@konneal/engine 0.2.35 → 0.2.38

package/dist/{ask-P6KLPBKL.js → ask-VXV2BFNC.js}

@@ -1,7 +1,7 @@
 import {
   handleAsk
-} from "./chunk-YSWKFXXG.js";
-import "./chunk-GHDRKT4K.js";
+} from "./chunk-CNFQNCWA.js";
+import "./chunk-6GAYBMUM.js";
 import "./chunk-R2V3X6SQ.js";
 import "./chunk-A3QHHUN5.js";
 import "./chunk-4GJGBGJK.js";

package/dist/{chunk-GHDRKT4K.js → chunk-6GAYBMUM.js}

@@ -61,6 +61,27 @@ async function generateOnce(env, model, messages, effort) {
   return null;
 }
 
+// workers/worker_public/src/quality.ts
+var ORDER = { verified: 0, curated: 1, ocr: 2 };
+function hitQuality(m) {
+  if (m.model_node || m.model_version || m.producer === "primmel") return "verified";
+  if (m.tier === "curated") return "curated";
+  return "ocr";
+}
+function answerQuality(qualities) {
+  let worst = null;
+  for (const q of qualities) {
+    if (!q) continue;
+    if (!worst || ORDER[q] > ORDER[worst]) worst = q;
+  }
+  return worst;
+}
+function qualityNote(q) {
+  if (q === "verified") return "Grounded in verified sources: this publication's requirements ride a machine-checkable data model.";
+  if (q === "curated") return "Grounded in the edited corpus: Metanorma-authored documents, chunked at clause boundaries.";
+  return "Partly grounded in experimental OCR text: verify quotations and table values against the official publication.";
+}
+
 // workers/worker_public/src/lexical.ts
 var LEXICAL_K = 40;
 function ftsMatchQuery(query) {
@@ -23515,6 +23536,7 @@ function citations(hits) {
     status: h.metadata.status ?? "unknown",
     superseded_by: h.metadata.superseded_by || void 0,
     corpus: h.metadata.corpus || P().publisher.id,
+    quality: hitQuality(h.metadata),
     url: publicationUrl(h.metadata),
     snippet: h.text.slice(0, 400),
     score: h.rerank_score ?? h.score
@@ -23803,6 +23825,55 @@ async function resolveLiveAccount(env, sessionRaw, member) {
   if (!read.ok) return { status: "unavailable", reason: read.reason };
   return { status: "ok", records: read.records, stores: read.stores, readAt: read.readAt };
 }
+function deviceClientIds(env) {
+  return String(env.OIDC_DEVICE_CLIENT_IDS ?? "").split(/[\s,]+/).filter(Boolean);
+}
+function opCfg(env) {
+  return { issuer: String(env.OIDC_ISSUER ?? "").trim().replace(/\/+$/, ""), clientId: String(env.OIDC_CLIENT_ID ?? "") };
+}
+function opMemberCanWrite(member) {
+  if (!member) return false;
+  if (member.via !== "op-token") return true;
+  return /\bwrite\b/.test(member.scope ?? "");
+}
+function opMemberFromIntrospection(answer, ids) {
+  if (!answer?.active) return null;
+  const clientId = String(answer.client_id ?? "");
+  if (!ids.includes(clientId)) return null;
+  const sub = String(answer.sub ?? "");
+  if (!sub) return null;
+  return { sub, scope: String(answer.scope ?? ""), via: "op-token" };
+}
+async function opTokenMember(env, cfg, req) {
+  const m = /^Bearer\s+(.+)$/i.exec((req.headers.get("Authorization") ?? "").trim());
+  const token = m?.[1]?.trim();
+  if (!token || token.split(".").length === 3) return null;
+  const ids = deviceClientIds(env);
+  if (!ids.length || !cfg.issuer || !cfg.clientId) return null;
+  const key = `opint:${await sha256Hex2(token)}`;
+  let answer = null;
+  try {
+    answer = await env.CACHE.get(key, "json");
+  } catch {
+  }
+  if (answer === void 0 || answer === null) {
+    try {
+      const res = await fetch(`${cfg.issuer}/op/introspect`, {
+        method: "POST",
+        headers: { "content-type": "application/x-www-form-urlencoded" },
+        body: new URLSearchParams({ token, client_id: cfg.clientId })
+      });
+      answer = res.ok ? await res.json() : { active: false };
+    } catch {
+      return null;
+    }
+    try {
+      await env.CACHE.put(key, JSON.stringify(answer ?? { active: false }), { expirationTtl: 45 });
+    } catch {
+    }
+  }
+  return opMemberFromIntrospection(answer, ids);
+}
 
 // workers/worker_public/src/oidc.ts
 var OidcError = class extends Error {
@@ -24511,6 +24582,8 @@ async function editionNote(env, u) {
 export {
   embed,
   generateOnce,
+  answerQuality,
+  qualityNote,
   ftsMatchQuery,
   refCodec,
   NO_CONTEXT,
@@ -24537,6 +24610,9 @@ export {
   liveDataConfig,
   liveTokenFor,
   resolveLiveAccount,
+  opCfg,
+  opMemberCanWrite,
+  opTokenMember,
   handleLogin,
   handleCallback,
   sessionFrom,

package/dist/{chunk-YSWKFXXG.js → chunk-CNFQNCWA.js}

@@ -1,5 +1,6 @@
 import {
   NO_CONTEXT,
+  answerQuality,
   appliedContext,
   buildMessages,
   checkQuota,
@@ -16,9 +17,12 @@ import {
   liveTokenFor,
   machineOffers,
   namedDocumentIn,
+  opCfg,
+  opTokenMember,
   parseContext,
   portModelRunner,
   portStore,
+  qualityNote,
   rawSessionToken,
   refCodec,
   resolveDocScope,
@@ -30,7 +34,7 @@ import {
   syntheticUnderstanding,
   telemetry,
   understandQuery
-} from "./chunk-GHDRKT4K.js";
+} from "./chunk-6GAYBMUM.js";
 import {
   corsHeaders,
   err,
@@ -495,6 +499,7 @@ function modelCitation(node) {
     clause_title: `${node.kind.replace(/_/g, " ")} \u2014 ${node.name} (${node.node_id})`,
     status: "in-force",
     corpus: "smart-model",
+    quality: "verified",
     url: void 0,
     snippet: `${node.node_id}${node.clause ? ` \xB7 ${node.clause.urn}` : ""}${node.content?.statement ? ` \u2014 ${clip(node.content.statement, 240)}` : ""}`,
     score: 1
@@ -1895,7 +1900,16 @@ async function handleAsk(env, ctx, req, tier, key) {
   const declaredCtx = parseContext(body);
   const draftAct = P().publisher.features?.drafts ? detectDraftIntent(q.query) : null;
   const apiCallIntent = !draftAct && P().publisher.features?.api_call_drafts ? detectApiCallIntent(q.query, declaredCtx) : null;
-  const member = tier === "member" ? await sessionFrom(req, env) : null;
+  const session = tier === "member" ? await sessionFrom(req, env) : null;
+  const opMember = !session && tier === "member" ? await opTokenMember(env, opCfg(env), req) : null;
+  const member = session ?? (opMember ? {
+    sub: opMember.sub,
+    roles: [],
+    iat: Math.floor(Date.now() / 1e3),
+    exp: Math.floor(Date.now() / 1e3) + 3600,
+    via: "op-token",
+    scope: opMember.scope
+  } : null);
   const effort = requestEffort(env, member, body?.effort);
   const limit = tier === "key" ? key.day_limit : tier === "member" || member ? num(env, "MEMBER_DAY_ASK", 300) : num(env, "ANON_DAY_ASK", 20);
   const bucketId = tier === "key" ? `key:${key.id}` : member ? `sub:${member.sub}` : clientIp(req);
@@ -2460,7 +2474,8 @@ Answer account questions from these records ONLY: name the record when you use i
 
 `));
           send({ type: "read", read: readAs() });
-          send({ type: "citations", citations: cites, context_applied: ctxApplied, ...liveRecords ? { records: liveRecords } : {}, quota });
+          const sourceQuality = answerQuality(cites.map((c) => c.quality));
+          send({ type: "citations", citations: cites, context_applied: ctxApplied, ...sourceQuality ? { source_quality: sourceQuality, quality_note: qualityNote(sourceQuality) } : {}, ...liveRecords ? { records: liveRecords } : {}, quota });
           let full = "";
           try {
             for await (const tok of sseTokens(stream)) {
@@ -2593,7 +2608,8 @@ Answer account questions from these records ONLY: name the record when you use i
     if (completionBlocks.length) console.log("contract completion:", completionBlocks.length, "table block(s) attached server-side");
   }
   completionBlocks.push(...await completeFigures(env.DB, answer, [...c2ns.blocks, ...completionBlocks], used));
-  const out = { answer, citations: finalCites, model: MODELS.member, query_hash: queryHash, follow_ups: understanding?.follow_ups ?? [], blocks: [...c2ns.blocks, ...verdictBlock ? [verdictBlock] : [], ...conditionBlock ? [conditionBlock] : [], ...aggregationBlock ? [aggregationBlock] : [], ...completionBlocks], context_applied: ctxApplied, ...liveRecords ? { records: liveRecords } : {} };
+  const jsonQuality = answerQuality(finalCites.map((c) => c.quality));
+  const out = { answer, citations: finalCites, ...jsonQuality ? { source_quality: jsonQuality, quality_note: qualityNote(jsonQuality) } : {}, model: MODELS.member, query_hash: queryHash, follow_ups: understanding?.follow_ups ?? [], blocks: [...c2ns.blocks, ...verdictBlock ? [verdictBlock] : [], ...conditionBlock ? [conditionBlock] : [], ...aggregationBlock ? [aggregationBlock] : [], ...completionBlocks], context_applied: ctxApplied, ...liveRecords ? { records: liveRecords } : {} };
   const cacheable = !contextual && !declaredCtx && !answer.includes(refusalAnswer()) && finalAnchors.violations.length === 0;
   if (cacheable) {
     const warmVec = await warmEmbed ?? null;

package/dist/{chunk-Z7AQEW6G.js → chunk-GDQOFP6B.js}

@@ -7,7 +7,7 @@ import {
   sessionFrom,
   telemetry,
   understandQuery
-} from "./chunk-GHDRKT4K.js";
+} from "./chunk-6GAYBMUM.js";
 import {
   corsHeaders,
   err,

package/dist/env.d.ts

@@ -31,6 +31,11 @@ export interface Env {
     OIDC_CLIENT_ID?: string;
     OIDC_CLIENT_SECRET?: string;
     OIDC_REDIRECT_URI?: string;
+    /** TODO.ai-platform/14 — the Ommisa tier: the OP device-grant client
+     *  ids (comma/space separated) whose opaque access tokens this
+     *  deployment admits as member-read credentials via introspection.
+     *  Empty/absent = the tier is off. */
+    OIDC_DEVICE_CLIENT_IDS?: string;
     SESSION_SECRET?: string;
     /** TODO.ai-platform/03 — the "my account" live-data delegation: the
      *  platform instance's API base + its client id at the OP (the

package/dist/livedata.d.ts

@@ -88,3 +88,39 @@ export declare function resolveLiveAccount(env: any, sessionRaw: string | null,
     via?: string;
     scope?: string;
 } | null): Promise<LiveAccount>;
+/** The device-grant clients this deployment admits. Empty = the tier is
+ *  off (a Bearer token that is not a service session stays anonymous). */
+export declare function deviceClientIds(env: any): string[];
+/** The introspection call's OP coordinates, read once per call site. */
+export declare function opCfg(env: any): {
+    issuer: string;
+    clientId: string;
+};
+export interface OpMember {
+    sub: string;
+    scope: string;
+    via: "op-token";
+}
+/** Mutations through the device-grant bearer (memories, conversations,
+ *  projects — the member's OWN data) need the token's scope to state a
+ *  write. The grammar is the OP's PAT vocabulary (`<service>:write`);
+ *  a read-only approval stays read-only here, and service sessions
+ *  (the browser) are always full-strength. */
+export declare function opMemberCanWrite(member: {
+    via?: string;
+    scope?: string;
+} | null): boolean;
+/** The introspection answer → the member credential, judged against the
+ *  deployment's allowlist. Inactive, foreign-client or subject-less
+ *  answers all resolve to null — never to a widened guess. */
+export declare function opMemberFromIntrospection(answer: any, ids: string[]): OpMember | null;
+/** The Bearer read + introspection, KV-cached 45s keyed by the token's
+ *  hash (an ask burst costs one introspection; a deactivation lands
+ *  within a minute). The cached object is the OP's RAW answer — the
+ *  allowlist re-judges on every read, so a config change takes effect
+ *  inside the cache window too. JWTs (3 dot-segments) are NOT opaque:
+ *  they belong to the delegated lane and never reach the OP here. */
+export declare function opTokenMember(env: any, cfg: {
+    issuer: string;
+    clientId: string;
+}, req: Request): Promise<OpMember | null>;

package/dist/modelplane.d.ts

@@ -87,6 +87,7 @@ export declare function modelCitation(node: BoundModelNode): {
     clause_title: string;
     status: string;
     corpus: string;
+    quality: string;
     url: undefined;
     snippet: string;
     score: number;

package/dist/pipeline.d.ts

@@ -61,6 +61,7 @@ export declare function citations(hits: Hit[]): {
     status: string;
     superseded_by: string | undefined;
     corpus: any;
+    quality: import("./quality").SourceQuality;
     url: string | undefined;
     snippet: string;
     score: number;

package/dist/quality.d.ts

@@ -0,0 +1,6 @@
+import type { ChunkMeta } from "../../shared/chunk.ts";
+export type SourceQuality = "verified" | "curated" | "ocr";
+export declare function hitQuality(m: ChunkMeta): SourceQuality;
+export declare function answerQuality(qualities: (SourceQuality | undefined)[]): SourceQuality | null;
+/** The one-line posture the interface renders under the answer. */
+export declare function qualityNote(q: SourceQuality): string;

package/dist/{search-IBZ2BK2E.js → search-HBE47CK6.js}

@@ -1,7 +1,7 @@
 import {
   handleSearch
-} from "./chunk-Z7AQEW6G.js";
-import "./chunk-GHDRKT4K.js";
+} from "./chunk-GDQOFP6B.js";
+import "./chunk-6GAYBMUM.js";
 import "./chunk-R2V3X6SQ.js";
 import "./chunk-A3QHHUN5.js";
 import "./chunk-4GJGBGJK.js";

package/dist/worker_public/src/index.js

@@ -1,6 +1,6 @@
 import {
   handleSearch
-} from "../../chunk-Z7AQEW6G.js";
+} from "../../chunk-GDQOFP6B.js";
 import {
   bindModelNode,
   checkQuoteAnchors,
@@ -9,7 +9,7 @@ import {
   modelGroundingBlock,
   scoreJudge,
   standardForDocNumber
-} from "../../chunk-YSWKFXXG.js";
+} from "../../chunk-CNFQNCWA.js";
 import {
   buildMessages,
   citations,
@@ -24,6 +24,9 @@ import {
   handleLogout,
   handleMe,
   namedDocumentIn,
+  opCfg,
+  opMemberCanWrite,
+  opTokenMember,
   parseAppliedContext,
   portModelRunner,
   promptVars,
@@ -32,7 +35,7 @@ import {
   sessionFrom,
   telemetry,
   understandQuery
-} from "../../chunk-GHDRKT4K.js";
+} from "../../chunk-6GAYBMUM.js";
 import {
   authenticate,
   corsHeaders,
@@ -996,7 +999,7 @@ async function handleMcp(env, ctx, req, tier, key) {
       // stream:false forces the JSON lane (anon defaults to SSE)
       body: JSON.stringify({ ...args, stream: false })
     });
-    const res = name === "ask" ? await (await import("../../ask-P6KLPBKL.js")).handleAsk(env, ctx, inner, tier, key) : await (await import("../../search-IBZ2BK2E.js")).handleSearch(env, ctx, inner, tier, key);
+    const res = name === "ask" ? await (await import("../../ask-VXV2BFNC.js")).handleAsk(env, ctx, inner, tier, key) : await (await import("../../search-HBE47CK6.js")).handleSearch(env, ctx, inner, tier, key);
     return res.json().catch(() => ({ error: { message: "tool transport failed", status: res.status } }));
   });
   if (out.ok && "accepted" in out) return new Response(null, { status: 202 });
@@ -1025,8 +1028,9 @@ function routeMatchesPath(pattern, path) {
   return params;
 }
 function matchRoute(routes, method, path) {
+  const effective = method === "HEAD" ? "GET" : method;
   for (const route of routes) {
-    if (route.method !== method && route.method !== "*") continue;
+    if (route.method !== effective && route.method !== "*") continue;
     const params = routeMatchesPath(route.pattern, path);
     if (params) return { route, params };
   }
@@ -1307,30 +1311,54 @@ async function serveIndexPage(c) {
   }
   return err(404, "not_found", "Page not found");
 }
-async function memoriesRoute(c) {
+var MUTATING_METHODS = /* @__PURE__ */ new Set(["POST", "PUT", "PATCH", "DELETE"]);
+async function opIdentity(c, signIn) {
   const session = await sessionFrom(c.req, c.env);
-  if (!session) return withCors(err(401, "unauthorized", "Sign in to use memory files"), corsHeaders(c.req));
-  return withCors(await handleMemories(c.env, session.sub, c.req, { method: c.req.method, id: c.params.id }), corsHeaders(c.req));
+  if (session) return { sub: session.sub, write: true };
+  const member = await opTokenMember(c.env, opCfg(c.env), c.req);
+  if (!member) return err(401, "unauthorized", signIn);
+  return { sub: member.sub, write: opMemberCanWrite(member) };
+}
+function opWriteRefused(c, who) {
+  if (!(who instanceof Response) && MUTATING_METHODS.has(c.req.method) && !who.write) {
+    return err(403, "forbidden", "This sign-in grants read only \u2014 request a write scope at login.");
+  }
+  return null;
+}
+async function memoriesRoute(c) {
+  const who = await opIdentity(c, "Sign in to use memory files");
+  if (who instanceof Response) return withCors(who, corsHeaders(c.req));
+  const refused = opWriteRefused(c, who);
+  if (refused) return withCors(refused, corsHeaders(c.req));
+  return withCors(await handleMemories(c.env, who.sub, c.req, { method: c.req.method, id: c.params.id }), corsHeaders(c.req));
 }
 async function projectsRoute(c) {
-  const session = await sessionFrom(c.req, c.env);
-  if (!session) return withCors(err(401, "unauthorized", "Sign in to use projects"), corsHeaders(c.req));
-  return withCors(await handleProjects(c.env, session.sub, c.req, { method: c.req.method, id: c.params.id }), corsHeaders(c.req));
+  const who = await opIdentity(c, "Sign in to use projects");
+  if (who instanceof Response) return withCors(who, corsHeaders(c.req));
+  const refused = opWriteRefused(c, who);
+  if (refused) return withCors(refused, corsHeaders(c.req));
+  return withCors(await handleProjects(c.env, who.sub, c.req, { method: c.req.method, id: c.params.id }), corsHeaders(c.req));
 }
 async function projectFilesRoute(c) {
-  const session = await sessionFrom(c.req, c.env);
-  if (!session) return withCors(err(401, "unauthorized", "Sign in to use projects"), corsHeaders(c.req));
-  return withCors(await handleProjectFiles(c.env, session.sub, c.req, { method: c.req.method, id: c.params.id }), corsHeaders(c.req));
+  const who = await opIdentity(c, "Sign in to use projects");
+  if (who instanceof Response) return withCors(who, corsHeaders(c.req));
+  const refused = opWriteRefused(c, who);
+  if (refused) return withCors(refused, corsHeaders(c.req));
+  return withCors(await handleProjectFiles(c.env, who.sub, c.req, { method: c.req.method, id: c.params.id }), corsHeaders(c.req));
 }
 async function conversationsRoute(c) {
-  const session = await sessionFrom(c.req, c.env);
-  if (!session) return withCors(err(401, "unauthorized", "Sign in to sync your conversations across devices"), corsHeaders(c.req));
-  return withCors(await handleConversations(c.env, session.sub, c.req, { method: c.req.method, id: c.params.id }), corsHeaders(c.req));
+  const who = await opIdentity(c, "Sign in to sync your conversations across devices");
+  if (who instanceof Response) return withCors(who, corsHeaders(c.req));
+  const refused = opWriteRefused(c, who);
+  if (refused) return withCors(refused, corsHeaders(c.req));
+  return withCors(await handleConversations(c.env, who.sub, c.req, { method: c.req.method, id: c.params.id }), corsHeaders(c.req));
 }
 async function appendMessageRoute(c) {
-  const session = await sessionFrom(c.req, c.env);
-  if (!session) return withCors(err(401, "unauthorized", "Sign in to sync your conversations across devices"), corsHeaders(c.req));
-  return withCors(await handleAppendMessage(c.env, session.sub, c.req, c.params.id), corsHeaders(c.req));
+  const who = await opIdentity(c, "Sign in to sync your conversations across devices");
+  if (who instanceof Response) return withCors(who, corsHeaders(c.req));
+  const refused = opWriteRefused(c, who);
+  if (refused) return withCors(refused, corsHeaders(c.req));
+  return withCors(await handleAppendMessage(c.env, who.sub, c.req, c.params.id), corsHeaders(c.req));
 }
 async function shareRoute(c) {
   const session = await sessionFrom(c.req, c.env);
@@ -1360,6 +1388,7 @@ async function tierFor(c) {
   }
   let tier = isApi ? "key" : "anon";
   if (!isApi && await sessionFrom(c.req, c.env)) tier = "member";
+  else if (!isApi && await opTokenMember(c.env, opCfg(c.env), c.req)) tier = "member";
   return { tier, key };
 }
 async function mcpRoute(c) {

package/package.json

@@ -27,7 +27,7 @@
     "playwright": "^1.62.1",
     "yaml": "^2.9.1"
   },
-  "version": "0.2.35",
+  "version": "0.2.38",
   "description": "The Konneal engine: the publisher-agnostic build pipeline and API plane for standards intelligence (retrieval, answer contract, verdicts, evaluation).",
   "license": "BSD-3-Clause",
   "type": "module",

package/workers/shared/router.ts

@@ -43,8 +43,11 @@ export function routeMatchesPath(pattern: string, path: string): Record<string,
 }
 
 export function matchRoute(routes: Route[], method: string, path: string): { route: Route; params: Record<string, string> } | null {
+  // HEAD rides the GET route (the fetch pipeline strips the body) — a
+  // bare HEAD / must not answer 405 to link previewers and probes.
+  const effective = method === "HEAD" ? "GET" : method;
   for (const route of routes) {
-    if (route.method !== method && route.method !== "*") continue;
+    if (route.method !== effective && route.method !== "*") continue;
     const params = routeMatchesPath(route.pattern, path);
     if (params) return { route, params };
   }

package/workers/shared/session.ts

@@ -16,8 +16,9 @@ export interface SessionClaims {
   exp: number;
   /** the credential kind: absent = the service session; "delegated" =
    *  the OP-minted RFC 8693 bearer (TODO.ai-platform/12 — the session
-   *  bridge; delegated.ts) */
-  via?: "delegated";
+   *  bridge; delegated.ts); "op-token" = the device-grant CLI's opaque
+   *  bearer, admitted through RFC 7662 introspection (livedata.ts) */
+  via?: "delegated" | "op-token";
   /** the delegating surface (the delegated bearer's act.sub — the
    *  platform instance's OP client) */
   delegator?: string;

package/workers/worker_public/src/ask.ts

@@ -19,17 +19,18 @@ import { canonicalRefusal } from "./refusal";
 import { contractV2, tableRetyped } from "./refs";
 import { completeTables, completeFigures } from "./completion";
 import { NO_CONTEXT, appliedContext, contextNote, namedDocumentIn, parseContext, resolveDocScope, syntheticUnderstanding } from "./context";
-import { liveDataConfig, liveTokenFor, resolveLiveAccount, type LiveRecord } from "./livedata";
+import { liveDataConfig, liveTokenFor, opCfg, opTokenMember, resolveLiveAccount, type LiveRecord } from "./livedata";
 import { bindModelNode, licenseBoundaryNote, licenseBoundaryRefusal, licensedEntryForPackage, modelCitation, modelEcho, modelGroundingBlock, modelNodeRefIn, standardForDocNumber } from "./modelplane";
 import { evaluate as machineEvaluate, verdictNote } from "./verdict";
 import { evaluateConditionSets, quantitiesIn, type ConditionVerdict } from "./conditions";
 import { evaluateAggregation, type AggregationVerdict } from "./aggregation";
 import { matchLicensedTopic, boundaryNoteText } from "./boundary";
+import { answerQuality, qualityNote } from "./quality";
 import { detectDraftIntent, prepareDraft } from "./drafts";
 import { detectApiCallIntent, prepareApiCall } from "./apicalls";
 import { memoryNote } from "./memories";
 import { entitlementScope, resolveRequestScope, requestSalt, standardKeysFrom } from "./requestScope";
-import { rawSessionToken } from "./session";
+import { rawSessionToken, type SessionClaims } from "./session";
 import { cacheKeyMaterial, corpusGen, exactCacheKey, freshRequested, semanticCacheKey } from "./answercache";
 import type { Env } from "./env";
 export type { Env };
@@ -286,7 +287,23 @@ async function handleAsk(
   // account's standing, never on the query alone.
   const apiCallIntent = !draftAct && P().publisher.features?.api_call_drafts ? detectApiCallIntent(q.query, declaredCtx) : null;
 
-  const member = tier === "member" ? await sessionFrom(req, env as any) : null;
+  const session = tier === "member" ? await sessionFrom(req, env as any) : null;
+  // The Ommisa tier: no service session but a device-grant CLI's opaque
+  // bearer → the OP's introspection answer admits a member-READ
+  // credential (livedata.ts). No sessionRaw behind it, so the draft and
+  // live-data lanes keep their honest "unsigned" refusals.
+  const opMember = !session && tier === "member" ? await opTokenMember(env, opCfg(env), req) : null;
+  const member: SessionClaims | null = session
+    ?? (opMember
+      ? {
+          sub: opMember.sub,
+          roles: [],
+          iat: Math.floor(Date.now() / 1000),
+          exp: Math.floor(Date.now() / 1000) + 3600,
+          via: "op-token",
+          scope: opMember.scope,
+        }
+      : null);
   // resolved before the quota check: the effort choice prices the ask
   const effort = requestEffort(env, member, (body as any)?.effort);
 
@@ -1129,7 +1146,8 @@ async function handleAsk(
           // the reading arrives first: the interpretation that steered
           // retrieval, before a single token of the answer
           send({ type: "read", read: readAs() });
-          send({ type: "citations", citations: cites, context_applied: ctxApplied, ...(liveRecords ? { records: liveRecords } : {}), quota, });
+          const sourceQuality = answerQuality(cites.map((c: any) => c.quality));
+          send({ type: "citations", citations: cites, context_applied: ctxApplied, ...(sourceQuality ? { source_quality: sourceQuality, quality_note: qualityNote(sourceQuality) } : {}), ...(liveRecords ? { records: liveRecords } : {}), quota, });
           let full = "";
           try {
             for await (const tok of sseTokens(stream)) {
@@ -1323,7 +1341,8 @@ async function handleAsk(
   // figure completion (#172) — see ./completion for the rationale
   completionBlocks.push(...(await completeFigures(env.DB, answer, [...c2ns.blocks, ...completionBlocks], used)));
 
-  const out = { answer, citations: finalCites, model: MODELS.member, query_hash: queryHash, follow_ups: understanding?.follow_ups ?? [], blocks: [...c2ns.blocks, ...(verdictBlock ? [verdictBlock] : []), ...(conditionBlock ? [conditionBlock] : []), ...(aggregationBlock ? [aggregationBlock] : []), ...completionBlocks], context_applied: ctxApplied, ...(liveRecords ? { records: liveRecords } : {}) };
+  const jsonQuality = answerQuality(finalCites.map((c: any) => c.quality));
+  const out = { answer, citations: finalCites, ...(jsonQuality ? { source_quality: jsonQuality, quality_note: qualityNote(jsonQuality) } : {}), model: MODELS.member, query_hash: queryHash, follow_ups: understanding?.follow_ups ?? [], blocks: [...c2ns.blocks, ...(verdictBlock ? [verdictBlock] : []), ...(conditionBlock ? [conditionBlock] : []), ...(aggregationBlock ? [aggregationBlock] : []), ...completionBlocks], context_applied: ctxApplied, ...(liveRecords ? { records: liveRecords } : {}) };
   const cacheable = !contextual && !declaredCtx && !answer.includes(refusalAnswer()) && finalAnchors.violations.length === 0;
   if (cacheable) {
     const warmVec = (await warmEmbed) ?? null;

package/workers/worker_public/src/env.ts

@@ -33,6 +33,11 @@ export interface Env {
   OIDC_CLIENT_ID?: string;
   OIDC_CLIENT_SECRET?: string;
   OIDC_REDIRECT_URI?: string;
+  /** TODO.ai-platform/14 — the Ommisa tier: the OP device-grant client
+   *  ids (comma/space separated) whose opaque access tokens this
+   *  deployment admits as member-read credentials via introspection.
+   *  Empty/absent = the tier is off. */
+  OIDC_DEVICE_CLIENT_IDS?: string;
   SESSION_SECRET?: string;
   /** TODO.ai-platform/03 — the "my account" live-data delegation: the
    *  platform instance's API base + its client id at the OP (the

package/workers/worker_public/src/index.ts

@@ -3,6 +3,7 @@ export { setProfile } from "./profile.ts";
 import { retrieve } from "./pipeline";
 import type { Hit } from "./pipeline";
 import { handleCallback, handleLogin, handleLogout, handleMe, sessionFrom } from "./auth";
+import { opCfg, opMemberCanWrite, opTokenMember } from "./livedata";
 import { handleAppendMessage, handleConversations } from "./conversations";
 import { handleMemories } from "./memories";
 import { handleProjects, handleProjectFiles } from "./projects";
@@ -60,34 +61,63 @@ async function serveIndexPage(c: RouteContext): Promise<Response> {
   return err(404, "not_found", "Page not found");
 }
 
-async function memoriesRoute(c: RouteContext): Promise<Response> {
+/** The member identity behind one member-data request: the service
+ *  session first; else the Ommisa tier's introspected device-grant
+ *  bearer (READ by default — mutations also need `opMemberCanWrite`).
+ *  The CLI's memories/conversations/projects ride this. */
+const MUTATING_METHODS = new Set(["POST", "PUT", "PATCH", "DELETE"]);
+async function opIdentity(c: RouteContext, signIn: string): Promise<{ sub: string; write: boolean } | Response> {
   const session = await sessionFrom(c.req, c.env as any);
-  if (!session) return withCors(err(401, "unauthorized", "Sign in to use memory files"), corsHeaders(c.req));
-  return withCors(await handleMemories(c.env, session.sub, c.req, { method: c.req.method, id: c.params.id }), corsHeaders(c.req));
+  if (session) return { sub: session.sub, write: true };
+  const member = await opTokenMember(c.env, opCfg(c.env), c.req);
+  if (!member) return err(401, "unauthorized", signIn);
+  return { sub: member.sub, write: opMemberCanWrite(member) };
+}
+function opWriteRefused(c: RouteContext, who: { write: boolean } | Response): Response | null {
+  if (!(who instanceof Response) && MUTATING_METHODS.has(c.req.method) && !who.write) {
+    return err(403, "forbidden", "This sign-in grants read only — request a write scope at login.");
+  }
+  return null;
+}
+
+async function memoriesRoute(c: RouteContext): Promise<Response> {
+  const who = await opIdentity(c, "Sign in to use memory files");
+  if (who instanceof Response) return withCors(who, corsHeaders(c.req));
+  const refused = opWriteRefused(c, who);
+  if (refused) return withCors(refused, corsHeaders(c.req));
+  return withCors(await handleMemories(c.env, who.sub, c.req, { method: c.req.method, id: c.params.id }), corsHeaders(c.req));
 }
 
 async function projectsRoute(c: RouteContext): Promise<Response> {
-  const session = await sessionFrom(c.req, c.env as any);
-  if (!session) return withCors(err(401, "unauthorized", "Sign in to use projects"), corsHeaders(c.req));
-  return withCors(await handleProjects(c.env, session.sub, c.req, { method: c.req.method, id: c.params.id }), corsHeaders(c.req));
+  const who = await opIdentity(c, "Sign in to use projects");
+  if (who instanceof Response) return withCors(who, corsHeaders(c.req));
+  const refused = opWriteRefused(c, who);
+  if (refused) return withCors(refused, corsHeaders(c.req));
+  return withCors(await handleProjects(c.env, who.sub, c.req, { method: c.req.method, id: c.params.id }), corsHeaders(c.req));
 }
 
 async function projectFilesRoute(c: RouteContext): Promise<Response> {
-  const session = await sessionFrom(c.req, c.env as any);
-  if (!session) return withCors(err(401, "unauthorized", "Sign in to use projects"), corsHeaders(c.req));
-  return withCors(await handleProjectFiles(c.env, session.sub, c.req, { method: c.req.method, id: c.params.id }), corsHeaders(c.req));
+  const who = await opIdentity(c, "Sign in to use projects");
+  if (who instanceof Response) return withCors(who, corsHeaders(c.req));
+  const refused = opWriteRefused(c, who);
+  if (refused) return withCors(refused, corsHeaders(c.req));
+  return withCors(await handleProjectFiles(c.env, who.sub, c.req, { method: c.req.method, id: c.params.id }), corsHeaders(c.req));
 }
 
 async function conversationsRoute(c: RouteContext): Promise<Response> {
-  const session = await sessionFrom(c.req, c.env as any);
-  if (!session) return withCors(err(401, "unauthorized", "Sign in to sync your conversations across devices"), corsHeaders(c.req));
-  return withCors(await handleConversations(c.env, session.sub, c.req, { method: c.req.method, id: c.params.id }), corsHeaders(c.req));
+  const who = await opIdentity(c, "Sign in to sync your conversations across devices");
+  if (who instanceof Response) return withCors(who, corsHeaders(c.req));
+  const refused = opWriteRefused(c, who);
+  if (refused) return withCors(refused, corsHeaders(c.req));
+  return withCors(await handleConversations(c.env, who.sub, c.req, { method: c.req.method, id: c.params.id }), corsHeaders(c.req));
 }
 
 async function appendMessageRoute(c: RouteContext): Promise<Response> {
-  const session = await sessionFrom(c.req, c.env as any);
-  if (!session) return withCors(err(401, "unauthorized", "Sign in to sync your conversations across devices"), corsHeaders(c.req));
-  return withCors(await handleAppendMessage(c.env, session.sub, c.req, c.params.id!), corsHeaders(c.req));
+  const who = await opIdentity(c, "Sign in to sync your conversations across devices");
+  if (who instanceof Response) return withCors(who, corsHeaders(c.req));
+  const refused = opWriteRefused(c, who);
+  if (refused) return withCors(refused, corsHeaders(c.req));
+  return withCors(await handleAppendMessage(c.env, who.sub, c.req, c.params.id!), corsHeaders(c.req));
 }
 
 async function shareRoute(c: RouteContext): Promise<Response> {
@@ -128,7 +158,10 @@ async function tierFor(c: RouteContext): Promise<{ tier: "anon" | "key" | "membe
   // No SESSION_SECRET precondition: the delegated bearer (the platform
   // bubble's OP-minted JWT, delegated.ts) admits the member lane on its
   // own — sessionFrom returns null honestly when neither lane applies.
+  // The Ommisa tier rides the same admission: a device-grant CLI's
+  // opaque bearer, introspected at the OP (livedata.ts).
   if (!isApi && (await sessionFrom(c.req, c.env as any))) tier = "member";
+  else if (!isApi && (await opTokenMember(c.env, opCfg(c.env), c.req))) tier = "member";
   return { tier, key };
 }
 

package/workers/worker_public/src/livedata.ts

@@ -390,3 +390,97 @@ export async function resolveLiveAccount(
   if (!read.ok) return { status: "unavailable", reason: read.reason };
   return { status: "ok", records: read.records, stores: read.stores, readAt: read.readAt };
 }
+
+// ── the Ommisa tier (RFC 7662 introspection) ─────────────────────────
+// The CLI signs in through the OP's device grant (RFC 8628) and holds an
+// OPAQUE access token. This deployment never saw that grant — it learns
+// the token the only honest way: it asks the OP (introspection, as an
+// active registered client), then admits the caller as a member-READ
+// credential. Writes, drafts and the live-data exchange stay session
+// acts (the CLI has no service session to exchange — rawSessionToken is
+// null, so those lanes already refuse honestly).
+
+/** The device-grant clients this deployment admits. Empty = the tier is
+ *  off (a Bearer token that is not a service session stays anonymous). */
+export function deviceClientIds(env: any): string[] {
+  return String(env.OIDC_DEVICE_CLIENT_IDS ?? "")
+    .split(/[\s,]+/)
+    .filter(Boolean);
+}
+
+/** The introspection call's OP coordinates, read once per call site. */
+export function opCfg(env: any): { issuer: string; clientId: string } {
+  return { issuer: String(env.OIDC_ISSUER ?? "").trim().replace(/\/+$/, ""), clientId: String(env.OIDC_CLIENT_ID ?? "") };
+}
+
+export interface OpMember {
+  sub: string;
+  scope: string;
+  via: "op-token";
+}
+
+/** Mutations through the device-grant bearer (memories, conversations,
+ *  projects — the member's OWN data) need the token's scope to state a
+ *  write. The grammar is the OP's PAT vocabulary (`<service>:write`);
+ *  a read-only approval stays read-only here, and service sessions
+ *  (the browser) are always full-strength. */
+export function opMemberCanWrite(member: { via?: string; scope?: string } | null): boolean {
+  if (!member) return false;
+  if (member.via !== "op-token") return true;
+  return /\bwrite\b/.test(member.scope ?? "");
+}
+
+/** The introspection answer → the member credential, judged against the
+ *  deployment's allowlist. Inactive, foreign-client or subject-less
+ *  answers all resolve to null — never to a widened guess. */
+export function opMemberFromIntrospection(answer: any, ids: string[]): OpMember | null {
+  if (!answer?.active) return null;
+  const clientId = String(answer.client_id ?? "");
+  if (!ids.includes(clientId)) return null;
+  const sub = String(answer.sub ?? "");
+  if (!sub) return null;
+  return { sub, scope: String(answer.scope ?? ""), via: "op-token" };
+}
+
+/** The Bearer read + introspection, KV-cached 45s keyed by the token's
+ *  hash (an ask burst costs one introspection; a deactivation lands
+ *  within a minute). The cached object is the OP's RAW answer — the
+ *  allowlist re-judges on every read, so a config change takes effect
+ *  inside the cache window too. JWTs (3 dot-segments) are NOT opaque:
+ *  they belong to the delegated lane and never reach the OP here. */
+export async function opTokenMember(
+  env: any,
+  cfg: { issuer: string; clientId: string },
+  req: Request,
+): Promise<OpMember | null> {
+  const m = /^Bearer\s+(.+)$/i.exec((req.headers.get("Authorization") ?? "").trim());
+  const token = m?.[1]?.trim();
+  if (!token || token.split(".").length === 3) return null;
+  const ids = deviceClientIds(env);
+  if (!ids.length || !cfg.issuer || !cfg.clientId) return null;
+  const key = `opint:${await sha256Hex(token)}`;
+  let answer: any = null;
+  try {
+    answer = await env.CACHE.get(key, "json");
+  } catch {
+    /* a KV hiccup costs one extra introspection */
+  }
+  if (answer === undefined || answer === null) {
+    try {
+      const res = await fetch(`${cfg.issuer}/op/introspect`, {
+        method: "POST",
+        headers: { "content-type": "application/x-www-form-urlencoded" },
+        body: new URLSearchParams({ token, client_id: cfg.clientId }),
+      });
+      answer = res.ok ? await res.json() : { active: false };
+    } catch {
+      return null;
+    }
+    try {
+      await env.CACHE.put(key, JSON.stringify(answer ?? { active: false }), { expirationTtl: 45 });
+    } catch {
+      /* cacheless = introspect per ask */
+    }
+  }
+  return opMemberFromIntrospection(answer, ids);
+}

package/workers/worker_public/src/modelplane.ts

@@ -287,6 +287,7 @@ export function modelCitation(node: BoundModelNode) {
     clause_title: `${node.kind.replace(/_/g, " ")} — ${node.name} (${node.node_id})`,
     status: "in-force",
     corpus: "smart-model",
+    quality: "verified",
     url: undefined,
     snippet: `${node.node_id}${node.clause ? ` · ${node.clause.urn}` : ""}${node.content?.statement ? ` — ${clip(node.content.statement, 240)}` : ""}`,
     score: 1,

package/workers/worker_public/src/pipeline.ts

@@ -33,6 +33,7 @@ export function fill(template: string, vars: Record<string, string>): string {
   return template.replace(/\{\{(\w+)\}\}/g, (_m, k: string) => (k in vars ? vars[k] : ""));
 }
 import { QueryFilters, toVectorizeFilter, standardKeyAllowed } from "./selfquery";
+import { hitQuality } from "./quality";
 import { lexicalPrefilter } from "./lexical";
 import { positionOrder } from "./structural";
 import { STAGES, runStages } from "./stages";
@@ -404,6 +405,7 @@ export function citations(hits: Hit[]) {
       status: h.metadata.status ?? "unknown",
       superseded_by: h.metadata.superseded_by || undefined,
       corpus: h.metadata.corpus || P().publisher.id,
+      quality: hitQuality(h.metadata),
       url: publicationUrl(h.metadata),
       snippet: h.text.slice(0, 400),
       score: h.rerank_score ?? h.score,

package/workers/worker_public/src/quality.ts

@@ -0,0 +1,48 @@
+// The answer-quality ladder (TODO.rag/13): every citation states what
+// kind of text grounds it, so the answer states how far to trust it.
+// Three rungs, derived from provenance the chunk wire already carries —
+// no new ingest state:
+//
+//   verified — the model plane: the chunk rides a primmel data model
+//     (model_node/model_version), the Recommendation's semantics are
+//     machine-checkable and the golden set measures them (R 60 is the
+//     gauge). The answer can be WRONG, but it is wrong against a
+//     contract we can see.
+//   curated  — the edited corpus: Metanorma-authored documents
+//     (mn-samples-oiml and the editors' own), clause-boundary chunks,
+//     enrichment applied.
+//   ocr      — the experimental OCR corpus: the broad coverage lane,
+//     text recovered from scans; quote anchors may wobble, tables can
+//     be mangled. Useful, and marked as experimental on purpose.
+//
+// The answer's tier is the WORST rung its citations stand on: one OCR
+// citation makes the whole answer experimental, because the reader
+// cannot tell which sentence leaned on which chunk.
+
+import type { ChunkMeta } from "../../shared/chunk.ts";
+
+export type SourceQuality = "verified" | "curated" | "ocr";
+
+const ORDER: Record<SourceQuality, number> = { verified: 0, curated: 1, ocr: 2 };
+
+export function hitQuality(m: ChunkMeta): SourceQuality {
+  if (m.model_node || m.model_version || m.producer === "primmel") return "verified";
+  if (m.tier === "curated") return "curated";
+  return "ocr";
+}
+
+export function answerQuality(qualities: (SourceQuality | undefined)[]): SourceQuality | null {
+  let worst: SourceQuality | null = null;
+  for (const q of qualities) {
+    if (!q) continue;
+    if (!worst || ORDER[q] > ORDER[worst]) worst = q;
+  }
+  return worst;
+}
+
+/** The one-line posture the interface renders under the answer. */
+export function qualityNote(q: SourceQuality): string {
+  if (q === "verified") return "Grounded in verified sources: this publication's requirements ride a machine-checkable data model.";
+  if (q === "curated") return "Grounded in the edited corpus: Metanorma-authored documents, chunked at clause boundaries.";
+  return "Partly grounded in experimental OCR text: verify quotations and table values against the official publication.";
+}