@geraldmaron/construct 1.0.3 → 1.0.5

package/lib/intake/tables/rnd.mjs

@@ -0,0 +1,175 @@
+/**
+ * lib/intake/tables/rnd.mjs — RND intake classification table.
+ *
+ * Extracted from lib/intake/classify.mjs as part of B2. Behavior must remain
+ * byte-identical for RND inputs; tests/intake/golden-rnd.test.mjs is the
+ * regression guard.
+ *
+ * Schema: { INTAKE_TYPES, STAGES, CLASSIFICATION_TABLE, UNKNOWN_TRIAGE }.
+ * UNKNOWN_TRIAGE handles the no-match fallback for this profile.
+ */
+
+export const INTAKE_TYPES = [
+  'user-signal',
+  'bug',
+  'requirement',
+  'research',
+  'experiment',
+  'eval-finding',
+  'architecture',
+  'incident',
+  'launch-asset',
+  'ops',
+  'security',
+  'legal-compliance',
+  'unknown',
+];
+
+export const STAGES = [
+  'signal',
+  'framing',
+  'hypothesis',
+  'research',
+  'artifact',
+  'design',
+  'implementation',
+  'evaluation',
+  'release',
+  'operations',
+  'unknown',
+];
+
+export const UNKNOWN_TRIAGE = {
+  intakeType: 'unknown',
+  rdStage: 'unknown',
+  primaryOwner: 'orchestrator',
+  recommendedChain: ['orchestrator'],
+  recommendedAction: 'summarize',
+  risk: 'low',
+  requiresApproval: false,
+};
+
+export const CLASSIFICATION_TABLE = [
+  {
+    intakeType: 'security',
+    keywords: ['security', 'secret', 'cve', 'vulnerability', 'vuln', 'exploit', 'leak', 'auth bypass', 'privilege escalation', 'sqli', 'xss', 'csrf', 'rce'],
+    rdStage: 'operations',
+    primaryOwner: 'security',
+    recommendedChain: ['security', 'engineer', 'reviewer'],
+    recommendedAction: 'diagnose',
+    risk: 'high',
+    requiresApproval: true,
+  },
+  {
+    intakeType: 'incident',
+    keywords: ['incident', 'outage', 'slo breach', 'sla breach', 'latency spike', 'availability', 'down', 'p0 ', 'p1 ', 'pagerduty', '5xx', 'oncall'],
+    rdStage: 'operations',
+    primaryOwner: 'sre',
+    recommendedChain: ['sre', 'debugger', 'platform-engineer'],
+    recommendedAction: 'create-runbook',
+    risk: 'high',
+    requiresApproval: true,
+  },
+  {
+    intakeType: 'legal-compliance',
+    keywords: ['gdpr', 'ccpa', 'hipaa', 'sox', 'soc2', 'license', 'lawsuit', 'dpa', 'data retention', 'pii', 'subpoena', 'compliance audit'],
+    rdStage: 'operations',
+    primaryOwner: 'legal-compliance',
+    recommendedChain: ['legal-compliance', 'security', 'product-manager'],
+    recommendedAction: 'clarify',
+    risk: 'high',
+    requiresApproval: true,
+  },
+  {
+    intakeType: 'architecture',
+    keywords: ['architecture', 'adr', 'rfc', 'interface', 'tradeoff', 'boundary', 'system design', 'data model', 'api contract', 'migration plan'],
+    rdStage: 'design',
+    primaryOwner: 'architect',
+    recommendedChain: ['architect', 'devil-advocate', 'engineer'],
+    recommendedAction: 'draft-rfc',
+    risk: 'medium',
+    requiresApproval: false,
+  },
+  {
+    intakeType: 'eval-finding',
+    keywords: ['eval', 'evaluation', 'hallucination', 'judge', 'trace', 'score regression', 'recall@', 'precision@', 'mrr', 'ndcg', 'failure case', 'rubric'],
+    rdStage: 'evaluation',
+    primaryOwner: 'evaluator',
+    recommendedChain: ['evaluator', 'ai-engineer', 'trace-reviewer'],
+    recommendedAction: 'evaluate',
+    risk: 'medium',
+    requiresApproval: false,
+  },
+  {
+    intakeType: 'bug',
+    keywords: ['bug', 'broken', 'error', 'stack trace', 'regression', 'crash', 'exception', 'fails', 'failing', 'throws', 'not working', 'reproduce', 'repro:'],
+    rdStage: 'implementation',
+    primaryOwner: 'debugger',
+    recommendedChain: ['debugger', 'engineer', 'qa', 'reviewer'],
+    recommendedAction: 'diagnose',
+    risk: 'medium',
+    requiresApproval: false,
+  },
+  {
+    intakeType: 'experiment',
+    keywords: ['hypothesis', 'experiment', 'spike', 'prototype', 'falsifiable', 'research question', 'a/b test', 'pilot'],
+    rdStage: 'hypothesis',
+    primaryOwner: 'rd-lead',
+    recommendedChain: ['rd-lead', 'researcher', 'evaluator'],
+    recommendedAction: 'create-experiment',
+    risk: 'low',
+    requiresApproval: false,
+  },
+  {
+    intakeType: 'launch-asset',
+    keywords: ['release', 'changelog', 'version bump', 'ship', 'launch', 'rollout', 'cut a release', 'rc1', 'rc2', 'release candidate'],
+    rdStage: 'release',
+    primaryOwner: 'release-manager',
+    recommendedChain: ['release-manager', 'qa', 'docs-keeper'],
+    recommendedAction: 'release-review',
+    risk: 'medium',
+    requiresApproval: false,
+  },
+  {
+    intakeType: 'research',
+    keywords: ['competitor', 'market', 'pricing', 'positioning', 'industry', 'state of the art', 'literature', 'benchmark study', 'desk research'],
+    rdStage: 'research',
+    primaryOwner: 'business-strategist',
+    recommendedChain: ['business-strategist', 'researcher', 'product-manager'],
+    recommendedAction: 'research',
+    risk: 'low',
+    requiresApproval: false,
+  },
+  {
+    intakeType: 'user-signal',
+    keywords: ['customer', 'feedback', 'pain point', 'user says', 'user feedback', 'support ticket', 'churn', 'nps', 'usability', 'frustrated'],
+    rdStage: 'signal',
+    primaryOwner: 'product-manager',
+    recommendedChain: ['product-manager', 'ux-researcher', 'researcher'],
+    recommendedAction: 'clarify',
+    risk: 'low',
+    requiresApproval: false,
+  },
+  {
+    intakeType: 'requirement',
+    keywords: ['acceptance criteria', 'requirement', 'must have', 'should have', 'feature request', 'prd', 'use case', 'success metric'],
+    rdStage: 'framing',
+    primaryOwner: 'product-manager',
+    recommendedChain: ['product-manager', 'architect', 'engineer'],
+    recommendedAction: 'draft-prd',
+    risk: 'low',
+    requiresApproval: false,
+  },
+  {
+    intakeType: 'ops',
+    keywords: ['runbook', 'cron', 'scheduled job', 'maintenance', 'backup', 'restore', 'capacity plan', 'cost optimization', 'dependency upgrade'],
+    rdStage: 'operations',
+    primaryOwner: 'operations',
+    recommendedChain: ['operations', 'sre', 'engineer'],
+    recommendedAction: 'create-runbook',
+    risk: 'low',
+    requiresApproval: false,
+  },
+];
+
+export default { INTAKE_TYPES, STAGES, CLASSIFICATION_TABLE, UNKNOWN_TRIAGE };

package/lib/intent-classifier.mjs

@@ -209,6 +209,7 @@ export async function verifyIntent({ request, specialist, flavor, matchedKeyword
 // Kept here (not in orchestration-policy) so the classifier module stays
 // the canonical source of "what does verified mean for this role."
 const ROLE_PROMPT_KEYWORDS = {
+  engineer: ['ai', 'platform', 'data', 'prompt', 'pipeline', 'deploy'],
   productManager: ['platform', 'enterprise', 'ai-product', 'growth', 'go-to-market'],
   architect: ['ai-systems', 'integration', 'data model', 'enterprise', 'platform'],
   qa: ['ai-eval', 'api-contract', 'data-pipeline', 'web-ui'],

package/lib/knowledge/layout.mjs

@@ -19,6 +19,8 @@
  */
 
 export const KNOWLEDGE_ROOT = '.cx/knowledge';
+export const KNOWLEDGE_INTERNAL_ROOT = `${KNOWLEDGE_ROOT}/internal`;
+export const KNOWLEDGE_REFERENCE_ROOT = `${KNOWLEDGE_ROOT}/reference`;
 
 /**
  * All valid knowledge subdirectory names.
@@ -70,3 +72,11 @@ export function inferKnowledgeTarget(filePath) {
   if (/\bpost.?mortem\b|\bincident\b|\brca\b/.test(name))             return 'internal';
   return 'internal';
 }
+
+export function knowledgeInternalStore(...segments) {
+  return ['knowledge', 'internal', ...segments].join('/');
+}
+
+export function knowledgeReferenceStore(...segments) {
+  return ['knowledge', 'reference', ...segments].join('/');
+}

package/lib/knowledge/research-store.mjs

@@ -0,0 +1,109 @@
+/**
+ * lib/knowledge/research-store.mjs — Persist research findings into the knowledge base.
+ *
+ * Wraps the existing document-ingest pipeline so research output written via
+ * `construct knowledge add --source=research` lands in
+ * `.cx/knowledge/external/research/<slug>.md` with research-specific frontmatter
+ * (topic, confidence, sources, expiresAt, profile). The file is then synced into
+ * the SQL/vector index via the standard `syncFileStateToSql` path.
+ *
+ * Schema (frontmatter):
+ *   kind: research-finding
+ *   topic: string
+ *   confidence: confirmed | inferred | weak
+ *   sources: [{ url, accessedAt, span? }]
+ *   expiresAt: ISO date (default +90d)
+ *   profile: <profile-id>
+ */
+import { existsSync, mkdirSync, writeFileSync } from 'node:fs';
+import { dirname, join } from 'node:path';
+import { syncFileStateToSql } from '../storage/sync.mjs';
+import { resolveActiveProfile } from '../profiles/loader.mjs';
+
+const ROOT = '.cx/knowledge/external/research';
+const MAX_BYTES = 50 * 1024;
+const DEFAULT_TTL_DAYS = 90;
+
+const VALID_CONFIDENCE = new Set(['confirmed', 'inferred', 'weak']);
+
+/**
+ * @param {object} args
+ * @param {string} args.cwd - project root
+ * @param {string} args.slug - filename slug (lowercase, hyphenated)
+ * @param {string} args.topic - human-readable topic line
+ * @param {string} args.body - the FINDINGS / INFERENCES / GAPS / RECOMMENDATION block
+ * @param {string} [args.confidence] - confirmed | inferred | weak
+ * @param {Array<{url:string,accessedAt?:string,span?:string}>} [args.sources]
+ * @param {number} [args.ttlDays] - override default expiry
+ * @returns {Promise<{path:string,bytes:number}>}
+ */
+export async function addResearchFinding({
+  cwd,
+  slug,
+  topic,
+  body,
+  confidence = 'inferred',
+  sources = [],
+  ttlDays = DEFAULT_TTL_DAYS,
+}) {
+  if (!cwd) throw new Error('addResearchFinding: cwd is required');
+  if (!slug || !/^[a-z0-9][a-z0-9-]{0,60}$/.test(slug)) {
+    throw new Error('addResearchFinding: slug must be lowercase, hyphenated, max 60 chars');
+  }
+  if (!topic || typeof topic !== 'string') {
+    throw new Error('addResearchFinding: topic is required');
+  }
+  if (!body || typeof body !== 'string') {
+    throw new Error('addResearchFinding: body is required');
+  }
+  if (!VALID_CONFIDENCE.has(confidence)) {
+    throw new Error(`addResearchFinding: confidence must be one of ${Array.from(VALID_CONFIDENCE).join(', ')}`);
+  }
+  if (confidence === 'confirmed' && (!Array.isArray(sources) || sources.length === 0)) {
+    throw new Error('addResearchFinding: confidence=confirmed requires at least one source');
+  }
+
+  const profile = resolveActiveProfile(cwd);
+  const now = new Date();
+  const expiresAt = new Date(now.getTime() + ttlDays * 24 * 60 * 60 * 1000).toISOString();
+
+  const outDir = join(cwd, ROOT);
+  mkdirSync(outDir, { recursive: true });
+  const outPath = join(outDir, `${slug}.md`);
+
+  const fmSources = (Array.isArray(sources) ? sources : [])
+    .filter((s) => s && typeof s.url === 'string')
+    .map((s) => ({
+      url: s.url,
+      accessedAt: s.accessedAt || now.toISOString(),
+      ...(s.span ? { span: String(s.span).slice(0, 200) } : {}),
+    }));
+
+  const frontmatter = [
+    '---',
+    'kind: research-finding',
+    `topic: ${JSON.stringify(topic)}`,
+    `confidence: ${confidence}`,
+    `sources: ${JSON.stringify(fmSources)}`,
+    `created: ${now.toISOString()}`,
+    `expiresAt: ${expiresAt}`,
+    `profile: ${profile?.id ?? 'rnd'}`,
+    '---',
+    '',
+  ].join('\n');
+
+  const fullText = frontmatter + body.trim() + '\n';
+  if (Buffer.byteLength(fullText, 'utf8') > MAX_BYTES) {
+    throw new Error(`addResearchFinding: file exceeds ${MAX_BYTES} bytes`);
+  }
+
+  writeFileSync(outPath, fullText);
+
+  // Best-effort sync into SQL/vector index. The file is the source of truth;
+  // index lag never blocks the operator.
+  try {
+    await syncFileStateToSql(cwd, { project: profile?.id ?? 'rnd' });
+  } catch { /* best effort */ }
+
+  return { path: outPath, bytes: Buffer.byteLength(fullText, 'utf8') };
+}

package/lib/mcp/tools/telemetry.mjs

@@ -2,12 +2,13 @@
  * lib/mcp/tools/telemetry.mjs — Telemetry MCP tools: trace/score, session usage, efficiency snapshot.
  *
  * Exposes cxTrace, cxScore, sessionUsage, and efficiencySnapshot.
- * Requires ROOT_DIR injected via opts. Telemetry credentials must be in env.
+ * Requires ROOT_DIR injected via opts. Remote export uses the shared telemetry
+ * adapter when configured; local JSONL remains available by default.
  */
 import { join, resolve } from 'node:path';
 import { homedir } from 'node:os';
 import { readFileSync, existsSync } from 'node:fs';
-import { isAvailable as telemetryAvailable } from '../../telemetry/backends/remote.mjs';
+import { createTelemetryClient } from '../../telemetry/client.mjs';
 import { summarizePromptComposition } from '../../prompt-composer.js';
 import { enrichMetadataWithPrompt } from '../../prompt-metadata.mjs';
 import { readCurrentModels, resolveExecutionContractModelMetadata, selectModelTierForWorkCategory } from '../../model-router.mjs';
@@ -16,7 +17,6 @@ import { loadWorkflow } from '../../workflow-state.mjs';
 import { buildStatus } from '../../status.mjs';
 import { readEfficiencyLog, buildCompactEfficiencyDigest } from '../../efficiency.mjs';
 import { addObservation } from '../../observation-store.mjs';
-// Local mock ingest client for fallback when ingestion service is unavailable
 import { loadConstructEnv } from '../../env-config.mjs';
 
 // Load config.env once at module init so config.env values win over shell env
@@ -34,15 +34,6 @@ function readJSON(filePath) {
 
 import { execSync as _execSync } from 'node:child_process';
 
-// Mock ingest client for fallback to direct API when the real client is not available.
-
-function getOrCreateIngestClient() {
-  return {
-    available: false,
-    trace: () => {}
-  };
-}
-
 function resolveReleaseTag(cwd) {
   try {
     return _execSync('git rev-parse --short HEAD', { stdio: 'pipe', cwd, timeout: 2000 }).toString().trim() || undefined;
@@ -51,18 +42,8 @@ function resolveReleaseTag(cwd) {
   }
 }
 
-function telemetryHeaders() {
-  const key = CONF_ENV.CONSTRUCT_TELEMETRY_PUBLIC_KEY ?? process.env.CONSTRUCT_TELEMETRY_PUBLIC_KEY;
-  const secret = CONF_ENV.CONSTRUCT_TELEMETRY_SECRET_KEY ?? process.env.CONSTRUCT_TELEMETRY_SECRET_KEY;
-  if (!key || !secret) throw new Error('CONSTRUCT_TELEMETRY_PUBLIC_KEY and CONSTRUCT_TELEMETRY_SECRET_KEY must be set.');
-  return {
-    Authorization: `Basic ${Buffer.from(`${key}:${secret}`).toString('base64')}`,
-    'Content-Type': 'application/json',
-  };
-}
-
-function telemetryBaseUrl() {
-  return (CONF_ENV.CONSTRUCT_TELEMETRY_URL ?? process.env.CONSTRUCT_TELEMETRY_URL ?? '').replace(/\/$/, '');
+function telemetryEnv() {
+  return { ...process.env, ...CONF_ENV };
 }
 
 function resolveSessionContext() {
@@ -128,10 +109,8 @@ export async function cxTrace(args, { ROOT_DIR }) {
   }, { rootDir: ROOT_DIR });
   const traceId = args.id ?? crypto.randomUUID();
   try {
-    const available = await telemetryAvailable();
-    if (!available) return { ok: false, error: 'Telemetry credentials not configured', id: traceId };
     const teamId = args.metadata?.teamId ?? metadata.teamId;
-    const workCategoryValue = route?.workCategory ?? (typeof args.input === 'string' ? classifyWorkCategory({ request: args.input }) : null);
+    const workCategoryValue = route?.workCategory ?? null;
     const body = {
       id: traceId,
       name: args.name,
@@ -156,27 +135,17 @@ export async function cxTrace(args, { ROOT_DIR }) {
       release: ctx.release,
     };
 
-     // Add version to metadata for test compatibility
-     body.metadata.version = 'v1';
-     
-    // Use ingestion batch for creation (handles large payloads better than direct API)
-        const ingestClient = getOrCreateIngestClient();
-        if (ingestClient?.available) {
-       ingestClient.trace(body);
-       return { ok: true, id: traceId };
-     }
+    body.metadata.version = 'v1';
 
-     // Fallback: direct API call
-     const res = await fetch(`${telemetryBaseUrl()}/api/public/traces`, {
-       method: 'POST',
-       headers: telemetryHeaders(),
-       body: JSON.stringify(body),
-     });
-     if (!res.ok) {
-       const text = await res.text().catch(() => '');
-       return { ok: false, error: `Telemetry API error ${res.status}: ${text}`, id: traceId };
-     }
-     return { ok: true, id: traceId };
+    const client = createTelemetryClient({ env: telemetryEnv(), rootDir: ROOT_DIR });
+    client.trace(body);
+    await client.flush();
+    return {
+      ok: true,
+      id: traceId,
+      backend: client.backend,
+      remoteStatus: client.remoteStatus,
+    };
   } catch (err) {
     return { ok: false, error: err.message, id: traceId };
   }
@@ -193,25 +162,16 @@ export async function cxTraceUpdate(args) {
   const metadata = args.metadata;
 
   try {
-    const available = await telemetryAvailable();
-    if (!available) return { ok: false, error: 'Telemetry credentials not configured' };
-
-    const res = await fetch(`${telemetryBaseUrl()}/api/public/traces/${traceId}`, {
-      method: 'PATCH',
-      headers: telemetryHeaders(),
-      body: JSON.stringify({
-        output,
-        metadata: {
-          ...(metadata && typeof metadata === 'object' ? metadata : {}),
-          traceUpdatedAt: new Date().toISOString(),
-        },
-      }),
+    const client = createTelemetryClient({ env: telemetryEnv(), rootDir: process.cwd() });
+    client.traceUpdate({
+      id: traceId,
+      output,
+      metadata: {
+        ...(metadata && typeof metadata === 'object' ? metadata : {}),
+        traceUpdatedAt: new Date().toISOString(),
+      },
     });
-
-    if (!res.ok) {
-      const text = await res.text().catch(() => '');
-      return { ok: false, error: `Telemetry PATCH error ${res.status}: ${text}` };
-    }
+    await client.flush();
 
     // Also record as observation for local learning
     if (output || metadata) {
@@ -227,7 +187,7 @@ export async function cxTraceUpdate(args) {
       });
     }
 
-    return { ok: true, traceId };
+    return { ok: true, traceId, backend: client.backend, remoteStatus: client.remoteStatus };
   } catch (err) {
     return { ok: false, error: err.message };
   }
@@ -240,8 +200,6 @@ const SCORE_GOOD_THRESHOLD = 0.85;   // at or above this → record positive pat
 export async function cxScore(args) {
   const traceId = args.trace_id ?? '';
   try {
-    const available = await telemetryAvailable();
-    if (!available) return { ok: false, error: 'Telemetry credentials not configured' };
     const body = {
       id: crypto.randomUUID(),
       traceId,
@@ -250,15 +208,9 @@ export async function cxScore(args) {
       dataType: 'NUMERIC',
       comment: args.comment,
     };
-    const res = await fetch(`${telemetryBaseUrl()}/api/public/scores`, {
-      method: 'POST',
-      headers: telemetryHeaders(),
-      body: JSON.stringify(body),
-    });
-    if (!res.ok) {
-      const text = await res.text().catch(() => '');
-      return { ok: false, error: `Telemetry API error ${res.status}: ${text}` };
-    }
+    const client = createTelemetryClient({ env: telemetryEnv(), rootDir: process.cwd() });
+    client.score(body);
+    await client.flush();
 
     // Feed score back into the local observation store so future agents learn from it.
     // Low scores generate anti-pattern observations; high scores reinforce positive patterns.
@@ -291,7 +243,7 @@ export async function cxScore(args) {
       }
     }
 
-    return { ok: true, traceId };
+    return { ok: true, traceId, backend: client.backend, remoteStatus: client.remoteStatus };
   } catch (err) {
     return { ok: false, error: err.message };
   }

package/lib/model-router.mjs

@@ -45,6 +45,61 @@ export const MODEL_TIER_BY_WORK_CATEGORY = {
   analysis: "standard",
 };
 
+export const MODEL_OPERATING_PROFILES = Object.freeze({
+  balanced: {
+    id: 'balanced',
+    label: 'Balanced',
+    maxPromptTokens: 3000,
+    learnedPatternsTokens: 200,
+    taskPacketTokens: 150,
+    contextDigestTokens: 200,
+    hostConstraintsTokens: 75,
+    roleFlavorTokens: 600,
+    retrievalFirst: false,
+    preferCompressedRoleGuidance: false,
+  },
+  small: {
+    id: 'small',
+    label: 'Small-model',
+    maxPromptTokens: 1800,
+    learnedPatternsTokens: 120,
+    taskPacketTokens: 110,
+    contextDigestTokens: 120,
+    hostConstraintsTokens: 40,
+    roleFlavorTokens: 280,
+    retrievalFirst: true,
+    preferCompressedRoleGuidance: true,
+  },
+});
+
+function normalizeModelOperatingProfile(value) {
+  const normalized = String(value || '').trim().toLowerCase();
+  if (!normalized) return null;
+  if (normalized === 'default') return 'balanced';
+  return MODEL_OPERATING_PROFILES[normalized] ? normalized : null;
+}
+
+function inferSmallModelProfile(selectedModel) {
+  const model = String(selectedModel || '').toLowerCase();
+  if (!model) return false;
+  if (/^(ollama|local)\//.test(model) && /(?:[:/-])(3b|7b|8b|13b|14b|32b)\b/.test(model)) return true;
+  if (/^(anthropic|openrouter\/anthropic)\/.*haiku/.test(model)) return true;
+  if (/gpt-5\.1-mini|gemma-3|gemma-4|phi3:mini/.test(model)) return true;
+  return false;
+}
+
+export function resolveModelOperatingProfile({
+  envValues = {},
+  selectedModel = null,
+} = {}) {
+  const explicit = normalizeModelOperatingProfile(
+    envValues.CONSTRUCT_MODEL_PROFILE ?? envValues.constructModelProfile
+  );
+  if (explicit) return MODEL_OPERATING_PROFILES[explicit];
+  if (inferSmallModelProfile(selectedModel)) return MODEL_OPERATING_PROFILES.small;
+  return MODEL_OPERATING_PROFILES.balanced;
+}
+
 /**
  * Provider-family definitions. Each entry contains:
  *   - `test`: RegExp that matches provider URLs.
@@ -229,7 +284,7 @@ const PROVIDER_ENV_MAP = {
   'github-copilot': ['GITHUB_TOKEN', 'GH_TOKEN'],
   'openai': ['OPENAI_API_KEY'],
   'openrouter-llama': ['OPENROUTER_API_KEY', 'OPEN_ROUTER_API_KEY'],
-  'ollama': ['OLLAMA_BASE_URL'],
+  'ollama': ['OLLAMA_BASE_URL', 'OLLAMA_HOST'],
   'local': ['LOCAL_LLM_BASE_URL'],
 };
 
@@ -630,6 +685,10 @@ export function resolveExecutionContractModelMetadata({
   const tiers = resolveTierAssignments(envValues, registryModels);
   const selectedTier = requestedTier ?? selectModelTierForWorkCategory(workCategory);
   const selected = selectedTier ? tiers[selectedTier] : null;
+  const profile = resolveModelOperatingProfile({
+    envValues,
+    selectedModel: selected?.model ?? null,
+  });
 
   return {
     version: "v1",
@@ -638,6 +697,7 @@ export function resolveExecutionContractModelMetadata({
     selectedTier: selectedTier ?? null,
     selectedModel: selected?.model ?? null,
     selectedModelSource: selected?.source ?? null,
+    profile,
     tiers,
   };
 }

package/lib/observation-store.mjs

@@ -58,6 +58,20 @@ function generateId() {
   return `obs-${ts}-${rand}`;
 }
 
+const MAX_EXTRAS_BYTES = 2 * 1024;
+
+function sanitizeExtras(extras) {
+  if (extras == null) return null;
+  if (typeof extras !== 'object' || Array.isArray(extras)) return null;
+  try {
+    const serialized = JSON.stringify(extras);
+    if (Buffer.byteLength(serialized, 'utf8') > MAX_EXTRAS_BYTES) return null;
+    return JSON.parse(serialized);
+  } catch {
+    return null;
+  }
+}
+
 function clamp(str, max) {
   if (!str || str.length <= max) return str || null;
   return str.slice(0, max - 1) + '\u2026';
@@ -131,6 +145,7 @@ export async function addObservation(rootDir, {
   confidence = 0.8,
   source = null,
   gitSha = null,
+  extras = null,
 } = {}) {
   const id = generateId();
   const now = new Date().toISOString();
@@ -139,6 +154,9 @@ export async function addObservation(rootDir, {
   const clampedSummary = clamp(String(summary), MAX_SUMMARY);
   const clampedContent = clamp(String(content), MAX_CONTENT);
   const clampedTags = (Array.isArray(tags) ? tags : []).slice(0, MAX_TAGS).map(String);
+  // Structured metadata: opt-in. Capped at 2 KB stringified so a misuse can't
+  // bloat the per-id JSON. Plain object only; rejects arrays and functions.
+  const clampedExtras = sanitizeExtras(extras);
 
   const record = {
     id,
@@ -151,6 +169,7 @@ export async function addObservation(rootDir, {
     confidence: Math.max(0, Math.min(1, Number(confidence) || 0.8)),
     source: source || null,
     gitSha: gitSha ? String(gitSha).slice(0, 40) : null,
+    extras: clampedExtras,
     createdAt: now,
     updatedAt: now,
   };

package/lib/ollama-manager.mjs

@@ -10,7 +10,7 @@ import { execSync } from 'node:child_process';
 import { join } from 'node:path';
 import { homedir } from 'node:os';
 
-const OLLAMA_BASE_URL = process.env.OLLAMA_BASE_URL || 'http://localhost:11434';
+const OLLAMA_BASE_URL = process.env.OLLAMA_BASE_URL || process.env.OLLAMA_HOST || 'http://localhost:11434';
 
 /**
  * Check if Ollama is installed and running

package/lib/opencode-telemetry.mjs

@@ -5,7 +5,7 @@
  * trace/generation/span/event observations, and flushes on session.idle.
  */
 import { randomUUID } from "node:crypto";
-import { createIngestClient } from "./telemetry/ingest.mjs";
+import { createTelemetryClient } from "./telemetry/client.mjs";
 
 const SECRET_PATH_PATTERNS = [
   /(^|\/)\.env(\.|$)/i,
@@ -24,10 +24,9 @@ let cachedIngest = null;
 
 export function getIngestClient(env = process.env) {
   if (cachedIngest) return cachedIngest;
-  cachedIngest = createIngestClient({
-    baseUrl: env.CONSTRUCT_TELEMETRY_URL,
-    publicKey: env.CONSTRUCT_TELEMETRY_PUBLIC_KEY,
-    secretKey: env.CONSTRUCT_TELEMETRY_SECRET_KEY,
+  cachedIngest = createTelemetryClient({
+    env,
+    rootDir: env.CX_TOOLKIT_DIR,
     onError: (err) => {
       if (env.CONSTRUCT_TRACE_DEBUG === "1") {
         // eslint-disable-next-line no-console