chore(deps): align eval and interface cohort

[drewstone]

Summary

• release @tangle-network/agent-knowledge as 7.0.5
• align Eval to 0.142.0 and Interface to 0.42.0
• preserve one installed Eval/Core/Interface package cohort
• allow fresh resolution of the exact internal Core and Trace Contract transitives under the 72-hour package-age policy

Proof

• pnpm typecheck
• pnpm lint - 203 files checked
• pnpm test - 545 passed, 12 skipped
• pnpm build
• pnpm verify:package - fresh tarball install, 5 public imports, one copy each of Eval 0.142.0, Core 0.4.31, Interface 0.42.0
• pnpm verify:official-optimizers - published Python bridge 0.142.0, GEPA, and SkillOpt integration passed
• pnpm install --lockfile-only - no lockfile rewrite after the package-age exclusions
• clean merge tree against origin/main

[tangletools]

✅ Auto-approved drewstone PR — e452fa53

This PR was opened by the trusted drewstone account.
The full PR reviewer audit still runs separately and will publish findings if it detects issues.

_{tangletools · auto-approval · reason: drewstone_author · 2026-08-02T09:28:09Z}

[tangletools]

🟢 Value Audit — sound

Verdict	sound
Concerns	0 (none)
Heuristic	0.0s
Duplication	0.0s
Interrogation	29.1s (2 bridge agents)
Total	29.1s

💰 Value — sound

Bumps agent-knowledge to 7.0.5 alongside agent-eval 0.141.0 and agent-interface 0.41.0; a routine cohort-alignment change in the repo's established pattern.

• What it does: Three-line dependency move in package.json: version 7.0.4 -> 7.0.5, @tangle-network/agent-eval 0.140.1 -> 0.141.0, @tangle-network/agent-interface 0.40.0 -> 0.41.0. No source changes.
• Goals it achieves: Keep the published agent-knowledge release on a single coherent cohort of its peer packages (eval/core/interface) so downstream consumers get one aligned set rather than mixed versions that can drift in shared types like RunRecord and OptimizationMethod.
• Assessment: Sound. This is exactly the grain of the repo: git log shows repeated 'align eval and interface cohort' / 'chore(release): align ... with eval X and interface Y' commits (#105, #106, #107, 95baf71, ef65f1a). The pnpm.minimumReleaseAgeExclude list already names @tangle-network/agent-eval and @tangle-network/agent-interface, confirming these internal tangle packages are intentionally pinned and bumpe
• Better / existing approach: none — this is the right approach. Verified git log for prior churn: b67218f, a59d53f, ef65f1a, 95baf71 all follow the identical bump-and-align pattern, and package.json:106-107 explicitly exempts the two tangle deps from the minimumReleaseAge gate so cohort bumps are first-class. No reusable helper could simplify a 3-line version bump.
• Model: opencode/zai-coding-plan/glm-5.2
• Bridge attempts: 2
• Bridge warning: opencode/kimi-for-coding/k2p7: opencode: opencode error

🎯 Usefulness — sound

Routine dependency-alignment release that pins agent-eval 0.141.0 and agent-interface 0.41.0 (plus a 7.0.5 self-bump), matching the established cadence of prior PRs.

• Integration: Fully wired. agent-eval and agent-interface are core dependencies consumed at 97 import sites across src/ (e.g. src/optimization.ts:1, src/memory/improvement/promotion.ts:1-3, src/kb-improvement/contracts.ts:1,6). The new versions resolve cleanly in pnpm-lock.yaml (specifier 0.141.0 → version 0.141.0; specifier 0.41.0 → version 0.41.0). Nothing is newly added or orphaned — every line of the bump f
• Fit with existing patterns: Matches the established pattern exactly. The prior three merge commits (d932983, 62bf508, b67218f) all carry the same 'chore(deps): align eval/interface cohort' shape with matching CHANGELOG line edits; this PR is the next step of that same discipline. No competing approach exists — there is only one place to declare these deps.
• Real-world viability: No code or contract changes, only version bumps; the surface behavior is whatever the new published versions carry, which the PR body asserts is covered by 545 passing tests plus verify:package (cohort singularity) and verify:official-optimizers (Python bridge parity). The lockfile pins are exact, not ranges, so installed copies are deterministic. Nothing here introduces a new error path or edge c
• Model: opencode/zai-coding-plan/glm-5.2
• Bridge attempts: 1

No concerns — sound change, no better or existing approach found. ✅

---

What this audit checks

It judges the change on its merits — not whether it was tasked out in an issue. Unticketed, fast-moving work is fine; the question is whether the change is good and whether a better or existing approach should be used instead.

Pass	What it asks
Heuristic	Vague title? Whitespace-only or cruft-bearing diff? (content signals only)
Duplication	Do added function/class names already exist elsewhere in the repo?
Value Audit	What does it do? What goal does it achieve? Is it good? Better architecture or already-exists?
Usefulness Audit	Does it integrate and fit? Will it hold up in real use and actually get used?

Findings are concerns, not blocks — the human reviewer decides what to do with them.

_{value-audit · 20260802T092852Z}

[tangletools]

✅ No Blockers — e452fa53

Review health 100/100 · Reviewer score 89/100 · Confidence 75/100 · 3 findings (3 low)

	glm	deepseek	deepseek-flash	aggregate
Readiness	92	95	89	89
Confidence	75	75	75	75
Correctness	92	95	89	89
Security	92	95	89	89
Testing	92	95	89	89
Architecture	92	95	89	89

Reviewer score is advisory once the run is complete and the verdict has no blockers.

Full multi-shot audit completed 3/3 planned shots over 3 changed files. Global verifier still owns final merge decision. | Full multi-shot audit completed 3/3 planned shots over 3 changed files. Global verifier still owns final merge decision. | Full multi-shot audit completed 3/3 planned shots over 3 changed files. Global verifier still owns final merge decision.

🟡 LOW New transitive agent-trace-contract@1.0.2 not in minimumReleaseAgeExclude — package.json

package.json pins minimumReleaseAge:4320 (72h) but the exclude list (lines 105-110) covers only agent-eval, agent-interface, esbuild, vite. agent-trace-contract@1.0.2 (published 2026-08-01T10:22Z, ~23h before this head) and agent-core@0.4.30 (2026-08-02T07:21Z) enter via agent-eval 0.141.0 and are not excluded, so fresh pnpm install emits release-age warnings. Non-blocking: CI's pnpm install --frozen-lockfile passed, so this is noise, not failure. Fix: add both names to minimumReleaseAgeExclude to keep installs quiet, or accept the warning.

🟡 LOW New transitive agent-trace-contract not in minimumReleaseAgeExclude — pnpm-lock.yaml

package.json sets pnpm.minimumReleaseAge=4320 (3 days) and excludes only @tangle-network/agent-eval, @tangle-network/agent-interface, esbuild, and vite. This PR's new transitive @tangle-network/agent-trace-contract@1.0.2 (and the bumped transitive agent-core@0.4.30) are NOT in that exclude list, and agent-trace-contract was published 2026-08-01 (1 day old). Frozen-lockfile installs (CI) are unaffected. Impact: developers cloning fresh and running pnpm install (not frozen) get a non-blocking warning today, and would hit a hard block if strict mode is later enabled. Fix: add @tangle-network/agent-trace-contract (and @tangle-network/agent-core for consistency) to minimumReleaseAgeExclude in package.json.

🟡 LOW New transitive dep not covered by minimumReleaseAgeExclude — pnpm-lock.yaml

package.json sets pnpm.minimumReleaseAge: 4320 (72h) but minimumReleaseAgeExclude lists only agent-eval, agent-interface, esbuild, vite. The new transitive @tangle-network/agent-trace-contract@1.0.2 was published 2026-08-01T10:22Z (~23h old) and agent-core@0.4.30 published 2026-08-02T07:21Z (hours old). Tested directly: install SUCCEEDS on the repo's pinned pnpm 10.34.5 (not blocking), so CI's pnpm install --frozen-lockfile (ci.yml:23/60, publish.yml:28/77) is unaffected today. But pnpm 11.18.0 in a controlled test auto-appended the too-new package to minimumReleaseAgeExclude in pnpm-workspace.yaml (which does not exist in this repo) instead of failing — a future packageManager bump could silently rewrite workspace config. No action required for this PR; note for the next upgrade

---

_{tangletools · 2026-08-02T09:31:11Z · trace}

[tangletools]

✅ Approved — 3 non-blocking findings — e452fa53

Full multi-shot audit completed 3/3 planned shots over 3 changed files. Global verifier still owns final merge decision. | Full multi-shot audit completed 3/3 planned shots over 3 changed files. Global verifier still owns final merge decision. | Full multi-shot audit completed 3/3 planned shots over 3 changed files. Global verifier still owns final merge decision.

Full immutable report for this review: trace

Summary comment for this run: full summary

---

_{tangletools · 2026-08-02T09:31:11Z · immutable trace}

[tangletools]

✅ Auto-approved drewstone PR — 3969c083

This PR was opened by the trusted drewstone account.
The full PR reviewer audit still runs separately and will publish findings if it detects issues.

_{tangletools · auto-approval · reason: drewstone_author · 2026-08-02T11:08:11Z}

[tangletools]

🟢 Value Audit — sound

Verdict	sound
Concerns	0 (none)
Heuristic	0.0s
Duplication	0.0s
Interrogation	40.6s (2 bridge agents)
Total	40.6s

💰 Value — sound

Routine cohort alignment: bumps agent-eval/interface and adds the two first-party transitive packages to the existing release-age exclude list — exactly the right mechanism, in grain.

• What it does: Bumps @tangle-network/agent-knowledge 7.0.4→7.0.5, agent-eval 0.140.1→0.142.0, agent-interface 0.40.0→0.42.0, and adds @tangle-network/agent-core and @tangle-network/agent-trace-contract to pnpm.minimumReleaseAgeExclude (the 72-hour package-age bypass list, minimumReleaseAge=4320 in package.json:104).
• Goals it achieves: (1) Keep knowledge on the current eval/interface cohort so internal type and runtime contracts stay aligned across the agent-* packages; (2) let the fresh transitives that the new cohort drags in (agent-core@0.4.31, agent-trace-contract@1.0.2 — confirmed present in pnpm-lock.yaml:627,638) resolve despite being <72h old, which the release-age gate would otherwise reject. The PR body's claim of 'one
• Assessment: Good change on its merits. This is the established maintenance pattern in this repo — git log shows ~6 'chore(deps): align ... cohort' commits in the last two weeks (b67218f, e452fa5, 7111e31, 3969c08, ef65f1a, 95baf71), all following the same shape. The exclude-list addition is the correct and only place to declare first-party packages that must bypass the age gate: agent-eval and agent-interface
• Better / existing approach: none — this is the right approach. Searched pnpm-lock.yaml and confirmed agent-core@0.4.31 and agent-trace-contract@1.0.2 are exactly the fresh transitives introduced by the new eval/interface cohort (lockfile lines 627, 638, 2783, 2806), so listing them in minimumReleaseAgeExclude alongside the already-excluded agent-eval/agent-interface is the in-grain mechanism — there is no alternative config
• Model: opencode/zai-coding-plan/glm-5.2
• Bridge attempts: 2
• Bridge warning: opencode/kimi-for-coding/k2p7: opencode: opencode error

🎯 Usefulness — sound

A routine internal-cohort dependency bump (eval 0.142.0, interface 0.42.0) that is consumed by 100+ import sites and correctly extends the existing release-age exclusion list to the two fresh transitive Tangle packages the new eval drags in.

• Integration: Fully reachable. agent-eval and agent-interface are imported from ~60 src files and ~25 test files (e.g. src/optimization.ts:1, src/retrieval-eval.ts:1, src/release.ts:9, src/agent-candidate.ts:4, tests/core.test.ts:4). No new surface is introduced — this only moves the cohort version, so reachability is the existing reachability. The two newly excluded packages (agent-core, agent-trace-contract)
• Fit with existing patterns: Follows the established pattern exactly. The minimumReleaseAgeExclude list already excluded the direct internal deps (agent-eval, agent-interface); adding the transitives (agent-core, agent-trace-contract) is the same 'internal Tangle cohort bypasses the 72-hour package-age gate because we publish them in a coordinated batch' rule (package.json:104-112). esbuild/vite are excluded for the same reas
• Real-world viability: Holds up. The lockfile diff is internally consistent: every transitive resolves to exactly one version (one core 0.4.31, one eval 0.142.0, one interface 0.42.0, one trace-contract 1.0.2) — no duplicate copies, which is the whole point of the 'one installed cohort' goal stated in the CHANGELOG. The exclusion entries are scoped (only @tangle-network/* names plus esbuild/vite), so they cannot mask a
• Model: opencode/zai-coding-plan/glm-5.2
• Bridge attempts: 1

No concerns — sound change, no better or existing approach found. ✅

---

What this audit checks

It judges the change on its merits — not whether it was tasked out in an issue. Unticketed, fast-moving work is fine; the question is whether the change is good and whether a better or existing approach should be used instead.

Pass	What it asks
Heuristic	Vague title? Whitespace-only or cruft-bearing diff? (content signals only)
Duplication	Do added function/class names already exist elsewhere in the repo?
Value Audit	What does it do? What goal does it achieve? Is it good? Better architecture or already-exists?
Usefulness Audit	Does it integrate and fit? Will it hold up in real use and actually get used?

Findings are concerns, not blocks — the human reviewer decides what to do with them.

_{value-audit · 20260802T110911Z}

[tangletools]

✅ No Blockers — 3969c083

Review health 100/100 · Reviewer score 89/100 · Confidence 75/100 · 3 findings (3 low)

	glm	deepseek	deepseek-flash	aggregate
Readiness	92	95	89	89
Confidence	75	75	75	75
Correctness	92	95	89	89
Security	92	95	89	89
Testing	92	95	89	89
Architecture	92	95	89	89

Reviewer score is advisory once the run is complete and the verdict has no blockers.

Full multi-shot audit completed 3/3 planned shots over 3 changed files. Global verifier still owns final merge decision. | Full multi-shot audit completed 3/3 planned shots over 3 changed files. Global verifier still owns final merge decision. | Full multi-shot audit completed 3/3 planned shots over 3 changed files. Global verifier still owns final merge decision.

🟡 LOW CHANGELOG documents dependency versions that do not match the actual bump in this PR — CHANGELOG.md

Line 16 says: 'Updated @tangle-network/agent-eval to 0.141.0 and @tangle-network/agent-interface to 0.41.0'. But the head package.json in this same PR sets @tangle-network/agent-eval to 0.142.0 and @tangle-network/agent-interface to 0.42.0, and pnpm-lock.yaml resolves agent-eval@0.142.0 / agent-interface@0.42.0. The CHANGELOG is off by one minor on both packages. Impact: release notes misstate what was shipped; for a package whose stated purpose is 'one installed stack uses the same exact contracts', a wrong-version changelog entry undermines the verification promise and will mislead anyone auditing the upgrade path. Fix: change 0.141.0 -> 0.142.0 and

🟡 LOW CHANGELOG documents stale dependency versions not shipped in this release — CHANGELOG.md

The changed line claims '@tangle-network/agent-eval to 0.141.0 and @tangle-network/agent-interface to 0.41.0', but this PR's head resolves and ships 0.142.0 / 0.42.0. Evidence: git diff base..head -- package.json shows dependencies set to agent-eval 0.142.0 and agent-interface 0.42.0 (package version bumped to 7.0.5); pnpm-lock.yaml at head resolves agent-eval@0.142.0 and agent-interface@0.42.0. The 0.141.0/0.41.0 text matches the intermediate commit 'align eval and interface 0.42 cohort' (7111e31), not the final state. The base version of this same line (0.140.1/0.40.0) matched the base package.json exactly, so this line is the changelog's contract record for the eval/interface cohort. Fix: update [line 16](https://github.com/tangle-network/agent-knowledge/blob/3969c0839d08cf24065

🟡 LOW CHANGELOG dependency versions stale vs shipped package.json — package.json

package.json now pins @tangle-network/agent-eval@0.142.0 and @tangle-network/agent-interface@0.42.0, but the CHANGELOG.md Unreleased 'Changed' entry (updated in this PR) reads 'Updated @tangle-network/agent-eval to 0.141.0 and @tangle-network/agent-interface to 0.41.0'. The middle commit (7111e31 'chore(deps): align eval and interface 0.42 cohort') advanced the real versions to 0.142.0/0.42.0 without updating the CHANGELOG text that the previous commit had written. Published changelog will misstate the dependency versions. Fix: update the CHANGELOG line to 0.142.0/0.42.0. Not blocking merge; affects docs accuracy only.

---

_{tangletools · 2026-08-02T11:11:40Z · trace}

[tangletools]

✅ Approved — 3 non-blocking findings — 3969c083

Full multi-shot audit completed 3/3 planned shots over 3 changed files. Global verifier still owns final merge decision. | Full multi-shot audit completed 3/3 planned shots over 3 changed files. Global verifier still owns final merge decision. | Full multi-shot audit completed 3/3 planned shots over 3 changed files. Global verifier still owns final merge decision.

Full immutable report for this review: trace

Summary comment for this run: full summary

---

_{tangletools · 2026-08-02T11:11:40Z · immutable trace}

[tangletools]

✅ Auto-approved drewstone PR — 9888d80c

This PR was opened by the trusted drewstone account.
The full PR reviewer audit still runs separately and will publish findings if it detects issues.

_{tangletools · auto-approval · reason: drewstone_author · 2026-08-02T11:28:09Z}

[tangletools]

🟢 Value Audit — sound

Verdict	sound
Concerns	0 (none)
Heuristic	0.0s
Duplication	0.0s
Interrogation	38.6s (2 bridge agents)
Total	38.6s

💰 Value — sound

Bumps agent-knowledge to 7.0.5, aligning agent-eval 0.142.0 / agent-interface 0.42.0 and exempting the two newly-introduced internal transitives (agent-core, agent-trace-contract) from the 72-hour freshness gate — a coherent, in-grain cohort refresh.

• What it does: Three things in package.json + lockfile + CHANGELOG: (1) releases @tangle-network/agent-knowledge as 7.0.5; (2) raises the direct deps @tangle-network/agent-eval 0.140.1 -> 0.142.0 and @tangle-network/agent-interface 0.40.0 -> 0.42.0; (3) adds @tangle-network/agent-core and @tangle-network/agent-trace-contract to pnpm's minimumReleaseAgeExclude list (package.json:105-112). The lockfile diff shows
• Goals it achieves: Preserve the repo's stated invariant — one installed copy each of Eval, Core, and Interface across the whole stack (CHANGELOG.md:17, enforced by scripts/verify-package.mjs via verify:package) — while moving the cohort forward to the just-released eval/interface. The exclude-list additions are not a policy change; they are the necessary lever so pnpm can resolve freshly-cut internal transitives und
• Assessment: Good change, squarely in the grain of the codebase. The git log shows this exact pattern repeating (b67218f, e452fa5, 7111e31, 3969c08, plus earlier 'align cohort' commits) — internal cohort bumps are routine here, and the exclude list already exempted the direct internal deps (agent-eval, agent-interface); extending it to cover the new transitive internal deps those versions pull in is the consis
• Better / existing approach: none — this is the right approach. Considered replacing the growing explicit @tangle-network/* list with a wildcard, but (a) pnpm's minimumReleaseAgeExclude is name/glob-sensitive and the explicit list is auditable and intentional — each internal package must be consciously opted out, which is better hygiene than blanket-exempting a scope that may later include a package that should be age-gated;
• Model: opencode/zai-coding-plan/glm-5.2
• Bridge attempts: 2
• Bridge warning: opencode/kimi-for-coding/k2p7: opencode: opencode error

🎯 Usefulness — sound

Clean cohort-alignment bump that follows the repo's established single-copy integrity pattern; the two new release-age excludes are required, not speculative.

• Integration: Both bumped packages are direct dependencies consumed in 100+ import sites across src/ and tests/ (grep for '@tangle-network/agent-(eval|interface)' returns matches from src/retrieval-eval.ts:1, src/optimization.ts:1, src/release.ts:9, src/memory/, src/kb-improvement/, and dozens of test files). scripts/verify-package.mjs:139-195 actively enforces single-copy cohort integrity (eval + core + inte
• Fit with existing patterns: Matches the established cohort-alignment grain exactly. Prior 7.0.2/7.0.3 releases did the same eval+interface bump with a CHANGELOG entry (CHANGELOG.md:16 mirrors the 7.0.2 wording). The release-age exclude list (package.json:105-112) already exempted internal Tangle packages (agent-eval, agent-interface) alongside esbuild/vite; adding agent-core and agent-trace-contract is the identical treatmen
• Real-world viability: Dependency bump with no new logic, so robustness risk is limited to the new transitive (agent-trace-contract@1.0.2). That risk is bounded: verify:package does a fresh npm install from tarball and asserts one installed copy of each stack package (assertSingleInstalledAgentStack, verify-package.mjs:277-301), and the PR body reports the full gate suite green (typecheck, lint 203 files, test 545 passe
• Model: opencode/zai-coding-plan/glm-5.2
• Bridge attempts: 1

No concerns — sound change, no better or existing approach found. ✅

---

What this audit checks

It judges the change on its merits — not whether it was tasked out in an issue. Unticketed, fast-moving work is fine; the question is whether the change is good and whether a better or existing approach should be used instead.

Pass	What it asks
Heuristic	Vague title? Whitespace-only or cruft-bearing diff? (content signals only)
Duplication	Do added function/class names already exist elsewhere in the repo?
Value Audit	What does it do? What goal does it achieve? Is it good? Better architecture or already-exists?
Usefulness Audit	Does it integrate and fit? Will it hold up in real use and actually get used?

Findings are concerns, not blocks — the human reviewer decides what to do with them.

_{value-audit · 20260802T112917Z}

[tangletools]

✅ No Blockers — 9888d80c

Review health 100/100 · Reviewer score 89/100 · Confidence 75/100 · 3 findings (3 low)

	glm	deepseek	deepseek-flash	aggregate
Readiness	89	92	95	89
Confidence	75	75	75	75
Correctness	89	92	95	89
Security	89	92	95	89
Testing	89	92	95	89
Architecture	89	92	95	89

Reviewer score is advisory once the run is complete and the verdict has no blockers.

Full multi-shot audit completed 3/3 planned shots over 3 changed files. Global verifier still owns final merge decision. | Full multi-shot audit completed 3/3 planned shots over 3 changed files. Global verifier still owns final merge decision. | Full multi-shot audit completed 3/3 planned shots over 3 changed files. Global verifier still owns final merge decision.

🟡 LOW Changelog missing minimumReleaseAgeExclude additions — CHANGELOG.md

package.json added @tangle-network/agent-core and @tangle-network/agent-trace-contract to minimumReleaseAgeExclude in the same commit, but the CHANGELOG's Unreleased section does not mention these changes. The version bumps (agent-eval 0.142.0, agent-interface 0.42.0) are correctly recorded. Consider adding a line documenting the Renovate configuration change.

🟡 LOW No version section header for released 7.0.5 — CHANGELOG.md

package.json is bumped to 7.0.5 in this PR, but the changelog entry remains under '## Unreleased' and there is no '## 7.0.5' heading. Prior releases (e.g. 7.0.1) have dedicated sections. If the release process cuts sections at publish time this is fine; otherwise the changelog does not reflect the published version. Non-blocking, doc-only.

🟡 LOW Patch bump pulls a new transitive dependency cohort; rely on CI to prove no source breakage — package.json

Self-version goes 7.0.4->7.0.5 while agent-eval 0.142.0 newly transitively introduces @tangle-network/agent-trace-contract@1.0.2 and bumps agent-core 0.4.29->0.4.31. The package.json change itself is correct and internally consistent with the lockfile, but if agent-knowledge source re-exports or structurally depends on any type shaped by these transitives, a patch release could leak a semver-breaking surface to downstream consumers. No evidence of such a re-export in this shot's scope (only package.json reviewable); confirm via green typecheck/build/test in CI before publish. Not blocking — pre-existing prepublishOnly hook runs pnpm build, and verify:package already rejects multiple installed copies of Core/Eval/Interface.

---

_{tangletools · 2026-08-02T11:31:03Z · trace}

[tangletools]

✅ Approved — 3 non-blocking findings — 9888d80c

Full multi-shot audit completed 3/3 planned shots over 3 changed files. Global verifier still owns final merge decision. | Full multi-shot audit completed 3/3 planned shots over 3 changed files. Global verifier still owns final merge decision. | Full multi-shot audit completed 3/3 planned shots over 3 changed files. Global verifier still owns final merge decision.

Full immutable report for this review: trace

Summary comment for this run: full summary

---

_{tangletools · 2026-08-02T11:31:03Z · immutable trace}