@konneal/engine 0.2.2 → 0.2.3

package/dist/worker_public/src/config.js

@@ -16,8 +16,8 @@ import {
   roleModel,
   sha256Hex,
   today
-} from "../../chunk-Q6LI4T7M.js";
-import "../../chunk-Q327B27J.js";
+} from "../../chunk-ADXV2DPK.js";
+import "../../chunk-TJRTVJW5.js";
 export {
   DATASETS,
   LIMITS,

package/dist/worker_public/src/index.js

@@ -1,14 +1,13 @@
 import {
   handleSearch
-} from "../../chunk-VJZLVU3S.js";
+} from "../../chunk-THSHLUOS.js";
 import {
   checkQuoteAnchors,
   handleAsk,
   handleMemories,
   scoreJudge,
   standardForDocNumber
-} from "../../chunk-PVHSBXZD.js";
-import "../../chunk-LNSDBEKS.js";
+} from "../../chunk-OGFH3RDM.js";
 import {
   buildMessages,
   citations,
@@ -30,7 +29,7 @@ import {
   sessionFrom,
   telemetry,
   understandQuery
-} from "../../chunk-6GOSMLRH.js";
+} from "../../chunk-RLT4W2VX.js";
 import {
   authenticate,
   corsHeaders,
@@ -39,10 +38,14 @@ import {
   readJson,
   validateQuery,
   withCors
-} from "../../chunk-SN3ANQ3Y.js";
+} from "../../chunk-EFQALN2Z.js";
 import {
   canonicalRefusal
-} from "../../chunk-WGXATDXY.js";
+} from "../../chunk-DBBGOOMZ.js";
+import {
+  entitlementScope,
+  standardKeysFrom
+} from "../../chunk-5MBWE7WD.js";
 import {
   LIMITS,
   MODELS,
@@ -53,11 +56,11 @@ import {
   roleModel,
   sha256Hex,
   today
-} from "../../chunk-Q6LI4T7M.js";
+} from "../../chunk-ADXV2DPK.js";
 import {
   P,
   setProfile
-} from "../../chunk-Q327B27J.js";
+} from "../../chunk-TJRTVJW5.js";
 
 // workers/worker_public/src/conversations.ts
 var ID_RE = /^[a-zA-Z0-9_-]{8,64}$/;
@@ -976,7 +979,7 @@ async function handleMcp(env, ctx, req, tier, key) {
       // stream:false forces the JSON lane (anon defaults to SSE)
       body: JSON.stringify({ ...args, stream: false })
     });
-    const res = name === "ask" ? await (await import("../../ask-VFSAF5WG.js")).handleAsk(env, ctx, inner, tier, key) : await (await import("../../search-OMPBMZT4.js")).handleSearch(env, ctx, inner, tier, key);
+    const res = name === "ask" ? await (await import("../../ask-YCDXMIZ4.js")).handleAsk(env, ctx, inner, tier, key) : await (await import("../../search-7TO2RWQE.js")).handleSearch(env, ctx, inner, tier, key);
     return res.json().catch(() => ({ error: { message: "tool transport failed", status: res.status } }));
   });
   if (out.ok && "accepted" in out) return new Response(null, { status: 202 });
@@ -1435,7 +1438,7 @@ async function verifyRoute(c) {
   if (!answer || !query) return err(400, "invalid_input", "answer and query are required");
   try {
     const u = await understandQuery(env.AI, roleModel(env, "understand"), query, [], []);
-    const retrieved = await retrieve(env, query, { understanding: u });
+    const retrieved = await retrieve(env, query, { understanding: u, standardKeys: entitlementScope(standardKeysFrom(body)) });
     const passages = retrieved.hits.map((h) => h.text);
     const anchors = checkQuoteAnchors(answer, passages);
     const refs = [...answer.matchAll(/\[\[u:([^\]]+)\]\]/g)].map((m) => m[1]);

package/dist/worker_public/src/profile.js

@@ -1,7 +1,7 @@
 import {
   P,
   setProfile
-} from "../../chunk-Q327B27J.js";
+} from "../../chunk-TJRTVJW5.js";
 export {
   P,
   setProfile

package/dist/worker_public/src/refusal.js

@@ -1,8 +1,8 @@
 import {
   canonicalRefusal,
   refusalAnswer
-} from "../../chunk-WGXATDXY.js";
-import "../../chunk-Q327B27J.js";
+} from "../../chunk-DBBGOOMZ.js";
+import "../../chunk-TJRTVJW5.js";
 export {
   canonicalRefusal,
   refusalAnswer

package/dist/worker_public/src/requestScope.js

@@ -1,10 +1,16 @@
 import {
+  entitlementScope,
+  licenseDeclared,
   requestSalt,
-  resolveRequestScope
-} from "../../chunk-LNSDBEKS.js";
-import "../../chunk-Q6LI4T7M.js";
-import "../../chunk-Q327B27J.js";
+  resolveRequestScope,
+  standardKeysFrom
+} from "../../chunk-5MBWE7WD.js";
+import "../../chunk-ADXV2DPK.js";
+import "../../chunk-TJRTVJW5.js";
 export {
+  entitlementScope,
+  licenseDeclared,
   requestSalt,
-  resolveRequestScope
+  resolveRequestScope,
+  standardKeysFrom
 };

package/docs/spec-pipeline.md

@@ -47,6 +47,7 @@ candidate lanes → pool open → pool-level merges → refinement → window as
 | 9 | `lexical-union` | `lexicalHits.length` | blocking | appends `hits` | Full-corpus BM25 hits dense missed (dense metadata wins on id collision). |
 | 10 | `federate` | `opts.federate` | additive (callback catches transport) | appends `hits` | Internal ISO/IEC passages at `federateDiscount`. |
 | 11 | `seal` | `opts.sealScope` | blocking | filters `hits` | The declared context's hard cut: nothing outside the declared family reaches rerank. (The lexical lane is sealed at the SOURCE, in the prelude — not here.) |
+| 11b | `license-scope` | `opts.standardKeys` | blocking | filters `hits` | The license entitlement hard cut (TODO.external-refs/08): a chunk carrying a `standard_key` outside the caller's set never reaches rerank; public chunks (no key) always pass. (The lexical lane is bound at the SOURCE, in the prelude — the lexical union AND the post-rerank lexical-rrf consume the bound list. The post-scope single-document fetches — section-descent, typed-pin parent, edition-cover — are doc-scoped, and a document's key is a per-document constant, so they cannot re-admit a dropped key; citation-probe filters its bibliography push by the same predicate.) |
 | 12 | `overview-demote` | — | blocking | mutates `hits[].score` | Overview boilerplate demotion (`overviewDemotion`). |
 | 13 | `family-boost` | boost only under `filter.doc_number`; sort always | blocking | mutates `hits[].score`, sorts | Family chunks decisively boosted for doc-scoped queries; the sort establishes the rerank-failure fallback order. |
 | 14 | `rerank` | `hits.length > 1` | additive | `hits[].rerank_score`, sorts, family pin | Cross-encoder scores; vector order is the designed fallback. Post-rerank family pin for doc-scoped queries. |

package/package.json

@@ -36,7 +36,7 @@
     "@konneal/engine": "github:konneal/engine#2d6c39b",
     "@oimlsmart/oiml-pubid": "^1.2.1"
   },
-  "version": "0.2.2",
+  "version": "0.2.3",
   "description": "The Konneal engine: the publisher-agnostic build pipeline and API plane for standards intelligence (retrieval, answer contract, verdicts, evaluation).",
   "license": "BSD-3-Clause",
   "type": "module",

package/profile/prompts.yaml

@@ -17,3 +17,17 @@ vars:
   docid_example: "FIXTURE 1-2"
   spelling_examples: '"f1", "FIXTURE 1"'
   process_vocab: "the fixture certification system framework"
+  # the license declare flow (TODO.external-refs/08): where an org admin
+  # declares a standards license — the boundary refusal's pointer
+  license_declare_pointer: "org admin → Settings → Standards licenses"
+  # the licensed-content posture (TODO.external-refs/08): how the answer
+  # model behaves when a question hits the license boundary (the
+  # per-question note rides the retrieval-note channel)
+  license_posture: >-
+    Some indexed publications are LICENSED. When a license boundary note
+    names the question's publication, obey it: answer at the citation
+    level only — the standard's title and edition, and the invoking clause
+    the public passages carry — never state, paraphrase or "summarize from
+    memory" any procedure of the licensed text, and point at the declare
+    flow the note names. Public content (the Recommendations' own models,
+    applicability and references) stays fully answerable.

package/profile/sources.yaml

@@ -3,3 +3,12 @@ corpora:
 bibliography: {}
 terminology: {}
 models: {}
+# the licensed-standards declaration (TODO.external-refs/08): the
+# entitlement keys the deployment's index may carry (`standard_key` chunk
+# metadata, from the packages' license_key facet) — this list is the
+# whitelist the request's entitlement set validates against, and the
+# package/doc-number mapping the ask path gates model bindings with.
+# Absent or empty = the deployment serves public content only. The
+# fixture declares one so the license scope rides every engine test.
+licensed:
+  - { key: "std:fixture-60068-2-30", package: "fixture-60068-2-30", doc_number: "60068-2-30", title: "FIXTURE environmental testing — damp heat, cyclic", edition: "2005" }

package/workers/shared/chunk.ts

@@ -35,6 +35,12 @@ export interface ChunkMeta {
   model_node?: string;
   model_kind?: string;
   standard?: string;
+  /** The license entitlement key (the package's `license_key` facet, e.g.
+   *  `std:iec-60068-2-30`) — present ONLY when the chunk's content comes
+   *  from a licensed package; public content carries none. The ask path's
+   *  hard scope (stages/licenseScope.ts) drops chunks whose key is absent
+   *  from the caller's entitlement set, before ranking. */
+  standard_key?: string;
   /** section-summary unit (FABLE multi-granularity, arXiv:2601.18116): a
    *  depth-1 clause summary vector — a navigation node whose children
    *  (child_anchors CSV) are quotable leaf clauses. The corpus's real
@@ -83,6 +89,7 @@ export const CHUNK_META_FIELDS = [
   "model_node",
   "model_kind",
   "standard",
+  "standard_key",
   "section_summary",
   "child_anchors",
   "ctx",

package/workers/worker_internal/src/index.ts

@@ -85,7 +85,7 @@ async function adminSyncRoute(c: RouteContext): Promise<Response> {
     if (Array.isArray(body?.upserts)) {
       for (let i = 0; i < body.upserts.length; i += 100) {
         const batch = body.upserts.slice(i, i + 100).filter((v: any) => v?.id && Array.isArray(v?.values) && v?.metadata);
-        if (batch.length) await env.PUBLIC.upsert(batch);
+        if (batch.length) await env.INTERNAL.upsert(batch);
         out.upserted += batch.length;
       }
     }
@@ -94,14 +94,14 @@ async function adminSyncRoute(c: RouteContext): Promise<Response> {
       for (let i = 0; i < todo.length; i += 16) {
         const batch = todo.slice(i, i + 16);
         const vectors = await Promise.all(batch.map((b: any) => embed(env.AI, b.text.slice(0, 6000))));
-        await env.PUBLIC.upsert(batch.map((b: any, j: number) => ({ id: b.id, values: vectors[j], metadata: b.metadata })));
+        await env.INTERNAL.upsert(batch.map((b: any, j: number) => ({ id: b.id, values: vectors[j], metadata: b.metadata })));
         out.embedded += batch.length;
       }
     }
     if (Array.isArray(body?.deletes)) {
       const ids = body.deletes.filter((x: any) => typeof x === "string");
       for (let i = 0; i < ids.length; i += 100) {
-        await env.PUBLIC.deleteByIds(ids.slice(i, i + 100));
+        await env.INTERNAL.deleteByIds(ids.slice(i, i + 100));
         out.deleted += Math.min(100, ids.length - i);
       }
     }

package/workers/worker_public/prompts/system.md

@@ -14,6 +14,7 @@ Synthesize practical answers from the passages: definitions, procedures and rule
 MANDATORY: when the question asks how to do something (get certified, apply, comply, register, test) and the passages describe the governing system or procedure, ALWAYS answer with that procedure citing the governing documents. Refusing such a question because the passages do not name the specific publication is WRONG — the publication sets technical requirements; the HOW is governed by the certification-system documents in the passages.
 If the passages cover only part of the question, answer the covered part fully, then state precisely what the indexed publications do not cover — do not pad with outside knowledge.
 Refuse ONLY when no passage relates to the question's topic. Use exactly this sentence: {{REFUSAL_SENTENCE}} Then add one short line naming what you can answer instead, so the refusal redirects rather than dead-ends.
+{{LICENSE_POSTURE}}
 {{CORPUS_NOTES}}
 Lead with the direct answer, then supporting detail; no preamble like 'Based on the passages'. Use short paragraphs or bullets for multi-part answers. Be concise and precise. Answer in the question's language{{LANG_CLAUSE}}.
 - HARD RULE — typed units: passages whose header shows `unit u:xxxx (table)` contain a typed table. If your answer presents that table's data, you MUST write the token `[[u:xxxx]]` where the table belongs and MUST NOT render the table as markdown or reproduce more than ONE of its rows inline. Summarize the pattern in prose ("classes A–D with lower limits from 100 to 50 000"), cite the clause normally, and let `[[u:xxxx]]` stand for the full table — the interface renders it exactly from the source. The same rule applies to `unit u:xxxx (formula|figure|term)` objects.

package/workers/worker_public/src/ask.ts

@@ -19,11 +19,11 @@ import { contractV2, tableRetyped } from "./refs";
 import { completeTables, completeFigures } from "./completion";
 import { NO_CONTEXT, appliedContext, contextNote, namedDocumentIn, parseContext, resolveDocScope, syntheticUnderstanding } from "./context";
 import { exchangeForLiveToken, liveDataConfig, resolveLiveAccount, type LiveRecord } from "./livedata";
-import { bindModelNode, modelCitation, modelEcho, modelGroundingBlock, modelNodeRefIn, standardForDocNumber } from "./modelplane";
+import { bindModelNode, licenseBoundaryNote, licenseBoundaryRefusal, modelCitation, modelEcho, modelGroundingBlock, modelNodeRefIn, standardForDocNumber } from "./modelplane";
 import { evaluate as machineEvaluate, verdictNote } from "./verdict";
 import { detectDraftIntent, prepareDraft } from "./drafts";
 import { memoryNote } from "./memories";
-import { resolveRequestScope, requestSalt } from "./requestScope";
+import { entitlementScope, resolveRequestScope, requestSalt } from "./requestScope";
 import { rawSessionToken } from "./session";
 import { cacheKeyMaterial, corpusGen, exactCacheKey, freshRequested, semanticCacheKey } from "./answercache";
 import type { Env } from "./env";
@@ -308,6 +308,13 @@ async function handleAsk(
   const scope = resolveRequestScope(body, member);
   if ("error" in scope) return err(400, "invalid_input", "datasets: at least one dataset must stay enabled");
   const { corpora, narrowed, isoOn } = scope;
+  // The license entitlement set (TODO.external-refs/08): request-scoped,
+  // validated against the profile's declared licensed list; the hard
+  // retrieval scope it feeds is fail-closed (an unentitled ask — empty
+  // set, the anon default — never sees licensed chunks, citation-level
+  // metadata stays). It salts the answer cache with the effort segment
+  // below.
+  const standardKeys = entitlementScope(scope.standardKeys);
   // Personalized memory files (#171): member-scoped, selected per ask;
   // the note rides buildMessages as a trusted-user-facts preamble, and
   // the selections SALT the answer cache (requestScope.requestSalt).
@@ -692,18 +699,23 @@ async function handleAsk(
         label: declaredCtx?.label,
         query: q.query,
         standard: standardForDocNumber(modelDocHint?.doc_number),
+        standardKeys,
       })
     : null;
   if (boundModel) {
     ctxApplied = { ...ctxApplied, model: modelEcho(boundModel) };
-    console.log("model plane: bound", boundModel.node_id, `[${boundModel.standard}]`, boundModel.clause?.urn ?? "no-clause");
+    console.log("model plane: bound", boundModel.node_id, `[${boundModel.standard}]`, boundModel.clause?.urn ?? "no-clause", boundModel.gated ? "(gated: license)" : "");
   }
-  const modelNote = boundModel ? modelGroundingBlock(boundModel) : undefined;
+  // A GATED binding (licensed package, unentitled caller) keeps its
+  // citation + echo — metadata the honesty posture keeps — and withholds
+  // the grounding block and the verdict engine: no licensed machine
+  // content enters the prompt by the binding lane either.
+  const modelNote = boundModel && !boundModel.gated ? modelGroundingBlock(boundModel) : undefined;
   // ── the verdict engine (TODO.era3/01) ──
   // the worker EXECUTES the bound node's machine checks against the
   // question's stated values; the model narrates the computed verdict
   // and the verdict BLOCK is server-built — data, never generated prose
-  const machineVerdict = boundModel ? machineEvaluate(boundModel.content, q.query) : null;
+  const machineVerdict = boundModel && !boundModel.gated ? machineEvaluate(boundModel.content, q.query) : null;
   const machineNote = machineVerdict && boundModel ? verdictNote(machineVerdict, boundModel) : undefined;
   const verdictBlock = machineVerdict
     ? {
@@ -776,7 +788,7 @@ async function handleAsk(
     // publications there).
     retrieved = await retrieve(env, q.query, { prev, understanding, federate, warmEmbed, graphDocNumbers,
       sealScope: declaredScoped ? docScope : null, optimisticHits, optimisticVec,
-      datasetScope: narrowed ? corpora : null });
+      datasetScope: narrowed ? corpora : null, standardKeys });
     stageTiming["retrieve-core"] = Date.now() - tR;
     console.log("stage: retrieve", Date.now() - tR, "ms");
     // ── TTFT surgery: the two post-retrieval LLM calls run IN PARALLEL —
@@ -810,7 +822,7 @@ async function handleAsk(
     if (grade === "weak" && understanding?.docidentifier) {
       const broaden = `${understanding.standalone_query || q.query} ${understanding.docidentifier}`.trim();
       const tc = Date.now();
-      const second = await retrieve(env, q.query, { prev, understanding, queryOverride: broaden, federate, datasetScope: narrowed ? corpora : null });
+      const second = await retrieve(env, q.query, { prev, understanding, queryOverride: broaden, federate, datasetScope: narrowed ? corpora : null, standardKeys, sealScope: declaredScoped ? docScope : null });
       const grade2 = await gradeRetrieval(env.AI, roleModel(env, "grader"), q.query, second.hits.map((h: Hit) => h.text));
       stageTiming.corrective = Date.now() - tc;
       if (grade2 === "good") retrieved = second; // corrective retry must be strictly better
@@ -821,8 +833,13 @@ async function handleAsk(
     return err(503, "retrieval_unavailable", "Search is briefly busy — please retry in a moment.");
   }
   const { hits } = retrieved;
-  if (hits.length === 0 && !liveRecords?.length && !boundModel) {
-    const answer = refusalAnswer();
+  if (hits.length === 0 && !liveRecords?.length && (!boundModel || boundModel.gated)) {
+    // the license boundary refusal (TODO.external-refs/08) outranks the
+    // plain "no information" sentence when the question's publication is
+    // licensed and unentitled: name the standard, state the boundary,
+    // point at the declare flow
+    const answer =
+      licenseBoundaryRefusal(modelDocHint?.doc_number ?? understanding?.doc_number ?? null, standardKeys) ?? refusalAnswer();
     const out = { answer, citations: [], model, query_hash: await sha256Hex(q.query), context_applied: ctxApplied };
     telemetry(env, ctx, tier, "ask", model, true, answer.length, out.query_hash, q.lang, undefined, telemetryMeta());
     return json({ ...out, quota, });
@@ -831,6 +848,11 @@ async function handleAsk(
   const processNote = understanding?.process_intent
     ? P().retrieval.process_note
     : undefined;
+  // the license boundary (TODO.external-refs/08): the question's named or
+  // understood publication is licensed and the caller's set lacks the key
+  // — the refusal-class note rides the retrieval-note channel beside the
+  // other structured facts
+  const licenseNote = licenseBoundaryNote(modelDocHint?.doc_number ?? understanding?.doc_number ?? null, standardKeys);
   // the vocabulary binding (L2): the corpus's defined-term candidates for
   // the question's subject — the model adjudicates among them and uses
   // the corpus term (with its defining publication) when it names the
@@ -859,7 +881,7 @@ async function handleAsk(
     q.lang,
     keptHistory,
     // stage-extracted graph facts (GraphRAG) ride the same note channel
-    [processNote, eNote, contextNote(declaredCtx, docScope), accountNote, modelNote, vocabNote, memNote, machineNote, ...(retrieved.notes ?? [])].filter(Boolean).join("\n") || undefined,
+    [processNote, eNote, contextNote(declaredCtx, docScope), accountNote, modelNote, vocabNote, memNote, machineNote, licenseNote, ...(retrieved.notes ?? [])].filter(Boolean).join("\n") || undefined,
     summary,
     budget,
   );
@@ -1046,6 +1068,7 @@ async function handleAsk(
         understanding: { ...understanding, standalone_query: `${understanding?.standalone_query || q.query} ${reflection.missing_info}` } as any,
         sealScope: declaredScoped ? docScope : null,
         datasetScope: narrowed ? corpora : null,
+        standardKeys,
       });
       if (retryRetrieve.hits.length > 0) {
         const { messages: retryMessages, usedHits: retryUsed } = buildMessages(q.query, retryRetrieve.hits, q.lang, keptHistory, undefined, summary, budget);

package/workers/worker_public/src/index.ts

@@ -14,6 +14,7 @@ import { scoreFaithfulness } from "./faithfulness";
 import { checkQuoteAnchors } from "./anchors";
 import { namedDocumentIn } from "./context";
 import { standardForDocNumber } from "./modelplane";
+import { entitlementScope, standardKeysFrom } from "./requestScope";
 import type { Env } from "./env";
 export type { Env };
 import { json, err, corsHeaders, withCors, readJson, authenticate, type ApiKey } from "./lib/http";
@@ -227,7 +228,7 @@ async function verifyRoute(c: RouteContext): Promise<Response> {
   if (!answer || !query) return err(400, "invalid_input", "answer and query are required");
   try {
     const u = await understandQuery(env.AI, roleModel(env, "understand"), query, [], []);
-    const retrieved = await retrieve(env, query, { understanding: u });
+    const retrieved = await retrieve(env, query, { understanding: u, standardKeys: entitlementScope(standardKeysFrom(body)) });
     const passages = retrieved.hits.map((h: Hit) => h.text);
     const anchors = checkQuoteAnchors(answer, passages);
     const refs = [...answer.matchAll(/\[\[u:([^\]]+)\]\]/g)].map((m) => m[1]);

package/workers/worker_public/src/modelplane.ts

@@ -52,6 +52,82 @@ export function standardForDocNumber(docNumber: string | undefined): string | nu
   return (models.standards as string[]).includes(docNumber) ? `${models.standard_prefix}${docNumber}` : null;
 }
 
+// ── the license tier (TODO.external-refs/08) ─────────────────────────────
+// The profile's `sources.licensed` rows ({key, package, doc_number,
+// title, edition}) are the deployment's declared licensed standards —
+// the same keys the chunk metadata carries (`standard_key`) and the
+// entitlement set arrives with (requestScope.standardKeysFrom validates
+// against exactly this list).
+
+/** The license entry for a package id (the model-plane standard id, e.g.
+ *  `iec-60068-2-30`), or null when the package is public content. */
+export function licensedEntryForPackage(packageId: string | undefined | null):
+  | { key: string; package: string; doc_number?: string; title?: string; edition?: string }
+  | null {
+  if (!packageId) return null;
+  return (P().sources?.licensed ?? []).find((l: any) => l.package === packageId) ?? null;
+}
+
+/** The license entry for a doc number (the question's named publication,
+ *  e.g. "60068-2-30"), or null when unnamed/public. */
+export function licensedEntryForDocNumber(docNumber: string | undefined | null):
+  | { key: string; package: string; doc_number?: string; title?: string; edition?: string }
+  | null {
+  if (!docNumber) return null;
+  return (P().sources?.licensed ?? []).find((l: any) => String(l.doc_number ?? "") === docNumber) ?? null;
+}
+
+/** The per-question license boundary note: composed ONLY when the
+ *  question's named/understood publication is licensed AND the caller's
+ *  entitlement set does not carry its key. The honesty posture, made
+ *  structural: name the standard, say the organization's license does
+ *  not cover its text, keep every procedural claim out, point at the
+ *  declare flow. Citation-level metadata (title, edition, the invoking
+ *  clause the RECs publicly name) stays answerable from the public
+ *  passages already in context — the note instructs exactly that. */
+export function licenseBoundaryNote(
+  docNumber: string | undefined | null,
+  standardKeys: ReadonlySet<string> | null | undefined,
+): string | undefined {
+  const entry = licensedEntryForDocNumber(docNumber);
+  if (!entry || (standardKeys && standardKeys.has(entry.key))) return undefined;
+  const pointer = P().prompts?.vars?.license_declare_pointer;
+  return (
+    `License boundary — the question is about ${licenseBoundaryName(entry)}, a licensed publication` +
+    ` (entitlement key ${entry.key}). The caller's organization license does not cover its text, so no passage of it was retrieved` +
+    ` and NONE of its procedural content (steps, parameters, severities, limits) may be stated, paraphrased or recalled from memory.` +
+    ` You MAY answer at the citation level: name the standard and edition, and cite the invoking clause from the PUBLIC passages in context` +
+    ` (the Recommendation's own applicability and normative references are public and stay answerable).` +
+    ` Then say the organization's license does not cover the standard's text` +
+    (pointer ? ` and point to the declare flow: ${pointer}.` : ".")
+  );
+}
+
+function licenseBoundaryName(entry: { title?: string; edition?: string; package: string; doc_number?: string }): string {
+  const id = entry.doc_number ? ` ${entry.doc_number}` : ` ${entry.package}`;
+  return `${entry.title ?? "standard"}${entry.edition ? ` (${entry.edition})` : ""} —${id}`;
+}
+
+/** The deterministic boundary answer for the zero-passage case: the
+ *  question's licensed publication has nothing to show an unentitled
+ *  caller — name the standard, state the boundary, point at the declare
+ *  flow. Undefined when the question is not the licensed case (the plain
+ *  refusal applies). */
+export function licenseBoundaryRefusal(
+  docNumber: string | undefined | null,
+  standardKeys: ReadonlySet<string> | null | undefined,
+): string | undefined {
+  const entry = licensedEntryForDocNumber(docNumber);
+  if (!entry || (standardKeys && standardKeys.has(entry.key))) return undefined;
+  const pointer = P().prompts?.vars?.license_declare_pointer;
+  return (
+    `${licenseBoundaryName(entry)} is a licensed publication and your organization's license does not cover its text, ` +
+    `so I can't quote or summarize its procedure. I can answer at the citation level — the standard's title and edition, ` +
+    `and the clause your Recommendation invokes — and the public ${P().publisher.name} content in full.` +
+    (pointer ? ` To unlock the full text, an org admin can declare the license under ${pointer}.` : "")
+  );
+}
+
 export interface BoundModelNode {
   standard: string;
   node_id: string;
@@ -60,6 +136,12 @@ export interface BoundModelNode {
   clause: { doc: string; ref: string; urn: string } | null;
   /** The node's bundle projection (verbatim JSON). */
   content: any;
+  /** True when the node's package is licensed and the caller's
+   *  entitlement set lacks the key (TODO.external-refs/08): the citation
+   *  and the echo stay (metadata), but the grounding block and the
+   *  verdict engine are withheld — no licensed machine content enters
+   *  the prompt. */
+  gated?: boolean;
 }
 
 async function fetchNode(env: any, standard: string, nodeId: string): Promise<BoundModelNode | null> {
@@ -97,18 +179,26 @@ async function fetchNode(env: any, standard: string, nodeId: string): Promise<Bo
  *  model-aware chip), then a node id the question names. The standard
  *  comes from the declared doc scope when it carries one; without a scope
  *  the node binds only when it exists in EXACTLY ONE indexed standard —
- *  ambiguity is refused honestly (retrieval still surfaces the chunks). */
+ *  ambiguity is refused honestly (retrieval still surfaces the chunks).
+ *  A licensed package binds GATED for an unentitled caller (metadata
+ *  only — the grounding block and the verdict engine are the ask path's
+ *  to withhold). */
 export async function bindModelNode(
   env: any,
-  opts: { label?: string; query: string; standard?: string | null },
+  opts: { label?: string; query: string; standard?: string | null; standardKeys?: ReadonlySet<string> | null },
 ): Promise<BoundModelNode | null> {
   const nodeId = modelNodeRefIn(opts.label) ?? modelNodeRefIn(opts.query);
   if (!nodeId) return null;
-  if (opts.standard) return fetchNode(env, opts.standard, nodeId);
+  const gate = (node: BoundModelNode | null): BoundModelNode | null => {
+    if (!node) return null;
+    const entry = licensedEntryForPackage(node.standard);
+    return entry && !(opts.standardKeys?.has(entry.key) ?? false) ? { ...node, gated: true, content: {} } : node;
+  };
+  if (opts.standard) return gate(await fetchNode(env, opts.standard, nodeId));
   try {
     const rows = await env.DB.prepare("SELECT standard FROM model_nodes WHERE node_id = ?1 LIMIT 2").bind(nodeId).all();
     const standards = (rows?.results ?? []).map((r: any) => String(r.standard));
-    if (standards.length === 1) return fetchNode(env, standards[0]!, nodeId);
+    if (standards.length === 1) return gate(await fetchNode(env, standards[0]!, nodeId));
     return null; // zero (not indexed) or ambiguous (several standards) — no silent pick
   } catch {
     return null;

package/workers/worker_public/src/pipeline.ts

@@ -32,7 +32,7 @@ export function promptVars(extra: Record<string, string> = {}): Record<string, s
 export function fill(template: string, vars: Record<string, string>): string {
   return template.replace(/\{\{(\w+)\}\}/g, (_m, k: string) => (k in vars ? vars[k] : ""));
 }
-import { QueryFilters, toVectorizeFilter } from "./selfquery";
+import { QueryFilters, toVectorizeFilter, standardKeyAllowed } from "./selfquery";
 import { lexicalPrefilter } from "./lexical";
 import { positionOrder } from "./structural";
 import { STAGES, runStages } from "./stages";
@@ -125,10 +125,18 @@ export async function retrieve(
   // The declared context's seal binds the lexical lane at the SOURCE: the
   // RRF fusion mixes the full-corpus lexical ranking straight into the
   // final hits — past the pool-level seal — so under a seal the lexical
-  // lane is the FAMILY's lexical hits only.
-  const lexicalHits = opts.sealScope
-    ? lexicalHits0.filter((h) => h.metadata.doc_number === opts.sealScope!.doc_number && (!opts.sealScope!.edition || h.metadata.edition === opts.sealScope!.edition))
-    : lexicalHits0;
+  // lane is the FAMILY's lexical hits only. The license entitlement scope
+  // binds the same lane the same way (it re-enters twice: lexical-union
+  // pre-rerank and lexical-rrf post-rerank — both consume this list).
+  const lexicalHits = (opts.sealScope || opts.standardKeys
+    ? lexicalHits0.filter(
+        (h) =>
+          (!opts.sealScope ||
+            (h.metadata.doc_number === opts.sealScope!.doc_number &&
+              (!opts.sealScope!.edition || h.metadata.edition === opts.sealScope!.edition))) &&
+          standardKeyAllowed(h.metadata, opts.standardKeys),
+      )
+    : lexicalHits0);
   if (lexicalHits.length) console.log("lexical prefilter:", lexicalHits.length, "hits");
 
   const ctx: PipelineContext = {

package/workers/worker_public/src/profile.gen.ts

@@ -77,7 +77,16 @@ export const PROFILE = {
     },
     "bibliography": {},
     "terminology": {},
-    "models": {}
+    "models": {},
+    "licensed": [
+      {
+        "key": "std:fixture-60068-2-30",
+        "package": "fixture-60068-2-30",
+        "doc_number": "60068-2-30",
+        "title": "FIXTURE environmental testing — damp heat, cyclic",
+        "edition": "2005"
+      }
+    ]
   },
   "ui": {
     "suggestions": [
@@ -115,7 +124,9 @@ export const PROFILE = {
       "parts_example": "FIXTURE 1-1, FIXTURE 1-A",
       "docid_example": "FIXTURE 1-2",
       "spelling_examples": "\"f1\", \"FIXTURE 1\"",
-      "process_vocab": "the fixture certification system framework"
+      "process_vocab": "the fixture certification system framework",
+      "license_declare_pointer": "org admin → Settings → Standards licenses",
+      "license_posture": "Some indexed publications are LICENSED. When a license boundary note names the question's publication, obey it: answer at the citation level only — the standard's title and edition, and the invoking clause the public passages carry — never state, paraphrase or \"summarize from memory\" any procedure of the licensed text, and point at the declare flow the note names. Public content (the Recommendations' own models, applicability and references) stays fully answerable."
     }
   }
 } as const;