modelrig 0.1.0 → 0.2.0

package/dist/watch/evaluate.d.ts

@@ -14,6 +14,7 @@
  * the same facts produces the same hashes, and the control-plane unique
  * index (route, trigger_hash) makes duplicates a no-op.
  */
+import type { CacheHysteresisConfig, CacheVerdict, EffectiveRates, ObservedCacheRates } from "../registry/effective-rate";
 export interface CandidateEconomics {
     readonly provider: string;
     readonly model: string;
@@ -41,9 +42,85 @@ export type WatchEvent = {
 export interface WatchConfig {
     /** Material-shift threshold in percent (spec default ±10). */
     readonly thresholdPct: number;
+    /** Cache-aware hysteresis (cache-aware-routing spec §4.3) — the absolute
+     * per-call floor and relative window-spend threshold a cache-adjusted swap
+     * must clear to be `cache_positive`. OPTIONAL & additive: absent ⇒
+     * `DEFAULT_CACHE_HYSTERESIS`. Same home as `thresholdPct`, distinct numbers —
+     * the price-move threshold and the cache-swap hysteresis are different gates. */
+    readonly cacheHysteresis?: CacheHysteresisConfig;
 }
-/** Trigger payload persisted on the proposal row (jsonb). */
-export interface ProposalTrigger {
+/** Trigger payload persisted on the proposal row (jsonb). A discriminated union
+ * on `type`: the watch loop's price/model economics triggers, the Monitor's
+ * conform-rate degradation trigger (E4 chunk B), and the Rig Analyst's cluster
+ * findings (E6 chunk A). The watch/monitor triggers keep KIND `bakeoff`; the
+ * Analyst's triggers ride the widened kinds (`insight`/`promote-eval`) or reuse
+ * `bakeoff` for an Analyst-initiated bake-off — all through the SAME proposals
+ * machinery and the SAME `submitDrafts` seam (trajectory F1/F4, one emission path). */
+export type ProposalTrigger = EconomicsTrigger | ConformDegradationTrigger | AnalystClusterTrigger | AnalystPromoteEvalTrigger | AnalystBakeoffTrigger;
+/** The measured statistics behind one Analyst cluster — all deterministic. */
+export interface AnalystClusterStats {
+    /** Runs in this (task, cluster) over the window. */
+    readonly runs: number;
+    /** This cluster's fail rate, 0..1 (run-outcome@v1 verdicts). */
+    readonly failRate: number;
+    /** The org's window-wide fail rate, 0..1 — the salience baseline. */
+    readonly windowFailRate: number;
+    /** failRate − windowFailRate, in percentage POINTS (the salience margin). */
+    readonly failPtsOverWindow: number;
+    /** Feedback down-rate for the task, 0..1 (downs / (ups+downs)); 0 when none. */
+    readonly downRate: number;
+    /** Feedback signals (ups+downs) behind `downRate` — the min-n gate input. */
+    readonly feedbackN: number;
+    /** The dominant run-outcome failure_class label for the cluster, or null. */
+    readonly dominantFailureClass: string | null;
+}
+/** One reporting cluster → the `insight` proposal's trigger. `clusterKey` is the
+ * within-task discriminator (`fail:<class>` | `feedback` | `ok`); the window END
+ * (quantized to day) is what the trigger_hash keys on so re-runs dedupe. */
+export interface AnalystClusterTrigger {
+    readonly type: "analyst_cluster";
+    readonly task: string;
+    readonly clusterKey: string;
+    /** Trailing window bounds — inclusive-from / exclusive-to ISO days. */
+    readonly windowFrom: string;
+    readonly windowTo: string;
+    readonly stats: AnalystClusterStats;
+    /** Exemplar run ids (≤10) so a human can open the E2 run pages. */
+    readonly exemplarRunIds: readonly string[];
+}
+/** A failing cluster's promotable failing artifacts → the `promote-eval`
+ * proposal's trigger. Approving iterates `candidates` through the EXISTING
+ * promote path (≤ ANALYST_PROMOTE_MAX items). `task` is what each promote records. */
+export interface AnalystPromoteEvalTrigger {
+    readonly type: "analyst_promote_eval";
+    readonly task: string;
+    readonly clusterKey: string;
+    readonly windowFrom: string;
+    readonly windowTo: string;
+    readonly candidates: readonly AnalystPromoteCandidate[];
+}
+export interface AnalystPromoteCandidate {
+    readonly runId: string;
+    readonly artifactId: string;
+}
+/** A cluster on a route with a cheaper NON-serving candidate → an Analyst-
+ * initiated `bakeoff` proposal's trigger (the wedge motion). Only candidates the
+ * route already DECLARES may appear (STOP list: no novel challenger generation,
+ * that is E8). */
+export interface AnalystBakeoffTrigger {
+    readonly type: "analyst_bakeoff";
+    readonly task: string;
+    readonly route: string;
+    readonly clusterKey: string;
+    readonly windowFrom: string;
+    readonly windowTo: string;
+    /** The cheaper non-serving candidate the Analyst proposes baking off. */
+    readonly challenger: CandidateEconomics;
+    /** The route's current serving candidates (context for the human). */
+    readonly incumbents: readonly CandidateEconomics[];
+}
+/** Watch-loop trigger: a candidate's price moved, or a new model appeared. */
+export interface EconomicsTrigger {
     readonly type: "price_change" | "new_model";
     readonly provider: string;
     readonly model: string;
@@ -53,14 +130,96 @@ export interface ProposalTrigger {
     readonly newRates?: TokenRates;
     readonly pricing?: TokenRates | null;
 }
+/** One side of the degradation comparison (E4 chunk B) — a window's conform
+ * rate over its evaluations. Dates are inclusive-from / exclusive-to ISO days. */
+export interface ConformWindow {
+    readonly from: string;
+    readonly to: string;
+    readonly n: number;
+    readonly conformRate: number;
+}
+/** Monitor trigger (E4 chunk B): the recent window's deterministic conform rate
+ * fell below the trailing baseline by ≥ the ruled margin, with min-n met on both
+ * sides. Records BOTH windows + their ns so the evidence is self-explanatory. */
+export interface ConformDegradationTrigger {
+    readonly type: "conform_degradation";
+    readonly task: string;
+    readonly window: ConformWindow;
+    readonly baseline: ConformWindow;
+    /** The drop that flagged it, in percentage POINTS of conform rate. */
+    readonly dropPts: number;
+    readonly marginPts: number;
+    readonly minN: number;
+}
+/** The proposal-kind vocabulary. `bakeoff`/`swap` are the shipped watch/monitor
+ * kinds (00006); `insight`/`promote-eval` join for the Rig Analyst (E6, migration
+ * 00052 widens the DB CHECK to match). */
+export type ProposalKind = "bakeoff" | "swap" | "insight" | "promote-eval";
 export interface ProposalDraft {
     readonly route: string;
-    readonly kind: "bakeoff";
+    readonly kind: ProposalKind;
     readonly trigger: ProposalTrigger;
     readonly triggerHash: string;
     readonly expiresAt: string;
+    /** Evidence seeded AT INSERT (optional). The Rig Analyst embeds a new insight
+     * cluster's summary here (Chunk B) so the summary rides the same idempotent
+     * insert as the row — a duplicate (already-seen trigger_hash) is a no-op and
+     * never overwrites. Watch/monitor never set it. */
+    readonly evidence?: Record<string, unknown>;
 }
 export declare const PROPOSAL_TTL_DAYS = 30;
 export declare function triggerHash(route: string, trigger: ProposalTrigger): string;
 export declare function evaluateEvents(routes: readonly RouteEconomics[], events: readonly WatchEvent[], config: WatchConfig): ProposalDraft[];
+/** The §5.5 evidence block — every field the rendered explanation and the
+ * verdict need, in one self-describing object. Rates are per-Mtok (the surface
+ * unit); switch/option/spend quantities are USD. */
+export interface CacheContext {
+    readonly observed_hit_rate: number;
+    readonly observed_write_rate: number;
+    readonly window_days: number;
+    readonly incumbent_effective_in_per_mtok: number;
+    readonly challenger_cold_in_per_mtok: number;
+    readonly switch_cost_usd: number;
+    readonly cache_option_value_usd: number;
+    readonly breakeven_conformant_calls: number;
+    readonly verdict: CacheVerdict;
+}
+/** The inputs `buildCacheContext` needs — the incumbent's observed cache
+ * behavior + both candidates' rates + the switch geometry. Kept as explicit
+ * separate inputs (NOT a widened `watch/evaluate` local `TokenRates`) per the
+ * QA name-collision note: the effective blend takes the rollup and the rate
+ * cards as distinct arguments. */
+export interface CacheContextInput {
+    /** Incumbent's trailing-window observed cache rates (from `rollupCacheStats`). */
+    readonly observed: ObservedCacheRates;
+    readonly windowDays: number;
+    /** Incumbent (warm) rate card, USD/token. */
+    readonly incumbentRates: EffectiveRates;
+    /** Challenger (cold) rate card, USD/token. */
+    readonly challengerRates: EffectiveRates;
+    /** Warm prefix size the incumbent carries (tokens) — from the derived ledger. */
+    readonly incumbentPrefixTokens: number;
+    /** Expected remaining calls over which the decision amortizes. */
+    readonly remainingCalls: number;
+    /** Trailing-window spend on the route, USD — base of the relative bar. */
+    readonly windowSpendUsd: number;
+    /** True when the window carried ANY cache observation (read or write). When
+     * false the verdict is `no_cache_signal` regardless of the numbers. */
+    readonly hasCacheSignal: boolean;
+}
+/**
+ * Assemble the `cache_context` evidence block + verdict for a proposal (spec
+ * §5.5), pure. The verdict compares the incumbent's cache-ADJUSTED effective
+ * input rate against the challenger's COLD list rate, amortized over the switch
+ * cost, and gates on the hysteresis config. The advantage is measured PER
+ * CACHED PREFIX (the tokens the decision actually turns on), so a per-call
+ * dollar figure is directly comparable to the floor.
+ */
+export declare function buildCacheContext(input: CacheContextInput, config?: CacheHysteresisConfig): CacheContext;
+/**
+ * The [Briefing §30] rendered explanation — one prose line a human reads on the
+ * console and the `swap execute` approval prompt. Single-sourced here so the
+ * console, the CLI, and the OTLP span never phrase the same decision three ways.
+ */
+export declare function explainCacheContext(ctx: CacheContext, incumbentLabel: string, challengerLabel: string): string;
 //# sourceMappingURL=evaluate.d.ts.map

package/dist/watch/evaluate.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"evaluate.d.ts","sourceRoot":"","sources":["../../src/watch/evaluate.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAIH,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,UAAU,EAAE,SAAS,kBAAkB,EAAE,CAAC;CACpD;AAED,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;CAClC;AAED,MAAM,MAAM,UAAU,GAClB;IACE,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAC;IAC9B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,GAAG,EAAE,UAAU,CAAC;IACzB,QAAQ,CAAC,GAAG,EAAE,UAAU,CAAC;CAC1B,GACD;IACE,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC;IAC3B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,OAAO,EAAE,UAAU,GAAG,IAAI,CAAC;CACrC,CAAC;AAEN,MAAM,WAAW,WAAW;IAC1B,8DAA8D;IAC9D,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;CAC/B;AAED,6DAA6D;AAC7D,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,IAAI,EAAE,cAAc,GAAG,WAAW,CAAC;IAC5C,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,uDAAuD;IACvD,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,QAAQ,CAAC,EAAE,UAAU,CAAC;IAC/B,QAAQ,CAAC,QAAQ,CAAC,EAAE,UAAU,CAAC;IAC/B,QAAQ,CAAC,OAAO,CAAC,EAAE,UAAU,GAAG,IAAI,CAAC;CACtC;AAED,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IACzB,QAAQ,CAAC,OAAO,EAAE,eAAe,CAAC;IAClC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAED,eAAO,MAAM,iBAAiB,KAAK,CAAC;AAYpC,wBAAgB,WAAW,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,eAAe,GAAG,MAAM,CAE3E;AAMD,wBAAgB,cAAc,CAC5B,MAAM,EAAE,SAAS,cAAc,EAAE,EACjC,MAAM,EAAE,SAAS,UAAU,EAAE,EAC7B,MAAM,EAAE,WAAW,GAClB,aAAa,EAAE,CAoDjB"}
+{"version":3,"file":"evaluate.d.ts","sourceRoot":"","sources":["../../src/watch/evaluate.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAYH,OAAO,KAAK,EACV,qBAAqB,EACrB,YAAY,EACZ,cAAc,EACd,kBAAkB,EACnB,MAAM,4BAA4B,CAAC;AAEpC,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,UAAU,EAAE,SAAS,kBAAkB,EAAE,CAAC;CACpD;AAED,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;CAClC;AAED,MAAM,MAAM,UAAU,GAClB;IACE,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAC;IAC9B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,GAAG,EAAE,UAAU,CAAC;IACzB,QAAQ,CAAC,GAAG,EAAE,UAAU,CAAC;CAC1B,GACD;IACE,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC;IAC3B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,OAAO,EAAE,UAAU,GAAG,IAAI,CAAC;CACrC,CAAC;AAEN,MAAM,WAAW,WAAW;IAC1B,8DAA8D;IAC9D,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B;;;;qFAIiF;IACjF,QAAQ,CAAC,eAAe,CAAC,EAAE,qBAAqB,CAAC;CAClD;AAED;;;;;;uFAMuF;AACvF,MAAM,MAAM,eAAe,GACvB,gBAAgB,GAChB,yBAAyB,GACzB,qBAAqB,GACrB,yBAAyB,GACzB,qBAAqB,CAAC;AAQ1B,8EAA8E;AAC9E,MAAM,WAAW,mBAAmB;IAClC,oDAAoD;IACpD,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,gEAAgE;IAChE,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,qEAAqE;IACrE,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,6EAA6E;IAC7E,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;IACnC,gFAAgF;IAChF,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,6EAA6E;IAC7E,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,6EAA6E;IAC7E,QAAQ,CAAC,oBAAoB,EAAE,MAAM,GAAG,IAAI,CAAC;CAC9C;AAED;;4EAE4E;AAC5E,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,IAAI,EAAE,iBAAiB,CAAC;IACjC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,uEAAuE;IACvE,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,KAAK,EAAE,mBAAmB,CAAC;IACpC,mEAAmE;IACnE,QAAQ,CAAC,cAAc,EAAE,SAAS,MAAM,EAAE,CAAC;CAC5C;AAED;;sFAEsF;AACtF,MAAM,WAAW,yBAAyB;IACxC,QAAQ,CAAC,IAAI,EAAE,sBAAsB,CAAC;IACtC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,UAAU,EAAE,SAAS,uBAAuB,EAAE,CAAC;CACzD;AAED,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;CAC7B;AAED;;;kBAGkB;AAClB,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,IAAI,EAAE,iBAAiB,CAAC;IACjC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,yEAAyE;IACzE,QAAQ,CAAC,UAAU,EAAE,kBAAkB,CAAC;IACxC,sEAAsE;IACtE,QAAQ,CAAC,UAAU,EAAE,SAAS,kBAAkB,EAAE,CAAC;CACpD;AAED,8EAA8E;AAC9E,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,IAAI,EAAE,cAAc,GAAG,WAAW,CAAC;IAC5C,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,uDAAuD;IACvD,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,QAAQ,CAAC,EAAE,UAAU,CAAC;IAC/B,QAAQ,CAAC,QAAQ,CAAC,EAAE,UAAU,CAAC;IAC/B,QAAQ,CAAC,OAAO,CAAC,EAAE,UAAU,GAAG,IAAI,CAAC;CACtC;AAED;kFACkF;AAClF,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;CAC9B;AAED;;iFAEiF;AACjF,MAAM,WAAW,yBAAyB;IACxC,QAAQ,CAAC,IAAI,EAAE,qBAAqB,CAAC;IACrC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAC;IAC/B,QAAQ,CAAC,QAAQ,EAAE,aAAa,CAAC;IACjC,sEAAsE;IACtE,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB;AAED;;0CAE0C;AAC1C,MAAM,MAAM,YAAY,GAAG,SAAS,GAAG,MAAM,GAAG,SAAS,GAAG,cAAc,CAAC;AAE3E,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAC;IAC5B,QAAQ,CAAC,OAAO,EAAE,eAAe,CAAC;IAClC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B;;;uDAGmD;IACnD,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC7C;AAED,eAAO,MAAM,iBAAiB,KAAK,CAAC;AAYpC,wBAAgB,WAAW,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,eAAe,GAAG,MAAM,CAE3E;AAMD,wBAAgB,cAAc,CAC5B,MAAM,EAAE,SAAS,cAAc,EAAE,EACjC,MAAM,EAAE,SAAS,UAAU,EAAE,EAC7B,MAAM,EAAE,WAAW,GAClB,aAAa,EAAE,CAoDjB;AAUD;;oDAEoD;AACpD,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;IACnC,QAAQ,CAAC,mBAAmB,EAAE,MAAM,CAAC;IACrC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,+BAA+B,EAAE,MAAM,CAAC;IACjD,QAAQ,CAAC,2BAA2B,EAAE,MAAM,CAAC;IAC7C,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,sBAAsB,EAAE,MAAM,CAAC;IACxC,QAAQ,CAAC,0BAA0B,EAAE,MAAM,CAAC;IAC5C,QAAQ,CAAC,OAAO,EAAE,YAAY,CAAC;CAChC;AAED;;;;kCAIkC;AAClC,MAAM,WAAW,iBAAiB;IAChC,kFAAkF;IAClF,QAAQ,CAAC,QAAQ,EAAE,kBAAkB,CAAC;IACtC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,6CAA6C;IAC7C,QAAQ,CAAC,cAAc,EAAE,cAAc,CAAC;IACxC,8CAA8C;IAC9C,QAAQ,CAAC,eAAe,EAAE,cAAc,CAAC;IACzC,iFAAiF;IACjF,QAAQ,CAAC,qBAAqB,EAAE,MAAM,CAAC;IACvC,kEAAkE;IAClE,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,0EAA0E;IAC1E,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC;2EACuE;IACvE,QAAQ,CAAC,cAAc,EAAE,OAAO,CAAC;CAClC;AAID;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAC/B,KAAK,EAAE,iBAAiB,EACxB,MAAM,GAAE,qBAAgD,GACvD,YAAY,CA8Cd;AAED;;;;GAIG;AACH,wBAAgB,mBAAmB,CACjC,GAAG,EAAE,YAAY,EACjB,cAAc,EAAE,MAAM,EACtB,eAAe,EAAE,MAAM,GACtB,MAAM,CAaR"}

package/dist/watch/evaluate.js

@@ -19,7 +19,10 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.PROPOSAL_TTL_DAYS = void 0;
 exports.triggerHash = triggerHash;
 exports.evaluateEvents = evaluateEvents;
+exports.buildCacheContext = buildCacheContext;
+exports.explainCacheContext = explainCacheContext;
 const node_crypto_1 = require("node:crypto");
+const effective_rate_1 = require("../registry/effective-rate");
 exports.PROPOSAL_TTL_DAYS = 30;
 /** Reference token mix for blending input/output rates into one comparable
  * number: 3 input tokens per output token — a conservative, route-agnostic
@@ -92,3 +95,61 @@ function evaluateEvents(routes, events, config) {
     }
     return drafts;
 }
+const PER_MTOK = 1e6;
+/**
+ * Assemble the `cache_context` evidence block + verdict for a proposal (spec
+ * §5.5), pure. The verdict compares the incumbent's cache-ADJUSTED effective
+ * input rate against the challenger's COLD list rate, amortized over the switch
+ * cost, and gates on the hysteresis config. The advantage is measured PER
+ * CACHED PREFIX (the tokens the decision actually turns on), so a per-call
+ * dollar figure is directly comparable to the floor.
+ */
+function buildCacheContext(input, config = effective_rate_1.DEFAULT_CACHE_HYSTERESIS) {
+    const incumbentEff = (0, effective_rate_1.effectiveInputRate)(input.observed, input.incumbentRates);
+    const challengerCold = input.challengerRates.input;
+    // Switch cost of leaving the warm incumbent for the cold challenger, and the
+    // per-call saving the incumbent's warmth is worth (spec §4.2–4.3).
+    const switch_cost_usd = (0, effective_rate_1.switchCostUsd)(input.incumbentPrefixTokens, input.challengerRates, input.incumbentRates);
+    const perCallSaving = (0, effective_rate_1.perCallCacheSavingsUsd)(input.incumbentPrefixTokens, input.observed.h, input.incumbentRates);
+    const cache_option_value_usd = (0, effective_rate_1.cacheOptionValueUsd)(input.remainingCalls, perCallSaving);
+    const breakeven_conformant_calls = (0, effective_rate_1.breakevenCalls)(switch_cost_usd, perCallSaving);
+    // The cache-adjusted per-call advantage of the challenger over the incumbent,
+    // on the cached prefix: (incumbent effective − challenger cold) per prefix
+    // token, times the prefix. Positive ⇒ the cold challenger is still cheaper.
+    const perCallAdvantageUsd = (incumbentEff - challengerCold) * input.incumbentPrefixTokens;
+    const totalAdvantageUsd = perCallAdvantageUsd * Math.max(input.remainingCalls, 0);
+    const verdict = (0, effective_rate_1.classifyCacheVerdict)({
+        hasCacheSignal: input.hasCacheSignal,
+        perCallAdvantageUsd,
+        totalAdvantageUsd,
+        windowSpendUsd: input.windowSpendUsd,
+    }, config);
+    return {
+        observed_hit_rate: input.observed.h,
+        observed_write_rate: input.observed.w,
+        window_days: input.windowDays,
+        incumbent_effective_in_per_mtok: incumbentEff * PER_MTOK,
+        challenger_cold_in_per_mtok: challengerCold * PER_MTOK,
+        switch_cost_usd,
+        cache_option_value_usd,
+        breakeven_conformant_calls,
+        verdict,
+    };
+}
+/**
+ * The [Briefing §30] rendered explanation — one prose line a human reads on the
+ * console and the `swap execute` approval prompt. Single-sourced here so the
+ * console, the CLI, and the OTLP span never phrase the same decision three ways.
+ */
+function explainCacheContext(ctx, incumbentLabel, challengerLabel) {
+    const warmMtok = ctx.incumbent_effective_in_per_mtok.toFixed(2);
+    const coldMtok = ctx.challenger_cold_in_per_mtok.toFixed(2);
+    const hit = `${(ctx.observed_hit_rate * 100).toFixed(0)}%`;
+    const breakeven = Number.isFinite(ctx.breakeven_conformant_calls)
+        ? `breaks even after ${Math.ceil(ctx.breakeven_conformant_calls)} calls`
+        : "never breaks even";
+    return (`${incumbentLabel} is warm (${hit} hit rate, effective $${warmMtok}/Mtok in); ` +
+        `${challengerLabel} is nominally cheaper but cold ($${coldMtok}/Mtok in). ` +
+        `Switching costs $${ctx.switch_cost_usd.toFixed(4)} and ${breakeven}. ` +
+        `Verdict: ${ctx.verdict}.`);
+}

package/dist/watch/monitor.d.ts

@@ -0,0 +1,116 @@
+/**
+ * Monitor v1 — conform-rate degradation → bake-off proposal (Expansion E4 chunk B).
+ *
+ * The watch loop reacts to PRICE moves; the Monitor reacts to QUALITY moves. It
+ * rolls up the deterministic-eval conform rate per (org, task) into a daily
+ * series, and when a recent window falls below the trailing baseline by a ruled
+ * margin — with enough evaluations on BOTH sides to trust the number — it emits
+ * ONE `proposals` row (kind='bakeoff') asking for a re-evaluation. It reuses the
+ * ENTIRE existing proposals machinery: same table, same kind, same
+ * (route, trigger_hash) idempotency, same human-approval gate. No new proposal
+ * kind, no auto-actuation — the swap gate is untouched (spec §3.2).
+ *
+ * ── MEASURED-ONLY DOCTRINE ────────────────────────────────────────────────
+ * A degradation is proposed only from DETERMINISTIC evaluations (evaluator_kind
+ * = 'deterministic' — no model-judge softness), and only when BOTH windows clear
+ * `MONITOR_MIN_N`. Below that the rate is too noisy to act on: two failures can
+ * swing a small sample past the margin, and the house rule is to refuse rather
+ * than propose on thin data.
+ */
+import type { ProposalDraft } from "./evaluate";
+/** The recent window whose conformance we judge. A week smooths daily noise
+ * while staying responsive to a regression that just landed. */
+export declare const MONITOR_WINDOW_DAYS = 7;
+/** The trailing baseline the window is compared against — the 28 days
+ * immediately BEFORE the window (non-overlapping). Four weeks is a stable
+ * reference that predates a week-old regression; it matches the proposal TTL
+ * cadence, so a baseline never silently includes an unresolved degradation. */
+export declare const MONITOR_BASELINE_DAYS = 28;
+/** The drop, in percentage POINTS of conform rate, that flags a degradation.
+ * Mirrors the watch loop's ±10% material-shift threshold — one house number for
+ * "materially worse" — so the two loops speak the same language. */
+export declare const MONITOR_MARGIN_PTS = 10;
+/** Minimum deterministic evaluations required in EACH window before the rate is
+ * trustworthy enough to propose on (measured-only). */
+export declare const MONITOR_MIN_N = 20;
+export interface MonitorConfig {
+    readonly windowDays: number;
+    readonly baselineDays: number;
+    readonly marginPts: number;
+    readonly minN: number;
+}
+export declare const DEFAULT_MONITOR_CONFIG: MonitorConfig;
+/** One day's deterministic-eval counts for a task. `conformN` ≤ `n`. */
+export interface ConformDay {
+    readonly date: string;
+    readonly n: number;
+    readonly conformN: number;
+}
+export interface TaskConformSeries {
+    readonly task: string;
+    readonly days: readonly ConformDay[];
+}
+/** A single deterministic evaluation row for the rollup (server read shape). */
+export interface EvalRollupRow {
+    readonly artifactId: string;
+    readonly passed: boolean | null;
+    readonly createdAt: string;
+}
+/**
+ * Roll deterministic-eval rows up into per-(task) daily conform counts. The
+ * task comes from `taskByArtifact` (the caller joins artifacts→task locally,
+ * since artifact_evaluations carries only artifact_id). Rows whose artifact has
+ * no known task, or whose `passed` is null (not a pass/fail eval), are dropped.
+ */
+export declare function rollupConformRate(rows: readonly EvalRollupRow[], taskByArtifact: ReadonlyMap<string, string>): TaskConformSeries[];
+/**
+ * The degradation rule (measured-only). For each task, compare the recent
+ * window to the trailing baseline; emit a bake-off draft when the drop clears
+ * the margin AND both windows clear min-n. Deterministic over `now` (passed in,
+ * never read from the clock) so the fixture test is reproducible. The
+ * trigger_hash keys on the task + both window bounds, so re-running the SAME
+ * day is a no-op (the (route, trigger_hash) unique index dedupes it).
+ */
+export declare function evaluateConformDegradation(series: readonly TaskConformSeries[], now: Date, config?: MonitorConfig): ProposalDraft[];
+/**
+ * The reads a Monitor cycle needs, injected so the orchestrator is testable
+ * without a database. BOTH must be scoped to ONE org (the rollup groups by task
+ * within that scope — cross-org tasks sharing a name must never merge): a
+ * hosted cron iterates orgs, a self-host has exactly one.
+ */
+export interface MonitorReads {
+    /** Deterministic artifact evaluations created at/after `sinceIso`. */
+    readonly recentDeterministicEvals: (sinceIso: string) => Promise<readonly EvalRollupRow[]>;
+    /** task for each of the given artifact ids (the rollup join — artifact_evaluations
+     * carries only artifact_id). Only the ids that actually have evals are asked
+     * for, so the read stays bounded regardless of total artifact count. */
+    readonly taskFor: (artifactIds: readonly string[]) => Promise<ReadonlyMap<string, string>>;
+}
+export interface MonitorCycleResult {
+    readonly series: TaskConformSeries[];
+    readonly drafts: ProposalDraft[];
+    /** How many proposals the control plane actually created (0 when duplicates). */
+    readonly inserted: number;
+}
+/**
+ * One Monitor cycle: read the recent deterministic evals + task map, roll up,
+ * apply the degradation rule, and submit any drafts through the EXISTING
+ * proposals client (idempotent on (route, trigger_hash)). Returns the series +
+ * drafts + inserted count so a caller/CLI can report without a second query.
+ * Never actuates — submitting a proposal is the whole of its authority (§3.2).
+ */
+export declare function runMonitorCycle(reads: MonitorReads, submitDrafts: (drafts: readonly ProposalDraft[]) => Promise<number>, now: Date, config?: MonitorConfig): Promise<MonitorCycleResult>;
+export interface MonitorReadsConfig {
+    readonly supabaseUrl: string;
+    readonly serviceRoleKey: string;
+    /** The org this cycle runs for — reads are org-scoped so tasks never merge
+     * across tenants. A hosted cron iterates orgs; a self-host has exactly one. */
+    readonly orgId: string;
+    readonly fetchFn?: typeof fetch;
+}
+/** PostgREST reads for a Monitor cycle (service role; mirrors the proposals
+ * client). Two org-scoped queries, joined in-SDK by `runMonitorCycle` — no DDL,
+ * no view (spec §3.1). `taskFor` batches ids ≤100 (T9 — PostgREST URLs fail
+ * silently around 8KB). */
+export declare function createMonitorReads(config: MonitorReadsConfig): MonitorReads;
+//# sourceMappingURL=monitor.d.ts.map

package/dist/watch/monitor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"monitor.d.ts","sourceRoot":"","sources":["../../src/watch/monitor.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,KAAK,EAA4C,aAAa,EAAE,MAAM,YAAY,CAAC;AAG1F;gEACgE;AAChE,eAAO,MAAM,mBAAmB,IAAI,CAAC;AACrC;;;+EAG+E;AAC/E,eAAO,MAAM,qBAAqB,KAAK,CAAC;AACxC;;oEAEoE;AACpE,eAAO,MAAM,kBAAkB,KAAK,CAAC;AACrC;uDACuD;AACvD,eAAO,MAAM,aAAa,KAAK,CAAC;AAEhC,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB;AAED,eAAO,MAAM,sBAAsB,EAAE,aAKpC,CAAC;AAEF,wEAAwE;AACxE,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B;AAED,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,SAAS,UAAU,EAAE,CAAC;CACtC;AAED,gFAAgF;AAChF,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,MAAM,EAAE,OAAO,GAAG,IAAI,CAAC;IAChC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAYD;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAC/B,IAAI,EAAE,SAAS,aAAa,EAAE,EAC9B,cAAc,EAAE,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,GAC1C,iBAAiB,EAAE,CA0BrB;AAeD;;;;;;;GAOG;AACH,wBAAgB,0BAA0B,CACxC,MAAM,EAAE,SAAS,iBAAiB,EAAE,EACpC,GAAG,EAAE,IAAI,EACT,MAAM,GAAE,aAAsC,GAC7C,aAAa,EAAE,CAgCjB;AAED;;;;;GAKG;AACH,MAAM,WAAW,YAAY;IAC3B,sEAAsE;IACtE,QAAQ,CAAC,wBAAwB,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,SAAS,aAAa,EAAE,CAAC,CAAC;IAC3F;;4EAEwE;IACxE,QAAQ,CAAC,OAAO,EAAE,CAAC,WAAW,EAAE,SAAS,MAAM,EAAE,KAAK,OAAO,CAAC,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;CAC5F;AAED,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,MAAM,EAAE,iBAAiB,EAAE,CAAC;IACrC,QAAQ,CAAC,MAAM,EAAE,aAAa,EAAE,CAAC;IACjC,iFAAiF;IACjF,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B;AAED;;;;;;GAMG;AACH,wBAAsB,eAAe,CACnC,KAAK,EAAE,YAAY,EACnB,YAAY,EAAE,CAAC,MAAM,EAAE,SAAS,aAAa,EAAE,KAAK,OAAO,CAAC,MAAM,CAAC,EACnE,GAAG,EAAE,IAAI,EACT,MAAM,GAAE,aAAsC,GAC7C,OAAO,CAAC,kBAAkB,CAAC,CAU7B;AAED,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC;mFAC+E;IAC/E,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,KAAK,CAAC;CACjC;AAYD;;;2BAG2B;AAC3B,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,kBAAkB,GAAG,YAAY,CA6B3E"}

package/dist/watch/monitor.js

@@ -0,0 +1,199 @@
+"use strict";
+/**
+ * Monitor v1 — conform-rate degradation → bake-off proposal (Expansion E4 chunk B).
+ *
+ * The watch loop reacts to PRICE moves; the Monitor reacts to QUALITY moves. It
+ * rolls up the deterministic-eval conform rate per (org, task) into a daily
+ * series, and when a recent window falls below the trailing baseline by a ruled
+ * margin — with enough evaluations on BOTH sides to trust the number — it emits
+ * ONE `proposals` row (kind='bakeoff') asking for a re-evaluation. It reuses the
+ * ENTIRE existing proposals machinery: same table, same kind, same
+ * (route, trigger_hash) idempotency, same human-approval gate. No new proposal
+ * kind, no auto-actuation — the swap gate is untouched (spec §3.2).
+ *
+ * ── MEASURED-ONLY DOCTRINE ────────────────────────────────────────────────
+ * A degradation is proposed only from DETERMINISTIC evaluations (evaluator_kind
+ * = 'deterministic' — no model-judge softness), and only when BOTH windows clear
+ * `MONITOR_MIN_N`. Below that the rate is too noisy to act on: two failures can
+ * swing a small sample past the margin, and the house rule is to refuse rather
+ * than propose on thin data.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DEFAULT_MONITOR_CONFIG = exports.MONITOR_MIN_N = exports.MONITOR_MARGIN_PTS = exports.MONITOR_BASELINE_DAYS = exports.MONITOR_WINDOW_DAYS = void 0;
+exports.rollupConformRate = rollupConformRate;
+exports.evaluateConformDegradation = evaluateConformDegradation;
+exports.runMonitorCycle = runMonitorCycle;
+exports.createMonitorReads = createMonitorReads;
+const evaluate_1 = require("./evaluate");
+/** The recent window whose conformance we judge. A week smooths daily noise
+ * while staying responsive to a regression that just landed. */
+exports.MONITOR_WINDOW_DAYS = 7;
+/** The trailing baseline the window is compared against — the 28 days
+ * immediately BEFORE the window (non-overlapping). Four weeks is a stable
+ * reference that predates a week-old regression; it matches the proposal TTL
+ * cadence, so a baseline never silently includes an unresolved degradation. */
+exports.MONITOR_BASELINE_DAYS = 28;
+/** The drop, in percentage POINTS of conform rate, that flags a degradation.
+ * Mirrors the watch loop's ±10% material-shift threshold — one house number for
+ * "materially worse" — so the two loops speak the same language. */
+exports.MONITOR_MARGIN_PTS = 10;
+/** Minimum deterministic evaluations required in EACH window before the rate is
+ * trustworthy enough to propose on (measured-only). */
+exports.MONITOR_MIN_N = 20;
+exports.DEFAULT_MONITOR_CONFIG = {
+    windowDays: exports.MONITOR_WINDOW_DAYS,
+    baselineDays: exports.MONITOR_BASELINE_DAYS,
+    marginPts: exports.MONITOR_MARGIN_PTS,
+    minN: exports.MONITOR_MIN_N,
+};
+/** ISO day (YYYY-MM-DD) of a timestamp. */
+function dayOf(iso) {
+    return iso.slice(0, 10);
+}
+/** N days before `d`, as a YYYY-MM-DD day string. */
+function dayMinus(d, days) {
+    return new Date(d.getTime() - days * 86400000).toISOString().slice(0, 10);
+}
+/**
+ * Roll deterministic-eval rows up into per-(task) daily conform counts. The
+ * task comes from `taskByArtifact` (the caller joins artifacts→task locally,
+ * since artifact_evaluations carries only artifact_id). Rows whose artifact has
+ * no known task, or whose `passed` is null (not a pass/fail eval), are dropped.
+ */
+function rollupConformRate(rows, taskByArtifact) {
+    // task → day → {n, conformN}
+    const byTask = new Map();
+    for (const r of rows) {
+        if (r.passed === null)
+            continue;
+        const task = taskByArtifact.get(r.artifactId);
+        if (task === undefined)
+            continue;
+        const day = dayOf(r.createdAt);
+        let days = byTask.get(task);
+        if (days === undefined) {
+            days = new Map();
+            byTask.set(task, days);
+        }
+        const cell = days.get(day) ?? { n: 0, conformN: 0 };
+        cell.n += 1;
+        if (r.passed)
+            cell.conformN += 1;
+        days.set(day, cell);
+    }
+    return [...byTask.entries()]
+        .map(([task, days]) => ({
+        task,
+        days: [...days.entries()]
+            .map(([date, c]) => ({ date, n: c.n, conformN: c.conformN }))
+            .sort((a, b) => (a.date < b.date ? -1 : a.date > b.date ? 1 : 0)),
+    }))
+        .sort((a, b) => (a.task < b.task ? -1 : a.task > b.task ? 1 : 0));
+}
+/** Aggregate the days whose date is in [from, to) into one window. */
+function windowOf(days, from, to) {
+    let n = 0;
+    let conformN = 0;
+    for (const d of days) {
+        if (d.date >= from && d.date < to) {
+            n += d.n;
+            conformN += d.conformN;
+        }
+    }
+    return { from, to, n, conformRate: n > 0 ? conformN / n : 0 };
+}
+/**
+ * The degradation rule (measured-only). For each task, compare the recent
+ * window to the trailing baseline; emit a bake-off draft when the drop clears
+ * the margin AND both windows clear min-n. Deterministic over `now` (passed in,
+ * never read from the clock) so the fixture test is reproducible. The
+ * trigger_hash keys on the task + both window bounds, so re-running the SAME
+ * day is a no-op (the (route, trigger_hash) unique index dedupes it).
+ */
+function evaluateConformDegradation(series, now, config = exports.DEFAULT_MONITOR_CONFIG) {
+    const windowFrom = dayMinus(now, config.windowDays);
+    const windowTo = dayMinus(now, 0);
+    const baselineFrom = dayMinus(now, config.windowDays + config.baselineDays);
+    const baselineTo = windowFrom;
+    const expiresAt = new Date(now.getTime() + evaluate_1.PROPOSAL_TTL_DAYS * 86400000).toISOString();
+    const drafts = [];
+    for (const s of series) {
+        const window = windowOf(s.days, windowFrom, windowTo);
+        const baseline = windowOf(s.days, baselineFrom, baselineTo);
+        if (window.n < config.minN || baseline.n < config.minN)
+            continue; // thin data → refuse
+        const dropPts = (baseline.conformRate - window.conformRate) * 100;
+        if (dropPts < config.marginPts)
+            continue; // not materially worse
+        const trigger = {
+            type: "conform_degradation",
+            task: s.task,
+            window,
+            baseline,
+            dropPts,
+            marginPts: config.marginPts,
+            minN: config.minN,
+        };
+        drafts.push({
+            route: s.task,
+            kind: "bakeoff",
+            trigger,
+            triggerHash: (0, evaluate_1.triggerHash)(s.task, trigger),
+            expiresAt,
+        });
+    }
+    return drafts;
+}
+/**
+ * One Monitor cycle: read the recent deterministic evals + task map, roll up,
+ * apply the degradation rule, and submit any drafts through the EXISTING
+ * proposals client (idempotent on (route, trigger_hash)). Returns the series +
+ * drafts + inserted count so a caller/CLI can report without a second query.
+ * Never actuates — submitting a proposal is the whole of its authority (§3.2).
+ */
+async function runMonitorCycle(reads, submitDrafts, now, config = exports.DEFAULT_MONITOR_CONFIG) {
+    const sinceMs = now.getTime() - (config.windowDays + config.baselineDays) * 86400000;
+    const sinceIso = new Date(sinceMs).toISOString();
+    const rows = await reads.recentDeterministicEvals(sinceIso);
+    const ids = [...new Set(rows.map((r) => r.artifactId))];
+    const tasks = ids.length > 0 ? await reads.taskFor(ids) : new Map();
+    const series = rollupConformRate(rows, tasks);
+    const drafts = evaluateConformDegradation(series, now, config);
+    const inserted = drafts.length > 0 ? await submitDrafts(drafts) : 0;
+    return { series, drafts, inserted };
+}
+/** PostgREST reads for a Monitor cycle (service role; mirrors the proposals
+ * client). Two org-scoped queries, joined in-SDK by `runMonitorCycle` — no DDL,
+ * no view (spec §3.1). `taskFor` batches ids ≤100 (T9 — PostgREST URLs fail
+ * silently around 8KB). */
+function createMonitorReads(config) {
+    const base = config.supabaseUrl.replace(/\/$/, "");
+    const fetchFn = config.fetchFn ?? fetch;
+    const org = encodeURIComponent(config.orgId);
+    async function get(path) {
+        const res = await fetchFn(`${base}/rest/v1/${path}`, {
+            headers: { apikey: config.serviceRoleKey, authorization: `Bearer ${config.serviceRoleKey}` },
+        });
+        if (!res.ok)
+            throw new Error(`monitor read ${path} → ${res.status} ${await res.text().catch(() => "")}`);
+        return (await res.json().catch(() => []));
+    }
+    return {
+        async recentDeterministicEvals(sinceIso) {
+            const rows = await get(`artifact_evaluations?select=artifact_id,passed,created_at&org_id=eq.${org}` +
+                `&evaluator_kind=eq.deterministic&created_at=gte.${encodeURIComponent(sinceIso)}`);
+            return rows.map((r) => ({ artifactId: r.artifact_id, passed: r.passed, createdAt: r.created_at }));
+        },
+        async taskFor(artifactIds) {
+            const out = new Map();
+            for (let i = 0; i < artifactIds.length; i += 100) {
+                const batch = artifactIds.slice(i, i + 100).map(encodeURIComponent).join(",");
+                const rows = await get(`artifacts?select=id,task&org_id=eq.${org}&id=in.(${batch})`);
+                for (const r of rows)
+                    if (r.task !== null)
+                        out.set(r.id, r.task);
+            }
+            return out;
+        },
+    };
+}

package/dist/watch/proposals.d.ts

@@ -10,13 +10,13 @@
  * Transport is PostgREST with the service-role key — proposals are
  * control-plane-only state (cross-run truth, not per-inference telemetry).
  */
-import type { ProposalDraft, ProposalTrigger } from "./evaluate";
+import type { ProposalDraft, ProposalKind, ProposalTrigger } from "./evaluate";
 export type ProposalStatus = "suggested" | "evidenced" | "approved" | "rejected" | "executed" | "expired";
 export declare function assertTransition(from: ProposalStatus, to: ProposalStatus): void;
 export interface ProposalRecord {
     readonly id: string;
     readonly route: string;
-    readonly kind: "bakeoff" | "swap";
+    readonly kind: ProposalKind;
     readonly trigger: ProposalTrigger;
     readonly triggerHash: string;
     readonly evidence: Record<string, unknown> | null;
@@ -32,6 +32,18 @@ export interface ProposalRecord {
 export interface ProposalsClientConfig {
     readonly supabaseUrl: string;
     readonly serviceRoleKey: string;
+    /**
+     * The tenant this client writes for. When set (the multi-tenant hosted cron —
+     * managed-loop §2), `submitDrafts` STAMPS every row with this org and dedupes
+     * against the real `(org_id, route, trigger_hash)` unique index, and
+     * `expireOverdue` sweeps only THIS org's rows. When omitted (the CLI /
+     * self-host lane) behaviour is unchanged: `org_id` falls to its house-org
+     * column default and one deployment sweeps its own single tenant. Omitting it
+     * on a hosted cron would file every org's proposals under the house org — the
+     * whole reason this field exists. Reads keyed by id (`get`/`orgOf`/`decide`)
+     * are org-agnostic and unaffected; `list` already takes its org as a param.
+     */
+    readonly orgId?: string;
     readonly fetchFn?: typeof fetch;
 }
 export interface ProposalsClient {
@@ -50,8 +62,12 @@ export interface ProposalsClient {
      */
     list(orgId: string | null, status?: ProposalStatus): Promise<ProposalRecord[]>;
     get(id: string): Promise<ProposalRecord | null>;
-    /** Bake-off evidence + the suggested→evidenced flip, one PATCH. */
-    attachEvidence(id: string, evidence: Record<string, unknown>): Promise<void>;
+    /** Bake-off evidence + the suggested→evidenced flip, one status-scoped PATCH.
+     * Only a proposal still OPEN to evidence (suggested, or evidenced being
+     * re-run) matches — a terminal proposal (approved/executed/rejected/expired)
+     * matches zero rows, so evidence can never resurrect it. Returns false when
+     * nothing matched (already moved on), like `decide`. */
+    attachEvidence(id: string, evidence: Record<string, unknown>): Promise<boolean>;
     /** Validated status change (assertTransition is the caller's guard for
      * reads-before-writes; the PATCH is still status-scoped server-side). */
     setStatus(id: string, from: ProposalStatus, to: ProposalStatus): Promise<void>;