synergyspec-selfevolving 2.1.5 → 2.1.7

package/dist/core/self-evolution/host-harness.js

@@ -34,17 +34,18 @@ const HARNESSES = ['claude', 'codex', 'opencode'];
 export const DEFAULT_AGENT_TIMEOUT_MS = 600_000;
 /**
  * Per-host absolute-timeout defaults. claude/codex keep the 10-min
- * {@link DEFAULT_AGENT_TIMEOUT_MS}; opencode is given a lower wall because — in
- * the v2.1.2 smoke run — an opencode/GPT-5.5 print-mode spawn emitted ZERO
- * output and burned the full 10 minutes before the wall fired (the host CLI is
- * empirically slow-to-emit / occasionally non-terminating in `run` print mode).
+ * {@link DEFAULT_AGENT_TIMEOUT_MS}; opencode gets a longer wall because the
+ * v2.1.5 Windows/OpenCode smoke run reached reward/scoring, then killed the
+ * evolving agent at the previous 5-min wall while it was still producing a
+ * bounded candidate. The idle watchdog remains the earlier trip wire for silent
+ * wedges, so the absolute wall should be large enough for a live edit attempt.
  * The wall is still overridable per-host via
  * `SYNERGYSPEC_SELFEVOLVING_AGENT_TIMEOUT_MS` ({@link resolveAgentTimeoutMs}).
  */
 const HARNESS_TIMEOUT_DEFAULTS_MS = {
     claude: DEFAULT_AGENT_TIMEOUT_MS,
     codex: DEFAULT_AGENT_TIMEOUT_MS,
-    opencode: 300_000,
+    opencode: 900_000,
 };
 /**
  * Default STDOUT/STDERR-idle watchdog window (2 min). If a spawned host CLI
@@ -62,11 +63,13 @@ export const DEFAULT_AGENT_IDLE_TIMEOUT_MS = 120_000;
  * emit ZERO bytes for well over 2 min while it reasons, so claude/codex get a
  * 5-min idle leash. opencode keeps the tighter 2-min window — it is the
  * empirically-wedging host (the v2.1.2 hang emitted no output at all) and a
- * faster idle kill is what we want there.
+ * faster idle kill is what we want there. opencode's absolute wall is longer
+ * than claude/codex because its live edit attempts can be slower even when they
+ * are not silent.
  *
  * INVARIANT: every harness's idle default is strictly LESS than its absolute
  * default ({@link HARNESS_TIMEOUT_DEFAULTS_MS}) so the idle watchdog stays the
- * earlier trip wire (claude 300<600, codex 300<600, opencode 120<300).
+ * earlier trip wire (claude 300<600, codex 300<600, opencode 120<900).
  * Overridable per host via `SYNERGYSPEC_SELFEVOLVING_AGENT_IDLE_TIMEOUT_MS`
  * ({@link resolveIdleTimeoutMs}).
  */
@@ -125,8 +128,8 @@ const AGENT_TIMEOUT_ENV = 'SYNERGYSPEC_SELFEVOLVING_AGENT_TIMEOUT_MS';
  *   (1) `SYNERGYSPEC_SELFEVOLVING_AGENT_TIMEOUT_MS` when it parses to a positive
  *       finite integer — a host-wide tunable that overrides every harness.
  *   (2) the per-harness default ({@link HARNESS_TIMEOUT_DEFAULTS_MS}): the 10-min
- *       {@link DEFAULT_AGENT_TIMEOUT_MS} for claude/codex, a lower wall for the
- *       empirically slow-to-emit opencode.
+ *       {@link DEFAULT_AGENT_TIMEOUT_MS} for claude/codex, and a longer wall for
+ *       opencode live edit attempts.
  *
  * `harness` omitted ⇒ {@link resolveHostHarness} is consulted so the default is
  * host-appropriate.
@@ -150,25 +153,25 @@ function isAgentHarness(value) {
  * Precedence:
  *   (a) `SYNERGYSPEC_SELFEVOLVING_HOST_HARNESS` when it equals claude|codex|opencode.
  *   (b) Heuristic on the ambient environment:
- *       - `CODEX_HOME` or any `CODEX_*` var set → 'codex'.
  *       - `OPENCODE_DATA_DIR` or any `OPENCODE_*` var set → 'opencode'.
+ *       - `CODEX_HOME` or any `CODEX_*` var set → 'codex'.
  *   (c) Default 'claude'.
  *
- * Codex is checked before opencode so that, in the unlikely event both families
- * of env vars are present, the explicit override remains the only way to force a
- * choice; the heuristic is best-effort.
+ * OpenCode is checked before Codex because Codex can be the meta-runner that is
+ * invoking an OpenCode smoke test; in that mixed environment OPENCODE_* is the
+ * stronger signal for the observed run whose trajectory we must grade.
  */
 export function resolveHostHarness() {
     const override = process.env.SYNERGYSPEC_SELFEVOLVING_HOST_HARNESS;
     if (isAgentHarness(override))
         return override;
     const envKeys = Object.keys(process.env);
-    const hasCodex = process.env.CODEX_HOME !== undefined || envKeys.some((k) => k.startsWith('CODEX_'));
-    if (hasCodex)
-        return 'codex';
     const hasOpencode = process.env.OPENCODE_DATA_DIR !== undefined || envKeys.some((k) => k.startsWith('OPENCODE_'));
     if (hasOpencode)
         return 'opencode';
+    const hasCodex = process.env.CODEX_HOME !== undefined || envKeys.some((k) => k.startsWith('CODEX_'));
+    if (hasCodex)
+        return 'codex';
     return 'claude';
 }
 // ---------------------------------------------------------------------------
@@ -194,14 +197,23 @@ function hostHarnessPath(repoRoot) {
  * spawns, never a precondition for the current run.
  */
 export async function persistHostHarness(repoRoot, harness) {
+    let tmpFile = null;
     try {
         const file = hostHarnessPath(repoRoot);
         await fs.mkdir(path.dirname(file), { recursive: true });
-        await fs.writeFile(file, `${JSON.stringify({ harness }, null, 2)}\n`, 'utf8');
+        tmpFile = path.join(path.dirname(file), `${HOST_HARNESS_FILE}.${process.pid}.${Date.now()}.${Math.random().toString(36).slice(2)}.tmp`);
+        await fs.writeFile(tmpFile, `${JSON.stringify({ harness }, null, 2)}\n`, 'utf8');
+        await fs.rename(tmpFile, file);
+        tmpFile = null;
     }
     catch {
         // Swallow: a read-only or transient FS must not break the loop.
     }
+    finally {
+        if (tmpFile) {
+            await fs.unlink(tmpFile).catch(() => undefined);
+        }
+    }
 }
 /**
  * Read + parse + validate the persisted-harness sidecar. Returns the
@@ -253,18 +265,16 @@ function binaryResolvable(binary) {
         if (binary.trim().length === 0)
             return false;
         const isWindows = process.platform === 'win32';
-        // Windows PATHEXT (e.g. `.COM;.EXE;.BAT;.CMD`); also try the bare name (a
-        // binary may already carry its extension).
-        const exts = isWindows
-            ? ['', ...(process.env.PATHEXT ?? '.COM;.EXE;.BAT;.CMD').split(';').filter(Boolean)]
-            : [''];
+        // Windows PATHEXT (e.g. `.COM;.EXE;.BAT;.CMD`). A bare extensionless npm
+        // shim is not a CreateProcess target; prefer the PATHEXT-resolved .cmd/.exe.
+        const exts = executableExtensions(binary, isWindows, process.env.PATHEXT);
         const isExecutableFile = (candidate) => {
             try {
                 const st = statSync(candidate);
                 if (!st.isFile())
                     return false;
                 if (isWindows)
-                    return true; // Windows has no executable bit; existence + ext suffices.
+                    return isWindowsSpawnCompatibleExecutable(candidate);
                 // POSIX: any execute bit (owner/group/other) marks it runnable.
                 return (st.mode & 0o111) !== 0;
             }
@@ -314,8 +324,11 @@ function persistedBinary(harness) {
  *       wrong binary,
  *   (4) 'claude'.
  *
- * When (1) or (2) resolve CONFIDENTLY from a real env signal, the result is
- * persisted best-effort (fire-and-forget) so a later env-less call recovers it.
+ * This resolver is read-only. Command entry points that need to seed an
+ * env-less subagent call `seedHostHarnessForRepo`; keeping this function pure
+ * matters because learn preview/report generation uses it during trajectory
+ * lookup and must not write sidecar files.
+ *
  * The env checks are replicated inline (rather than only calling the sync
  * {@link resolveHostHarness}) precisely so we can tell "env gave a real signal"
  * apart from "defaulted to claude with no signal" — the sync resolver collapses
@@ -325,24 +338,21 @@ export async function resolveHostHarnessDetailsForRepo(repoRoot) {
     // (1) explicit override.
     const override = process.env.SYNERGYSPEC_SELFEVOLVING_HOST_HARNESS;
     if (isAgentHarness(override)) {
-        void persistHostHarness(repoRoot, override);
         return { harness: override, source: 'override' };
     }
     // (2) env heuristic — only a POSITIVE hit counts (mirrors resolveHostHarness'
-    //     CODEX_-before-OPENCODE_ ordering, but distinguishes a real signal from
+    //     OPENCODE_-before-CODEX_ ordering, but distinguishes a real signal from
     //     the 'claude' fall-through).
     const envKeys = Object.keys(process.env);
-    const hasCodex = process.env.CODEX_HOME !== undefined || envKeys.some((k) => k.startsWith('CODEX_'));
-    if (hasCodex) {
-        void persistHostHarness(repoRoot, 'codex');
-        return { harness: 'codex', source: 'env' };
-    }
     const hasOpencode = process.env.OPENCODE_DATA_DIR !== undefined ||
         envKeys.some((k) => k.startsWith('OPENCODE_'));
     if (hasOpencode) {
-        void persistHostHarness(repoRoot, 'opencode');
         return { harness: 'opencode', source: 'env' };
     }
+    const hasCodex = process.env.CODEX_HOME !== undefined || envKeys.some((k) => k.startsWith('CODEX_'));
+    if (hasCodex) {
+        return { harness: 'codex', source: 'env' };
+    }
     // (3) persisted sidecar (the env-less-subagent recovery path) — honored ONLY
     //     when its binary is resolvable here. The persisted value for codex /
     //     opencode IS the binary name; probing it on PATH skips a wrong/stale
@@ -358,14 +368,27 @@ export async function resolveHostHarnessDetailsForRepo(repoRoot) {
 export async function resolveHostHarnessForRepo(repoRoot) {
     return (await resolveHostHarnessDetailsForRepo(repoRoot)).harness;
 }
+/**
+ * Resolve the host harness and persist only a confident host signal (explicit
+ * override or CODEX_/OPENCODE_ env). This is the side-effecting entry point for
+ * command handlers that are about to spawn env-less subagents; core report and
+ * trajectory readers should use the read-only resolver above.
+ */
+export async function seedHostHarnessForRepo(repoRoot) {
+    const resolution = await resolveHostHarnessDetailsForRepo(repoRoot);
+    if (resolution.source === 'override' || resolution.source === 'env') {
+        await persistHostHarness(repoRoot, resolution.harness);
+    }
+    return resolution;
+}
 /**
  * Build the concrete `{binary, args, useStdin}` invocation for a headless run.
  *
  * Full escape hatch: if `SYNERGYSPEC_CODE_AGENT_COMMAND` is set, it is parsed as a
- * JSON `string[]` template. The literal tokens `{prompt}` and `{cwd}` are
- * substituted in each element; `binary = template[0]`, `args = template.slice(1)`.
- * `useStdin` is inferred — true iff the template does NOT contain a `{prompt}`
- * token anywhere (so the caller streams the prompt to stdin instead).
+ * JSON `string[]` template. The literal token `{cwd}` is substituted in each
+ * element; `binary = template[0]`, `args = template.slice(1)`. `{prompt}` is
+ * deliberately rejected: loop-v2 prompts are too large for argv and must flow
+ * through stdin for every harness and override.
  *
  * Otherwise the command is derived from the harness (default
  * {@link resolveHostHarness}). Every harness streams the prompt over stdin
@@ -385,12 +408,14 @@ export function buildHeadlessCommand(prompt, opts) {
             throw new Error('SYNERGYSPEC_CODE_AGENT_COMMAND must be a non-empty JSON array of strings');
         }
         const rawTemplate = parsed;
-        const useStdin = !rawTemplate.some((e) => e.includes('{prompt}'));
-        const substituted = rawTemplate.map((e) => e.split('{prompt}').join(prompt).split('{cwd}').join(opts.cwd));
+        if (rawTemplate.some((e) => e.includes('{prompt}'))) {
+            throw new Error('SYNERGYSPEC_CODE_AGENT_COMMAND must not contain {prompt}; prompts are always streamed over stdin');
+        }
+        const substituted = rawTemplate.map((e) => e.split('{cwd}').join(opts.cwd));
         return {
             binary: substituted[0],
             args: substituted.slice(1),
-            useStdin,
+            useStdin: true,
         };
     }
     const harness = opts.harness ?? resolveHostHarness();
@@ -422,6 +447,110 @@ export function buildHeadlessCommand(prompt, opts) {
         }
     }
 }
+export function resolveHeadlessCommandForSpawn(command, opts = {}) {
+    const platform = opts.platform ?? process.platform;
+    if (platform !== 'win32') {
+        return { ...command, shell: false };
+    }
+    const resolved = resolveWindowsExecutable(command.binary, {
+        env: opts.env ?? process.env,
+        isExecutableFile: opts.isExecutableFile ??
+            ((candidate) => {
+                try {
+                    return statSync(candidate).isFile();
+                }
+                catch {
+                    return false;
+                }
+            }),
+    });
+    const binary = resolved ?? command.binary;
+    if (isUnsupportedWindowsExecutable(binary)) {
+        throw new Error(`Windows headless agent binary '${binary}' has unsupported extension '${path.win32
+            .extname(binary)
+            .toLowerCase()}'; use a .cmd, .bat, .exe, or .com shim, or invoke the interpreter explicitly via SYNERGYSPEC_CODE_AGENT_COMMAND.`);
+    }
+    if (isWindowsShellScript(binary)) {
+        const wrapper = wrapWindowsShellScript(binary, command.args, opts.env ?? process.env);
+        return {
+            ...command,
+            binary: wrapper.binary,
+            args: wrapper.args,
+            shell: false,
+        };
+    }
+    return {
+        ...command,
+        binary,
+        shell: false,
+    };
+}
+function executableExtensions(binary, isWindows, pathext) {
+    if (!isWindows)
+        return [''];
+    if (path.win32.extname(binary))
+        return [''];
+    return (pathext ?? '.COM;.EXE;.BAT;.CMD')
+        .split(';')
+        .map((ext) => ext.trim())
+        .filter(Boolean);
+}
+function resolveWindowsExecutable(binary, opts) {
+    if (!binary || binary.trim().length === 0)
+        return null;
+    const exts = executableExtensions(binary, true, opts.env.PATHEXT);
+    const candidates = [];
+    const hasPathSeparator = binary.includes('/') || binary.includes('\\');
+    if (hasPathSeparator) {
+        candidates.push(...exts.map((ext) => binary + ext));
+    }
+    else {
+        const entries = (opts.env.PATH ?? '').split(';').filter(Boolean);
+        for (const dir of entries) {
+            for (const ext of exts)
+                candidates.push(path.win32.join(dir, binary + ext));
+        }
+    }
+    let firstUnsupported = null;
+    for (const candidate of candidates) {
+        if (!opts.isExecutableFile(candidate, true))
+            continue;
+        if (isWindowsSpawnCompatibleExecutable(candidate))
+            return candidate;
+        firstUnsupported ??= candidate;
+    }
+    if (firstUnsupported) {
+        throw new Error(`Windows headless agent binary resolved to '${firstUnsupported}', but that extension cannot be spawned with shell:false; use a .cmd, .bat, .exe, or .com shim, or invoke the interpreter explicitly via SYNERGYSPEC_CODE_AGENT_COMMAND.`);
+    }
+    return null;
+}
+function isWindowsShellScript(binary) {
+    const ext = path.win32.extname(binary).toLowerCase();
+    return ext === '.cmd' || ext === '.bat';
+}
+function isWindowsSpawnCompatibleExecutable(binary) {
+    const ext = path.win32.extname(binary).toLowerCase();
+    return ext === '' || ext === '.com' || ext === '.exe' || ext === '.bat' || ext === '.cmd';
+}
+function isUnsupportedWindowsExecutable(binary) {
+    const ext = path.win32.extname(binary).toLowerCase();
+    return ext.length > 0 && !isWindowsSpawnCompatibleExecutable(binary);
+}
+function wrapWindowsShellScript(binary, args, env) {
+    const comspec = firstNonBlankEnv(env, 'ComSpec', 'COMSPEC') ?? 'cmd.exe';
+    return {
+        binary: comspec,
+        args: ['/d', '/s', '/c', 'call', binary, ...args],
+    };
+}
+function firstNonBlankEnv(env, ...keys) {
+    for (const key of keys) {
+        const value = env[key];
+        if (typeof value === 'string' && value.trim().length > 0)
+            return value;
+    }
+    return undefined;
+}
 /**
  * The claude-default binary fallback: `SYNERGYSPEC_SELFEVOLVING_CLAUDE_BIN` when
  * non-empty, else `'claude'`. Kept here so {@link buildHeadlessCommand} is the
@@ -457,16 +586,27 @@ function claudeDefaultBinary() {
  */
 export async function runHeadlessAgent(prompt, opts) {
     const spawnImpl = opts.spawn ?? nodeSpawn;
-    const command = buildHeadlessCommand(prompt, {
-        cwd: opts.cwd,
-        harness: opts.harness,
-        binaryOverride: opts.binaryOverride,
-    });
+    let spawnCommand;
+    try {
+        const command = buildHeadlessCommand(prompt, {
+            cwd: opts.cwd,
+            harness: opts.harness,
+            binaryOverride: opts.binaryOverride,
+        });
+        spawnCommand = resolveHeadlessCommandForSpawn(command);
+    }
+    catch (e) {
+        return {
+            exitCode: -1,
+            stdout: '',
+            stderr: e instanceof Error ? e.message : String(e),
+        };
+    }
     return await new Promise((resolve) => {
         let child;
         try {
-            child = spawnImpl(command.binary, command.args, {
-                shell: false,
+            child = spawnImpl(spawnCommand.binary, spawnCommand.args, {
+                shell: spawnCommand.shell,
                 cwd: opts.cwd,
             });
         }
@@ -524,7 +664,7 @@ export async function runHeadlessAgent(prompt, opts) {
                 // ignore
             }
         };
-        if (command.useStdin) {
+        if (spawnCommand.useStdin) {
             // Swallow stdin stream errors (e.g. EPIPE when the child exits before it
             // has read the whole — possibly 100KB+ — prompt). The real failure is
             // reported via the child's own 'error'/'close' handlers below; an
@@ -585,7 +725,6 @@ export async function runHeadlessAgent(prompt, opts) {
                 if (settled)
                     return;
                 const elapsedS = Math.round((Date.now() - startedAt) / 1000);
-                // eslint-disable-next-line no-console
                 console.error(`[self-evolution] headless agent running: ${elapsedS}s elapsed, ${bytesReceived} bytes received`);
             }, HEARTBEAT_INTERVAL_MS);
             heartbeatTimer.unref?.();

package/dist/core/self-evolution/reward-aggregator.js

@@ -1,4 +1,4 @@
-import { DEFAULT_AGENT_TIMEOUT_MS, resolveAgentTimeoutMs, runHeadlessAgent, } from './host-harness.js';
+import { resolveAgentTimeoutMs, runHeadlessAgent, } from './host-harness.js';
 import { enrichGradientWithDeepRead, DEFAULT_DEEP_READ_CONFIG, } from './reward-deepread.js';
 import { loadRewardScoringContext, scoreOnce, deriveSingleSampleVerdict, buildAnchors, computeJudgeVerifierDivergence, formatJudgeVerifierDivergenceFlag, JUDGE_VERIFIER_DIVERGENCE_FLAG_PREFIX, } from './reward-agent.js';
 import { writeDiagnosis, advanceEpisodeStage, } from './episode-store.js';
@@ -102,7 +102,7 @@ export async function runRewardAgentEnsemble(opts) {
                         cwd: repoRoot,
                         spawn: opts.spawn,
                         binaryOverride: opts.binary,
-                        timeoutMs: opts.timeoutMs ?? DEFAULT_AGENT_TIMEOUT_MS,
+                        timeoutMs: opts.timeoutMs ?? resolveAgentTimeoutMs(opts.harness),
                         harness: opts.harness,
                     });
                     if (r.exitCode === 0 && r.stdout.length > 0)

package/dist/core/templates/workflows/archive-change.js

@@ -121,12 +121,12 @@ export function getArchiveChangeSkillTemplate() {
    If \`evolution.status\` is \`error\`, surface the defect from status and still warn that the durable report is missing.
    If \`evolution.status\` is \`not-run\`, learn has not run or left evidence.
 
-   If either is missing, display a non-blocking warning before archiving:
-   - Missing verification evidence: suggest \`/synspec:verify <name>\`
-   - Missing learn evidence: suggest \`/synspec:learn <name>\`
-   - Ask the user to confirm before archiving without those files
-
-4d. **Final workspace/package identity check**
+   If either is missing, stop before archiving:
+   - Missing verification evidence: suggest \`/synspec:verify <name>\`
+   - Missing learn evidence: suggest \`/synspec:learn <name>\`
+   - Do not archive until the missing evidence exists and readiness passes
+
+4d. **Final workspace/package identity check**
 
    Before archiving, validate that verification evidence still describes the
    current workspace:
@@ -169,7 +169,7 @@ export function getArchiveChangeSkillTemplate() {
    - Whether specs were synced (if applicable)
    - Blast radius triage results (e.g. "2 specs synced, 1 marked for review" or "No blast radius")
    - Verify/learn evidence status
-   - Note about any warnings (incomplete artifacts/tasks or missing verify/learn evidence)
+   - Note about any warnings (incomplete artifacts/tasks) and any hard evidence blockers found
 
 **Output On Success**
 
@@ -188,12 +188,12 @@ All artifacts complete. All tasks complete.
 **Guardrails**
 - Always prompt for change selection if not provided
 - Use artifact graph (synergyspec-selfevolving status --json) for completion checking
-- Don't block archive on warnings - just inform and confirm
+- Do not block archive on force-bypassable warnings, such as incomplete artifacts/tasks when the user explicitly forces them; do block on missing verification evidence, missing learn evidence, invalid workspace identity, or incomplete evolution.
 - Preserve .synergyspec-selfevolving.yaml when moving to archive (it moves with the directory)
 - Show clear summary of what happened
 - If sync is requested, use synergyspec-selfevolving-sync-specs approach (agent-driven)
 - If delta specs exist, always run the sync assessment and show the combined summary before prompting
-- If verification or learn evidence is missing, warn and confirm before archiving; do not silently skip those workflow stages
+- If verification or learn evidence is missing, stop before archiving; do not silently skip those workflow stages
 - If spec-blast-radius.md does not exist, skip step 4b silently (no warning needed)`,
         license: 'MIT',
         compatibility: 'Requires synergyspec-selfevolving CLI.',
@@ -325,12 +325,12 @@ export function getOpsxArchiveCommandTemplate() {
    If \`evolution.status\` is \`error\`, surface the defect from status and still warn that the durable report is missing.
    If \`evolution.status\` is \`not-run\`, learn has not run or left evidence.
 
-   If either is missing, display a non-blocking warning before archiving:
-   - Missing verification evidence: suggest \`/synspec:verify <name>\`
-   - Missing learn evidence: suggest \`/synspec:learn <name>\`
-   - Ask the user to confirm before archiving without those files
-
-5. **Perform the archive**
+   If either is missing, stop before archiving:
+   - Missing verification evidence: suggest \`/synspec:verify <name>\`
+   - Missing learn evidence: suggest \`/synspec:learn <name>\`
+   - Do not archive until the missing evidence exists and readiness passes
+
+5. **Perform the archive**
 
    Create the archive directory if it doesn't exist:
    \`\`\`bash
@@ -356,7 +356,7 @@ export function getOpsxArchiveCommandTemplate() {
    - Spec sync status (synced / sync skipped / no delta specs)
    - Blast radius triage results (e.g. "2 specs synced, 1 marked for review" or "No blast radius")
    - Verify/learn evidence status
-   - Note about any warnings (incomplete artifacts/tasks or missing verify/learn evidence)
+   - Note about any warnings (incomplete artifacts/tasks) and any hard evidence blockers found
 
 **Output On Success**
 
@@ -424,12 +424,12 @@ Target archive directory already exists.
 **Guardrails**
 - Always prompt for change selection if not provided
 - Use artifact graph (synergyspec-selfevolving status --json) for completion checking
-- Don't block archive on warnings - just inform and confirm
+- Do not block archive on force-bypassable warnings, such as incomplete artifacts/tasks when the user explicitly forces them; do block on missing verification evidence, missing learn evidence, invalid workspace identity, or incomplete evolution.
 - Preserve .synergyspec-selfevolving.yaml when moving to archive (it moves with the directory)
 - Show clear summary of what happened
 - If sync is requested, use the Skill tool to invoke \`synergyspec-selfevolving-sync-specs\` (agent-driven)
 - If delta specs exist, always run the sync assessment and show the combined summary before prompting
-- If verification or learn evidence is missing, warn and confirm before archiving; do not silently skip those workflow stages
+- If verification or learn evidence is missing, stop before archiving; do not silently skip those workflow stages
 - If spec-blast-radius.md does not exist, skip step 4b silently (no warning needed)`
     };
 }

package/dist/core/templates/workflows/dream.js

@@ -3,32 +3,35 @@ const INSTRUCTIONS_BODY = `**Input**: Optionally specify a Dream mode and flags
 Accepted forms:
 
 \`\`\`text
-/synspec:dream
-/synspec:dream preview [--target <id>] [--limit <n>] [--json]
-/synspec:dream run [--target <id>] [--limit <n>] [--json]
-/synspec:dream show [runId] [--json]
-\`\`\`
-
-Bare \`/synspec:dream\` means \`preview\`. Preview is read-only.
+/synspec:dream
+/synspec:dream preview [--target <id>] [--limit <n>] [--json]
+/synspec:dream run [--target <id>] [--limit <n>] [--apply --yes] [--json]
+/synspec:dream show [runId] [--json]
+/synspec:dream policy-update <candidateId> --accepted-by <name> --yes [--json]
+\`\`\`
+
+Bare \`/synspec:dream\` means \`preview\`. Preview is read-only. Plain \`run\` writes only Dream artifacts. \`run --apply --yes\` and \`policy-update ... --yes\` are explicit policy-update entrances for already accepted Dream candidates.
 
 **Purpose**
 
-This is the SS agent-harness entrance for offline Supervised Learning Dream. The user should trigger Dream from the code-agent chat, not by opening a separate terminal. Your job is to call the existing CLI engine, parse the JSON result, and relay a short Dream Verdict.
-
-Dream is not the loop-v2 episode runner. It batch-reads completed evidence and proposes optimizer briefs for existing skill/workflow/template targets. It never creates new skills, never edits POLICY directly, never promotes candidates, and never runs the episode/reward/evolving agents.
+This is the SS agent-harness entrance for offline Supervised Learning Dream. The user should trigger Dream from the code-agent chat, not by opening a separate terminal. Your job is to call the existing CLI engine, parse the JSON result, and relay a short Dream Verdict.
+
+Dream is not the loop-v2 episode runner. It batch-reads completed evidence and proposes optimizer briefs for existing skill/workflow/template targets. It never creates new skills, never edits POLICY directly, and never runs the episode/reward/evolving agents. By default Dream is proposal-only; policy changes require an explicit accepted-candidate update with \`--yes\`, synthesize bounded edits into the candidate package, pass the static gate, and promote through the existing rollback/ledger path.
 
 **Mode parsing**
 
 1. If the first argument is missing, use \`preview\`.
-2. If the first argument is one of \`preview\`, \`run\`, or \`show\`, use that mode.
-3. If the first argument starts with \`--\`, treat it as a \`preview\` flag.
-4. If the mode is unknown, stop and show the accepted forms above.
-
-Pass only these user options through:
-- \`--target <id>\`
-- \`--limit <n>\`
-- \`--json\`
-- \`runId\` for \`show\`
+2. If the first argument is one of \`preview\`, \`run\`, \`show\`, or \`policy-update\`, use that mode.
+3. If the first argument starts with \`--\`, treat it as a \`preview\` flag.
+4. If the mode is unknown, stop and show the accepted forms above.
+
+Pass only these user options through:
+- \`--target <id>\`
+- \`--limit <n>\`
+- \`--apply\` and \`--yes\` for \`run\`
+- \`candidateId\`, \`--accepted-by <name>\`, and \`--yes\` for \`policy-update\`
+- \`--json\`
+- \`runId\` for \`show\`
 
 Always add \`--json\` to the CLI command you run so the result is machine-readable. If the user explicitly asked for \`--json\`, include the compact raw JSON after the Dream Verdict; otherwise provide the human summary only.
 
@@ -46,49 +49,56 @@ Always add \`--json\` to the CLI command you run so the result is machine-readab
    synergyspec-selfevolving self-evolution dream run --json
    \`\`\`
 
-   For show:
-   \`\`\`bash
-   synergyspec-selfevolving self-evolution dream show --json
-   \`\`\`
-
-   Append \`--target <id>\`, \`--limit <n>\`, or \`runId\` only when the user supplied them.
+   For show:
+   \`\`\`bash
+   synergyspec-selfevolving self-evolution dream show --json
+   \`\`\`
+
+   For accepted candidate policy update:
+   \`\`\`bash
+   synergyspec-selfevolving self-evolution dream policy-update <candidateId> --accepted-by <name> --yes --json
+   \`\`\`
+
+   Append \`--target <id>\`, \`--limit <n>\`, \`--apply\`, \`--yes\`, \`--accepted-by <name>\`, or \`runId\` only when the user supplied them. Never add \`--yes\` on the user's behalf.
 
 2. **Interpret the result without re-judging it**
 
-   Read candidate ids, target ids, evidence summary, run id, and write paths from the CLI JSON when present. Do not invent candidate ids or claim a policy change.
+   Read candidate ids, target ids, evidence summary, run id, update outcome, gate result, promoted files, policy version, and write paths from the CLI JSON when present. Do not invent candidate ids or claim a policy change.
 
 3. **Classify writes**
 
-   - \`preview\`: Writes are \`none\`.
-   - \`run\`: Writes are \`dream-run + draft candidates\`.
-   - \`show\`: Writes are \`none\`.
-
-4. **Report the next step**
-
-   Dream candidates are proposal-only optimizer briefs. If the user wants to turn one into a real SS change, use the existing review/promotion channel after a reviewer or optimizer backend authors bounded edits. Do not promote from this skill.
+   - \`preview\`: Writes are \`none\`.
+   - plain \`run\`: Writes are \`dream-run + draft candidates\`.
+   - \`run --apply --yes\`: Writes are \`dream-run + candidates + gated policy update\` when the update is promoted; otherwise report the refusal outcome.
+   - \`show\`: Writes are \`none\`.
+   - \`policy-update --yes\`: Writes are \`gated policy update\` when promoted; otherwise report the refusal outcome.
+
+4. **Report the next step**
+
+   Plain Dream candidates are proposal-only optimizer briefs. To turn an accepted candidate into policy, use \`/synspec:dream policy-update <candidateId> --accepted-by <name> --yes\`. The update path must author bounded edits, pass the static gate, and promote through the existing rollback/ledger channel; if any gate refuses, report the refusal and leave the policy unchanged.
 
 **Output Format**
 
 End with this block:
 
 \`\`\`text
-## Dream Verdict
-- Mode: preview | run | show
-- Run id: <id or none>
-- Candidates: <ids or none>
-- Targets: <target ids or all eligible>
-- Evidence read: <short summary>
-- Writes: none | dream-run + draft candidates
-- Policy changed: no
-- New skills created: no
-- Next step: review candidate(s), then use the existing review/promotion flow if wanted
-\`\`\`
+## Dream Verdict
+- Mode: preview | run | show | policy-update
+- Run id: <id or none>
+- Candidates: <ids or none>
+- Targets: <target ids or all eligible>
+- Evidence read: <short summary>
+- Writes: none | dream-run + draft candidates | dream-run + candidates + gated policy update | gated policy update
+- Policy changed: yes | no
+- New skills created: no
+- Next step: review candidate(s), run accepted policy-update, or inspect gate refusal
+\`\`\`
 
 If the CLI command fails, still end with \`## Dream Verdict\` and set fields to \`none\` where unknown. Put the command failure under \`Evidence read\` or \`Next step\`; do not retry with a different self-evolution command.`;
 export function getDreamSkillTemplate() {
     return {
         name: 'synergyspec-selfevolving-dream',
-        description: 'SS Dream entrance: preview, run, or inspect offline Supervised Learning Dream proposals from the code-agent chat.',
+        description: 'SS Dream entrance: preview, run, inspect, or apply accepted offline Supervised Learning Dream updates from the code-agent chat.',
         instructions: `Run the SS offline Supervised Learning Dream lane from the code-agent harness.
 
 ${INSTRUCTIONS_BODY}`,
@@ -100,12 +110,12 @@ ${INSTRUCTIONS_BODY}`,
 export function getOpsxDreamCommandTemplate() {
     return {
         name: 'SS: Dream',
-        description: 'Preview, run, or inspect offline Supervised Learning Dream proposals from the code-agent chat',
+        description: 'Preview, run, inspect, or apply accepted offline Supervised Learning Dream updates from the code-agent chat',
         category: 'Workflow',
         tags: ['workflow', 'dream', 'self-evolution', 'offline-learning'],
         content: `Run the SS offline Supervised Learning Dream lane from the code-agent harness.
 
-**Input**: Optionally specify a mode after \`/synspec:dream\` (for example \`/synspec:dream preview\`, \`/synspec:dream run --limit 5\`, or \`/synspec:dream show\`). Bare \`/synspec:dream\` means read-only \`preview\`.
+**Input**: Optionally specify a mode after \`/synspec:dream\` (for example \`/synspec:dream preview\`, \`/synspec:dream run --limit 5\`, \`/synspec:dream show\`, or \`/synspec:dream policy-update <candidateId> --accepted-by <name> --yes\`). Bare \`/synspec:dream\` means read-only \`preview\`.
 
 ${INSTRUCTIONS_BODY}`,
     };