@konneal/engine 0.2.6 → 0.2.10

package/dist/{ask-RX3W5JJW.js → ask-PKHGS2DZ.js}

@@ -1,7 +1,7 @@
 import {
   handleAsk
-} from "./chunk-7K5XP4PB.js";
-import "./chunk-GCL73ZLT.js";
+} from "./chunk-ZAEUQFC2.js";
+import "./chunk-7UT76RQO.js";
 import "./chunk-EFQALN2Z.js";
 import "./chunk-DBBGOOMZ.js";
 import "./chunk-5MBWE7WD.js";

package/dist/{chunk-GCL73ZLT.js → chunk-7UT76RQO.js}

@@ -2294,6 +2294,7 @@ function buildAuthorizationUrl(metadata, params) {
   url.searchParams.set("nonce", params.nonce);
   url.searchParams.set("code_challenge", params.codeChallenge);
   url.searchParams.set("code_challenge_method", "S256");
+  if (params.prompt) url.searchParams.set("prompt", params.prompt);
   return url.toString();
 }
 async function exchangeCode(metadata, params) {
@@ -2473,13 +2474,19 @@ async function handleLogin(env, req) {
         expirationTtl: 600
       }
     );
+    const silent = url0.searchParams.get("prompt") === "none";
     const url = buildAuthorizationUrl(meta, {
       clientId: cfg.clientId,
       redirectUri: cfg.redirectUri,
       scopes: "openid profile email roles",
       state,
       nonce,
-      codeChallenge: pkce.challenge
+      codeChallenge: pkce.challenge,
+      // silent SSO: the OP answers from its existing session or errors
+      // login_required — the callback then lands quietly, signed in or
+      // still anonymous, and the estate session carries to this site
+      // without a click
+      ...silent ? { prompt: "none" } : {}
     });
     return new Response(null, { status: 302, headers: { location: url } });
   } catch (e) {
@@ -2491,6 +2498,9 @@ async function handleCallback(env, req) {
   if (!cfg) return redirectWithError("not_configured");
   const url = new URL(req.url);
   const opError = url.searchParams.get("error");
+  if (opError === "login_required") {
+    return new Response(null, { status: 302, headers: { location: "/?auth_silent=none" } });
+  }
   if (opError) {
     const msg = opError === "access_denied" ? "Sign-in was cancelled." : opError === "temporarily_unavailable" ? "The sign-in service is busy. Please try again in a moment." : "The sign-in service reported a problem. Please try again.";
     return new Response(null, {

package/dist/{chunk-NRC4FBDQ.js → chunk-YFDWKXEB.js}

@@ -7,7 +7,7 @@ import {
   sessionFrom,
   telemetry,
   understandQuery
-} from "./chunk-GCL73ZLT.js";
+} from "./chunk-7UT76RQO.js";
 import {
   corsHeaders,
   err,

package/dist/{chunk-7K5XP4PB.js → chunk-ZAEUQFC2.js}

@@ -27,7 +27,7 @@ import {
   syntheticUnderstanding,
   telemetry,
   understandQuery
-} from "./chunk-GCL73ZLT.js";
+} from "./chunk-7UT76RQO.js";
 import {
   corsHeaders,
   err,
@@ -759,6 +759,83 @@ function verdictNote(v, node) {
   return lines.join("\n");
 }
 
+// workers/worker_public/src/conditions.ts
+var NUM = String.raw`-?\d+(?:[.,]\d+)?`;
+function quantitiesIn(query) {
+  const out = {};
+  const num2 = (s) => Number(s.replace(",", "."));
+  const temp = query.match(new RegExp(`(${NUM})\\s*(?:\xB0\\s*)?(?:C\\b|degC\\b|celsius)`, "i"));
+  if (temp) out.temperature = num2(temp[1]);
+  const rh = query.match(new RegExp(`(${NUM})\\s*%\\s*(?:RH\\b|relative\\s+humidity)?`, "i"));
+  if (rh) out.relative_humidity = num2(rh[1]);
+  const hours = query.match(new RegExp(`(${NUM})\\s*h\\b`, "i"));
+  if (hours) out.duration = num2(hours[1]);
+  const days = query.match(new RegExp(`(${NUM})\\s*days?\\b`, "i"));
+  if (days && out.duration === void 0) out.duration = num2(days[1]) * 24;
+  return out;
+}
+function entryBand(e) {
+  const value = Number(String(e.value).replace(",", "."));
+  const tolerance = Number(String(e.tolerance ?? "0").replace(",", "."));
+  if (!Number.isFinite(value)) return null;
+  return { value, tolerance: Number.isFinite(tolerance) ? tolerance : 0, lo: value - tolerance, hi: value + tolerance };
+}
+function scoreSet(entries, q) {
+  const checks = [];
+  let distance = 0;
+  let stated = 0;
+  for (const e of entries) {
+    const statedValue = q[e.quantity_kind];
+    if (statedValue === void 0) continue;
+    const band = entryBand(e);
+    if (!band) continue;
+    const in_band = statedValue >= band.lo && statedValue <= band.hi;
+    const gap = Math.max(0, statedValue - band.hi, band.lo - statedValue);
+    distance += gap / Math.max(band.tolerance, 1);
+    stated += 1;
+    checks.push({
+      quantity_kind: e.quantity_kind,
+      band: `${band.value} ${e.unit} \xB1${band.tolerance}`,
+      stated: statedValue,
+      in_band
+    });
+  }
+  return stated ? { checks, distance, stated } : null;
+}
+function evaluateConditionSets(nodes, query) {
+  const q = quantitiesIn(query);
+  const kinds = Object.keys(q);
+  if (!kinds.length) return null;
+  const scored = [];
+  for (const n of nodes) {
+    const c = n.content && typeof n.content === "object" ? n.content : {};
+    const payload = c.payload ?? {};
+    const entries = Array.isArray(payload.entries) ? payload.entries : [];
+    if (!entries.length) continue;
+    const s = scoreSet(entries, q);
+    if (s) scored.push({ node_id: n.node_id, checks: s.checks, distance: s.distance });
+  }
+  if (!scored.length) return null;
+  const matched = scored.filter((s) => s.checks.every((c) => c.in_band));
+  scored.sort((a, b) => a.distance - b.distance);
+  if (matched.length) {
+    return {
+      verdict: "pass",
+      matched: matched.map((m) => m.node_id),
+      checks: matched[0].checks,
+      note: `VERDICT: PASS \u2014 the stated combination (${kinds.join(", ")}) matches severity set(s) ${matched.map((m) => m.node_id).join(", ")}. Present this verdict and cite the set's clause.`
+    };
+  }
+  const nearest = scored[0];
+  return {
+    verdict: "fail",
+    matched: [],
+    nearest: { node_id: nearest.node_id, distance: Number(nearest.distance.toFixed(2)), bands: nearest.checks.map((c) => c.band) },
+    checks: scored[0].checks,
+    note: `VERDICT: FAIL \u2014 no severity set admits the stated combination. The nearest set is ${nearest.node_id} (bands: ${nearest.checks.map((c) => c.band).join("; ")}). Say the combination is outside the menu and name the nearest set; never soften it.`
+  };
+}
+
 // workers/worker_public/src/drafts.ts
 var ACT_VERB = "(?:draft|prepare|pre-?fill|fill\\s+(?:in|out)|start|submit|file|lodge)";
 var ACT_TARGET = "(?:new\\s+)?(?:certification\\s+|type[ -]evaluation\\s+|OIML[- ]CS\\s+)?application";
@@ -1551,6 +1628,32 @@ ${summary}` }] : [],
   const modelNote = boundModel && !boundModel.gated ? modelGroundingBlock(boundModel) : void 0;
   const machineVerdict = boundModel && !boundModel.gated ? evaluate(boundModel.content, q.query) : null;
   const machineNote = machineVerdict && boundModel ? verdictNote(machineVerdict, boundModel) : void 0;
+  let conditionVerdict = null;
+  let conditionStandard = null;
+  if (!machineVerdict && !boundModel && P().publisher.features?.model_plane) {
+    const ql = q.query.toLowerCase();
+    const severityWord = /\b(severity|test|valid|tolerance|condition|within)\b/.test(ql);
+    const stated = quantitiesIn(q.query);
+    if (severityWord && Object.keys(stated).length >= 1) {
+      const docNum = modelDocHint?.doc_number;
+      const sql = docNum ? "SELECT standard, node_id, content FROM model_nodes WHERE kind = 'condition_set' AND standard = ?1" : "SELECT standard, node_id, content FROM model_nodes WHERE kind = 'condition_set' LIMIT 40";
+      const stmt = docNum ? env.DB.prepare(sql).bind(docNum) : env.DB.prepare(sql);
+      const rows = await stmt.all().catch(() => ({ results: [] }));
+      const candidates = (rows.results ?? []).filter((r) => {
+        const entry = licensedEntryForPackage(String(r.standard));
+        return !entry || (standardKeys?.has(entry.key) ?? false);
+      });
+      const v = evaluateConditionSets(
+        candidates.map((r) => ({ node_id: String(r.node_id), content: JSON.parse(String(r.content ?? "{}")) })),
+        q.query
+      );
+      if (v) {
+        conditionVerdict = v;
+        conditionStandard = String(rows.results?.[0]?.standard ?? "");
+      }
+    }
+  }
+  const conditionNote = conditionVerdict && conditionStandard ? `${conditionVerdict.note} (computed from the ${conditionStandard} condition sets \u2014 machine evaluation, cite the package's clause.)` : void 0;
   const verdictBlock = machineVerdict ? {
     unit_id: boundModel.node_id,
     type: "verdict",
@@ -1564,6 +1667,22 @@ ${summary}` }] : [],
     }
   } : null;
   if (machineVerdict) console.log("verdict engine:", boundModel.node_id, "\u2192", machineVerdict.verdict.toUpperCase(), machineVerdict.missing.length ? `(missing ${machineVerdict.missing.join(",")})` : "");
+  const conditionBlock = conditionVerdict ? {
+    unit_id: conditionVerdict.matched[0] ?? conditionVerdict.nearest.node_id,
+    type: "verdict",
+    docidentifier: `IEC SMART model (${conditionStandard})`,
+    payload: {
+      verdict: conditionVerdict.verdict,
+      missing: [],
+      checks: conditionVerdict.checks.map((c) => ({
+        expression: `${c.quantity_kind} within ${c.band}`,
+        values: { stated: c.stated },
+        result: c.in_band
+      })),
+      ...conditionVerdict.nearest ? { nearest: conditionVerdict.nearest } : { matched: conditionVerdict.matched }
+    }
+  } : null;
+  if (conditionVerdict) console.log("condition engine:", conditionVerdict.matched.join("|") || conditionVerdict.nearest.node_id, "\u2192", conditionVerdict.verdict.toUpperCase());
   try {
     const tR = Date.now();
     if (declaredCtx?.kind === "account") {
@@ -1657,7 +1776,7 @@ Answer account questions from these records ONLY: name the record when you use i
     q.lang,
     keptHistory,
     // stage-extracted graph facts (GraphRAG) ride the same note channel
-    [processNote, eNote, contextNote(declaredCtx, docScope), accountNote, modelNote, vocabNote, memNote, machineNote, licenseNote, ...retrieved.notes ?? []].filter(Boolean).join("\n") || void 0,
+    [processNote, eNote, contextNote(declaredCtx, docScope), accountNote, modelNote, vocabNote, memNote, machineNote, conditionNote, licenseNote, ...retrieved.notes ?? []].filter(Boolean).join("\n") || void 0,
     summary,
     budget
   );
@@ -1705,7 +1824,7 @@ Answer account questions from these records ONLY: name the record when you use i
             model,
             query_hash: queryHash,
             follow_ups: understanding?.follow_ups ?? [],
-            blocks: verdictBlock ? [...c2.blocks, verdictBlock] : c2.blocks,
+            blocks: [...c2.blocks, ...verdictBlock ? [verdictBlock] : [], ...conditionBlock ? [conditionBlock] : []],
             context_applied: ctxApplied,
             read: readAs(),
             // the evidence view's ground truth: the exact passages this
@@ -1822,7 +1941,7 @@ Answer account questions from these records ONLY: name the record when you use i
     if (completionBlocks.length) console.log("contract completion:", completionBlocks.length, "table block(s) attached server-side");
   }
   completionBlocks.push(...await completeFigures(env.DB, answer, [...c2ns.blocks, ...completionBlocks], used));
-  const out = { answer, citations: finalCites, model: MODELS.member, query_hash: queryHash, follow_ups: understanding?.follow_ups ?? [], blocks: [...c2ns.blocks, ...verdictBlock ? [verdictBlock] : [], ...completionBlocks], context_applied: ctxApplied, ...liveRecords ? { records: liveRecords } : {} };
+  const out = { answer, citations: finalCites, model: MODELS.member, query_hash: queryHash, follow_ups: understanding?.follow_ups ?? [], blocks: [...c2ns.blocks, ...verdictBlock ? [verdictBlock] : [], ...conditionBlock ? [conditionBlock] : [], ...completionBlocks], context_applied: ctxApplied, ...liveRecords ? { records: liveRecords } : {} };
   const cacheable = !contextual && !declaredCtx && !answer.includes(refusalAnswer()) && finalAnchors.violations.length === 0;
   if (cacheable) {
     const warmVec = await warmEmbed ?? null;

package/dist/conditions.d.ts

@@ -0,0 +1,30 @@
+export interface ConditionCheck {
+    quantity_kind: string;
+    band: string;
+    stated: number;
+    in_band: boolean;
+}
+export interface ConditionVerdict {
+    verdict: "pass" | "fail";
+    matched: string[];
+    nearest?: {
+        node_id: string;
+        distance: number;
+        bands: string[];
+    };
+    checks: ConditionCheck[];
+    note: string;
+}
+/** The question's stated quantities, normalized onto the entries'
+ *  quantity kinds by UNIT (degC/K → temperature; % / RH →
+ *  relative_humidity; h/days → duration). Units, never words: "12
+ *  months" is not a 12 h duration. */
+export declare function quantitiesIn(query: string): Record<string, number>;
+/** Evaluate the candidate condition_set nodes against the question's
+ *  stated quantities. PASS when at least one set admits every stated
+ *  quantity within its band (the set is named); FAIL names the nearest
+ *  set and the violated bands. */
+export declare function evaluateConditionSets(nodes: {
+    node_id: string;
+    content: unknown;
+}[], query: string): ConditionVerdict | null;

package/dist/oidc.d.ts

@@ -30,6 +30,9 @@ export declare function buildAuthorizationUrl(metadata: OidcMetadata, params: {
     state: string;
     nonce: string;
     codeChallenge: string;
+    /** OIDC prompt ('none' = silent: the OP answers from its session or
+     *  errors login_required — never an interaction). */
+    prompt?: string;
 }): string;
 export interface OidcTokenResponse {
     id_token: string;

package/dist/{search-OXHXXT5S.js → search-RFKT7ZZY.js}

@@ -1,7 +1,7 @@
 import {
   handleSearch
-} from "./chunk-NRC4FBDQ.js";
-import "./chunk-GCL73ZLT.js";
+} from "./chunk-YFDWKXEB.js";
+import "./chunk-7UT76RQO.js";
 import "./chunk-EFQALN2Z.js";
 import "./chunk-DBBGOOMZ.js";
 import "./chunk-5MBWE7WD.js";

package/dist/worker_public/src/index.js

@@ -1,13 +1,13 @@
 import {
   handleSearch
-} from "../../chunk-NRC4FBDQ.js";
+} from "../../chunk-YFDWKXEB.js";
 import {
   checkQuoteAnchors,
   handleAsk,
   handleMemories,
   scoreJudge,
   standardForDocNumber
-} from "../../chunk-7K5XP4PB.js";
+} from "../../chunk-ZAEUQFC2.js";
 import {
   buildMessages,
   citations,
@@ -29,7 +29,7 @@ import {
   sessionFrom,
   telemetry,
   understandQuery
-} from "../../chunk-GCL73ZLT.js";
+} from "../../chunk-7UT76RQO.js";
 import {
   authenticate,
   corsHeaders,
@@ -979,7 +979,7 @@ async function handleMcp(env, ctx, req, tier, key) {
       // stream:false forces the JSON lane (anon defaults to SSE)
       body: JSON.stringify({ ...args, stream: false })
     });
-    const res = name === "ask" ? await (await import("../../ask-RX3W5JJW.js")).handleAsk(env, ctx, inner, tier, key) : await (await import("../../search-OXHXXT5S.js")).handleSearch(env, ctx, inner, tier, key);
+    const res = name === "ask" ? await (await import("../../ask-PKHGS2DZ.js")).handleAsk(env, ctx, inner, tier, key) : await (await import("../../search-RFKT7ZZY.js")).handleSearch(env, ctx, inner, tier, key);
     return res.json().catch(() => ({ error: { message: "tool transport failed", status: res.status } }));
   });
   if (out.ok && "accepted" in out) return new Response(null, { status: 202 });
@@ -1602,7 +1602,7 @@ function permissionsCatalog() {
   perms.push({ id: "ai.memories", description: "Personalized memory files on the assistant" });
   perms.push({ id: "ai.research", description: "Deep-research multi-pass questions" });
   perms.push({ id: "ai.keys.admin", description: "Create and revoke API keys" });
-  groups.push({ id: "ai", description: "The publications assistant's gated capabilities", permissions: perms });
+  groups.push({ id: "ai", description: `${P().publisher.product_name} gated capabilities`, permissions: perms });
   return {
     version: 1,
     verbs: ["read", "write", "admin"],

package/package.json

@@ -34,7 +34,7 @@
     "@oimlsmart/oiml-pubid": "^1.2.1"
   },
   "dependencies": {},
-  "version": "0.2.6",
+  "version": "0.2.10",
   "description": "The Konneal engine: the publisher-agnostic build pipeline and API plane for standards intelligence (retrieval, answer contract, verdicts, evaluation).",
   "license": "BSD-3-Clause",
   "type": "module",

package/workers/worker_public/src/ask.ts

@@ -19,8 +19,9 @@ import { contractV2, tableRetyped } from "./refs";
 import { completeTables, completeFigures } from "./completion";
 import { NO_CONTEXT, appliedContext, contextNote, namedDocumentIn, parseContext, resolveDocScope, syntheticUnderstanding } from "./context";
 import { exchangeForLiveToken, liveDataConfig, resolveLiveAccount, type LiveRecord } from "./livedata";
-import { bindModelNode, licenseBoundaryNote, licenseBoundaryRefusal, modelCitation, modelEcho, modelGroundingBlock, modelNodeRefIn, standardForDocNumber } from "./modelplane";
+import { bindModelNode, licenseBoundaryNote, licenseBoundaryRefusal, licensedEntryForPackage, modelCitation, modelEcho, modelGroundingBlock, modelNodeRefIn, standardForDocNumber } from "./modelplane";
 import { evaluate as machineEvaluate, verdictNote } from "./verdict";
+import { evaluateConditionSets, quantitiesIn, type ConditionVerdict } from "./conditions";
 import { detectDraftIntent, prepareDraft } from "./drafts";
 import { memoryNote } from "./memories";
 import { entitlementScope, resolveRequestScope, requestSalt } from "./requestScope";
@@ -717,6 +718,42 @@ async function handleAsk(
   // and the verdict BLOCK is server-built — data, never generated prose
   const machineVerdict = boundModel && !boundModel.gated ? machineEvaluate(boundModel.content, q.query) : null;
   const machineNote = machineVerdict && boundModel ? verdictNote(machineVerdict, boundModel) : undefined;
+  // ── condition-set membership (konneal/engine#90): the test-method
+  // packages' severity menus as machine-verifiable membership. Fires
+  // when no explicit node binding ran and the question states
+  // quantities alongside severity vocabulary; the candidate sets come
+  // from the model node store (kind condition_set), license-gated like
+  // every model lane.
+  let conditionVerdict: ConditionVerdict | null = null;
+  let conditionStandard: string | null = null;
+  if (!machineVerdict && !boundModel && P().publisher.features?.model_plane) {
+    const ql = q.query.toLowerCase();
+    const severityWord = /\b(severity|test|valid|tolerance|condition|within)\b/.test(ql);
+    const stated = quantitiesIn(q.query);
+    if (severityWord && Object.keys(stated).length >= 1) {
+      const docNum = modelDocHint?.doc_number;
+      const sql = docNum
+        ? "SELECT standard, node_id, content FROM model_nodes WHERE kind = 'condition_set' AND standard = ?1"
+        : "SELECT standard, node_id, content FROM model_nodes WHERE kind = 'condition_set' LIMIT 40";
+      const stmt = docNum ? env.DB.prepare(sql).bind(docNum) : env.DB.prepare(sql);
+      const rows = await stmt.all().catch(() => ({ results: [] }));
+      const candidates = (rows.results ?? []).filter((r: any) => {
+        const entry = licensedEntryForPackage(String(r.standard));
+        return !entry || (standardKeys?.has(entry.key) ?? false);
+      });
+      const v = evaluateConditionSets(
+        candidates.map((r: any) => ({ node_id: String(r.node_id), content: JSON.parse(String(r.content ?? "{}")) })),
+        q.query,
+      );
+      if (v) {
+        conditionVerdict = v;
+        conditionStandard = String((rows.results?.[0] as any)?.standard ?? "");
+      }
+    }
+  }
+  const conditionNote = conditionVerdict && conditionStandard
+    ? `${conditionVerdict.note} (computed from the ${conditionStandard} condition sets — machine evaluation, cite the package's clause.)`
+    : undefined;
   const verdictBlock = machineVerdict
     ? {
         unit_id: boundModel!.node_id,
@@ -732,6 +769,26 @@ async function handleAsk(
       }
     : null;
   if (machineVerdict) console.log("verdict engine:", boundModel!.node_id, "→", machineVerdict.verdict.toUpperCase(), machineVerdict.missing.length ? `(missing ${machineVerdict.missing.join(",")})` : "");
+  const conditionBlock = conditionVerdict
+    ? {
+        unit_id: conditionVerdict.matched[0] ?? conditionVerdict.nearest!.node_id,
+        type: "verdict",
+        docidentifier: `IEC SMART model (${conditionStandard})`,
+        payload: {
+          verdict: conditionVerdict.verdict,
+          missing: [],
+          checks: conditionVerdict.checks.map((c) => ({
+            expression: `${c.quantity_kind} within ${c.band}`,
+            values: { stated: c.stated },
+            result: c.in_band,
+          })),
+          ...(conditionVerdict.nearest
+            ? { nearest: conditionVerdict.nearest }
+            : { matched: conditionVerdict.matched }),
+        },
+      }
+    : null;
+  if (conditionVerdict) console.log("condition engine:", conditionVerdict.matched.join("|") || conditionVerdict.nearest!.node_id, "→", conditionVerdict.verdict.toUpperCase());
   try {
     const tR = Date.now();
     // ── The "my account" live read (TODO.ai-platform/03) — resolved
@@ -881,7 +938,7 @@ async function handleAsk(
     q.lang,
     keptHistory,
     // stage-extracted graph facts (GraphRAG) ride the same note channel
-    [processNote, eNote, contextNote(declaredCtx, docScope), accountNote, modelNote, vocabNote, memNote, machineNote, licenseNote, ...(retrieved.notes ?? [])].filter(Boolean).join("\n") || undefined,
+    [processNote, eNote, contextNote(declaredCtx, docScope), accountNote, modelNote, vocabNote, memNote, machineNote, conditionNote, licenseNote, ...(retrieved.notes ?? [])].filter(Boolean).join("\n") || undefined,
     summary,
     budget,
   );
@@ -934,7 +991,7 @@ async function handleAsk(
           const c2 = canonical0.includes(refusalAnswer())
             ? { text: canonical0, blocks: [], dropped: [] as string[] }
             : await contractV2(env.DB, canonical0, usedHits);
-          send({ type: "done", model, query_hash: queryHash, follow_ups: understanding?.follow_ups ?? [], blocks: verdictBlock ? [...c2.blocks, verdictBlock] : c2.blocks, context_applied: ctxApplied, read: readAs(),
+          send({ type: "done", model, query_hash: queryHash, follow_ups: understanding?.follow_ups ?? [], blocks: [...c2.blocks, ...(verdictBlock ? [verdictBlock] : []), ...(conditionBlock ? [conditionBlock] : [])], context_applied: ctxApplied, read: readAs(),
             // the evidence view's ground truth: the exact passages this
             // answer was built from, compact — cache hits carry none,
             // because the cache stores the answer and never the passages
@@ -1113,7 +1170,7 @@ async function handleAsk(
   // figure completion (#172) — see ./completion for the rationale
   completionBlocks.push(...(await completeFigures(env.DB, answer, [...c2ns.blocks, ...completionBlocks], used)));
 
-  const out = { answer, citations: finalCites, model: MODELS.member, query_hash: queryHash, follow_ups: understanding?.follow_ups ?? [], blocks: [...c2ns.blocks, ...(verdictBlock ? [verdictBlock] : []), ...completionBlocks], context_applied: ctxApplied, ...(liveRecords ? { records: liveRecords } : {}) };
+  const out = { answer, citations: finalCites, model: MODELS.member, query_hash: queryHash, follow_ups: understanding?.follow_ups ?? [], blocks: [...c2ns.blocks, ...(verdictBlock ? [verdictBlock] : []), ...(conditionBlock ? [conditionBlock] : []), ...completionBlocks], context_applied: ctxApplied, ...(liveRecords ? { records: liveRecords } : {}) };
   const cacheable = !contextual && !declaredCtx && !answer.includes(refusalAnswer()) && finalAnchors.violations.length === 0;
   if (cacheable) {
     const warmVec = (await warmEmbed) ?? null;

package/workers/worker_public/src/auth.ts

@@ -85,6 +85,7 @@ export async function handleLogin(env: any, req: Request): Promise<Response> {
         expirationTtl: 600,
       },
     );
+    const silent = url0.searchParams.get("prompt") === "none";
     const url = buildAuthorizationUrl(meta, {
       clientId: cfg.clientId,
       redirectUri: cfg.redirectUri,
@@ -92,6 +93,11 @@ export async function handleLogin(env: any, req: Request): Promise<Response> {
       state,
       nonce,
       codeChallenge: pkce.challenge,
+      // silent SSO: the OP answers from its existing session or errors
+      // login_required — the callback then lands quietly, signed in or
+      // still anonymous, and the estate session carries to this site
+      // without a click
+      ...(silent ? { prompt: "none" } : {}),
     });
     return new Response(null, { status: 302, headers: { location: url } });
   } catch (e) {
@@ -104,6 +110,11 @@ export async function handleCallback(env: any, req: Request): Promise<Response>
   if (!cfg) return redirectWithError("not_configured");
   const url = new URL(req.url);
   const opError = url.searchParams.get("error");
+  if (opError === "login_required") {
+    // the silent probe found no OP session — anonymous is the honest
+    // state, never an error
+    return new Response(null, { status: 302, headers: { location: "/?auth_silent=none" } });
+  }
   if (opError) {
     // the OP redirected back with its own failure (user denied consent,
     // session expired at the OP, …) — fail closed, in plain language

package/workers/worker_public/src/conditions.ts

@@ -0,0 +1,123 @@
+// Condition-set evaluation (konneal/engine#90): the severity menus of
+// the test-method packages as machine-verifiable membership. A
+// condition_set node's payload.entries carry the kernel's quantity
+// doctrine — value + unit inseparable, tolerance the SPECIFIED band —
+// so "is 85 % RH at 40 °C a valid Test Cab severity?" computes: find
+// the sets whose temperature AND relative_humidity bands admit the
+// stated pair. The verdict is executed data; the model narrates it.
+
+export interface ConditionCheck {
+  quantity_kind: string;
+  band: string;
+  stated: number;
+  in_band: boolean;
+}
+
+export interface ConditionVerdict {
+  verdict: "pass" | "fail";
+  matched: string[];
+  nearest?: { node_id: string; distance: number; bands: string[] };
+  checks: ConditionCheck[];
+  note: string;
+}
+
+interface Entry {
+  quantity_kind: string;
+  value: string | number;
+  unit: string;
+  tolerance: string | number;
+}
+
+const NUM = String.raw`-?\d+(?:[.,]\d+)?`;
+
+/** The question's stated quantities, normalized onto the entries'
+ *  quantity kinds by UNIT (degC/K → temperature; % / RH →
+ *  relative_humidity; h/days → duration). Units, never words: "12
+ *  months" is not a 12 h duration. */
+export function quantitiesIn(query: string): Record<string, number> {
+  const out: Record<string, number> = {};
+  const num = (s: string) => Number(s.replace(",", "."));
+  const temp = query.match(new RegExp(`(${NUM})\\s*(?:°\\s*)?(?:C\\b|degC\\b|celsius)`, "i"));
+  if (temp) out.temperature = num(temp[1]!);
+  const rh = query.match(new RegExp(`(${NUM})\\s*%\\s*(?:RH\\b|relative\\s+humidity)?`, "i"));
+  if (rh) out.relative_humidity = num(rh[1]!);
+  const hours = query.match(new RegExp(`(${NUM})\\s*h\\b`, "i"));
+  if (hours) out.duration = num(hours[1]!);
+  const days = query.match(new RegExp(`(${NUM})\\s*days?\\b`, "i"));
+  if (days && out.duration === undefined) out.duration = num(days[1]!) * 24;
+  return out;
+}
+
+function entryBand(e: Entry): { lo: number; hi: number; value: number; tolerance: number } | null {
+  const value = Number(String(e.value).replace(",", "."));
+  const tolerance = Number(String(e.tolerance ?? "0").replace(",", "."));
+  if (!Number.isFinite(value)) return null;
+  return { value, tolerance: Number.isFinite(tolerance) ? tolerance : 0, lo: value - tolerance, hi: value + tolerance };
+}
+
+/** Evaluate ONE set: every stated quantity in-band? Sets with entries
+ *  whose kind the question never states are skipped for that kind (a
+ *  question stating one quantity does not fail a two-entry set). */
+function scoreSet(entries: Entry[], q: Record<string, number>): { checks: ConditionCheck[]; distance: number; stated: number } | null {
+  const checks: ConditionCheck[] = [];
+  let distance = 0;
+  let stated = 0;
+  for (const e of entries) {
+    const statedValue = q[e.quantity_kind];
+    if (statedValue === undefined) continue;
+    const band = entryBand(e);
+    if (!band) continue;
+    const in_band = statedValue >= band.lo && statedValue <= band.hi;
+    const gap = Math.max(0, statedValue - band.hi, band.lo - statedValue);
+    distance += gap / Math.max(band.tolerance, 1);
+    stated += 1;
+    checks.push({
+      quantity_kind: e.quantity_kind,
+      band: `${band.value} ${e.unit} ±${band.tolerance}`,
+      stated: statedValue,
+      in_band,
+    });
+  }
+  return stated ? { checks, distance, stated } : null;
+}
+
+/** Evaluate the candidate condition_set nodes against the question's
+ *  stated quantities. PASS when at least one set admits every stated
+ *  quantity within its band (the set is named); FAIL names the nearest
+ *  set and the violated bands. */
+export function evaluateConditionSets(
+  nodes: { node_id: string; content: unknown }[],
+  query: string,
+): ConditionVerdict | null {
+  const q = quantitiesIn(query);
+  const kinds = Object.keys(q);
+  if (!kinds.length) return null;
+  const scored: { node_id: string; checks: ConditionCheck[]; distance: number }[] = [];
+  for (const n of nodes) {
+    const c = (n.content && typeof n.content === "object" ? n.content : {}) as Record<string, any>;
+    const payload = (c.payload ?? {}) as { role?: string; entries?: Entry[] };
+    const entries = Array.isArray(payload.entries) ? payload.entries : [];
+    if (!entries.length) continue;
+    const s = scoreSet(entries, q);
+    if (s) scored.push({ node_id: n.node_id, checks: s.checks, distance: s.distance });
+  }
+  if (!scored.length) return null;
+  const matched = scored.filter((s) => s.checks.every((c) => c.in_band));
+  scored.sort((a, b) => a.distance - b.distance);
+  if (matched.length) {
+    return {
+      verdict: "pass",
+      matched: matched.map((m) => m.node_id),
+      checks: matched[0]!.checks,
+      note: `VERDICT: PASS — the stated combination (${kinds.join(", ")}) matches severity set(s) ${matched.map((m) => m.node_id).join(", ")}. Present this verdict and cite the set's clause.`,
+    };
+  }
+  const nearest = scored[0]!;
+  return {
+    verdict: "fail",
+    matched: [],
+    nearest: { node_id: nearest.node_id, distance: Number(nearest.distance.toFixed(2)), bands: nearest.checks.map((c) => c.band) },
+    checks: scored[0]!.checks,
+    note: `VERDICT: FAIL — no severity set admits the stated combination. The nearest set is ${nearest.node_id} (bands: ${nearest.checks.map((c) => c.band).join("; ")}). Say the combination is outside the menu and name the nearest set; never soften it.`,
+  };
+}

package/workers/worker_public/src/index.ts

@@ -421,7 +421,7 @@ function permissionsCatalog(): Record<string, unknown> {
   perms.push({ id: "ai.memories", description: "Personalized memory files on the assistant" });
   perms.push({ id: "ai.research", description: "Deep-research multi-pass questions" });
   perms.push({ id: "ai.keys.admin", description: "Create and revoke API keys" });
-  groups.push({ id: "ai", description: "The publications assistant's gated capabilities", permissions: perms });
+  groups.push({ id: "ai", description: `${P().publisher.product_name} gated capabilities`, permissions: perms });
   return {
     version: 1,
     verbs: ["read", "write", "admin"],

package/workers/worker_public/src/oidc.ts

@@ -131,6 +131,9 @@ export function buildAuthorizationUrl(
     state: string;
     nonce: string;
     codeChallenge: string;
+    /** OIDC prompt ('none' = silent: the OP answers from its session or
+     *  errors login_required — never an interaction). */
+    prompt?: string;
   },
 ): string {
   const url = new URL(metadata.authorization_endpoint);
@@ -142,6 +145,7 @@ export function buildAuthorizationUrl(
   url.searchParams.set("nonce", params.nonce);
   url.searchParams.set("code_challenge", params.codeChallenge);
   url.searchParams.set("code_challenge_method", "S256");
+  if (params.prompt) url.searchParams.set("prompt", params.prompt);
   return url.toString();
 }