.
-- Local model selection is measured on your hardware rather than guessed from model cards.
+## History
 
-`README.md` links each of those to a committed artifact of it happening. `docs/claims.md`
-maps every claim to its evidence, and lists what this tree cannot back.
+Versions 13.0.0 through 13.1.9 turned the package from v12's pull request auditor into a coding
+agent whose every completion claim resolved to harness-captured evidence in a hash-chained,
+signed ledger: a single tool chokepoint under a lexical path policy, gates declared as data, a
+numeric ratchet across retries, measured local model selection, and an offline verifier. Earlier
+major versions (v6 to v12) were a pull request auditor for AI-authored changes and share nothing
+with the current interface. The full entries are in this file's git history before the
+verifier-first rebuild.