@gotcos/glasses-server 6.79.1 → 6.80.0

package/server/lib/ollama-run-ledger.ts

@@ -1,7 +1,9 @@
 import crypto from 'node:crypto'
 import { appendFileSync, existsSync, mkdirSync, readFileSync } from 'node:fs'
 import { dirname, resolve } from 'node:path'
-import { OLLAMA_MODEL, type OllamaModelPreference } from '../../shared/model-preference.js'
+import { OLLAMA_MODEL } from '../../shared/model-preference.js'
+import { dataPath } from './data-dir.js'
+import type { KeyLane } from './key-relay-contract.js'
 
 const DEFAULT_MAX_RUNS = 100
 const DEFAULT_TTL_MS = 7 * 24 * 60 * 60_000
@@ -10,6 +12,13 @@ const RUNNING_STALE_MS = 30 * 60_000
 
 export type OllamaRunStatus = 'running' | 'completed' | 'failed' | 'cancelled' | 'client_disconnected'
 
+/**
+ * One run, Ollama or (key lanes K1 P5, plan v4 9.1) direct. `model` was OllamaModelPreference; it
+ * is a string now so a direct run can carry its `profile:<id>` preference. Ollama rows still write
+ * exactly `model: 'ollama'` and never a `lane`, `profile` or `providerModel` key, in the 6.79.0
+ * key order (pinned byte for byte by ollama-run-ledger.test.ts). Direct rows live in their own
+ * file (`direct-runs.jsonl` under the data dir), so the Ollama ledger only ever holds Ollama runs.
+ */
 export interface OllamaRunRecord {
   runId: string
   turnId?: string
@@ -18,8 +27,15 @@ export interface OllamaRunRecord {
   status: OllamaRunStatus
   createdAt: string
   updatedAt: string
-  model: OllamaModelPreference
-  ollamaModel: string
+  model: string
+  /** Direct rows only. */
+  lane?: KeyLane
+  /** Direct rows only: the key profile id. */
+  profile?: string
+  /** Ollama rows: the pulled tag. Direct rows leave it out and use providerModel. */
+  ollamaModel?: string
+  /** Direct rows only: the provider model id or OpenRouter slug. */
+  providerModel?: string
   origin: string
   queryPreview?: string
   outputPreview?: string
@@ -42,6 +58,11 @@ export function getOllamaLedgerPath(): string {
   return resolve(process.env.COS_OLLAMA_RUN_LEDGER_FILE || resolve(import.meta.dirname, '..', 'data', 'ollama-runs.jsonl'))
 }
 
+/** Direct (Lane C1) runs. Written only by a keyed turn, so nothing is created while lanes are off. */
+export function getDirectRunLedgerPath(): string {
+  return resolve(process.env.COS_DIRECT_RUN_LEDGER_FILE || dataPath('direct-runs.jsonl'))
+}
+
 function getMaxRuns(): number {
   const raw = Number(process.env.COS_OLLAMA_RUN_LEDGER_MAX ?? DEFAULT_MAX_RUNS)
   return Number.isFinite(raw) && raw > 0 ? Math.floor(raw) : DEFAULT_MAX_RUNS
@@ -52,9 +73,8 @@ function getTtlMs(): number {
   return Number.isFinite(rawDays) && rawDays > 0 ? rawDays * 24 * 60 * 60_000 : DEFAULT_TTL_MS
 }
 
-function appendEvent(event: OllamaRunEvent): void {
+function appendEvent(event: OllamaRunEvent, path: string = getOllamaLedgerPath()): void {
   try {
-    const path = getOllamaLedgerPath()
     mkdirSync(dirname(path), { recursive: true })
     appendFileSync(path, JSON.stringify(event) + '\n')
   } catch (err) {
@@ -62,8 +82,7 @@ function appendEvent(event: OllamaRunEvent): void {
   }
 }
 
-function readEvents(): OllamaRunEvent[] {
-  const path = getOllamaLedgerPath()
+function readEvents(path: string = getOllamaLedgerPath()): OllamaRunEvent[] {
   if (!existsSync(path)) return []
   try {
     const events: OllamaRunEvent[] = []
@@ -129,23 +148,29 @@ export function startOllamaRun(input: {
   return run
 }
 
-export function finishOllamaRun(runId: string, input: {
+interface FinishRunInput {
   status: Exclude<OllamaRunStatus, 'running'>
   startedAtMs: number
   output?: string
   error?: string
-}): OllamaRunRecord | null {
+}
+
+function finishRun(path: string, classify: (message: string) => string, runId: string, input: FinishRunInput): void {
   const patch: Partial<OllamaRunRecord> = {
     status: input.status,
     durationMs: Math.max(0, Date.now() - input.startedAtMs),
   }
   if (input.output) patch.outputPreview = redactForOllamaLedger(input.output)
   if (input.error) {
-    patch.errorCode = classifyOllamaError(input.error)
+    patch.errorCode = classify(input.error)
     patch.errorPreview = redactForOllamaLedger(input.error)
   }
   const ts = new Date().toISOString()
-  appendEvent({ runId, ts, patch: { ...patch, updatedAt: ts } })
+  appendEvent({ runId, ts, patch: { ...patch, updatedAt: ts } }, path)
+}
+
+export function finishOllamaRun(runId: string, input: FinishRunInput): OllamaRunRecord | null {
+  finishRun(getOllamaLedgerPath(), classifyOllamaError, runId, input)
   return getOllamaRun(runId)
 }
 
@@ -154,10 +179,14 @@ export function getOllamaRun(runId: string): OllamaRunRecord | null {
 }
 
 export function listOllamaRuns(limit = 20, sessionId?: string): OllamaRunRecord[] {
+  return listRuns(getOllamaLedgerPath(), 'ollama.timeout', limit, sessionId)
+}
+
+function listRuns(path: string, staleCode: string, limit: number, sessionId?: string): OllamaRunRecord[] {
   const runs = new Map<string, OllamaRunRecord>()
   const order = new Map<string, number>()
   let eventIndex = 0
-  for (const event of readEvents()) {
+  for (const event of readEvents(path)) {
     eventIndex += 1
     const existing = runs.get(event.runId)
     const next = { ...(existing ?? {}), ...event.patch, runId: event.runId } as OllamaRunRecord
@@ -175,7 +204,7 @@ export function listOllamaRuns(limit = 20, sessionId?: string): OllamaRunRecord[
         return {
           ...run,
           status: 'client_disconnected' as const,
-          errorCode: run.errorCode ?? 'ollama.timeout',
+          errorCode: run.errorCode ?? staleCode,
         }
       }
       return run
@@ -183,3 +212,57 @@ export function listOllamaRuns(limit = 20, sessionId?: string): OllamaRunRecord[
     .sort((a, b) => Date.parse(b.createdAt) - Date.parse(a.createdAt))
     .slice(0, limit)
 }
+
+// ── Direct runs (key lanes K1 P5, plan v4 9.1) ───────────────────────────────
+
+/** `direct.<failure>` for a key-lane failure kind, else the closest generic code. */
+export function classifyDirectError(message: string): string {
+  const m = /^direct-bridge: \[([a-z_]+)\]/.exec(message)
+  if (m) return `direct.${m[1]}`
+  const text = message.toLowerCase()
+  if (/tool round cap/.test(text)) return 'direct.tool_cap'
+  if (/tool aborted|tool call aborted/.test(text)) return 'direct.tool_abort'
+  if (/timeout|timed out|aborted/.test(text)) return 'direct.timeout'
+  return 'direct.error'
+}
+
+export function startDirectRun(input: {
+  turnId?: string
+  clientJobId?: string
+  cosSessionId: string
+  /** The COS preference the exchange is stamped with, `profile:<id>`. */
+  model: string
+  profile: string
+  providerModel: string
+  /** Endpoint origin only (scheme, host, port). Never a path, query or key. */
+  origin: string
+  query: string
+}): OllamaRunRecord {
+  const now = new Date().toISOString()
+  const run: OllamaRunRecord = {
+    runId: `direct-${crypto.randomUUID().slice(0, 8)}`,
+    turnId: input.turnId,
+    clientJobId: input.clientJobId,
+    cosSessionId: input.cosSessionId,
+    status: 'running',
+    createdAt: now,
+    updatedAt: now,
+    model: input.model,
+    lane: 'direct',
+    profile: input.profile,
+    providerModel: input.providerModel,
+    origin: input.origin,
+    queryPreview: redactForOllamaLedger(input.query),
+  }
+  appendEvent({ runId: run.runId, ts: now, patch: run }, getDirectRunLedgerPath())
+  return run
+}
+
+export function finishDirectRun(runId: string, input: FinishRunInput): OllamaRunRecord | null {
+  finishRun(getDirectRunLedgerPath(), classifyDirectError, runId, input)
+  return listDirectRuns(getMaxRuns()).find(run => run.runId === runId) ?? null
+}
+
+export function listDirectRuns(limit = 20, sessionId?: string): OllamaRunRecord[] {
+  return listRuns(getDirectRunLedgerPath(), 'direct.timeout', limit, sessionId)
+}

package/server/lib/prompt-edit.ts

@@ -1,4 +1,5 @@
 import { spawn } from 'node:child_process'
+import { claudeKeySecretsGuardArgs } from './key-secrets-guard.js'
 
 export const PROMPT_EDIT_DRAFT_MAX_CHARS = 24_000
 export const PROMPT_EDIT_INSTRUCTION_MAX_CHARS = 2_000
@@ -90,6 +91,7 @@ export function spawnClaudeText(prompt: string, opts: SpawnClaudeTextOptions = {
     const args = ['-p', '--model', model, '--effort', effort, '--output-format', 'text', '--no-session-persistence',
       '--strict-mcp-config', '--mcp-config', '{"mcpServers":{}}']
     if (opts.systemPrompt) args.push('--system-prompt', opts.systemPrompt)
+    args.push(...claudeKeySecretsGuardArgs())
 
     const proc = spawn('claude', args, {
       stdio: ['pipe', 'pipe', 'pipe'],

package/server/lib/query-job-coordinator.ts

@@ -31,6 +31,7 @@ import {
   type QueryJobSteerState,
   type QueryJobStoreHealth,
 } from './query-job-types.js'
+import type { QueryJobKeyAnswerFields } from './key-answer-fields.js'
 import { SteerPort, steerClock, steerCutoffMs, type PendingSteer, type QueryProvider } from './claude-steer.js'
 import type { MaintenanceWorkLease } from './maintenance-lifecycle.js'
 import { applyTrailToolMode, type JobTrailDraft } from './job-trail.js'
@@ -43,7 +44,7 @@ export interface QueryJobRunnerStart extends QueryJobProviderLinkage {
   sessionId?: string
 }
 
-export interface QueryJobRunnerCompletion extends QueryJobProviderLinkage {
+export interface QueryJobRunnerCompletion extends QueryJobProviderLinkage, QueryJobKeyAnswerFields {
   text: string
   attachments?: unknown
   outputImageStats?: QueryJobOutputImageStats

package/server/lib/query-job-runtime.ts

@@ -9,7 +9,7 @@ import { dataPath } from './data-dir.js'
 import { currentMessageEra, LEGACY_MESSAGE_ERA } from './message-era.js'
 import { durableQueryJobsEnabled, messagesSteerEnabled, messagesTrailEnabled } from './query-job-feature.js'
 import { claudeSupportsSteer } from './claude-cli-support.js'
-import { providerOfModel, resolveRunModel } from './claude-steer.js'
+import { steerProviderFor } from './claude-steer.js'
 import { QueryJobCoordinator, type QueryJobRunner } from './query-job-coordinator.js'
 import { QueryJobStore, createQueryJobJournalStorage } from './query-job-store.js'
 import {
@@ -17,7 +17,6 @@ import {
   isCursorModel,
   isOllamaModel,
   normalizeEffortPreference,
-  normalizeModelPreference,
   type CursorExecutionMode,
   type ModelPreference,
 } from '../../shared/model-preference.js'
@@ -26,10 +25,15 @@ import { attachmentHistoryPrefix, defaultAttachmentRequest } from '../../shared/
 import {
   findExchangesByJobIdentity,
   flushConversationToDisk,
+  getSessionBinding,
   getSessionModel,
   reconcileExchangeByJobIdentity,
   removeExchangesByJobIdentity,
+  type KeyProfileBinding,
+  type SessionModelBinding,
 } from './conversation.js'
+import { parsePreference, profilePreference } from '../../shared/key-preference.js'
+import { linkageProviderForEngine, profileSteerProvider, type KeyProfileTurn } from './key-profile-routing.js'
 import {
   isTerminalQueryJobStatus,
   type QueryJobProviderLinkage,
@@ -40,6 +44,7 @@ import { acquireMaintenanceWork } from './maintenance-lifecycle.js'
 import type { JobTrailDraft } from './job-trail.js'
 import { registerMessageReservationSource } from './message-reservations.js'
 import { bootResumeGate } from './boot-resume.js'
+import { keyAnswerCompletionFields, keyAnswerDoneFields } from './key-answer-fields.js'
 
 const TOOL_STATUS_MESSAGES: Record<string, string> = {
   WebSearch: 'Searching web...',
@@ -118,6 +123,38 @@ export async function preparePublicDurableQueryAdmission(raw: unknown): Promise<
   }
 }
 
+/**
+ * Plan 5.2 Accept by syntax for the terminal projection: a model slot exactly as
+ * normalizeModelPreference gives it, or `profile:<id>`. Same rule as conversation's
+ * normalizeSessionBinding, computed here so the projection needs nothing new from the store.
+ */
+function requestBinding(model: unknown): SessionModelBinding | undefined {
+  const parsed = parsePreference(model)
+  if (!parsed) return undefined
+  return parsed.kind === 'model' ? parsed.value : profilePreference(parsed.id) as KeyProfileBinding
+}
+
+/** Linkage provider for a keyed turn: the profile's engine. Direct (Lane C) carries none. */
+function keyProfileLinkageProvider(turn: KeyProfileTurn): { provider?: 'claude' | 'codex' } {
+  const provider = linkageProviderForEngine(turn.profile.engine)
+  return provider ? { provider } : {}
+}
+
+/**
+ * The steer gate's provider for a job (P6 owns this; P3 consumes it). With no profile anywhere
+ * this is exactly `providerOfModel(resolveRunModel(...))`, as in 6.78.0.
+ */
+export function steerProviderForJob(request: Pick<QueryJobRequest, 'model' | 'sessionId'>): ReturnType<typeof profileSteerProvider> {
+  const verdict = steerProviderFor(
+    request.model,
+    getSessionModel(request.sessionId),
+    process.env.COS_G2_DEFAULT_MODEL,
+    () => getSessionBinding(request.sessionId),
+  )
+  if (verdict.kind === 'profile_session') return profileSteerProvider(verdict.profileId)
+  return verdict.provider
+}
+
 function providerFor(model: ModelPreference): 'claude' | 'codex' | 'cursor' | 'ollama' {
   if (isOllamaModel(model)) return 'ollama'
   if (isCursorModel(model)) return 'cursor'
@@ -167,7 +204,7 @@ export async function projectPublicConversationTerminal(
     request.globalMsgNum,
     request.attachmentRefs,
     request.messageEra,
-    normalizeModelPreference(request.model),
+    requestBinding(request.model),
     request.origin,
   )
   reconcileExchangeByJobIdentity(
@@ -178,7 +215,7 @@ export async function projectPublicConversationTerminal(
     request.globalMsgNum,
     mergeMediaAttachmentRefs(outputAttachments, existingOutputAttachments),
     request.messageEra,
-    normalizeModelPreference(request.model),
+    requestBinding(request.model),
     request.origin,
   )
   flushConversationToDisk()
@@ -204,19 +241,29 @@ const runner: QueryJobRunner = async ({ jobId, turnId, request, signal, callback
     sessionId: request.sessionId,
   })
   const imageInputs = resolvedAttachments.inputs.length > 0 ? resolvedAttachments.inputs : undefined
-  const validModel = normalizeModelPreference(request.model)
+  // Key lanes K1 (plan 5.2): Accept. A `profile:<id>` goes to model-router, which runs it on the
+  // profile's engine or refuses it; the closed slot keeps every family guard below unchanged.
+  const requestedBinding = parsePreference(request.model)
+  const validModel = requestedBinding?.kind === 'model' ? requestedBinding.value : undefined
   const validEffort = normalizeEffortPreference(request.effort)
   let activeModel = validModel
+  // Set only by model-router's onKeyProfileTurn, so a subscription turn never sees it.
+  let keyTurn: KeyProfileTurn | undefined
+  const linkageFor = (model: ModelPreference) => keyTurn
+    ? { ...keyProfileLinkageProvider(keyTurn), resolvedModel: keyTurn.binding }
+    : { provider: providerFor(model), resolvedModel: model }
 
   await callModelStreaming(
     request.query,
     request.sessionId,
     {
+      ...(requestedBinding?.kind === 'model' ? {} : {
+        onKeyProfileTurn: (turn: KeyProfileTurn) => { keyTurn = turn },
+      }),
       onStart: async (model, sessionId, cliSessionId, metadata) => {
         activeModel = model
         const linkage = {
-          provider: providerFor(model),
-          resolvedModel: model,
+          ...linkageFor(model),
           cliSessionId,
           claudeRunId: metadata?.claudeRunId,
           codexRunId: metadata?.codexRunId,
@@ -232,7 +279,7 @@ const runner: QueryJobRunner = async ({ jobId, turnId, request, signal, callback
           turnId,
           messageEra: request.messageEra,
           globalMsgNum: request.globalMsgNum,
-          model,
+          model: keyTurn ? keyTurn.binding : model,
           sessionId,
           cliSessionId,
           ...metadata,
@@ -241,7 +288,7 @@ const runner: QueryJobRunner = async ({ jobId, turnId, request, signal, callback
       },
       onProviderProcess: metadata => callbacks.onProviderProcess({
         provider: metadata.provider,
-        ...(activeModel ? { resolvedModel: activeModel } : {}),
+        ...(keyTurn ? { resolvedModel: keyTurn.binding } : activeModel ? { resolvedModel: activeModel } : {}),
         ...(metadata.provider === 'claude'
           ? { claudeRunId: metadata.runId }
           : metadata.provider === 'cursor'
@@ -273,7 +320,8 @@ const runner: QueryJobRunner = async ({ jobId, turnId, request, signal, callback
         onTrail: (draft: JobTrailDraft) => callbacks.onTrail(draft),
       } : {}),
       onAnswerReady: text => callbacks.onAnswerReady(text, {
-        ...(activeModel ? { provider: providerFor(activeModel), resolvedModel: activeModel } : {}),
+        ...(keyTurn ? { ...keyProfileLinkageProvider(keyTurn), resolvedModel: keyTurn.binding }
+          : activeModel ? { provider: providerFor(activeModel), resolvedModel: activeModel } : {}),
       }),
       onDone: async (fullText, model, cliSessionId, metadata) => {
         const attachments = mergeMediaAttachmentRefs(
@@ -287,8 +335,7 @@ const runner: QueryJobRunner = async ({ jobId, turnId, request, signal, callback
           ? acquireMaintenanceWork('query_attachment_write', { allowDuringDrain: true })
           : undefined
         const linkage = {
-          provider: providerFor(model),
-          resolvedModel: model,
+          ...linkageFor(model),
           cliSessionId,
           claudeRunId: metadata?.claudeRunId,
           codexRunId: metadata?.codexRunId,
@@ -304,6 +351,7 @@ const runner: QueryJobRunner = async ({ jobId, turnId, request, signal, callback
             attachments,
             outputImageStats: metadata?.outputImageStats,
             ...linkage,
+            ...keyAnswerCompletionFields(metadata),
           })
           if (!terminalOwned) return
           if (resolvedAttachments.ids.length > 0) {
@@ -323,9 +371,10 @@ const runner: QueryJobRunner = async ({ jobId, turnId, request, signal, callback
             globalMsgNum: request.globalMsgNum,
             text: fullText,
             sessionId: request.sessionId,
-            model,
+            model: keyTurn ? keyTurn.binding : model,
             cliSessionId,
             ...runMetadata,
+            ...keyAnswerDoneFields(runMetadata),
             ...(attachments.length > 0 ? { attachments } : {}),
             ...originStamp(request),
           } })
@@ -348,7 +397,7 @@ const runner: QueryJobRunner = async ({ jobId, turnId, request, signal, callback
         } })
       },
     },
-    validModel,
+    requestedBinding?.kind === 'profile' ? requestBinding(request.model) : validModel,
     imageInputs,
     request.reference,
     request.globalMsgNum,
@@ -371,6 +420,7 @@ const runner: QueryJobRunner = async ({ jobId, turnId, request, signal, callback
       sessionLockHeld: true,
       ...(request.dispatch ? { dispatch: request.dispatch } : {}),
       ...(request.sessionName ? { sessionName: request.sessionName } : {}),
+      ...(request.keyTurnOnly ? { keyTurnOnly: true } : {}),
       // 6.78.0: only on a run the coordinator decided is steerable.
       ...(steer ? { steer } : {}),
     },
@@ -399,9 +449,11 @@ export const queryJobCoordinator = new QueryJobCoordinator(queryJobStore, runner
   bootResumeGate,
   // 6.78.0 Messages steer (COS_MESSAGES_STEER, default off). The provider is resolved as
   // model-router resolves it, so a run is steerable only when it will run on Claude.
+  // Key lanes K1 (plan 5.2): claude-steer stays closed and names a profile-bound job
+  // `profile_session`; the profile's engine then decides (only Lane B Claude steers).
   steer: {
     enabled: () => messagesSteerEnabled(),
-    provider: request => providerOfModel(resolveRunModel(request.model, getSessionModel(request.sessionId), process.env.COS_G2_DEFAULT_MODEL)),
+    provider: request => steerProviderForJob(request),
     cliSupported: () => claudeSupportsSteer(),
   },
 })

package/server/lib/query-job-store.ts

@@ -39,6 +39,7 @@ import {
   type QueryJobSteerState,
   type QueryJobTrailEntry,
 } from './query-job-types.js'
+import { keyAnswerJobFields, type QueryJobKeyAnswerFields } from './key-answer-fields.js'
 import {
   jobTrailTextChars,
   parseJobTrailEventData,
@@ -868,6 +869,7 @@ export class QueryJobStore {
       const outputImageStats = parseQueryJobOutputImageStats(patch.outputImageStats)
       if (outputImageStats) snapshot.outputImageStats = outputImageStats
       else delete snapshot.outputImageStats
+      Object.assign(snapshot, keyAnswerJobFields(patch))
       this.applyLinkage(snapshot, patch)
       delete snapshot.error
     } else if (record.type === 'failed' || record.type === 'canceled' || record.type === 'interrupted') {
@@ -1466,13 +1468,15 @@ export class QueryJobStore {
 
   async complete(
     jobId: string,
-    input: { text: string; attachments?: unknown; outputImageStats?: unknown } & QueryJobProviderLinkage,
+    input: { text: string; attachments?: unknown; outputImageStats?: unknown } & QueryJobProviderLinkage & QueryJobKeyAnswerFields,
   ): Promise<QueryJobMutationResult> {
     const response = boundedText(input.text, QUERY_JOB_LIMITS.terminalResponseChars)
     const partial = boundedText(input.text, QUERY_JOB_LIMITS.partialChars)
     const linkage = this.safeLinkage(input)
     const attachments = parseMediaAttachmentRefs(input.attachments)
     const outputImageStats = parseQueryJobOutputImageStats(input.outputImageStats)
+    // Key lanes (P11): {} unless a key profile answered, so a subscription record is unchanged.
+    const keyAnswer = keyAnswerJobFields(input)
     const completedAt = this.now().toISOString()
     return this.transition(jobId, 'completed', 'completed', {
       ...linkage,
@@ -1483,12 +1487,14 @@ export class QueryJobStore {
       partialTruncated: partial.truncated,
       attachments,
       ...(outputImageStats ? { outputImageStats } : {}),
+      ...keyAnswer,
     }, {
       ...linkage,
       response: response.text,
       responseTruncated: response.truncated,
       attachments,
       ...(outputImageStats ? { outputImageStats } : {}),
+      ...keyAnswer,
     })
   }
 

package/server/lib/query-job-types.ts

@@ -1,5 +1,7 @@
 import { providerFailureCode } from './provider-failure-text.js'
 import { createHash } from 'node:crypto'
+import type { QueryJobKeyAnswerFields } from './key-answer-fields.js'
+import { isProfilePreference } from '../../shared/key-preference.js'
 import {
   parseMediaAttachmentRefs,
   parseMediaIdList,
@@ -132,6 +134,12 @@ export interface QueryJobRequest {
    * it names the session, it does not change what is asked.
    */
   sessionName?: string
+  /**
+   * Key lanes (QA U9 / C10): run THIS turn on the key profile it names without binding the
+   * session to it (the plan-limit "run this one on your key" offer). Kept only with a
+   * `profile:<id>` model; in the fingerprint, since it changes what the turn does.
+   */
+  keyTurnOnly?: true
   /**
    * 6.78.0: the client can steer this run (it read `durableQueryJobs.steer`). Only `true` is
    * kept. Excluded from the fingerprint: it says how the answer may be guided, not what is
@@ -437,6 +445,11 @@ export interface QueryJobSnapshot extends QueryJobProviderLinkage {
   response?: string
   responseTruncated?: boolean
   outputImageStats?: QueryJobOutputImageStats
+  /** Key lanes (P11, plan 3.1): present only on a job a key profile answered; omitted, never null. */
+  lane?: QueryJobKeyAnswerFields['lane']
+  credential?: QueryJobKeyAnswerFields['credential']
+  profile?: string
+  usd?: number
   error?: QueryJobError
   /** 6.78.0: what a restart cut off (see QueryJobInterruption). Only on a job a restart ended. */
   interruption?: QueryJobInterruption
@@ -657,6 +670,7 @@ export function parseQueryJobRequest(raw: unknown, options: ParseQueryJobRequest
     ...(input.handoffLatest === true ? { handoffLatest: true } : {}),
     ...(clientQueueItemId ? { clientQueueItemId } : {}),
     ...(sessionName ? { sessionName } : {}),
+    ...(input.keyTurnOnly === true && isProfilePreference(model) ? { keyTurnOnly: true as const } : {}),
     ...(input.steerable === true ? { steerable: true as const } : {}),
     attachmentIds,
     attachmentRefs,
@@ -721,7 +735,7 @@ export const FINGERPRINT_KEYS = [
   'clientJobId', 'generation', 'query', 'sessionId', 'model', 'effort',
   'cursorExecutionMode', 'messageEra', 'globalMsgNum', 'reference', 'handoffCode',
   'handoffLatest', 'clientQueueItemId', 'attachmentIds', 'attachmentRefs',
-  'activityToolMode',
+  'activityToolMode', 'keyTurnOnly',
 ] as const satisfies readonly (keyof QueryJobRequest)[]
 
 /** The request keys deliberately OUTSIDE the identity. Every key of

package/server/lib/session-hook-events.ts

@@ -14,6 +14,10 @@
 // whose shapes are still the documented ones until a Desktop recording lands.
 
 import { createHash } from 'node:crypto'
+import { profileIdForCodexPath } from './codex-homes.js'
+import { isKeyProfileId } from '../../shared/key-preference.js'
+import { keyLanesEnabled } from './key-lanes.js'
+import { keyedSessionProfile } from './keyed-sessions.js'
 
 /** Events the installer subscribes and the reducer understands. Anything else is dropped. */
 export const HOOK_EVENT_NAMES = [
@@ -71,9 +75,29 @@ export function inferHookProvider(stamped: unknown, payload: Record<string, unkn
   if (isHookProvider(stamped)) return stamped
   if ('cursor_version' in payload) return 'cursor'
   if (typeof payload.transcript_path === 'string' && payload.transcript_path.includes('/.codex/sessions/')) return 'codex'
+  // Key lanes K1 (plan v4 8.2): a keyed Codex profile home keeps its rollouts under
+  // `data/codex-homes/<id>/sessions/`, which never contains `/.codex/`.
+  if (profileIdForCodexPath(payload.transcript_path) !== undefined) return 'codex'
   return 'claude'
 }
 
+/**
+ * Key lanes K1 (plan v4 7.3): the key profile a hook event ran under, or undefined. Read from
+ * the envelope's own `keyProfile` stamp (a hook script that forwards `COS_KEY_PROFILE`), else
+ * from a transcript inside a keyed Codex profile home, else (canary R7: the installed hook script
+ * does not stamp it, and changing the script would mark every install outdated) from the
+ * keyed-session record the bridge wrote for that CLI session id. Lanes off: never looked up.
+ * Undefined for every Lane A event.
+ */
+export function hookKeyProfile(stamped: unknown, payload: Record<string, unknown>, sessionId?: string | null): string | undefined {
+  if (isKeyProfileId(stamped)) return stamped
+  const codex = profileIdForCodexPath(payload.transcript_path)
+  if (codex) return codex
+  if (!sessionId || !keyLanesEnabled()) return undefined
+  const recorded = keyedSessionProfile(sessionId)
+  return isKeyProfileId(recorded) ? recorded : undefined
+}
+
 /** 6.62.0: the cap on an agent thought kept in memory and sent on the live feed. */
 export const AGENT_THOUGHT_MAX = 280
 
@@ -99,6 +123,8 @@ export interface HookEnvelope {
   payload: Record<string, unknown>
   /** 6.62.0: set by `parseHookEnvelope` and a 6.62 ledger row; absent on older rows and hand-built envelopes. */
   provider?: HookProvider
+  /** Key lanes K1 (plan v4 7.3): the key profile this event ran under. Absent on every Lane A envelope. */
+  keyProfile?: string
   /**
    * 6.62.0 (QA W2): the envelope itself named the provider: a 6.62 hook script (from the Codex
    * command, or from a Codex payload) or the Cursor observer wrote it. Inferred is not stamped.
@@ -150,6 +176,7 @@ export function parseHookEnvelope(text: string): ParsedHookEnvelope {
   const sessionId = typeof p.session_id === 'string' && SESSION_ID_RE.test(p.session_id) ? p.session_id.toLowerCase() : null
   if (!sessionId) return { ok: false, reason: 'no_session', salvaged: null }
   const ppid = Number(r.ppid)
+  const keyProfile = hookKeyProfile(r.keyProfile, p, sessionId)
   return {
     ok: true,
     envelope: {
@@ -160,6 +187,7 @@ export function parseHookEnvelope(text: string): ParsedHookEnvelope {
       payload: p,
       provider: inferHookProvider(r.provider, p),
       ...(isHookProvider(r.provider) ? { stamped: true as const } : {}),
+      ...(keyProfile ? { keyProfile } : {}),
     },
   }
 }

package/server/lib/session-hook-ledger.ts

@@ -9,6 +9,8 @@
 import { appendFileSync, existsSync, readFileSync, renameSync, statSync } from 'node:fs'
 import type { HookEnvelope, HookEventName, HookProvider } from './session-hook-events.js'
 import { projectHookPayload, isHookEventName, isHookProvider, SESSION_ID_RE } from './session-hook-events.js'
+import { keyLanesEnabled } from './key-lanes.js'
+import { isKeyProfileId } from '../../shared/key-preference.js'
 
 export const LEDGER_ROTATE_BYTES = 10 * 1024 * 1024
 
@@ -30,6 +32,12 @@ export interface LedgerRow {
   provider?: HookProvider
   /** 6.62.0 (QA W2): the envelope carried the provider stamp; a replay keeps the evidence. */
   stamped?: true
+  /**
+   * Key lanes K1 (canary rerun R8): the key profile the event ran under, as `hookKeyProfile`
+   * resolved it at ingest (for a Codex thread, from the keyed-thread record the bridge wrote).
+   * Written only while lanes are on, so a row with lanes off is byte-identical to before.
+   */
+  keyProfile?: string
   payload: Record<string, unknown>
 }
 
@@ -77,6 +85,7 @@ export class SessionHookLedger {
         ...(entrypoint ? { entrypoint } : {}),
         ...(env.provider ? { provider: env.provider } : {}),
         ...(env.stamped ? { stamped: true as const } : {}),
+        ...(env.keyProfile && keyLanesEnabled() ? { keyProfile: env.keyProfile } : {}),
         payload: projectHookPayload(env.event, env.payload),
       }
     } catch (error) {
@@ -137,6 +146,7 @@ export class SessionHookLedger {
         payload: { session_id: r.session_id, ...payload },
         ...(isHookProvider(r.provider) ? { provider: r.provider } : {}),
         ...(r.stamped === true && isHookProvider(r.provider) ? { stamped: true as const } : {}),
+        ...(isKeyProfileId(r.keyProfile) ? { keyProfile: r.keyProfile } : {}),
       }, r.key, r.child === true, entrypoint)
       applied++
     }