deps-dev(deps-dev): bump the patch-and-minor group with 2 updates

[dependabot]

Bumps the patch-and-minor group with 2 updates: darwin-agents and tsx.

Updates darwin-agents from 0.13.2 to 0.15.0

Release notes

Sourced from darwin-agents's releases.

v0.15.0 — the Hoeffding confidence sequence had no working proof

An external technical review went through the statistics rather than around them and found that one of our load-bearing claims did not hold. This release fixes the mathematics, then asks the same question everywhere else in the repository: is this claim actually true? Several were softened. Nothing was deleted quietly.

The boundary had no working proof

From v0.7 through v0.14 the Hoeffding gate used w(n) = R·√(ln((n+1)/α)/(2n)), documented as "a standard union-bound time-uniform Hoeffding bound". That boundary allows 2α/(n+1) at every look, Σ 2α/(n+1) diverges, and no union bound closes over a divergent series.

Replaced with a summable α-spending schedule, α_n = α_arm/(n(n+1)), whose sum telescopes to exactly α_arm. The four-line proof now sits in the docstring instead of an assertion that one exists. Precisely: what is refuted is the argument, not the boundary. Both arms also spent the full α rather than α/2.

tests/sequential-coverage.test.ts re-derives the α-spend numerically on every run, and shows the old schedule diverging past the budget. The guarantee is measured, not asserted.

Three more defects the review loop surfaced

• mSPRT could decide independently of α. Its zero-variance shortcut fired whenever both arms came out constant, which at minSamplesPerArm: 2 under Bernoulli(0.5) is a 12.5% type-I error against a configured 0.05. It now abstains, and spread-free arms fall back to Hoeffding, which needs no variance estimate.
• Hoeffding failed OPEN on a broken bound. An inverted range silently became 1 and out-of-range samples were accepted, so misconfigured metric weights could promote a challenger on a guarantee that does not apply there. Both now abstain and say why.
• mSPRT is not calibrated at these sample sizes. Measured under H0, at the default α of 0.05, checking after every run: type-I error 0.059 / 0.064 / 0.069 through n=14 / 20 / 30. It is no longer presented as the rigorous option, and the measurement runs as a test so the figures cannot rot.

Also

Four missing CI gates (tests were never type-checked, coverage was measured but never enforced), compiler-enforced dead-code checks in place of a linter (16 real removals, zero new dependencies), and the structural debt in loop.ts named with measured numbers plus a decomposition plan, deliberately not attempted in the same release as a change to A/B decision behaviour.

Upgrade notes

If you use confidenceMethod: 'hoeffding', read

... (truncated)

Changelog

Sourced from darwin-agents's changelog.

[0.15.0] - 2026-08-12

An external technical review of this repository went through the statistics rather than around them, and found that one of our load-bearing claims did not hold. This release fixes the mathematics, and then goes through the rest of the repository asking the same question everywhere: is this claim actually true?

Several were softened as a result. Nothing was quietly deleted.

Fixed

• The Hoeffding confidence sequence had no working proof (src/evolution/sequential.ts). From v0.7 through v0.14 the boundary was w(n) = R·√(ln((n+1)/α)/(2n)), documented in the source as "a standard union-bound / Cramer-Chernoff time-uniform Hoeffding bound". That boundary allows 2α/(n+1) of the error budget at every look, Σ 2α/(n+1) diverges, and no union bound closes over a divergent series, so the always-valid guarantee the code advertised was never established. Precisely: what is refuted is the argument, not the boundary. A divergent chain of upper bounds does not prove the true crossing probability diverges, and nobody has produced another construction that covers it. Gating production promotions on an unproven bound is reason enough to replace it. Replaced with a summable α-spending schedule, α_n = α_arm/(n(n+1)), whose sum telescopes to exactly α_arm:

  w(n) = R · √( ln( 2·n·(n+1) / α_arm ) / (2n) )
  

  The four-line proof now sits in the function's docstring instead of an assertion that it exists. Compare Howard, Ramdas, McAuliffe and Sekhon (arXiv:1810.08240), who make the same point about pointwise Hoeffding intervals. This is stricter than before, by roughly a third on the half-width (29.8% at n=10, 32.1% at n=30, 35.5% at n=900), so a challenger that used to clear the bar may no longer. It should not have cleared it.

• Both arms were spending the full α (src/evolution/sequential.ts). A two-arm verdict needs both confidence sequences to hold at once, so the budget was allocated twice over: even the nominal accounting was off by a factor of two. Precisely, and no further: because the per-arm boundary had no established level to begin with (see above), this is an allocation error, not a proof that the old procedure ran at 2α. Each arm now runs at α/2 and the union bound over the two returns the requested α. This is a second, independent defect in the same function, found while fixing the first.

• mSPRT could decide independently of α (src/evolution/sequential.ts). Its zero-variance shortcut returned decisive: true whenever both arms came out internally constant with a gap, on the reasoning that deterministic arms obviously differ. It fired regardless of the configured significance level, and at small n two arms are constant by chance under H0 often enough

... (truncated)

Commits

• 9dc6855 fix(v0.15.0): the Hoeffding confidence sequence had no working proof
• b4e12a4 deps-dev(deps-dev): bump the patch-and-minor group with 3 updates (#24)
• 85aa70c feat(v0.14.0): offline evals, metrics sink, per-agent safety thresholds — har...
• f16b477 docs(code): align comments + one test with 0.13.2 behaviour — R3 nits
• See full diff in compare view

Updates tsx from 4.23.10 to 4.23.12

Release notes

Sourced from tsx's releases.

v4.23.12

4.23.12 (2026-08-10)

Bug Fixes

• shim import.meta when tokens are split by comments or newlines (#829) (ed9d330), closes #828

---

This release is also available on:

• npm package (@​latest dist-tag)

v4.23.11

4.23.11 (2026-08-07)

Bug Fixes

• preserve async ESM require fallback (55cbece)

---

This release is also available on:

• npm package (@​latest dist-tag)

Commits

• ed9d330 fix: shim import.meta when tokens are split by comments or newlines (#829)
• 651f5be test: cover CommonJS TypeScript import.meta paths
• bd3bc64 test: cover CommonJS loader source fallback
• 55cbece fix: preserve async ESM require fallback
• 6c5ba85 docs: document CommonJS default interop
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[dependabot]

Labels

The following labels could not be found: dependencies. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.