v0.18.2 — Adversarial-review hardening

Two adversarial reviews — of the governance/security surface and the hierarchy/orchestration cost accounting — found ten real bugs the test suite missed, all fixed and regression-tested (the same discipline that caught the fusion bugs in 0.18.1).

Security — governance (6 fixes)

• Taint survives crash/resume: a tainted run that crashed and resumed came back with an empty ledger → a later success finalized "clean", bypassing outbound-strip / tainted-provenance / pause-on-taint. Persisted + re-seeded on resume.
• Aggregate monitor sees exfiltration: send_email/http_post/post_webhook/... produced no capability event, so split-exfil (A fetches, B sends it out) passed clean. Outbound sends are now recorded as sinks.
• Memory merge no longer launders taint: merge() dropped provenance → imported tainted facts stored/recalled as verified. Provenance now carried through.
• Drift absent fails closed: a forbidden pattern hiding in an oversized/undecodable file reported "absent". Unscannable files now fail the check.
• Data-fence can't be closed early: fence() neutralizes its own fixed public close marker if untrusted content embeds it.
• Taint write-escalation covers self-executing configs: jobs.json, CI .yml, Dockerfile, dotfiles, and patch/diff content keys now escalate too.

Fixed — hierarchy cost honesty (4 fixes)

• Orchestrator overhead is metered: the decompose + synthesis calls were never counted; now recorded as receipts (counterfactual = 0), so they add to measured cost and honestly reduce the saving.
• Counterfactual no longer double-charges context: each per-subtask inline counterfactual re-charged the full ~24k orchestrator context; now shared across subtasks (inline loads it once).
• Re-ask is re-audited: a spot-failure re-ask skipped the spot check ~80% of the time; now forced.
• Cascade weak-tier usage: a k-sample consensus returned one sample's usage; now sums all k.

Added

• Cost-bench tail: chimera cascade-bench reports per-arm p50 / p95 / p99 / max token cost, not just the mean — a cascade can look cheap on average while a few tasks escalate all the way to fusion.

Documentation

• Contributor onboarding: a Makefile (make check runs the whole gate), a refreshed Architecture map covering the newer subsystems, and a strict-clean docs site.

Gate: ruff + mypy clean, 1377 passed / 3 skipped. pip install -U chimera-agent