Hypothesis

Given a real (not-monorepo, not-dev-fallback) installation of @metaharness/kernel via npm, when @metaharness/kernel/self-evolution is imported per the published docs, or when create-agent-harness's harness diag resolves @metaharness/kernel/package.json to read the installed kernel's version, then both resolutions should succeed exactly as documented, subject to: (a) no other exported subpath's resolution target/shape changes; (b) harness diag's version-skew verdict for a correctly-matched kernel changes from 'unparseable' (with a false "not installed locally" actionable) to 'match'; (c) zero regressions across kernel-js and its 14 direct TS consumers.

Candidate

packages/kernel-js/package.json — added "./self-evolution" and "./package.json" to the exports map (6 lines). New test: packages/kernel-js/__tests__/exports-map.test.ts (resolves both subpaths through Node's real self-referencing-package resolution, not a relative ../src import that would bypass exports entirely).

Evaluation Receipt

• Baseline (git stash the package.json change): new test suite fails to even load — Error: Missing "./self-evolution" specifier in "@metaharness/kernel" package — exact predicted error, confirmed live.
• Candidate: kernel-js 62→64/65 tests (+2, 1 pre-existing skip, 0 regressions); tsc --noEmit clean; full monorepo npm run build clean (JS-only; wasm-pack unavailable in this sandbox — recorded degradation, irrelevant to this candidate).
• Live repro of the real-world consequence, outside the monorepo so diag.ts's dev-fallback can't mask it: built create-agent-harness's dist into a scratch directory outside the repo, with a real @metaharness/kernel symlink and a manifest whose kernel_version exactly matches. Pre-fix: {"verdict":"unparseable","actionable":"Run: npm install @metaharness/kernel@0.1.3 (kernel not installed locally)"} — wrong, the kernel WAS installed at the right version. Post-fix: {"localKernelVersion":"0.1.3","verdict":"match"} — correct.

Baseline Comparison

Full downstream sweep (all 14 packages importing @metaharness/kernel): create-agent-harness 623/625 (2 pre-existing skips), agntcy 82/84 (2 pre-existing skips), arc-agi-3 91/91, arc-agi-3-chatgpt 69/69, host-claude-code 35/35, host-codex 23/23, host-copilot 13/13, host-github-actions 34/34, host-hermes 20/20, host-openclaw 29/29, host-opencode 17/17, host-pi-dev 10/10, host-prime-agent 21/21, host-rvm 42/42, sdk 18/18 — 0 regressions anywhere. Root __tests__/pack-contents.test.ts 6/6 (tarball-content invariants unaffected).

Darwin Lineage

DARWIN=not_applicable — a package.json metadata fix is not an ADR-071 mutation surface.

Flywheel Evidence

FLYWHEEL=not_applicable — static packaging fix, not a promotion-gate candidate. Full MEASUREMENT/DECISION/REJECTION record: docs/dream-cycle/2026-10-14-evidence.md.

Reward Hack Check

Clear. Diff is purely additive (2 new exports entries + 1 new test file); no existing test, threshold, or gold data touched; zero live model spend (candidate required no LLM calls).

Security Review

No new attack surface. ./package.json's content (name/version/scripts/deps) is already public in every published npm tarball — require.resolve-ability exposes nothing new. ./self-evolution exposes SelfEvolvingRouter, whose behavior is unchanged by this diff (see independent critic note below on its pre-existing, unrelated correctness gap).

Regression Analysis

See Baseline Comparison above — 0 regressions across every real consumer, tsc clean, full build clean.

Independent Adversarial Critic

Fresh subagent, cold-read, own reproduction (not taken on faith): verified the diff matches the claim exactly (dist file paths real, shape consistent with sibling subpaths); independently reproduced resolution via raw Node (not just vitest) for both subpaths; introspected the actually-installed @ruvector/emergent-time@0.1.0 directly; read docs/RELEASE.md/scripts/preflight.mjs.

Verdict: ACCEPT-WITH-CAVEATS

1. No CHANGELOG entry. Checked against scripts/preflight.mjs's actual gate (only requires an ### Added/Changed — Iter N pattern exist somewhere in the file — already true) and against the last several merged dream-cycle PRs (including dream(host-adapters): #385 close SessionLog.append()/fork() TOCTOU race (evaluated) #386, the same bug-class fix), none of which touched CHANGELOG.md. Matches established convention for this PR category — not a gap, not fixed.
2. self-evolution.ts's LearnedWeightsApi doesn't match the real installed @ruvector/emergent-time API (confirmed: real class has a private constructor, no update/weight/weights()) and its ensureLoaded() has a latent, currently-dormant TOCTOU race under concurrent recordOutcome() calls. Both pre-existing and unrelated to this diff; exporting the module formally makes a real external consumer slightly more likely to actually reach them (previously the broken import path masked the module entirely). Disclosed as a follow-up candidate, not fixed tonight — fixing self-evolution.ts's internal correctness is out of scope for "repair the exports map."

ADR

None filed — this is a packaging/exports-map bug fix, not an architectural decision (no new ADR warranted per the repo's own "never for parameter changes... minor fixes" rule).

Research Gist

docs/dream-cycle/2026-10-14-gist.md (this session's gist-publish tool was denied by the auto-mode permission classifier as a "Public Data-Sharing Upload" — not an auth failure; committed file used instead, per the convention adopted 2026-09-09). Includes: sourced 2026 findings on Node exports-map tooling (publint, are-the-types-wrong), a competitor comparison on multi-host codegen + durable session logging (LangGraph/CrewAI/AutoGen/Claude Agent SDK/DSPy-GEPA), and 4 disclosed-not-fixed follow-on candidates (CI exports-map linting, SDK validation asymmetry, kernel native-backend shape check + memory-rvf race, and the standing PR review backlog).

Issue

#401

Witness

session_commit : e0dfd44da72b7adfb7c57fdd42d124be58ed7086
report_sha256  : 8609cf99ca556fbf1fc43ca462ec1c40c33da5748b1964e13675c98013ca2df6
witness        : b4ae4dc12d95fa15a6e32845d4714f0b7875478e680b27f8019a875cd4e7d4e7

Merge Policy

Human review required. Do not self-merge. Do not autonomously promote Flywheel state.

🤖 Generated with Claude Code

https://claude.ai/code/session_01TbD5QrLYYZF7KSdahrh5i6

Generated by Claude Code