Your first session

npm install -g replume-cli
replume --version
replume init --check

replume status
replume report --session
replume guide

Verdict: PASS
Status: PASS (verify PASS; steered 0 times, 0 blocked)

## What was asked

- Task: Fix src/sum.js so the existing npm test passes. Do not edit the test. Run npm test.
- DONE — test\_command: \`npm test\` exit 0
- DONE — done: npm test: \`npm test\` exit 0 (definition of done, re-run here)
- OBSERVED — src/sum.js changed and seen by the hooks: checked by test\_command and observed steps; no scenario

## What changed

- src/sum.js (+1, −1)

## Where Replume steered

- No Stop retries were recorded.
- No blocks or nudges were recorded.

## Tests

- 1 run — 0 failed, 1 passed.
- npm test: passed (exit 0; verify, isolated copy); 1 passed, 0 failed, 0 skipped.

## Runtime check

- Not checked: No runnable entry point found in package.json, Python files, or Dockerfile.
- No screenshot evidence was supplied.

## Model judge

- No model judge result was supplied.

## What was NOT checked

- No runnable entry point found in package.json, Python files, or Dockerfile

## Assumptions Replume made

- Mode: auto (from \`.replume/config\`).
- The task is the confirmed contract task-2026-10-23-001: "Fix src/sum.js so the existing npm test passes. Do not edit the test. Run npm test.". Scope = allow \[src/sum.js, test/\*\*\], protected \[test/sum.test.js, .env, .env.\*\].
- Inferred when the contract was made (ledger): assumed from the first prompt of this session; no confirm
- Inferred when the contract was made (ledger): worktree snapshot 60657afeab0c134aa0bd3e51ee3081ea71754f65 (dirty tree)
- Inferred when the contract was made (ledger): test\_command "npm test": package.json has a "test" script
- Inferred when the contract was made (ledger): protect "test/sum.test.js": existing test file
- Inferred when the contract was made (ledger): protect ".env": secrets file
- Inferred when the contract was made (ledger): protect ".env.\*": secrets files (.env.example and similar templates are still readable)
- Inferred when the contract was made (ledger): allow "src/sum.js": the task names this file
- Inferred when the contract was made (ledger): allow "test/\*\*": new test files may be added; verify lists them as informational EXTRA (decision D-022); existing test files stay protected
- Inferred when the contract was made (ledger): done "npm test": the agent is asked at Stop to run it successfully after its last edit (capped, see max\_stop\_blocks)
- "Done" means \`npm test\` passes with at least one test. Replume ran it itself at Stop 1 time (timeout 120 s, at most 3 steers).
- The agent's changes were not committed. Replume verified a snapshot commit (af1a10a, kept as refs/replume/auto/a5a16277-02dd-4521-b7d7-6e3ad9e05773) of the working tree; your branch, index and working tree were not changed.
- Isolation: docker (auto: local Docker daemon, image node:20-bookworm-slim).
- Replume's hooks recorded 10 events for this session; a change the hooks did not see is reported as NOT CHECKED, not as checked.

## Verify (full report)

```
Verdict: PASS — the checks that ran passed
Why: 2 check(s) passed (test_command, done: npm test); no failing check, blocking extra change, tampering or undeclared coverage was reported; 1 changed file(s) checked by test_command and observed steps, no scenario.
Agent activity: 10 event(s) reached Replume; this is not proof that every step was captured.
Replume report  commit af1a10a  task: task-2026-10-23-001
Base         60657af  the task-start commit recorded when the contract was confirmed
POLICY       contract read from the working tree; .replume/baseline.json is a local file and is not authenticated (anyone who can write .replume/ can rewrite it). Pass --trusted-base <ref> to read policy and scenarios from a git ref
  Meaning: POLICY identifies the contract and scenarios used to judge this change.
CHECKED      6 check(s) ran
  Meaning: CHECKED lists checks Replume actually performed in this run.
  scope: 1 changed file compared with allow globs, 0 outside
  tampering: 0 changed test files inspected for removed assertions, skip/only and forced success; 3 protect globs; .replume/ changes
  test_command: `npm test` exit 0 (declares no coverage by itself; with observed agent steps it checks changed files no scenario declares, D-062)
  baseline: recorded when the contract was confirmed (task-2026-10-23-001, 2026-10-23T06:23:52.831Z): recorded base 60657af used as the default base; contract and 0 scenario files unchanged since
  dependencies: no dependency file changed in the diff
  done: 1 done entry re-run here: 1 passed
NOT RUN      1 check(s) did not run
  Meaning: NOT RUN lists checks without an executed result.
  scenarios: no scenario files at this commit
DONE         (2)  test_command, done: npm test
EXTRA        (0)  —
TAMPERING    (0)  —
OBSERVED     (1)  src/sum.js  checked by test_command and observed steps; no scenario
NOT CHECKED  (0)  —
RUNTIME (like a user)  NOT CHECKED: No runnable entry point found in package.json, Python files, or Dockerfile; BASE RUN not_checked: No runnable entry point found in package.json, Python files, or Dockerfile
  Meaning: RUNTIME runs the committed app like a user inside Docker, then compares the same probe at the base commit. It does not assert unrequested behaviour.
  Mode: Docker container, image node:20-bookworm-slim; separate from scenario isolation (docker).
  Detected: nothing runnable
  Ran: nothing
SUPERVISOR   (0)  layer 2: off; 1 ledger session that edited files changed in this diff; blocked 0, warned 0, asked 0; protected-state writes 0
  Meaning: SUPERVISOR lists permission decisions; matching Cursor shell hooks are counted once. Hook output alone does not confirm execution. These records are editable.
CAPTURE COVERAGE
  seen       10 events from claude-code in 1 session (2026-10-23T06:23:52.832Z to 2026-10-23T06:23:59.469Z): command 3, prompt 2, rule_hit 2, tool_pre 2, stop 1
  tools      Bash 2
  files      1 of 1 changed file(s) named by an allowed step; 1 landed and observed (file_edit or successful command event); 0 only attempted (blocked)
  not seen   nothing flagged by these checks (they cannot see steps taken outside the hooks)
  limits     only agents with a Replume adapter and installed hooks write events; the ledger is a local file that can be edited or deleted. This is what was captured, not proof of what the agent did.
DONE CHECKS  live at Stop: last Stop: all 1 done entries met according to the ledger; the ledger is a local file anyone can edit, so this is not evidence that they ran
METRICS      wall 7s (ledger, first to last event); hook calls 8; steer 0; block 0; protected-state writes 0; layer-2 calls 0; test_weakened 0 in diff / 0 live; tokens 146480 (recorded)
ACCOUNTING   wall 7s; active Unknown; human wait Unknown; tokens 6 in / 377 out (cache 107522 read / 38575 write); accepted no; API-equivalent Unknown (change not accepted);
  Meaning: METRICS counts recorded activity; missing token data stays unknown.
  Meaning: ACCOUNTING lists local task time, token counts, acceptance and any estimated API-equivalent amount.
EVIDENCE TAGS
  Meaning: EVIDENCE TAGS show where each result came from and how strong its evidence is.
  Base: [Observed]
  POLICY: [Observed]
  scope: [Verified in this environment]
  tampering: [Verified in this environment]
  test_command: [Verified in this environment]
  baseline: [Observed]
  dependencies: [Verified in this environment]
  done: [Verified in this environment]
  scenarios: [Unknown]
  DONE: [Verified in this environment]
  EXTRA: [Verified in this environment]
  TAMPERING: [Verified in this environment]
  OBSERVED: [Observed]
  NOT CHECKED: [Unknown]
  RUNTIME (like a user): [Unknown]
  SUPERVISOR: [Observed]
  seen: [Observed]
  DONE CHECKS: [Observed: editable ledger]
  METRICS: [evidence: wall time, hook calls, steer, block, layer-2 calls Observed; test_weakened in diff Verified in this environment; tokens Observed]
  ACCOUNTING: [evidence: wall observed; tokens observed; active and human wait Unknown; API-equivalent unknown]
EVIDENCE     [Verified in this environment] ran or computed in this verify run; [Observed] read from a record (ledger, baseline.json), not re-checked; [Assumed] model judge output; [Unknown] not checked. The verdict at the top is derived from these lines.
  Meaning: advisory means a warning to inspect, not a check that was proven to fail.
Isolation    isolation: docker, Docker container (no network, read-only copy of the commit)  [auto: local Docker daemon, image node:20-bookworm-slim]
```