@konneal/engine 0.2.47 → 0.2.49

package/dist/worker_public/src/index.js

@@ -1,17 +1,19 @@
 import {
   handleSearch
-} from "../../chunk-AKAFLMIB.js";
+} from "../../chunk-DMIOBGQU.js";
 import {
   bindModelNode,
   checkQuoteAnchors,
   handleAsk,
   handleMemories,
   modelGroundingBlock,
+  scoreFaithfulness,
   scoreJudge,
   standardForDocNumber
-} from "../../chunk-SE67PTJ6.js";
+} from "../../chunk-4KA34NMU.js";
 import {
   buildMessages,
+  cfBlobs,
   citations,
   editionNote,
   embed,
@@ -35,7 +37,7 @@ import {
   sessionFrom,
   telemetry,
   understandQuery
-} from "../../chunk-N2UOENDY.js";
+} from "../../chunk-VVLNUHW2.js";
 import {
   authenticate,
   corsHeaders,
@@ -44,14 +46,14 @@ import {
   readJson,
   validateQuery,
   withCors
-} from "../../chunk-R2V3X6SQ.js";
+} from "../../chunk-JWTIPQ4L.js";
 import {
   canonicalRefusal
 } from "../../chunk-A3QHHUN5.js";
 import {
   entitlementScope,
   standardKeysFrom
-} from "../../chunk-4GJGBGJK.js";
+} from "../../chunk-O6VZIDPW.js";
 import {
   LIMITS,
   MODELS,
@@ -62,7 +64,7 @@ import {
   roleModel,
   sha256Hex,
   today
-} from "../../chunk-V46XM2GU.js";
+} from "../../chunk-Z24IAKB6.js";
 import {
   P,
   setProfile
@@ -332,118 +334,6 @@ async function handleGetShared(env, slug) {
   });
 }
 
-// workers/worker_public/prompts/faithfulness.md
-var faithfulness_default = `You are a factuality judge. Given an answer and the retrieved passages it was based on, identify any claims in the answer that are NOT directly supported by the passages. Reply with ONLY a JSON object: {"score": 0.0-1.0, "ungrounded_claims": ["claim text", ...]} \u2014 score is the fraction of claims that ARE grounded in the passages; if every claim is supported, score is 1.0 and ungrounded_claims is [].
-
-Passages prefixed [M] are this service's own machine-computed model data (typed blocks the answer was given) \u2014 a claim restating [M] content is grounded.
-`;
-
-// workers/worker_public/src/verdict-parse.ts
-function coerceVerdict(obj) {
-  if (obj === null || typeof obj !== "object" || Array.isArray(obj)) return null;
-  const raw = obj.score;
-  const score = typeof raw === "number" ? raw : typeof raw === "string" && raw.trim() !== "" ? Number(raw) : NaN;
-  if (!Number.isFinite(score)) return null;
-  const claims = obj.ungrounded_claims;
-  return {
-    score: Math.max(0, Math.min(1, score)),
-    ungrounded_claims: Array.isArray(claims) ? claims.map(String).slice(0, 5) : []
-  };
-}
-function parseVerdict(text) {
-  const stripped = text.replace(/```[a-zA-Z]*\n?/g, "").replace(/```/g, "").trim();
-  try {
-    const whole = coerceVerdict(JSON.parse(stripped));
-    if (whole) return whole;
-  } catch {
-  }
-  let verdict = null;
-  let depth = 0;
-  let start = -1;
-  let inString = false;
-  let escaped = false;
-  for (let i = 0; i < stripped.length; i++) {
-    const ch = stripped[i];
-    if (escaped) {
-      escaped = false;
-      continue;
-    }
-    if (inString && ch === "\\") {
-      escaped = true;
-      continue;
-    }
-    if (ch === '"') {
-      inString = !inString;
-      continue;
-    }
-    if (inString) continue;
-    if (ch === "{") {
-      if (depth === 0) start = i;
-      depth++;
-    } else if (ch === "}" && depth > 0) {
-      depth--;
-      if (depth === 0 && start >= 0) {
-        try {
-          const v = coerceVerdict(JSON.parse(stripped.slice(start, i + 1)));
-          if (v) verdict = v;
-        } catch {
-        }
-      }
-    }
-  }
-  return verdict;
-}
-
-// workers/worker_public/src/faithfulness-context.ts
-function buildJudgeContext(passages, machine = []) {
-  const context = passages.slice(0, 8).map((p, i) => {
-    const text = typeof p === "string" ? p : p.text;
-    const limit = typeof p !== "string" && p.table ? 2400 : 1400;
-    return `[${i + 1}] ${text.replace(/\s+/g, " ").slice(0, limit)}`;
-  }).join("\n");
-  const machineContext = machine.length ? "\n" + machine.slice(0, 6).map((m) => `[M] ${m.replace(/\s+/g, " ").slice(0, 400)}`).join("\n") : "";
-  return context + machineContext;
-}
-
-// workers/worker_public/src/faithfulness.ts
-async function scoreFaithfulness(ai, model, answer, passages, machine = []) {
-  if (!answer || !passages.length) return null;
-  const context = buildJudgeContext(passages, machine);
-  const t0 = Date.now();
-  const timeout = new Promise((r) => setTimeout(() => {
-    console.log(`faithfulness: timeout (${Date.now() - t0}ms)`);
-    r(null);
-  }, 24e4));
-  const call = (async () => {
-    const res = await ai.run(model, {
-      messages: [
-        {
-          role: "system",
-          content: faithfulness_default.trimEnd()
-        },
-        { role: "user", content: `Answer:
-${answer.slice(0, 2e3)}
-
-Passages:
-${context}${machine.length ? buildJudgeContext([], machine) : ""}` }
-      ],
-      max_tokens: 6144,
-      reasoning_effort: "low",
-      // DeepSeek-V4 card: temp 1.0 / top_p 1.0
-      temperature: 1,
-      top_p: 1
-    });
-    const text = typeof res?.response === "string" ? res.response : res?.choices?.[0]?.message?.content;
-    const verdict = parseVerdict(text ?? "");
-    if (!verdict) {
-      console.log(`faithfulness: no parse (${Date.now() - t0}ms, text ${(text ?? "").length} chars) raw=${JSON.stringify((text ?? "").replace(/\s+/g, " ").slice(0, 500))}`);
-      return null;
-    }
-    return verdict;
-  })();
-  return await Promise.race([call, timeout]);
-}
-
 // workers/worker_public/prompts/enrichment.md
 var enrichment_default = "You write a retrieval context for a passage from {{CORPUS_KIND}}. The context is prepended to the passage before embedding so a semantic search can locate the passage even when the query uses different vocabulary than the passage itself.\n\nWrite ONE concise sentence (at most 40 words) that situates the passage: name the publication by its exact {{PUBLISHER_NAME}} identifier (including part or annex when applicable) and what the passage covers \u2014 paraphrasing the topic in words DIFFERENT from the passage's own. Do not copy the passage verbatim, do not add facts that are not derivable from the passage or its header, do not answer or explain the content. Reply with the context sentence only \u2014 no quotes, no preamble.\n";
 
@@ -936,6 +826,64 @@ ${recent.map((h, n) => `[${n + 1}] ${h.metadata.docidentifier ?? ""} \xA7${h.met
   return out;
 }
 
+// workers/worker_public/src/attachments.ts
+var MAX_BYTES = 4e6;
+var ALLOWED = {
+  "image/png": "png",
+  "image/jpeg": "jpg",
+  "image/webp": "webp",
+  "image/gif": "gif"
+};
+function sniffImage(head, totalBytes) {
+  if (totalBytes > MAX_BYTES || totalBytes < 12) return null;
+  if (head[0] === 137 && head[1] === 80 && head[2] === 78 && head[3] === 71) return "image/png";
+  if (head[0] === 255 && head[1] === 216) return "image/jpeg";
+  if (head.length >= 12 && head[8] === 87 && head[9] === 69 && head[10] === 66 && head[11] === 80) return "image/webp";
+  if (head[0] === 71 && head[1] === 73 && head[2] === 70) return "image/gif";
+  return null;
+}
+function parseDataUrl(dataUrl) {
+  const m = /^data:(image\/[a-z+]+);base64,([\s\S]+)$/.exec(dataUrl);
+  if (!m) return null;
+  const raw = atob(m[2]);
+  const bytes = new Uint8Array(raw.length);
+  for (let i = 0; i < raw.length; i++) bytes[i] = raw.charCodeAt(i);
+  const mime = ALLOWED[m[1]] ? m[1] : sniffImage(bytes.subarray(0, 12), bytes.length);
+  if (!mime || bytes.length > MAX_BYTES) return null;
+  return { mime, bytes };
+}
+async function uploadAttachment(deps, sub, dataUrl) {
+  const parsed = parseDataUrl(dataUrl);
+  if (!parsed) {
+    return new Response(JSON.stringify({ error: { code: "invalid_input", message: "A PNG, JPEG, WebP or GIF image of at most 4 MB is required" } }), { status: 400, headers: { "content-type": "application/json" } });
+  }
+  const id = crypto.randomUUID();
+  const key = `att/${sub}/${id}`;
+  await deps.blobs.put(key, parsed.bytes.buffer, parsed.mime);
+  await deps.store.prepare("INSERT INTO attachments (id, sub, mime, bytes, r2_key) VALUES (?1,?2,?3,?4,?5)").bind(id, sub, parsed.mime, parsed.bytes.length, key).run();
+  return { id };
+}
+async function ownedAttachment(deps, sub, id) {
+  const row = await deps.store.prepare("SELECT id, sub, mime, bytes, created_at FROM attachments WHERE id = ?1 AND sub = ?2").bind(id, sub).first();
+  return row ?? null;
+}
+async function readAttachment(deps, sub, id) {
+  const row = await ownedAttachment(deps, sub, id);
+  if (!row) return null;
+  const obj = await deps.blobs.get(`att/${row.sub}/${row.id}`);
+  if (!obj) return null;
+  return new Response(obj.body, {
+    headers: { "content-type": obj.contentType ?? row.mime, "cache-control": "private, max-age=86400" }
+  });
+}
+async function deleteAttachment(deps, sub, id) {
+  const row = await ownedAttachment(deps, sub, id);
+  if (!row) return false;
+  await deps.blobs.delete(`att/${sub}/${id}`);
+  await deps.store.prepare("DELETE FROM attachments WHERE id = ?1 AND sub = ?2").bind(id, sub).run();
+  return true;
+}
+
 // workers/worker_public/src/mcp-proto.ts
 var PROTOCOL_VERSION = "2025-06-18";
 var TOOLS = [
@@ -999,7 +947,7 @@ async function handleMcp(env, ctx, req, tier, key) {
       // stream:false forces the JSON lane (anon defaults to SSE)
       body: JSON.stringify({ ...args, stream: false })
     });
-    const res = name === "ask" ? await (await import("../../ask-6QPD3QA5.js")).handleAsk(env, ctx, inner, tier, key) : await (await import("../../search-QZDQVB57.js")).handleSearch(env, ctx, inner, tier, key);
+    const res = name === "ask" ? await (await import("../../ask-OH5KPHZA.js")).handleAsk(env, ctx, inner, tier, key) : await (await import("../../search-KNB2S2PS.js")).handleSearch(env, ctx, inner, tier, key);
     return res.json().catch(() => ({ error: { message: "tool transport failed", status: res.status } }));
   });
   if (out.ok && "accepted" in out) return new Response(null, { status: 202 });
@@ -1149,6 +1097,26 @@ var OPENAPI_SURFACE = [
     "pattern": "/api/shared/:slug",
     "operationId": "getShared"
   },
+  {
+    "method": "POST",
+    "pattern": "/api/attachments",
+    "operationId": "uploadAttachment"
+  },
+  {
+    "method": "GET",
+    "pattern": "/api/attachments",
+    "operationId": "listAttachments"
+  },
+  {
+    "method": "GET",
+    "pattern": "/api/attachments/:id",
+    "operationId": "getAttachment"
+  },
+  {
+    "method": "DELETE",
+    "pattern": "/api/attachments/:id",
+    "operationId": "deleteAttachment"
+  },
   {
     "method": "GET",
     "pattern": "/api/memories",
@@ -1325,6 +1293,36 @@ function opWriteRefused(c, who) {
   }
   return null;
 }
+async function attachmentsUploadRoute(c) {
+  const session = await sessionFrom(c.req, c.env);
+  if (!session) return withCors(err(401, "unauthorized", "Sign in to store attachments"), corsHeaders(c.req));
+  const deps = { blobs: cfBlobs(c.env.CHAT_UPLOADS), store: c.env.DB };
+  const body = await readJson(c.req);
+  const out = await uploadAttachment(deps, session.sub, String(body?.data_url ?? ""));
+  if (out instanceof Response) return withCors(out, corsHeaders(c.req));
+  return withCors(json({ id: out.id }, 201), corsHeaders(c.req));
+}
+async function attachmentsListRoute(c) {
+  const session = await sessionFrom(c.req, c.env);
+  if (!session) return withCors(err(401, "unauthorized", "Sign in to list attachments"), corsHeaders(c.req));
+  const rows = await c.env.DB.prepare("SELECT id, mime, bytes, created_at FROM attachments WHERE sub = ?1 ORDER BY created_at DESC LIMIT 200").bind(session.sub).all();
+  return withCors(json({ attachments: rows.results ?? [] }), corsHeaders(c.req));
+}
+async function attachmentsGetRoute(c) {
+  const session = await sessionFrom(c.req, c.env);
+  if (!session) return err(404, "not_found", "No such attachment");
+  const deps = { blobs: cfBlobs(c.env.CHAT_UPLOADS), store: c.env.DB };
+  const out = await readAttachment(deps, session.sub, c.params.id);
+  return out ?? err(404, "not_found", "No such attachment");
+}
+async function attachmentsDeleteRoute(c) {
+  const session = await sessionFrom(c.req, c.env);
+  if (!session) return withCors(err(401, "unauthorized", "Sign in to manage attachments"), corsHeaders(c.req));
+  const deps = { blobs: cfBlobs(c.env.CHAT_UPLOADS), store: c.env.DB };
+  const gone = await deleteAttachment(deps, session.sub, c.params.id);
+  if (!gone) return withCors(err(404, "not_found", "No such attachment"), corsHeaders(c.req));
+  return withCors(json({ ok: true }), corsHeaders(c.req));
+}
 async function memoriesRoute(c) {
   const who = await opIdentity(c, "Sign in to use memory files");
   if (who instanceof Response) return withCors(who, corsHeaders(c.req));
@@ -1742,6 +1740,10 @@ var OPENAPI_HANDLERS = {
   appendMessage: appendMessageRoute,
   shareConversation: shareRoute,
   getShared: getSharedRoute,
+  uploadAttachment: attachmentsUploadRoute,
+  listAttachments: attachmentsListRoute,
+  getAttachment: attachmentsGetRoute,
+  deleteAttachment: attachmentsDeleteRoute,
   listMemories: memoriesRoute,
   createMemory: memoriesRoute,
   deleteMemory: memoriesRoute,

package/dist/worker_public/src/requestScope.js

@@ -4,8 +4,8 @@ import {
   requestSalt,
   resolveRequestScope,
   standardKeysFrom
-} from "../../chunk-4GJGBGJK.js";
-import "../../chunk-V46XM2GU.js";
+} from "../../chunk-O6VZIDPW.js";
+import "../../chunk-Z24IAKB6.js";
 import "../../chunk-3FYJM7LH.js";
 export {
   entitlementScope,

package/package.json

@@ -27,7 +27,7 @@
     "playwright": "^1.62.1",
     "yaml": "^2.9.1"
   },
-  "version": "0.2.47",
+  "version": "0.2.49",
   "description": "The Konneal engine: the publisher-agnostic build pipeline and API plane for standards intelligence (retrieval, answer contract, verdicts, evaluation).",
   "license": "BSD-3-Clause",
   "type": "module",

package/workers/worker_public/migrations/0017_attachments.sql

@@ -0,0 +1,12 @@
+-- conversation attachments (TODO.new-era/8 Tier 1): a member's uploaded
+-- images persist until they delete them; the R2 object key embeds the
+-- owner's subject so the storage partition is the isolation
+CREATE TABLE IF NOT EXISTS attachments (
+    id TEXT PRIMARY KEY,
+    sub TEXT NOT NULL,
+    mime TEXT NOT NULL,
+    bytes INTEGER NOT NULL,
+    r2_key TEXT NOT NULL,
+    created_at TEXT NOT NULL DEFAULT (datetime('now'))
+);
+CREATE INDEX IF NOT EXISTS idx_attachments_sub ON attachments (sub);

package/workers/worker_public/openapi.yaml

@@ -545,6 +545,75 @@ paths:
       responses:
         '200':
           description: The shared conversation, without member identity.
+  /api/attachments:
+    post:
+      tags: [Attachments]
+      summary: Upload an image attachment
+      description: >-
+        Stores a member-uploaded image (PNG, JPEG, WebP or GIF, at most
+        4 MB) and returns its identifier. The attachment persists until
+        the member deletes it. The content is verified from its bytes,
+        never from a declared type. The body carries the image as a data
+        URL — the same shape the composer produces.
+      operationId: uploadAttachment
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              type: object
+              required: [data_url]
+              properties:
+                data_url:
+                  type: string
+                  description: The image as a data URL.
+      responses:
+        '201':
+          description: The attachment's identifier.
+        '400':
+          description: The content is not an allowed image, or exceeds the size cap.
+    get:
+      tags: [Attachments]
+      summary: List the member's attachments
+      operationId: listAttachments
+      responses:
+        '200':
+          description: The attachment identifiers, newest first.
+  /api/attachments/{id}:
+    get:
+      tags: [Attachments]
+      summary: Read one attachment's image
+      description: >-
+        Streams the stored image. The response is 404 for a foreign
+        identifier — ownership is checked on every fetch, and a file
+        belonging to another account is indistinguishable from a missing
+        one.
+      operationId: getAttachment
+      parameters:
+        - name: id
+          in: path
+          required: true
+          schema: { type: string }
+      responses:
+        '200':
+          description: The image bytes.
+        '404':
+          description: No such attachment owned by the caller.
+    delete:
+      tags: [Attachments]
+      summary: Delete an attachment
+      description: Removes the stored object and its record. Stored until deleted — and this deletes it.
+      operationId: deleteAttachment
+      parameters:
+        - name: id
+          in: path
+          required: true
+          schema: { type: string }
+      responses:
+        '200':
+          description: Deleted.
+        '404':
+          description: No such attachment owned by the caller.
   /api/memories:
     get:
       tags: [Memory]

package/workers/worker_public/schema.sql

@@ -248,3 +248,13 @@ CREATE TABLE IF NOT EXISTS model_plane_meta (
   node_count  INTEGER NOT NULL,
   indexed_at  TEXT NOT NULL          -- when the index landed (operational truth)
 );
+
+CREATE TABLE IF NOT EXISTS attachments (
+    id TEXT PRIMARY KEY,
+    sub TEXT NOT NULL,
+    mime TEXT NOT NULL,
+    bytes INTEGER NOT NULL,
+    r2_key TEXT NOT NULL,
+    created_at TEXT NOT NULL DEFAULT (datetime('now'))
+);
+CREATE INDEX IF NOT EXISTS idx_attachments_sub ON attachments (sub);

package/workers/worker_public/src/ask.ts

@@ -3,7 +3,7 @@
 // echo — everything between "request validated" and "response written".
 // index.ts routes here; this module owns the answer contract.
 
-import { LIMITS, MODELS, num, sha256Hex, roleModel, answerEffort, requestEffort, effortBudget } from "./config";
+import { LIMITS, MODELS, THRESHOLDS, num, sha256Hex, roleModel, answerEffort, requestEffort, effortBudget } from "./config";
 import { portModelRunner } from "./env.ts";
 import { refCodec } from "./codecs";
 import { buildMessages, citations, retrieve, retrievalQuery, identityNote, splitHistory, listwiseRerank, refusalAnswer, Hit } from "./pipeline";
@@ -14,6 +14,8 @@ import { gradeRetrieval } from "./grader";
 import summarizePrompt from "../prompts/summarize.md";
 import { embed, generateOnce } from "./ai";
 import { reflect } from "./reflect";
+import { scoreFaithfulness } from "./faithfulness";
+import { entailmentVerdict } from "./entailment";
 import { checkQuoteAnchors, ANCHOR_CORRECTION_NOTE } from "./anchors";
 import { canonicalRefusal } from "./refusal";
 import { contractV2, tableRetyped } from "./refs";
@@ -1309,7 +1311,26 @@ async function handleAsk(
   completionBlocks.push(...(await completeFigures(env.DB, answer, [...c2ns.blocks, ...completionBlocks], used)));
 
   const jsonQuality = answerQuality(finalCites.map((c: any) => c.quality));
-  const out = { answer, citations: finalCites, ...(jsonQuality ? { source_quality: jsonQuality, confidence_note: qualityNote(jsonQuality), ...(jsonQuality === "ocr" ? { experimental_sources: experimentalSourceLabels(finalCites) } : {}) } : {}), model: MODELS.member, query_hash: queryHash, follow_ups: understanding?.follow_ups ?? [], blocks: [...c2ns.blocks, ...(verdictBlock ? [verdictBlock] : []), ...(conditionBlock ? [conditionBlock] : []), ...(aggregationBlock ? [aggregationBlock] : []), ...completionBlocks], context_applied: ctxApplied, ...(liveRecords ? { records: liveRecords } : {}) };
+  // the entailment gate (TODO.new-era/10): the eval battery's faithfulness
+  // scorer, promoted onto the serving path — the confidence line states a
+  // measurement (claim support in the cited passages), not only the source
+  // rung. Budgeted and fail-open: a slow or unparseable check leaves the
+  // rung note untouched; refusals and uncited answers have nothing to gate.
+  let entailment: { support: string; score: number; ungrounded?: string[] } | null = null;
+  let entailmentNote = "";
+  if (THRESHOLDS.entailmentGate && jsonQuality && used.length && !answer.includes(refusalAnswer())) {
+    const raced = await Promise.race([
+      scoreFaithfulness(env.AI, roleModel(env, "grader"), answer, (used as Hit[]).map((h: Hit) => h.text)),
+      new Promise<null>((r) => setTimeout(() => r(null), THRESHOLDS.entailmentBudgetMs)),
+    ]);
+    if (raced) {
+      const v = entailmentVerdict(raced.score, THRESHOLDS.entailmentSupportedFloor, THRESHOLDS.entailmentPartialFloor);
+      entailment = { support: v.support, score: Math.round(raced.score * 100) / 100, ...(raced.ungrounded_claims?.length ? { ungrounded: raced.ungrounded_claims.slice(0, 3) } : {}) };
+      entailmentNote = v.note;
+      if (v.support !== "supported") console.log("entailment:", v.support, raced.score, raced.ungrounded_claims?.slice(0, 2));
+    }
+  }
+  const out = { answer, citations: finalCites, ...(jsonQuality ? { source_quality: jsonQuality, confidence_note: entailmentNote || qualityNote(jsonQuality), ...(entailment ? { entailment } : {}), ...(jsonQuality === "ocr" ? { experimental_sources: experimentalSourceLabels(finalCites) } : {}) } : {}), model: MODELS.member, query_hash: queryHash, follow_ups: understanding?.follow_ups ?? [], blocks: [...c2ns.blocks, ...(verdictBlock ? [verdictBlock] : []), ...(conditionBlock ? [conditionBlock] : []), ...(aggregationBlock ? [aggregationBlock] : []), ...completionBlocks], context_applied: ctxApplied, ...(liveRecords ? { records: liveRecords } : {}) };
   const cacheable = !contextual && !declaredCtx && !answer.includes(refusalAnswer()) && finalAnchors.violations.length === 0;
   if (cacheable) {
     const ck = exactCacheKey(env.INDEX_VERSION, gen, ns, await sha256Hex(cacheKeyMaterial(q.query, q.lang, salt)));

package/workers/worker_public/src/attachments.ts

@@ -0,0 +1,102 @@
+// Conversation attachments (TODO.new-era/8, Tier 1): a member's uploaded
+// image persists until they delete it. The guarantees, in order:
+//
+//   1. NO CROSS-ACCOUNT READS — the R2 object key embeds the owner's
+//      subject (`att/{sub}/{id}`), and every route re-checks the D1
+//      row's ownership against the caller before touching storage. A
+//      logic slip cannot cross accounts, because the key-space itself
+//      is partitioned.
+//   2. Stored until deleted — by the owner, or by the cascade when
+//      their conversation is deleted. No TTL quietly eats member files.
+//   3. The content is verified, not the extension: the magic bytes
+//      decide what the file is.
+//
+// Storage rides the Blobs port and the row rides the StoreQuery port —
+// the module never names a provider binding (the ports purity lint).
+
+import type { Blobs } from "./ports/blobs.ts";
+import type { StoreQuery } from "./ports/store.ts";
+
+export interface AttachmentDeps {
+  blobs: Blobs;
+  store: StoreQuery;
+}
+
+const MAX_BYTES = 4_000_000;
+const ALLOWED: Record<string, string> = {
+  "image/png": "png",
+  "image/jpeg": "jpg",
+  "image/webp": "webp",
+  "image/gif": "gif",
+};
+
+export interface AttachmentRow {
+  id: string;
+  sub: string;
+  mime: string;
+  bytes: number;
+  created_at: string;
+}
+
+/** Sniff the image type from the magic bytes — the declared type is
+ *  never trusted. Returns null for anything that is not one of the four
+ *  allowed images or that exceeds the cap. */
+export function sniffImage(head: Uint8Array, totalBytes: number): string | null {
+  if (totalBytes > MAX_BYTES || totalBytes < 12) return null;
+  if (head[0] === 0x89 && head[1] === 0x50 && head[2] === 0x4e && head[3] === 0x47) return "image/png";
+  if (head[0] === 0xff && head[1] === 0xd8) return "image/jpeg";
+  if (head.length >= 12 && head[8] === 0x57 && head[9] === 0x45 && head[10] === 0x42 && head[11] === 0x50) return "image/webp";
+  if (head[0] === 0x47 && head[1] === 0x49 && head[2] === 0x46) return "image/gif";
+  return null;
+}
+
+/** A data URL (the composer's current shape) → { mime, bytes } or null. */
+export function parseDataUrl(dataUrl: string): { mime: string; bytes: Uint8Array } | null {
+  const m = /^data:(image\/[a-z+]+);base64,([\s\S]+)$/.exec(dataUrl);
+  if (!m) return null;
+  const raw = atob(m[2]);
+  const bytes = new Uint8Array(raw.length);
+  for (let i = 0; i < raw.length; i++) bytes[i] = raw.charCodeAt(i);
+  const mime = ALLOWED[m[1]] ? m[1] : sniffImage(bytes.subarray(0, 12), bytes.length);
+  if (!mime || bytes.length > MAX_BYTES) return null;
+  return { mime, bytes };
+}
+
+export async function uploadAttachment(deps: AttachmentDeps, sub: string, dataUrl: string): Promise<{ id: string } | Response> {
+  const parsed = parseDataUrl(dataUrl);
+  if (!parsed) {
+    return new Response(JSON.stringify({ error: { code: "invalid_input", message: "A PNG, JPEG, WebP or GIF image of at most 4 MB is required" } }), { status: 400, headers: { "content-type": "application/json" } });
+  }
+  const id = crypto.randomUUID();
+  // the key embeds the owner — the storage partition IS the isolation
+  const key = `att/${sub}/${id}`;
+  await deps.blobs.put(key, parsed.bytes.buffer as ArrayBuffer, parsed.mime);
+  await deps.store.prepare("INSERT INTO attachments (id, sub, mime, bytes, r2_key) VALUES (?1,?2,?3,?4,?5)").bind(id, sub, parsed.mime, parsed.bytes.length, key).run();
+  return { id };
+}
+
+/** The ownership check every access runs first: the row must exist and
+ *  belong to the caller. A foreign id is indistinguishable from a
+ *  missing one (404 — never a confirmation of someone else's file). */
+export async function ownedAttachment(deps: AttachmentDeps, sub: string, id: string): Promise<AttachmentRow | null> {
+  const row = await deps.store.prepare("SELECT id, sub, mime, bytes, created_at FROM attachments WHERE id = ?1 AND sub = ?2").bind(id, sub).first();
+  return (row as AttachmentRow) ?? null;
+}
+
+export async function readAttachment(deps: AttachmentDeps, sub: string, id: string): Promise<Response | null> {
+  const row = await ownedAttachment(deps, sub, id);
+  if (!row) return null;
+  const obj = await deps.blobs.get(`att/${row.sub}/${row.id}`);
+  if (!obj) return null;
+  return new Response(obj.body, {
+    headers: { "content-type": obj.contentType ?? row.mime, "cache-control": "private, max-age=86400" },
+  });
+}
+
+export async function deleteAttachment(deps: AttachmentDeps, sub: string, id: string): Promise<boolean> {
+  const row = await ownedAttachment(deps, sub, id);
+  if (!row) return false;
+  await deps.blobs.delete(`att/${sub}/${id}`);
+  await deps.store.prepare("DELETE FROM attachments WHERE id = ?1 AND sub = ?2").bind(id, sub).run();
+  return true;
+}

package/workers/worker_public/src/config.ts

@@ -56,6 +56,15 @@ export const THRESHOLDS = {
    *  pool below the primary dense lane; they must earn their window
    *  slot under the cross-encoder, not by graph membership alone. */
   graphLaneDiscount: 0.75,
+  /** The entailment gate (TODO.new-era/10): the faithfulness scorer
+   *  promoted from eval-only onto the serving path. The confidence line
+   *  then states a measurement — claim support in the cited passages —
+   *  not only the source rung. Fails open (a slow or unparseable check
+   *  leaves the source-rung note unchanged). */
+  entailmentGate: true,
+  entailmentBudgetMs: 6000,
+  entailmentSupportedFloor: 0.9,
+  entailmentPartialFloor: 0.5,
   /** Concept-graph candidate discount — same rationale as the graph
    *  lane: definitional content enters discounted. */
   conceptGraphDiscount: 0.75,

package/workers/worker_public/src/entailment.ts

@@ -0,0 +1,15 @@
+// The entailment gate's pure verdict mapper (TODO.new-era/10): what the
+// confidence line says once the claims were measured against the
+// passages they cite. Lives apart from faithfulness.ts so the unit
+// suites (plain node, no esbuild .md loader) can exercise it.
+
+export interface EntailmentVerdict {
+  support: "supported" | "partial" | "unsupported";
+  note: string;
+}
+
+export function entailmentVerdict(score: number, supportedFloor: number, partialFloor: number): EntailmentVerdict {
+  if (score >= supportedFloor) return { support: "supported", note: "" };
+  if (score >= partialFloor) return { support: "partial", note: "Partially grounded — some claims lack support in the cited passages; verify against the cited clauses." };
+  return { support: "unsupported", note: "WARNING: This answer's claims are largely unsupported by the retrieved passages. Verify against official publications." };
+}

package/workers/worker_public/src/env.ts

@@ -22,6 +22,7 @@ export interface Env {
   ASSETS: Fetcher;
   INDEX_VERSION: string;
   UNIT_ASSETS: R2Bucket;
+  CHAT_UPLOADS: R2Bucket;
   ANON_DAY_ASK: string;
   ANON_DAY_SEARCH: string;
   KEY_DAY_ASK_DEFAULT: string;