refactor(replay): run replay verification through agent-eval's trajectory-replay

[drewstone]

What changes

traces no longer carries its own copy of replay verification.
src/replay-{verify,batch,corpus,fix,fix-loop,wire}.ts and src/analyze-verify.ts (3,626 lines) duplicated @tangle-network/agent-eval/trajectory-replay, which is the stricter owner: its prefix replay counts a step as confirmed only on positive evidence (verify.ts:24-30).

• New src/replay.ts (about 440 lines) keeps only what the CLI owns: the Tangle Sandbox exec backend (sandboxReplayBackend), the OpenAI-compatible fix caller (zaiChatCaller), the sandbox reachability preflight, and flag parsing for replay-verify, replay-verify-batch and verify-findings.
• analyze --verify-findings calls the same verifyFindingsInSandbox.
• The package root re-exports @tangle-network/agent-eval/trajectory-replay, so replayVerify, runReplayBatch, verifyFindings and the rest keep their import path.
• The six mock-backed unit test files of the deleted code are deleted with it.
• Command names, flags and exit behaviour are unchanged.

Source: agent-inspect audit, "Duplication on our side" (~/webb/_wt/_mq-notes/agent-inspect-audit.md section 4).

Proof

Real input: the 21 recorded bash steps of VerticalBench climb cell base-pay-usdc-checkout.train.2.pbfe352ff.aeeedf5e0 (vb-climb-runs/climb-20260924T005443Z), written as a CodeTraceBench steps file, and four analyst-shaped findings.
The same commands ran on origin/main (detached worktree) and on this branch:

=== traces-main-proof (origin/main 2201999)
--- 1) no SANDBOX_API_KEY, one replayable finding:
error: verify-findings: replayable findings need a sandbox API key — export SANDBOX_API_KEY or pass --api-key-env
exit=1
--- 2) key set, no sandbox listening on 127.0.0.1:4097:
error: verify-findings: sandbox API unreachable at http://127.0.0.1:4097 — fetch failed. Executing findings requires a running sandbox orchestrator + SDK adapter (see docs/replay-verify.md); start them or pass --base-url.
exit=1
--- 3) only not-replayable findings (no sandbox needed):
exit=0
verify-findings: 3 finding(s) → 0 reproduced, 0 fix-flipped, 0 divergent, 3 not-replayable (0 execution(s)) → …/out-main-proof-3
=== traces-analysis (this branch)
--- 1) no SANDBOX_API_KEY, one replayable finding:
error: verify-findings: replayable findings need a sandbox API key — export SANDBOX_API_KEY or pass --api-key-env
exit=1
--- 2) key set, no sandbox listening on 127.0.0.1:4097:
error: verify-findings: sandbox API unreachable at http://127.0.0.1:4097 — fetch failed. Executing findings requires a running sandbox orchestrator + SDK adapter (see docs/replay-verify.md); start them or pass --base-url.
exit=1
--- 3) only not-replayable findings (no sandbox needed):
exit=0
verify-findings: 3 finding(s) → 0 reproduced, 0 fix-flipped, 0 divergent, 3 not-replayable (0 execution(s)) → …/out-analysis-3

Per-finding verdicts on this branch:

f-step-99 not-replayable - step 99 is outside the trajectory (21 steps)
f-none    not-replayable - subject 'tool-thrash' names no trajectory step (expected incorrect-step-<n>, …)
f-other   not-replayable - finding cites trajectory 'some-other-trajectory' but the supplied steps are case 'aeeedf5e0'

diff -r of the two receipt directories differs only in produced_at timestamps and output paths, plus agent-eval's run verdict, which traces never had:

>   "valid": false,
>   "score": 0,
>   "scores": { "reproduced": 0, "fixFlipped": 0, "divergent": 0, "notReplayable": 1 },
>   "notes": "no finding was replayable — nothing measured"

Gate: git merge-tree against origin/main is clean, pnpm install --frozen-lockfile passes, and pnpm typecheck is clean.

Not run: a live sandbox replay. No sandbox orchestrator is running on this host, and no traces-owned SANDBOX_API_KEY exists. The arm execution path is agent-eval's replayVerify, called with the same backend object as before.

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, add credits to your account and enable them for code reviews in your settings.