Merge remote-tracking branch 'refs/remotes/origin/main'

assets/agents/adversary/graph.yaml

@@ -37,7 +37,9 @@ variables:
     description: |
       JSON array of shell commands the CALLER declares for the deterministic
       run_checks stage — e.g. '["cargo test --all"]'. Never inferred from the
-      prompt; empty array = none declared.
+      prompt; empty array = none declared. Must not boot shared stacks or
+      services (compose projects, fixed ports) — those collide with the probe
+      lane running in parallel.
     default: '[]'
 
 settings:

assets/agents/architect/config.yaml

@@ -342,7 +342,10 @@ instructions: |
        here is executed with a shell — a trust boundary the prose must not cross.
        Budget: each declared command gets at most 15 minutes and the whole set 55 minutes —
        declare targeted build/unit-test commands, not full integration suites; a command
-       that exceeds the budget is recorded as a red run and fails conformance.
+       that exceeds the budget is recorded as a red run and fails conformance. Never declare
+       commands that boot shared stacks or services (docker compose projects, dev servers,
+       fixed ports) — the probe lane owns end-to-end runs and WILL collide with them in
+       parallel; keep verification to generate/lint/build/unit/integration commands.
 
        It returns `GAUNTLET: PASS/BLOCKED`. On BLOCKED with real review findings apply the same
        fix-and-rerun rules as below (resume the SAME Sisyphus session with the findings verbatim,

assets/agents/review-gauntlet/graph.yaml

@@ -115,8 +115,10 @@ nodes:
         the change (absolute path preferred); empty string when the caller
         named none.
       - `plan_context`: the plan / spec / acceptance-criteria text the
-        implementation must satisfy, verbatim (or a file path the caller
+        implementation must satisfy, copied through VERBATIM — never
-        pointed at). Empty string when the caller supplied none.
+        summarize it and never replace pasted text with file paths or a
+        sentence saying it was included; the adversary lane fails closed on
+        whatever you drop. Empty string when the caller supplied none.
       - `rigor`: poc | prototype | production. Default "production" when
         not stated.
       - `security_posture`: prototype | standard | hardened. Default

assets/agents/review-gauntlet/scripts/signals.py

@@ -38,6 +38,25 @@ def git(*args):
 
 
 out = {"project_dir": proj}
+
+# Deterministic plan_context recovery: the parse LLM proved a lossy channel
+# for verbatim spec text (observed replacing ~4 KB of pasted criteria with
+# file paths + a summary sentence). When the raw prompt carries the callers'
+# labeled plan block, cut it out verbatim and override the extraction — but
+# only when the recovered block is LONGER, so a good extraction is never
+# degraded. The adversary lane fails closed on whatever goes missing here.
+_prompt = state.get("initial_prompt")
+if isinstance(_prompt, str) and _prompt:
+    _m = re.search(
+        r"Plan / acceptance criteria:\s*(.+?)"
+        r"(?=\n\s*(?:Local-run recipe|Forced lanes|Rigor:|Security posture:|Extra context)\b|\Z)",
+        _prompt,
+        re.S | re.I,
+    )
+    if _m:
+        _block = _m.group(1).strip()
+        if len(_block) > len((state.get("plan_context") or "").strip()):
+            out["plan_context"] = _block
 # retry_gate measures its wall-clock budget from this stamp; it is set
 # before the git work so a failed diff still starts the clock.
 if not state.get("gauntlet_started_at"):

assets/agents/sisyphus/config.yaml

@@ -324,7 +324,10 @@ instructions: |
   executed with a shell — a trust boundary the prose must not cross.
   Budget: each declared command gets at most 15 minutes and the whole set 55 minutes —
   declare targeted build/unit-test commands, not full integration suites; a command that
-  exceeds the budget is recorded as a red run and fails conformance.
+  exceeds the budget is recorded as a red run and fails conformance. Never declare commands
+  that boot shared stacks or services (docker compose projects, dev servers, fixed ports) —
+  the probe lane owns end-to-end runs and WILL collide with them in parallel; keep
+  verification to generate/lint/build/unit/integration commands.
 
   It computes diff signals deterministically, selects lanes (code-review always; adversary when a
   spec/plan is present; security on attack-surface signals; probe on consumer-facing surface with a

models.yaml

@@ -6955,9 +6955,9 @@
   - name: deepseek/deepseek-v4-flash-0731
     type: chat
     max_input_tokens: 1310720
-    input_price: 0.055
+    input_price: 0.06
-    output_price: 0.11
+    output_price: 0.12
-    cache_read_price: 0.011
+    cache_read_price: 0.012
     max_output_tokens: 943718
     supports_function_calling: true
   - name: deepseek/deepseek-v4-flash-0731:batch
@@ -7430,8 +7430,8 @@
   - name: gryphe/mythomax-l2-13b
     type: chat
     max_input_tokens: 8192
-    input_price: 0.06
+    input_price: 0.08
-    output_price: 0.06
+    output_price: 0.11
     max_output_tokens: 3686
   - name: ibm-granite/granite-4.0-h-micro
     type: chat
@@ -9800,7 +9800,6 @@
     input_price: 0.4
     output_price: 0.4
     max_output_tokens: 819200
-    supports_function_calling: true
   - name: thinkingmachines/inkling
     type: chat
     max_input_tokens: 1048576
@@ -10065,9 +10064,9 @@
   - name: z-ai/glm-5.3-flash
     type: chat
     max_input_tokens: 1310720
-    input_price: 0.1
+    input_price: 0.09
-    output_price: 0.3333
+    output_price: 0.3
-    cache_read_price: 0.02
+    cache_read_price: 0.018
     max_output_tokens: 131072
     supports_vision: true
     supports_function_calling: true
@@ -10261,10 +10260,10 @@
   - name: ~z-ai/glm-latest
     type: chat
     max_input_tokens: 1310720
-    input_price: 0.85
+    input_price: 0.8775
-    output_price: 2.8985
+    output_price: 2.97
-    cache_read_price: 0.17
+    cache_read_price: 0.1755
-    max_output_tokens: 943718
+    max_output_tokens: 235929
     supports_function_calling: true
 - provider: github
   models: