@wrenai/genbi 0.0.4 → 0.0.6

package/dist-server/server/db.js

@@ -153,10 +153,21 @@ CREATE TABLE IF NOT EXISTS native_structured_answers (
   envelope_json TEXT NOT NULL,
   digest TEXT NOT NULL,
   created_at TEXT NOT NULL,
+  grounded INTEGER NOT NULL DEFAULT 0,
   UNIQUE(native_session_id, idempotency_key)
 );
 CREATE INDEX IF NOT EXISTS native_structured_answers_session_created_at
   ON native_structured_answers(native_session_id, created_at DESC);
+-- Warble profile registry: the shipped profiles plus any the operator added. A row's admission
+-- verdict is recomputed when the profile bytes or the warble binary change; rows are never
+-- deleted by admission, only marked unavailable.
+CREATE TABLE IF NOT EXISTS warble_profiles (
+  id TEXT PRIMARY KEY, kind TEXT NOT NULL, role TEXT NOT NULL, source_dir TEXT NOT NULL,
+  profile_hash TEXT NOT NULL, warble_identity TEXT NOT NULL,
+  admission_status TEXT NOT NULL, admission_reason TEXT, entry_kind TEXT, entry_verb TEXT,
+  ir_version TEXT, components_json TEXT NOT NULL DEFAULT '[]', rules_version INTEGER NOT NULL DEFAULT 0,
+  created_at TEXT NOT NULL, updated_at TEXT NOT NULL, admitted_at TEXT
+);
 `;
 function boolToInt(value) {
     return value ? 1 : 0;
@@ -245,6 +256,7 @@ function coerceOrphanedTodoSteps(steps) {
 }
 export class Store {
     db;
+    closed = false;
     onContextSuccessWrite;
     onEnrichmentTransitionWrite;
     onEnrichmentCreationWrite;
@@ -362,6 +374,9 @@ export class Store {
         this.addColumnIfMissing("artifacts", "native_agent", "TEXT");
         this.addColumnIfMissing("artifacts", "content_digest", "TEXT");
         this.addColumnIfMissing("artifacts", "idempotency_key", "TEXT");
+        // Pre-existing retained answers carry no provenance, so they default to
+        // ungrounded: a later save by reference to one of them is Unverified.
+        this.addColumnIfMissing("native_structured_answers", "grounded", "INTEGER NOT NULL DEFAULT 0");
         this.db.exec("CREATE UNIQUE INDEX IF NOT EXISTS artifacts_native_idempotency_unique ON artifacts(native_session_id, idempotency_key) WHERE native_session_id IS NOT NULL AND idempotency_key IS NOT NULL");
         this.addColumnIfMissing("enrichment_operations", "draft", "TEXT NOT NULL DEFAULT ''");
         this.addColumnIfMissing("enrichment_operations", "change_kind", "TEXT NOT NULL DEFAULT 'knowledge_append'");
@@ -383,10 +398,14 @@ export class Store {
         this.addColumnIfMissing("enrichment_approvals", "evidence_ref", "TEXT NOT NULL DEFAULT ''");
         this.addColumnIfMissing("enrichment_approvals", "nonce", "TEXT NOT NULL DEFAULT ''");
         this.addColumnIfMissing("enrichment_approvals", "expires_at", "TEXT NOT NULL DEFAULT ''");
+        this.addColumnIfMissing("native_sessions", "entry_verb", "TEXT");
+        this.addColumnIfMissing("native_sessions", "transport", "TEXT");
         this.addColumnIfMissing("native_sessions", "dispatch_profile", "TEXT");
         this.addColumnIfMissing("native_sessions", "dispatch_target", "TEXT");
         this.addColumnIfMissing("native_sessions", "runtime_generation", "INTEGER");
         this.addColumnIfMissing("artifacts", "source_answer_id", "TEXT");
+        // A database written before admission carried a rule-set version reads 0 and re-admits.
+        this.addColumnIfMissing("warble_profiles", "rules_version", "INTEGER NOT NULL DEFAULT 0");
         this.db.exec("CREATE UNIQUE INDEX IF NOT EXISTS enrichment_approvals_nonce_unique ON enrichment_approvals(nonce) WHERE nonce <> ''");
     }
     addColumnIfMissing(table, column, type) {
@@ -398,7 +417,10 @@ export class Store {
     }
     close() {
         this.db.close();
+        this.closed = true;
     }
+    /** Lets delayed process-local cleanup avoid touching SQLite after shutdown. */
+    isClosed() { return this.closed; }
     // ---------------------------------------------------------------------
     // sessions
     // ---------------------------------------------------------------------
@@ -415,8 +437,8 @@ export class Store {
     // ---------------------------------------------------------------------
     createNativeSession(params) {
         const now = this.now().toISOString();
-        this.db.prepare(`INSERT INTO native_sessions (id, purpose, vendor, agent, scope_kind, scope_id, project_identity, binding_generation, project_revision, dispatch_profile, dispatch_target, runtime_generation, status, created_at, updated_at, started_at, ended_at, exit_code, failure)
-       VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, 'creating', ?, ?, NULL, NULL, NULL, NULL)`).run(params.id, params.purpose, params.vendor, params.agent, params.scopeKind, params.scopeId, params.projectIdentity ?? null, params.bindingGeneration ?? null, params.projectRevision ?? null, params.dispatchProfile ?? null, params.dispatchTarget ?? null, params.runtimeGeneration ?? null, now, now);
+        this.db.prepare(`INSERT INTO native_sessions (id, purpose, vendor, agent, entry_verb, scope_kind, scope_id, project_identity, binding_generation, project_revision, dispatch_profile, dispatch_target, runtime_generation, status, created_at, updated_at, started_at, ended_at, exit_code, failure, transport)
+       VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, 'creating', ?, ?, NULL, NULL, NULL, NULL, ?)`).run(params.id, params.purpose, params.vendor, params.agent, params.entryVerb ?? null, params.scopeKind, params.scopeId, params.projectIdentity ?? null, params.bindingGeneration ?? null, params.projectRevision ?? null, params.dispatchProfile ?? null, params.dispatchTarget ?? null, params.runtimeGeneration ?? null, now, now, params.transport ?? null);
         return this.getNativeSession(params.id);
     }
     /** Stores a sealed provider handle only; callers must never pass plaintext. */
@@ -478,8 +500,8 @@ export class Store {
             }
             const now = this.now().toISOString();
             const child = params.child;
-            this.db.prepare(`INSERT INTO native_sessions (id, purpose, vendor, agent, scope_kind, scope_id, project_identity, binding_generation, project_revision, dispatch_profile, dispatch_target, runtime_generation, status, created_at, updated_at, started_at, ended_at, exit_code, failure)
-         VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, 'creating', ?, ?, NULL, NULL, NULL, NULL)`).run(child.id, child.purpose, child.vendor, child.agent, child.scopeKind, child.scopeId, child.projectIdentity ?? null, child.bindingGeneration ?? null, child.projectRevision ?? null, child.dispatchProfile ?? null, child.dispatchTarget ?? null, child.runtimeGeneration ?? null, now, now);
+            this.db.prepare(`INSERT INTO native_sessions (id, purpose, vendor, agent, entry_verb, scope_kind, scope_id, project_identity, binding_generation, project_revision, dispatch_profile, dispatch_target, runtime_generation, status, created_at, updated_at, started_at, ended_at, exit_code, failure)
+         VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, 'creating', ?, ?, NULL, NULL, NULL, NULL)`).run(child.id, child.purpose, child.vendor, child.agent, child.entryVerb ?? null, child.scopeKind, child.scopeId, child.projectIdentity ?? null, child.bindingGeneration ?? null, child.projectRevision ?? null, child.dispatchProfile ?? null, child.dispatchTarget ?? null, child.runtimeGeneration ?? null, now, now);
             this.db.prepare(`INSERT INTO native_session_resume_actions (session_id, idempotency_key, scope_fingerprint, resumed_session_id, created_at) VALUES (?, ?, ?, ?, ?)`).run(params.sourceSessionId, params.idempotencyKey, params.scopeFingerprint, child.id, now);
             this.db.prepare(`UPDATE native_session_resume_handles SET consumed_at = ? WHERE session_id = ? AND consumed_at IS NULL`).run(now, params.sourceSessionId);
             this.saveNativeSessionResumeHandle(child.id, child.vendor, params.sealedHandle);
@@ -503,8 +525,8 @@ export class Store {
         const createdAt = this.now().toISOString();
         this.db.exec("BEGIN IMMEDIATE");
         try {
-            this.db.prepare(`INSERT INTO native_structured_answers (id, native_session_id, idempotency_key, envelope_json, digest, created_at)
-         VALUES (?, ?, ?, ?, ?, ?)`).run(params.id, params.nativeSessionId, params.idempotencyKey, params.envelopeJson, params.digest, createdAt);
+            this.db.prepare(`INSERT INTO native_structured_answers (id, native_session_id, idempotency_key, envelope_json, digest, created_at, grounded)
+         VALUES (?, ?, ?, ?, ?, ?, ?)`).run(params.id, params.nativeSessionId, params.idempotencyKey, params.envelopeJson, params.digest, createdAt, boolToInt(params.grounded));
             this.db.prepare(`DELETE FROM native_structured_answers
          WHERE id IN (
            SELECT id FROM native_structured_answers
@@ -539,6 +561,41 @@ export class Store {
        LIMIT 1`).get(nativeSessionId);
         return row ? rowToNativeStructuredAnswer(row) : undefined;
     }
+    // ---------------------------------------------------------------------
+    // warble profile registry
+    // ---------------------------------------------------------------------
+    upsertWarbleProfile(row) {
+        this.db.prepare(`INSERT INTO warble_profiles (id, kind, role, source_dir, profile_hash, warble_identity, admission_status, admission_reason,
+         entry_kind, entry_verb, ir_version, components_json, rules_version, created_at, updated_at, admitted_at)
+       VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+       ON CONFLICT(id) DO UPDATE SET
+         kind = excluded.kind, role = excluded.role, source_dir = excluded.source_dir,
+         profile_hash = excluded.profile_hash, warble_identity = excluded.warble_identity,
+         admission_status = excluded.admission_status, admission_reason = excluded.admission_reason,
+         entry_kind = excluded.entry_kind, entry_verb = excluded.entry_verb, ir_version = excluded.ir_version,
+         components_json = excluded.components_json, rules_version = excluded.rules_version,
+         updated_at = excluded.updated_at, admitted_at = excluded.admitted_at`).run(row.id, row.kind, row.role, row.sourceDir, row.profileHash, row.warbleIdentity, row.admissionStatus, row.admissionReason, row.entryKind, row.entryVerb, row.irVersion, row.componentsJson, row.rulesVersion, row.createdAt, row.updatedAt, row.admittedAt);
+        return this.getWarbleProfile(row.id);
+    }
+    getWarbleProfile(id) {
+        const row = this.db.prepare(`SELECT * FROM warble_profiles WHERE id = ?`).get(id);
+        return row ? rowToWarbleProfile(row) : undefined;
+    }
+    /** Built-ins first (in registration order), then user profiles by id. */
+    listWarbleProfiles() {
+        return this.db
+            .prepare(`SELECT * FROM warble_profiles ORDER BY CASE kind WHEN 'builtin' THEN 0 ELSE 1 END, rowid ASC`)
+            .all()
+            .map(rowToWarbleProfile);
+    }
+    deleteWarbleProfile(id) {
+        return this.db.prepare(`DELETE FROM warble_profiles WHERE id = ?`).run(id).changes > 0;
+    }
+    /** How many native sessions ever ran inside this profile; the registry refuses to remove a referenced one. */
+    countNativeSessionsByDispatchProfile(profileId) {
+        const row = this.db.prepare(`SELECT COUNT(*) AS n FROM native_sessions WHERE dispatch_profile = ?`).get(profileId);
+        return row ? num(row, "n") : 0;
+    }
     listNativeSessions() {
         return this.db.prepare(`SELECT * FROM native_sessions ORDER BY updated_at DESC, rowid DESC`).all().map(rowToNativeSession);
     }
@@ -853,7 +910,7 @@ export class Store {
         const createdAt = new Date().toISOString();
         const row = {
             id: params.id, sessionId: params.sessionId, name: params.name, kind: "dashboard", location: params.location,
-            verified: true, createdAt, savedAt: createdAt, nativeSessionId: params.nativeSessionId,
+            verified: params.verified, createdAt, savedAt: createdAt, nativeSessionId: params.nativeSessionId,
             projectIdentity: params.projectIdentity, bindingGeneration: params.bindingGeneration,
             projectRevision: params.projectRevision, nativeVendor: params.vendor, nativeAgent: params.agent,
             contentDigest: params.digest, idempotencyKey: params.idempotencyKey,
@@ -865,7 +922,7 @@ export class Store {
         native_session_id, project_identity, binding_generation, project_revision,
         native_vendor, native_agent, content_digest, idempotency_key, source_answer_id
       ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`)
-                .run(row.id, row.sessionId, row.name, row.kind, row.location, 1, row.createdAt, row.savedAt, row.nativeSessionId, row.projectIdentity, row.bindingGeneration, row.projectRevision, row.nativeVendor, row.nativeAgent, row.contentDigest, row.idempotencyKey, row.sourceAnswerId);
+                .run(row.id, row.sessionId, row.name, row.kind, row.location, boolToInt(row.verified), row.createdAt, row.savedAt, row.nativeSessionId, row.projectIdentity, row.bindingGeneration, row.projectRevision, row.nativeVendor, row.nativeAgent, row.contentDigest, row.idempotencyKey, row.sourceAnswerId);
             return { row, created: true };
         }
         catch (error) {
@@ -1724,8 +1781,9 @@ function rowToSession(row) {
 }
 function rowToNativeSession(row) {
     return {
+        ...(row["transport"] === "conversation" ? { transport: "conversation" } : {}),
         id: str(row, "id"), purpose: str(row, "purpose"),
-        vendor: str(row, "vendor"), agent: str(row, "agent"),
+        vendor: str(row, "vendor"), agent: str(row, "agent"), entryVerb: strOrNull(row, "entry_verb"),
         scopeKind: str(row, "scope_kind"), scopeId: str(row, "scope_id"),
         projectIdentity: strOrNull(row, "project_identity"),
         bindingGeneration: row["binding_generation"] === null ? null : num(row, "binding_generation"),
@@ -1739,6 +1797,26 @@ function rowToNativeSession(row) {
         exitCode: row["exit_code"] === null ? null : num(row, "exit_code"), failure: strOrNull(row, "failure"),
     };
 }
+function rowToWarbleProfile(row) {
+    return {
+        id: str(row, "id"),
+        kind: str(row, "kind"),
+        role: str(row, "role"),
+        sourceDir: str(row, "source_dir"),
+        profileHash: str(row, "profile_hash"),
+        warbleIdentity: str(row, "warble_identity"),
+        admissionStatus: str(row, "admission_status"),
+        admissionReason: strOrNull(row, "admission_reason"),
+        entryKind: strOrNull(row, "entry_kind"),
+        entryVerb: strOrNull(row, "entry_verb"),
+        irVersion: strOrNull(row, "ir_version"),
+        componentsJson: str(row, "components_json"),
+        rulesVersion: row["rules_version"] === null || row["rules_version"] === undefined ? 0 : num(row, "rules_version"),
+        createdAt: str(row, "created_at"),
+        updatedAt: str(row, "updated_at"),
+        admittedAt: strOrNull(row, "admitted_at"),
+    };
+}
 function rowToNativeSetupRecovery(row) {
     return {
         sessionId: str(row, "session_id"),
@@ -1761,6 +1839,7 @@ function rowToNativeStructuredAnswer(row) {
         envelopeJson: str(row, "envelope_json"),
         digest: str(row, "digest"),
         createdAt: str(row, "created_at"),
+        grounded: intToBool(row["grounded"]),
     };
 }
 function rowToEvent(row) {

package/dist-server/server/env-detect.d.ts

@@ -1,4 +1,10 @@
 import type { AdapterEnvStatus } from "./wire-types.js";
+/**
+ * The one credential env var for `"gateway"` mode, whatever pi-ai provider it
+ * targets. The BFF reads it and passes it to the adapter per request; pi-ai's
+ * own provider env vars are never consulted.
+ */
+export declare const GATEWAY_API_KEY_ENV = "GENBI_GATEWAY_API_KEY";
 /**
  * Reports which api-key adapters have their required credential env var present on the BFF
  * process — booleans only. The key values themselves (or any prefix/suffix/length derived

package/dist-server/server/env-detect.js

@@ -1,3 +1,9 @@
+/**
+ * The one credential env var for `"gateway"` mode, whatever pi-ai provider it
+ * targets. The BFF reads it and passes it to the adapter per request; pi-ai's
+ * own provider env vars are never consulted.
+ */
+export const GATEWAY_API_KEY_ENV = "GENBI_GATEWAY_API_KEY";
 /** True iff the named env var is set to a non-empty (non-whitespace-only) value. */
 function isNonEmptyEnv(name) {
     const value = process.env[name];
@@ -13,5 +19,6 @@ export function detectAdapterEnv() {
     return {
         anthropic: isNonEmptyEnv("ANTHROPIC_API_KEY"),
         openaiCompatible: isNonEmptyEnv("OPENAI_API_KEY"),
+        gateway: isNonEmptyEnv(GATEWAY_API_KEY_ENV),
     };
 }

package/dist-server/server/fold.d.ts

@@ -14,7 +14,7 @@
  *    forwards whatever the runtime actually reports.
  */
 import type { AgentEvent, RouteResult, StepTrace } from "../harness/index.js";
-import type { AnswerEvent, ArtifactEvent, ArtifactKind, RefusalEvent, ToolStep } from "./wire-types.js";
+import type { AnswerEvent, ArtifactEvent, ArtifactKind, RefusalEvent, RenderEnvelope, ToolStep } from "./wire-types.js";
 /**
  * Canned remediation text for a refusal. `RefusalAgentEvent`/`RefusalResult`
  * carry no remediation hint from the agent runtime — the UI's `fix` field is
@@ -37,9 +37,11 @@ export declare function extractTrace(result: RouteResult): StepTrace | undefined
  * on the floor and the raw text always went out as `form: "text"`,
  * `verified: false`). `extractEnvelopeFromText` recovers it — including
  * `answer_query`'s flat `{columns, rows}` tool-contract shape, normalized
- * into a `table` block — and `verified` is whatever the recovered envelope
- * actually carries, never hardcoded. Only when no envelope can be recovered
- * at all does the raw text fall back to `form: "text"`.
+ * into a `table` block. The recovered envelope's `verified` is model-written,
+ * so {@link withHostVerification} decides it from host evidence instead (see
+ * there). Only when
+ * no envelope can be recovered at all does the raw text fall back to
+ * `form: "text"`.
  *
  * That `form: "text"` fallback is the one case where "verified: false" is
  * ambiguous between two very different situations: a pure conversational
@@ -51,6 +53,23 @@ export declare function extractTrace(result: RouteResult): StepTrace | undefined
  * introspection and artifact-saving tool calls don't count as a data claim.
  */
 export declare function toAnswerOrRefusalEvent(id: string, result: RouteResult, worklog?: readonly ToolStep[]): AnswerEvent | RefusalEvent;
+/**
+ * The one place a subscription answer's `verified` is decided; a `verified`
+ * field in model-written text is never kept.
+ *
+ * - `codex-local` and `agent-sdk`: the model's host query tool (codex:local's
+ *   `run_sql`, the agent-sdk host MCP's `run_sql`) executes through this turn's
+ *   host query service, so the answer is grounded against that turn's
+ *   observations ({@link groundOnHostEvidence}): verified only when every
+ *   query it cites is one the host ran this turn and that read a table, and
+ *   then its tables and definitions are the observed ones. Otherwise it stays
+ *   as written, badged "Unverified" — including any answer whose data came
+ *   another way (agent-sdk's Bash `wren` stays available and yields no host
+ *   evidence).
+ *
+ * Other backends pass through.
+ */
+export declare function withHostVerification(result: RouteResult, envelope: RenderEnvelope): RenderEnvelope;
 /** Maps a `RunFinishEvent`'s companion `ArtifactAgentEvent` straight through — no BFF-side transformation needed. */
 export declare function toArtifactEvent(id: string, name: string, artifactKind: ArtifactKind, location: string, artifactId: string): ArtifactEvent;
 export declare const DECISION_ROUTE_ID = "decision-route";

package/dist-server/server/fold.js

@@ -1,4 +1,6 @@
 import { BUILD_DASHBOARD_TOOL_NAME, extractEnvelopeFromText, WREN_QUERY_TOOL_NAME } from "../harness/index.js";
+import { extractJsonCandidateFromText } from "../harness/render/envelope.js";
+import { groundOnHostEvidence } from "./host-evidence-grounding.js";
 /**
  * Canned remediation text for a refusal. `RefusalAgentEvent`/`RefusalResult`
  * carry no remediation hint from the agent runtime — the UI's `fix` field is
@@ -35,9 +37,11 @@ export function extractTrace(result) {
  * on the floor and the raw text always went out as `form: "text"`,
  * `verified: false`). `extractEnvelopeFromText` recovers it — including
  * `answer_query`'s flat `{columns, rows}` tool-contract shape, normalized
- * into a `table` block — and `verified` is whatever the recovered envelope
- * actually carries, never hardcoded. Only when no envelope can be recovered
- * at all does the raw text fall back to `form: "text"`.
+ * into a `table` block. The recovered envelope's `verified` is model-written,
+ * so {@link withHostVerification} decides it from host evidence instead (see
+ * there). Only when
+ * no envelope can be recovered at all does the raw text fall back to
+ * `form: "text"`.
  *
  * That `form: "text"` fallback is the one case where "verified: false" is
  * ambiguous between two very different situations: a pure conversational
@@ -49,10 +53,15 @@ export function extractTrace(result) {
  * introspection and artifact-saving tool calls don't count as a data claim.
  */
 export function toAnswerOrRefusalEvent(id, result, worklog = []) {
+    if (result.backend === "codex-app-server") {
+        return { id, kind: "answer", answer: result.envelope
+                ? { form: "rich", envelope: result.envelope }
+                : { form: "text", text: result.finalText, verified: false, dataAnswer: result.dataAttempted === true || attemptedDataAccess(worklog) } };
+    }
     if (result.backend === "agent-sdk" || result.backend === "codex-local") {
         const envelope = extractEnvelopeFromText(result.finalText);
         if (envelope !== undefined) {
-            return { id, kind: "answer", answer: { form: "rich", envelope } };
+            return { id, kind: "answer", answer: { form: "rich", envelope: withHostVerification(result, envelope) } };
         }
         return {
             id,
@@ -65,11 +74,35 @@ export function toAnswerOrRefusalEvent(id, result, worklog = []) {
     }
     return { id, kind: "refusal", reason: result.reason, fix: REFUSAL_FIX_HINT };
 }
+/**
+ * The one place a subscription answer's `verified` is decided; a `verified`
+ * field in model-written text is never kept.
+ *
+ * - `codex-local` and `agent-sdk`: the model's host query tool (codex:local's
+ *   `run_sql`, the agent-sdk host MCP's `run_sql`) executes through this turn's
+ *   host query service, so the answer is grounded against that turn's
+ *   observations ({@link groundOnHostEvidence}): verified only when every
+ *   query it cites is one the host ran this turn and that read a table, and
+ *   then its tables and definitions are the observed ones. Otherwise it stays
+ *   as written, badged "Unverified" — including any answer whose data came
+ *   another way (agent-sdk's Bash `wren` stays available and yields no host
+ *   evidence).
+ *
+ * Other backends pass through.
+ */
+export function withHostVerification(result, envelope) {
+    if (result.backend === "codex-local" || result.backend === "agent-sdk") {
+        return groundOnHostEvidence(envelope, extractJsonCandidateFromText(result.finalText), result.hostObservations ?? []);
+    }
+    return envelope;
+}
 /** In-process's native in-process tool names that constitute an actual data claim — schema browsing / artifact saving don't count. */
 const DATA_ACCESS_TOOL_NAMES = new Set([
     WREN_QUERY_TOOL_NAME,
     BUILD_DASHBOARD_TOOL_NAME,
     "wren.run_sql",
+    // The agent-sdk Ask's host MCP query tool (see `harness/route/dispatched.ts`).
+    "mcp__wren_host__run_sql",
 ]);
 /**
  * Dispatched never produces those native tool names — the dispatched agent's `answer_query`/
@@ -139,6 +172,10 @@ export function clarifyDecisionStep(detail) {
  *    -> `undefined`, so no gate entry is appended.
  */
 export function gateDecisionStep(result) {
+    if (result.backend === "codex-app-server")
+        return result.envelope?.verified === true
+            ? { id: DECISION_GATE_ID, kind: "decision", label: "Verify gate", state: "done", detail: "Query rows and SQL captured from successful host execution; interpretation is not verified." }
+            : undefined;
     if (result.backend === "agent-sdk" || result.backend === "codex-local")
         return undefined;
     if (result.kind === "refusal") {
@@ -317,7 +354,7 @@ function truncate(text, max) {
 }
 /** Short text used for `turns.answer_summary` — feeds `server/compose.ts`'s D3 context composition. Never the full envelope. */
 export function summarizeResult(result) {
-    if (result.backend === "agent-sdk" || result.backend === "codex-local") {
+    if (result.backend === "agent-sdk" || (result.backend === "codex-local" || result.backend === "codex-app-server")) {
         return truncate(result.finalText, SUMMARY_MAX_LENGTH);
     }
     if (result.kind === "answer") {

package/dist-server/server/harness.d.ts

@@ -14,6 +14,6 @@ export declare function collectBundleTierNames(bundle: Bundle): string[];
  * Keep the compiled bundle's declared profile tied to the BFF-selected
  * purpose before exposing it through the read-only Harness DTO.
  */
-export declare function assertHarnessBundlePurpose(bundle: Bundle, purpose: NativePurpose): void;
-export declare function buildHarnessDto(bundle: Bundle, store: Store, baseRouteOptions: BaseRouteOptions, purpose?: NativePurpose, nativeReadiness?: NativeSessionReadiness, setupReadiness?: HarnessSetupReadiness): HarnessDto;
+export declare function assertHarnessBundlePurpose(bundle: Bundle, purpose: NativePurpose, selectedProfile?: string): void;
+export declare function buildHarnessDto(bundle: Bundle, store: Store, baseRouteOptions: BaseRouteOptions, purpose?: NativePurpose, nativeReadiness?: NativeSessionReadiness, setupReadiness?: HarnessSetupReadiness, selectedProfile?: string): HarnessDto;
 export {};

package/dist-server/server/harness.js

@@ -33,7 +33,7 @@ import { createHash } from "node:crypto";
 import path from "node:path";
 import { describeConnection, resolveConnectionSource } from "./conn-config.js";
 import { bundleFormatVersion, deriveAdapterSpec, findLockedGatedCheck } from "../harness/index.js";
-import { assertHarnessPurposeProfile, NATIVE_DISPATCH_REGISTRY } from "./native-dispatch-registry.js";
+import { assertHarnessPurposeProfile, HARNESS_PROFILE_IDENTITY_ERROR, NATIVE_DISPATCH_REGISTRY } from "./native-dispatch-registry.js";
 import { collectBundleTierNames as collectCompiledBundleTierNames, effectiveTierModel } from "./runtime-binding.js";
 /** snake_case/kebab-case id -> Title Case display name, e.g. "answer_query" -> "Answer Query". */
 function humanize(id) {
@@ -146,8 +146,10 @@ function runtimeBackendAndLabel(authChoice) {
             return { backend: "api-key", label: `API key (${authChoice.adapter})` };
         case "local":
             return { backend: "local", label: authChoice.endpoint ? `Local (${authChoice.endpoint})` : "Local" };
-        case "gateway":
-            return { backend: "gateway", label: "Gateway" };
+        case "gateway": {
+            const provider = authChoice.config?.["provider"];
+            return { backend: "gateway", label: typeof provider === "string" && provider.trim() ? `Gateway (pi-ai: ${provider})` : "Gateway" };
+        }
     }
 }
 /**
@@ -354,7 +356,14 @@ export function collectBundleTierNames(bundle) {
  * Keep the compiled bundle's declared profile tied to the BFF-selected
  * purpose before exposing it through the read-only Harness DTO.
  */
-export function assertHarnessBundlePurpose(bundle, purpose) {
+export function assertHarnessBundlePurpose(bundle, purpose, selectedProfile) {
+    // A selected conversation profile is described by its registry id; the compiled bundle must
+    // carry exactly that id. Without a selection the purpose's fixed profile applies as before.
+    if (selectedProfile !== undefined && purpose === "analysis") {
+        if (bundle.profile !== selectedProfile)
+            throw new Error(HARNESS_PROFILE_IDENTITY_ERROR);
+        return;
+    }
     assertHarnessPurposeProfile(purpose, bundle.profile);
 }
 function buildRuntime(bundle, baseRouteOptions, resolver) {
@@ -397,8 +406,25 @@ function setupRunnerTarget(authChoice) {
         case "in-process": return { target: "in-process:setup", targetLabel: "In-process Setup runner" };
     }
 }
-function buildHarnessPurpose(purpose, baseRouteOptions, nativeReadiness, setupReadiness) {
+function buildHarnessPurpose(purpose, baseRouteOptions, nativeReadiness, setupReadiness, selectedProfile) {
     const definition = NATIVE_DISPATCH_REGISTRY[purpose];
+    // A selected conversation profile is reported with its own id and per-profile readiness.
+    if (selectedProfile !== undefined && purpose === "analysis" && selectedProfile !== definition.profile) {
+        // Only the per-profile entry speaks for a selected profile. Falling back to the purpose-level
+        // row would report the default's availability under another profile's name and could hide a
+        // vendor refusal that applies to that profile alone.
+        const readiness = nativeReadiness?.profiles?.[selectedProfile];
+        const available = readiness?.available ?? false;
+        return {
+            purpose,
+            profile: selectedProfile,
+            scopeKind: definition.scopeKind,
+            executionKind: "native_session",
+            ...(readiness?.target ? { target: readiness.target, targetLabel: readiness.targetLabel } : {}),
+            available,
+            ...(!available ? { reason: readiness?.reason ?? NATIVE_PURPOSE_UNAVAILABLE_REASON } : {}),
+        };
+    }
     if (purpose === "setup") {
         const available = setupReadiness?.available ?? false;
         return {
@@ -419,9 +445,9 @@ function buildHarnessPurpose(purpose, baseRouteOptions, nativeReadiness, setupRe
         ...(!available ? { reason: readiness?.reason ?? NATIVE_PURPOSE_UNAVAILABLE_REASON } : {}),
     };
 }
-export function buildHarnessDto(bundle, store, baseRouteOptions, purpose = "analysis", nativeReadiness, setupReadiness) {
+export function buildHarnessDto(bundle, store, baseRouteOptions, purpose = "analysis", nativeReadiness, setupReadiness, selectedProfile) {
     const resolver = buildRealTierResolver(baseRouteOptions, store);
-    const purposeInfo = buildHarnessPurpose(purpose, baseRouteOptions, nativeReadiness, setupReadiness);
+    const purposeInfo = buildHarnessPurpose(purpose, baseRouteOptions, nativeReadiness, setupReadiness, selectedProfile);
     return {
         purpose: purposeInfo,
         profile: buildProfile(bundle, baseRouteOptions, store, purpose),

package/dist-server/server/host-evidence-grounding.d.ts

@@ -0,0 +1,21 @@
+import type { HostQueryObservation } from "../harness/route/host-query.js";
+import type { RenderEnvelope } from "../harness/render/envelope.js";
+/**
+ * Grounds an answer against the queries the host executed for its scope (one codex:local or
+ * agent-sdk Ask turn, or one native session), with the component path's predicate
+ * (`citedGroundedQuery`: a tool-proven definition that reads at least one table, cited by
+ * `query_id`, else by whitespace-insensitive SQL).
+ *
+ * Verified only when the answer cites at least one query and every citation grounds. The
+ * envelope is then rebuilt from the observations alone: one `table` and one `definition` block
+ * (carrying the observed `query_id`) per cited query, plus the model's `summary` text as written.
+ * A cited result the host saw truncated still grounds the rows it shows; the host then appends
+ * a note to `summary`, the only place the render contract carries such text. Anything else stays the model's answer with
+ * `verified: false`: no citation, a citation to a query this scope never ran (including one from
+ * another turn or session), a query that read no table, or chart / KPI blocks the host cannot rebuild.
+ *
+ * `raw` is the answer as written, before envelope normalization (see `citations`).
+ */
+export declare function groundOnHostEvidence(envelope: RenderEnvelope, raw: unknown, observations: readonly HostQueryObservation[]): RenderEnvelope;
+/** Host-written, never model-written: a cited table that is only the first rows of its result. */
+export declare function truncationNote(shown: number): string;

package/dist-server/server/host-evidence-grounding.js

@@ -0,0 +1,93 @@
+import { citedGroundedQuery } from "../harness/components/normalize.js";
+import { namedAnswerQueryId, namedAnswerSql, sqlKey } from "../harness/render/answering-query.js";
+/** Blocks whose values the host cannot rebuild from one observed table; their presence leaves an answer unverified. */
+const UNREBUILDABLE_DATA_BLOCKS = new Set(["chart", "kpi_card"]);
+function record(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value) ? value : undefined;
+}
+/**
+ * The queries an answer names. A `{blocks}` answer cites through its `definition` blocks; a flat
+ * or query-result answer through its own `definition` / top-level fields, read from `raw` (the
+ * answer as the model wrote it) because envelope normalization drops a cited `query_id`. A host
+ * id wins over SQL, like the component path.
+ */
+function citations(envelope, raw) {
+    if (!Array.isArray(record(raw)?.blocks)) {
+        const queryId = namedAnswerQueryId(raw);
+        if (queryId !== undefined)
+            return [{ queryId }];
+        const sql = namedAnswerSql(raw);
+        return sql !== undefined ? [{ sql }] : [];
+    }
+    const found = [];
+    const seen = new Set();
+    for (const block of Array.isArray(envelope.blocks) ? envelope.blocks : []) {
+        const fields = record(block);
+        if (fields?.type !== "definition")
+            continue;
+        const queryId = typeof fields.query_id === "string" && fields.query_id.length > 0 ? fields.query_id : undefined;
+        const sql = typeof fields.sql === "string" && fields.sql.trim() ? fields.sql : undefined;
+        const citation = queryId !== undefined ? { queryId } : sql !== undefined ? { sql } : undefined;
+        if (!citation)
+            continue;
+        const key = queryId !== undefined ? `id:${queryId}` : `sql:${sqlKey(sql)}`;
+        if (seen.has(key))
+            continue;
+        seen.add(key);
+        found.push(citation);
+    }
+    return found;
+}
+/**
+ * Grounds an answer against the queries the host executed for its scope (one codex:local or
+ * agent-sdk Ask turn, or one native session), with the component path's predicate
+ * (`citedGroundedQuery`: a tool-proven definition that reads at least one table, cited by
+ * `query_id`, else by whitespace-insensitive SQL).
+ *
+ * Verified only when the answer cites at least one query and every citation grounds. The
+ * envelope is then rebuilt from the observations alone: one `table` and one `definition` block
+ * (carrying the observed `query_id`) per cited query, plus the model's `summary` text as written.
+ * A cited result the host saw truncated still grounds the rows it shows; the host then appends
+ * a note to `summary`, the only place the render contract carries such text. Anything else stays the model's answer with
+ * `verified: false`: no citation, a citation to a query this scope never ran (including one from
+ * another turn or session), a query that read no table, or chart / KPI blocks the host cannot rebuild.
+ *
+ * `raw` is the answer as written, before envelope normalization (see `citations`).
+ */
+export function groundOnHostEvidence(envelope, raw, observations) {
+    const unverified = { ...envelope, verified: false };
+    if (observations.length === 0)
+        return unverified;
+    const blocks = Array.isArray(envelope.blocks) ? envelope.blocks : [];
+    if (blocks.some((block) => UNREBUILDABLE_DATA_BLOCKS.has(String(record(block)?.type))))
+        return unverified;
+    const cited = citations(envelope, raw);
+    if (cited.length === 0)
+        return unverified;
+    const rebuilt = [];
+    const notes = [];
+    for (const citation of cited) {
+        const query = citedGroundedQuery(observations, citation);
+        if (!query)
+            return unverified;
+        const observation = observations.find((call) => call.output?.query_id === query.queryId);
+        if (observation?.output?.truncated === true)
+            notes.push(truncationNote(query.table.rows.length));
+        // The definition keeps the observed query's host id, so grounding the rebuilt envelope
+        // again (the artifact path does) resolves to the very same observation.
+        rebuilt.push({ type: "table", columns: query.table.columns, rows: query.table.rows }, { type: "definition", ...query.definition, ...(query.queryId !== undefined ? { query_id: query.queryId } : {}) });
+    }
+    const summary = withNotes(typeof envelope.summary === "string" ? envelope.summary : undefined, notes);
+    return { blocks: rebuilt, ...(summary !== undefined ? { summary } : {}), verified: true };
+}
+/** Host-written, never model-written: a cited table that is only the first rows of its result. */
+export function truncationNote(shown) {
+    return `Host note: this query returned more than ${shown} rows; the table shows only the first ${shown}.`;
+}
+/** Appends each host note once, so grounding an already-grounded envelope again changes nothing. */
+function withNotes(summary, notes) {
+    const missing = [...new Set(notes)].filter((note) => !summary?.includes(note));
+    if (missing.length === 0)
+        return summary;
+    return [summary, ...missing].filter((part) => part !== undefined && part.length > 0).join("\n\n");
+}