modelrig 0.8.1 → 0.10.0

package/dist/index.js

@@ -24,17 +24,20 @@ var __exportStar = (this && this.__exportStar) || function(m, exports) {
     for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.rawOnlyRouteFailure = exports.requireRoutesDir = exports.runRawStream = exports.runRaw = exports.hashResolvedBundle = exports.resolveRouteBundle = exports.bundleFromResolved = exports.runStream = exports.KEY_SHAPED_PREFIXES = exports.containsKeyShapedString = exports.scrubSecrets = exports.hasScope = exports.parseScopes = exports.redactApiKey = exports.looksLikeApiKey = exports.hashApiKeySecret = exports.API_KEY_SECRET_BYTES = exports.API_KEY_SCOPES = exports.API_KEY_PREFIX = exports.resolveArtifactsConfig = exports.resolveOtlpConfig = exports.parseOtlpHeaders = exports.decodeOtlpProtobufTraces = exports.looksLikeLogsPayload = exports.normalizeOtlpTraces = exports.startOtlpEmitterIfConfigured = exports.createOtlpEmitter = exports.TRACEPARENT_TAG = exports.parseTraceparent = exports.buildExportTraceRequest = exports.inferenceToSpan = exports.SEMCONV_VERSION = exports.SinkSendError = exports.createDirectSink = exports.createApiSink = exports.createTelemetryExporter = exports.RESERVED_TAG_KEYS = exports.resolvePipelineSha = exports.reservedTagNearMisses = exports.renderRequestForHash = exports.sanitizeMetaForWire = exports.isMetaSafeString = exports.summarizeAttemptMeta = exports.DEFAULT_INGEST_URL = exports.INGEST_PROTOCOL_VERSION_V1 = exports.INGEST_PROTOCOL_VERSION = exports.INGEST_PATH = exports.foreignOrgFeedback = exports.stampBatch = exports.loadConfigFromEnv = void 0;
-exports.readObjectLiteral = exports.findCallSitesInText = exports.scanRepoForCallSites = exports.capabilitiesFor = exports.routeNameFor = exports.buildMigrationMarkdown = exports.runInit = exports.renderConfigErrorForTerminal = exports.describeConfigFailure = exports.teachConfigError = exports.classifyConfigProblem = exports.CONFIG_TEACHING = exports.mergeLoadedRoutes = exports.loadRoutesWithExtra = exports.loadRoutes = exports.RouteConfigError = exports.renderFailureForTerminal = exports.teach = exports.FAILURE_TEACHING = exports.isRigFailure = exports.RigFailureError = exports.extractCitations = exports.createTavilySearchProvider = exports.sampleQuality = exports.pairedRegret = exports.wilson95 = exports.aggregateVariantMetrics = exports.OUTPUT_MAX_BYTES = exports.retentionExpiry = exports.truncateOutput = exports.selectArmsToKeep = exports.buildBakeoffSamples = exports.createBakeoffSamplesClient = exports.bakeoffEvidence = exports.computeProposal = exports.mirrorBakeoff = exports.runBakeoff = exports.replayVariant = exports.openTelemetryStore = exports.openCaptureStore = exports.SSE_DONE = exports.MODELRIG_REQUEST_HEADERS = exports.MODELRIG_HEADERS = exports.GATEWAY_PROTOCOL_VERSION = exports.MODELS_PATH = exports.CHAT_COMPLETIONS_PATH = exports.classifyLane = exports.ALL_CAPABILITY_FLAGS = exports.PROVIDER_IDS = exports.RAW_ONLY_FIX_HINT = void 0;
-exports.PROBE_FRESHNESS_SLO_DAYS = exports.stalenessSentence = exports.probeFreshness = exports.callNotesFor = exports.evaluateChallengerEligibility = exports.requirementPredicates = exports.PREDICATE_GLOSS = exports.ALL_CAPABILITY_PREDICATES = exports.explainEmptySelection = exports.hasCapability = exports.selectModels = exports.parseCapabilityQuery = exports.capabilityFactsFromEntry = exports.loadRegistryFacts = exports.fingerprintSchema = exports.loadManifest = exports.SNAPSHOT_BASIS = exports.describePricingV2 = exports.tierRates = exports.synthesizeFromFlat = exports.seededCachePolicyProviders = exports.getCachePolicy = exports.DEFAULT_CACHE_HYSTERESIS = exports.classifyCacheVerdict = exports.effectiveInputRate = exports.estimateCostUsd = exports.getPricingV2 = exports.getPricing = exports.resolveCandidates = exports.OPENAI_COMPAT_HOSTS = exports.shapeFireworksModelId = exports.classifyCompatFailure = exports.buildOpenAICompatParams = exports.createOpenAICompatAdapter = exports.createGrokAdapter = exports.createAnthropicAdapter = exports.createDeepSeekAdapter = exports.createOpenAIAdapter = exports.GEMINI_THINKING_CAPABLE_MODELS = exports.createGeminiAdapter = exports.PROVIDER_KEY_ENV = exports.serveabilityWarnings = exports.checkServeability = exports.writeRouteDraft = exports.buildRouteDraft = exports.splitModelKey = exports.seedCandidates = exports.loadRegistryRows = exports.signatureFor = exports.PROVIDER_SIGNATURES = void 0;
-exports.buildRestoreYaml = exports.buildSwapChange = exports.runTelemetryQuery = exports.RESERVED_DIMENSION_NAMES = exports.METRIC_COLUMNS = exports.DIMENSION_COLUMNS = exports.sinceIsoFor = exports.savedQueryById = exports.SAVED_QUERIES = exports.ANALYTICS_SCAN_CAP = exports.selectableColumnsAreMetaSafe = exports.planAnalyticsRead = exports.evaluateAnalyticsQuery = exports.describeAnalyticsSchema = exports.parseQuery = exports.QueryGrammarError = exports.compileQuery = exports.writePriorsCells = exports.aggregatePairwiseFromTelemetry = exports.aggregatePriors = exports.DEFAULT_WATCH_MONTHLY_USD = exports.watchEnvelopeKey = exports.reserveWatchBudget = exports.WATCH_STATE_KEY = exports.createFileWatchStateStore = exports.createControlPlaneWatchStateStore = exports.createWatchStateStore = exports.saveWatchState = exports.loadWatchState = exports.computeWatchEvents = exports.buildPriceUniverse = exports.runWatchCycle = exports.DEFAULT_MONITOR_CONFIG = exports.createMonitorReads = exports.rollupConformRate = exports.evaluateConformDegradation = exports.runMonitorCycle = exports.assertTransition = exports.createProposalsClient = exports.explainCacheContext = exports.PROPOSAL_TTL_DAYS = exports.manualChallengerTriggerHash = exports.triggerHash = exports.evaluateEvents = exports.RUNG1_MIN_FEEDBACK = exports.computeCoverage = exports.buildFeedbackRow = exports.computeParity = exports.factsUnderCredential = exports.factsFor = void 0;
-exports.computeOdometer = exports.createSwapsClient = exports.executeSwap = exports.trialVariantName = exports.buildDeclareTrialChange = void 0;
+exports.redactApiKey = exports.looksLikeApiKey = exports.hashApiKeySecret = exports.API_KEY_SECRET_BYTES = exports.API_KEY_SCOPES = exports.API_KEY_PREFIX = exports.resolveArtifactsConfig = exports.createToolRegistry = exports.SlotResolutionError = exports.assemblePrompt = exports.createEmbeddedPrompts = exports.createPromptResolver = exports.parseServedPrompt = exports.createPromptCache = exports.createApiPromptFetcher = exports.promptTemplateSha = exports.normalizeManifest = exports.parseAuthoringDoc = exports.assertValidManifest = exports.validateManifest = exports.resolveOtlpConfig = exports.parseOtlpHeaders = exports.decodeOtlpProtobufTraces = exports.looksLikeLogsPayload = exports.normalizeOtlpTraces = exports.startOtlpEmitterIfConfigured = exports.createOtlpEmitter = exports.TRACEPARENT_TAG = exports.parseTraceparent = exports.buildExportTraceRequest = exports.inferenceToSpan = exports.SEMCONV_VERSION = exports.SinkSendError = exports.createDirectSink = exports.createApiSink = exports.createTelemetryExporter = exports.RESERVED_TAG_KEYS = exports.resolvePipelineSha = exports.reservedTagNearMisses = exports.renderRequestForHash = exports.sanitizeMetaForWire = exports.isMetaSafeString = exports.summarizeAttemptMeta = exports.DEFAULT_INGEST_URL = exports.INGEST_PROTOCOL_VERSION_V1 = exports.INGEST_PROTOCOL_VERSION = exports.INGEST_PATH = exports.foreignOrgGrades = exports.stampBatch = exports.loadConfigFromEnv = void 0;
+exports.computeProposal = exports.mirrorBakeoff = exports.runBakeoff = exports.replayVariant = exports.openTelemetryStore = exports.openCaptureStore = exports.SSE_DONE = exports.MODELRIG_REQUEST_HEADERS = exports.MODELRIG_HEADERS = exports.GATEWAY_PROTOCOL_VERSION = exports.MODELS_PATH = exports.CHAT_COMPLETIONS_PATH = exports.classifyLane = exports.ALL_CAPABILITY_FLAGS = exports.PROVIDER_IDS = exports.RAW_ONLY_FIX_HINT = exports.rawOnlyRouteFailure = exports.requireRoutesDir = exports.runRawStream = exports.runRaw = exports.resolveCallConfigForRun = exports.hashUnitKey = exports.armName = exports.drawArm = exports.narrowExperiment = exports.pinFromResolved = exports.parseCallConfig = exports.narrowCallConfigPin = exports.getCallConfig = exports.createCallConfigResolver = exports.createApiCallConfigFetcher = exports.applyCallConfig = exports.assertMirrorSafe = exports.hashResolvedBundle = exports.resolveRouteBundle = exports.bundleFromResolved = exports.runStream = exports.evalCaseCaptureStore = exports.selectEvalCaseCaptures = exports.runBakeoffFromEvalCases = exports.extractEvidenceQuotes = exports.groundednessScore = exports.resolveDeterministicQuality = exports.fieldAccuracy = exports.exactMatch = exports.KEY_SHAPED_PREFIXES = exports.containsKeyShapedString = exports.scrubSecrets = exports.hasScope = exports.parseScopes = void 0;
+exports.servedDestinations = exports.DEFAULT_DESTINATION = exports.DESTINATIONS = exports.GEMINI_THINKING_CAPABLE_MODELS = exports.createGeminiAdapter = exports.PROVIDER_KEY_ENV = exports.serveabilityWarnings = exports.checkServeability = exports.writeRouteDraft = exports.buildRouteDraft = exports.splitModelKey = exports.seedCandidates = exports.loadRegistryRows = exports.signatureFor = exports.PROVIDER_SIGNATURES = exports.readObjectLiteral = exports.findCallSitesInText = exports.scanRepoForCallSites = exports.capabilitiesFor = exports.routeNameFor = exports.buildMigrationMarkdown = exports.runInit = exports.renderConfigErrorForTerminal = exports.describeConfigFailure = exports.teachConfigError = exports.classifyConfigProblem = exports.CONFIG_TEACHING = exports.mergeLoadedRoutes = exports.loadRoutesWithExtra = exports.loadRoutes = exports.RouteConfigError = exports.renderFailureForTerminal = exports.teach = exports.FAILURE_TEACHING = exports.isRigFailure = exports.RigFailureError = exports.extractCitations = exports.createTavilySearchProvider = exports.sampleQuality = exports.pairedRegret = exports.wilson95 = exports.aggregateVariantMetrics = exports.OUTPUT_MAX_BYTES = exports.retentionExpiry = exports.truncateOutput = exports.selectArmsToKeep = exports.buildBakeoffSamples = exports.createBakeoffSamplesClient = exports.deriveSwapDirection = exports.bakeoffEvidence = void 0;
+exports.PROPOSAL_TTL_DAYS = exports.regretBreachTriggerHash = exports.upgradeTriggerHash = exports.manualChallengerTriggerHash = exports.triggerHash = exports.evaluateEvents = exports.RUNG1_MIN_GRADES = exports.computeCoverage = exports.computeParity = exports.factsUnderCredential = exports.factsFor = exports.PROBE_FRESHNESS_SLO_DAYS = exports.stalenessSentence = exports.probeFreshness = exports.callNotesFor = exports.evaluateChallengerEligibility = exports.requirementPredicates = exports.PREDICATE_GLOSS = exports.ALL_CAPABILITY_PREDICATES = exports.explainEmptySelection = exports.hasCapability = exports.selectModels = exports.parseCapabilityQuery = exports.capabilityFactsFromEntry = exports.loadRegistryFacts = exports.fingerprintSchema = exports.loadManifest = exports.SNAPSHOT_BASIS = exports.describePricingV2 = exports.tierRates = exports.synthesizeFromFlat = exports.seededCachePolicyProviders = exports.getCachePolicy = exports.DEFAULT_CACHE_HYSTERESIS = exports.classifyCacheVerdict = exports.effectiveInputRate = exports.estimateCostUsd = exports.getPricingV2 = exports.getPricing = exports.resolveCandidates = exports.OPENAI_COMPAT_HOSTS = exports.shapeFireworksModelId = exports.classifyCompatFailure = exports.buildOpenAICompatParams = exports.createOpenAICompatAdapter = exports.createGrokAdapter = exports.createAnthropicAdapter = exports.createDeepSeekAdapter = exports.createOpenAIAdapter = exports.destinationSupported = void 0;
+exports.RESERVED_DIMENSION_NAMES = exports.METRIC_COLUMNS = exports.DIMENSION_COLUMNS = exports.sinceIsoFor = exports.savedQueryById = exports.SAVED_QUERIES = exports.ANALYTICS_SCAN_CAP = exports.selectableColumnsAreMetaSafe = exports.planAnalyticsRead = exports.evaluateAnalyticsQuery = exports.describeAnalyticsSchema = exports.parseQuery = exports.QueryGrammarError = exports.compileQuery = exports.writePriorsCells = exports.aggregatePairwiseFromTelemetry = exports.aggregatePriors = exports.DEFAULT_WATCH_MONTHLY_USD = exports.watchEnvelopeKey = exports.reserveWatchBudget = exports.WATCH_STATE_KEY = exports.createFileWatchStateStore = exports.createControlPlaneWatchStateStore = exports.createWatchStateStore = exports.saveWatchState = exports.loadWatchState = exports.computeWatchEvents = exports.buildPriceUniverse = exports.runWatchCycle = exports.DEFAULT_MONITOR_CONFIG = exports.createMonitorReads = exports.rollupConformRate = exports.evaluateConformDegradation = exports.runMonitorCycle = exports.assertTransition = exports.createProposalsClient = exports.MONITOR_SOURCE_PREFIX = exports.MONITOR_CYCLE_MARKER = exports.REGRET_MONITOR_MARGIN = exports.REGRET_MONITOR_MIN_N = exports.REGRET_MONITOR_BASELINE_DAYS = exports.REGRET_MONITOR_WINDOW_DAYS = exports.createRegretMonitorReads = exports.regretMonitorConfig = exports.cyclePointFromArtifact = exports.aggregateRegretBand = exports.evaluateRegretDrift = exports.runRegretMonitorCycle = exports.evaluateUpgradeOpportunities = exports.explainCacheContext = void 0;
+exports.computeOdometer = exports.createSwapsClient = exports.executeSwap = exports.trialVariantName = exports.buildDeclareTrialChange = exports.buildRestoreYaml = exports.buildSwapChange = exports.runTelemetryQuery = void 0;
 exports.createRig = createRig;
 const build_adapters_1 = require("./adapters/build-adapters");
+const config_1 = require("./config");
 const rawonly_1 = require("./run/rawonly");
 const resolved_bundle_1 = require("./routes/resolved-bundle");
 const serveability_1 = require("./routes/serveability");
 const manifest_1 = require("./routes/manifest");
+const tools_register_1 = require("./prompts/tools-register");
 const run_1 = require("./run/run");
 const stream_1 = require("./run/stream");
 const raw_1 = require("./run/raw");
@@ -51,13 +54,14 @@ const api_fetcher_1 = require("./settings/api-fetcher");
 const status_1 = require("./status");
 const deprecations_1 = require("./deprecations");
 const otlp_emitter_1 = require("./telemetry/otlp-emitter");
-const feedback_1 = require("./feedback/feedback");
+const grade_1 = require("./feedback/grade");
 const facts_1 = require("./registry/facts");
 const engine_1 = require("./bakeoff/engine");
 const replay_1 = require("./bakeoff/replay");
 const samples_1 = require("./bakeoff/samples");
-const eval_cases_1 = require("./bakeoff/eval-cases");
+const eval_cases_rig_1 = require("./bakeoff/eval-cases-rig");
 const verify_1 = require("./verify/verify");
+const arm_1 = require("./mask/arm");
 const provider_1 = require("./types/provider");
 const reference_1 = require("./bakeoff/reference");
 /** Per-variant replay spend ceiling when the caller doesn't set one. */
@@ -100,6 +104,13 @@ function createRig(config) {
         return registryFacts.flagsFor(provider, model, staticFlags) ?? staticFlags;
     };
     const telemetry = (0, store_1.openTelemetryStore)(config.telemetryDbPath);
+    const gradeApi = (0, grade_1.makeGradeApi)(telemetry); // rig.grade — the sole judgment write API (grade primitive)
+    // Control-plane settings resolver (§1.5) — api mode only; refreshes task
+    // settings on the exporter interval, fail-open, so a console flip is honored
+    // without a redeploy. null for local-only/direct (env/YAML their mechanism).
+    // Declared BEFORE the artifact wiring so the content-upload path can resolve
+    // scrub per task/account from it (P15 CP-3b).
+    const settings = (0, api_fetcher_1.startApiSettings)(config, exporter_1.DEFAULT_INTERVAL_MS);
     // Artifact / execution-graph namespace (Expansion E2) — bound to this rig's
     // telemetry buffer and gated by config. Disabled ⇒ run.start is a no-op, the
     // ambient run context is never set, and rig.run's auto-step is never reached.
@@ -110,6 +121,7 @@ function createRig(config) {
         buffer: telemetry,
         enabled: artifactsEnabled,
         artifactStore,
+        resolver: settings, // §1.5 per-task/account scrub source for the content-upload path (P15 CP-3b)
         ...(config.artifacts !== undefined ? { artifacts: config.artifacts } : {}),
     });
     // Local-only capture store (Phase 3/§1.5): a YAML opt-in OR api mode — a console flip needs a destination.
@@ -140,12 +152,9 @@ function createRig(config) {
             artifactsEnabled,
             artifactStore,
             ...(onArtifactsFlushed !== undefined ? { onArtifactsFlushed } : {}),
+            ...(config.expectOrg !== undefined ? { expectOrg: config.expectOrg } : {}),
         })
         : null;
-    // Control-plane settings resolver (§1.5) — api mode only; refreshes task
-    // settings on the exporter interval, fail-open, so a console flip is honored
-    // without a redeploy. null for local-only/direct (env/YAML their mechanism).
-    const settings = (0, api_fetcher_1.startApiSettings)(config, exporter_1.DEFAULT_INTERVAL_MS);
     // Boot banner (§2) + one-time deprecation warnings (§3): posture, plus a loud
     // notice if YAML `capture:` is being ignored under a control plane, or the
     // `direct` sink is in use. Silent for a pure local-only rig.
@@ -165,6 +174,16 @@ function createRig(config) {
         captures,
         search,
         settings, // §1.5 resolver (null local-only); capture-WRITE gate consults it
+        managedServingEnabled: config.managedServing === true, // U3 (D-2): `config.managedServing`, set IN CODE via createRig (NOT an env var); default off ⇒ `modelrig-served` fails closed pre-dispatch
+        // K1 (managed-serving-keyless §2/§3): the hosted-gateway serving transport,
+        // resolved from the SAME `api`-mode export the telemetry sink uses — the
+        // ingest host (MODELRIG_INGEST_URL ‖ default) as `baseUrl`, the `rig_sk_` key
+        // as the Bearer credential (NO provider key ever). Absent for local-only /
+        // direct rigs ⇒ a `modelrig-served` run fails closed (no control plane to
+        // serve it), never a silent `direct` fall back. Read ONLY on the served path.
+        ...(config.export?.mode === "api"
+            ? { serve: { baseUrl: config.export.ingestUrl, apiKey: config.export.apiKey } }
+            : {}),
         ...(config.envelopeBudgetUsd !== undefined
             ? { envelopeBudgetUsd: config.envelopeBudgetUsd }
             : {}),
@@ -189,15 +208,20 @@ function createRig(config) {
         return captures;
     }
     // Bake-off review-sample sink (addendum A3) — direct mode only (see buildDirectSamplesSink; undefined for api/local rigs). S7: scrubs input+output with the task ScrubMode before persist.
-    const samplesSink = config.export?.mode === "direct" ? (0, samples_1.buildDirectSamplesSink)({ ...config.export, resolver: settings, defaultScrub: config.artifacts?.content?.scrub ?? "off" }) : undefined;
+    const samplesSink = config.export?.mode === "direct" ? (0, samples_1.buildDirectSamplesSink)({ ...config.export, resolver: settings, defaultScrub: config.artifacts?.content !== undefined ? config_1.DEFAULT_CONTENT_SCRUB_MODE : "off" }) : undefined;
     const resolveReferenceAuto = (0, reference_1.makeReferenceAutoResolver)(config.registryPath); // RB-1 reference:auto
+    // PSR-2b (spec §4 ADJ-2): the client-fill tool registry backing rig.tools.
+    // One per rig; empty until the app calls rig.tools.register. In-process only —
+    // no network/telemetry reach, so bound tool keys never leave the process.
+    const tools = (0, tools_register_1.createToolRegistry)();
     return {
         serveability,
         capabilities,
         searchAvailable: search !== null && search !== undefined,
         artifacts: artifactNamespace,
+        tools,
         exporterStats: () => (exporter !== null ? exporter.stats() : { poisonSkipped: {} }),
-        status: () => (0, status_1.buildRigStatus)(config, settings?.snapshot() ?? new Map()),
+        status: () => (0, status_1.buildRigStatus)(config, settings?.snapshot() ?? new Map(), undefined, settings?.posture() ?? null),
         run(route, opts) {
             // Track the task (= route handle) so its control-plane settings stay
             // fresh on the exporter interval (§1.5). Fire-and-forget, fail-open.
@@ -226,11 +250,7 @@ function createRig(config) {
         runRawStream(input) {
             return (0, raw_1.runRawStream)(rawDeps, input);
         },
-        feedback(target, opts) {
-            const row = (0, feedback_1.buildFeedbackRow)(target, opts);
-            telemetry.recordFeedback(row);
-            return row;
-        },
+        grade: gradeApi.grade,
         replay(route, opts) {
             return (0, replay_1.replayVariant)(deps, captureStoreForReplay(), {
                 route,
@@ -249,34 +269,59 @@ function createRig(config) {
                 ...(opts.objectiveMode !== undefined ? { objectiveMode: opts.objectiveMode } : {}), resolveReferenceAuto,
             }, samplesSink);
         },
+        maskArm(route, opts) { return (0, arm_1.runMaskArmBakeoff)(deps, captureStoreForReplay(), { route, replayLast: opts.replayLast, envelopeUsd: opts.envelopeUsd ?? DEFAULT_REPLAY_ENVELOPE_USD }); },
         verifySwap(route, fixture, opts) {
             settings?.track(route);
             return (0, verify_1.verifySwap)(deps, { route, fixture, ...(opts?.envelopeUsd !== undefined ? { envelopeUsd: opts.envelopeUsd } : {}) });
         },
         bakeoffFromEvalCases(task, opts) {
-            return (0, eval_cases_1.runBakeoffFromEvalCases)(deps, { artifacts: artifactStore, telemetry, captures: captureStoreForReplay }, {
-                task,
-                variants: opts.variants,
-                envelopeUsdPerVariant: opts.envelopeUsdPerVariant ?? DEFAULT_REPLAY_ENVELOPE_USD, qualityGate: opts.qualityGate,
-                ...(opts.keepOutputs !== undefined ? { keepOutputs: opts.keepOutputs } : {}),
-                ...(opts.objectiveMode !== undefined ? { objectiveMode: opts.objectiveMode } : {}), resolveReferenceAuto,
-            }, samplesSink);
+            return (0, eval_cases_rig_1.runRigEvalCasesBakeoff)({ deps, stores: { artifacts: artifactStore, telemetry, captures: captureStoreForReplay }, task, samplesSink, resolveReferenceAuto, defaultEnvelopeUsd: DEFAULT_REPLAY_ENVELOPE_USD, opts });
+        },
+        bakeoffFromEvalCasesWith(bundle, stores, opts) {
+            // Overlay the caller's bundle so the engine's `deps.routes.get(task)`
+            // resolves the mirror-served route (the seam runBundle uses); the eval set
+            // + inputs + goldens all come from the INJECTED `stores`, never this rig's
+            // local artifact store or captures.
+            return (0, eval_cases_rig_1.runRigEvalCasesBakeoff)({ deps: { ...deps, routes: (0, resolved_bundle_1.singleRouteStore)(bundle) }, stores, task: bundle.route, samplesSink, resolveReferenceAuto, defaultEnvelopeUsd: DEFAULT_REPLAY_ENVELOPE_USD, opts });
         },
         close() {
             settings?.stop(); // stop the settings refresh loop (§1.5)
             // DRAIN FIRST, close stores LAST (H1): the final flush reads the artifact
             // store + captures — closing first lost the final rows (walkthrough 2026-08-20).
             const closeStores = () => { captures?.close(); artifactStore?.close(); telemetry.close(); };
+            // Content custody drains the SAME way (E2-C / E2E-1, finding 2026-08-30):
+            // a content upload is fire-and-forget off the customer's hot path, so a
+            // short-lived process (InferWealth calls close() once per run at
+            // run-pipeline-v3.ts:7251) can exit before the uploads land — the
+            // systematic 0 content_ref across every artifact, with the store proven
+            // configured and custody proven enabled. So await content completion here,
+            // the content analogue of the H1 telemetry drain, BEFORE closeStores():
+            //   1. flushContent() settles the in-flight uploads — the first attempt
+            //      404s ("metadata not yet durable") and queues a bounded retry, so
+            //      this is what populates the pending queue in the first place;
+            //   2. the telemetry drain below (exporter.stop()) makes those metadata
+            //      rows durable (its own post-flush hook retries some);
+            //   3. drainPendingContent() drains whatever the hook left, so the
+            //      now-durable uploads land instead of being abandoned at exit.
+            // flushContent/retryPendingContent NEVER throw; an inert or custody-off
+            // namespace is a no-op (contentPending stays 0). The queue is bounded by
+            // CONTENT_RETRY_BUDGET, so the drain loop always terminates.
+            const artifact = artifactNamespace.artifact;
+            const drainPendingContent = async () => {
+                while (artifact.coverage().contentPending > 0)
+                    await artifact.retryPendingContent();
+            };
             const stops = [];
             if (exporter !== null)
                 stops.push(exporter.stop());
             if (otlpEmitter !== null)
                 stops.push(otlpEmitter.stop());
-            if (stops.length > 0) {
-                return Promise.allSettled(stops).finally(closeStores).then(() => undefined);
-            }
-            closeStores();
-            return Promise.resolve();
+            return artifact
+                .flushContent() // settle in-flight uploads (populate the pending queue) FIRST
+                .then(() => Promise.allSettled(stops)) // H1 telemetry drain — rows become durable
+                .then(drainPendingContent) // land the now-durable pending uploads
+                .finally(closeStores) // every store closes strictly LAST (H1)
+                .then(() => undefined);
         },
         // CE-8 (R1): a runRaw-only rig (routesDir: null) has no routes — override
         // every route-dependent surface to throw a teaching invariant_violation.
@@ -284,8 +329,8 @@ function createRig(config) {
         ...(config.routesDir === null ? (0, rawonly_1.rawOnlyRouteMethods)() : {}),
     };
 }
-var config_1 = require("./config");
-Object.defineProperty(exports, "loadConfigFromEnv", { enumerable: true, get: function () { return config_1.loadConfigFromEnv; } });
+var config_2 = require("./config");
+Object.defineProperty(exports, "loadConfigFromEnv", { enumerable: true, get: function () { return config_2.loadConfigFromEnv; } });
 // The telemetry wire contract (Phase 6 WS2). Exported because modelrig-server
 // COMPILES AGAINST IT: one definition of a batch and one mapper from batch to
 // database rows, shared by the SDK's two sinks and the ingest endpoint. A
@@ -293,7 +338,7 @@ Object.defineProperty(exports, "loadConfigFromEnv", { enumerable: true, get: fun
 // prettier-ignore
 var ingest_protocol_1 = require("./telemetry/ingest-protocol");
 Object.defineProperty(exports, "stampBatch", { enumerable: true, get: function () { return ingest_protocol_1.stampBatch; } });
-Object.defineProperty(exports, "foreignOrgFeedback", { enumerable: true, get: function () { return ingest_protocol_1.foreignOrgFeedback; } });
+Object.defineProperty(exports, "foreignOrgGrades", { enumerable: true, get: function () { return ingest_protocol_1.foreignOrgGrades; } });
 Object.defineProperty(exports, "INGEST_PATH", { enumerable: true, get: function () { return ingest_protocol_1.INGEST_PATH; } });
 Object.defineProperty(exports, "INGEST_PROTOCOL_VERSION", { enumerable: true, get: function () { return ingest_protocol_1.INGEST_PROTOCOL_VERSION; } });
 Object.defineProperty(exports, "INGEST_PROTOCOL_VERSION_V1", { enumerable: true, get: function () { return ingest_protocol_1.INGEST_PROTOCOL_VERSION_V1; } });
@@ -330,14 +375,41 @@ Object.defineProperty(exports, "normalizeOtlpTraces", { enumerable: true, get: f
 Object.defineProperty(exports, "looksLikeLogsPayload", { enumerable: true, get: function () { return otel_normalize_1.looksLikeLogsPayload; } });
 var otlp_proto_1 = require("./telemetry/otlp-proto");
 Object.defineProperty(exports, "decodeOtlpProtobufTraces", { enumerable: true, get: function () { return otlp_proto_1.decodeOtlpProtobufTraces; } });
-var config_2 = require("./config");
-Object.defineProperty(exports, "parseOtlpHeaders", { enumerable: true, get: function () { return config_2.parseOtlpHeaders; } });
-Object.defineProperty(exports, "resolveOtlpConfig", { enumerable: true, get: function () { return config_2.resolveOtlpConfig; } });
+var config_3 = require("./config");
+Object.defineProperty(exports, "parseOtlpHeaders", { enumerable: true, get: function () { return config_3.parseOtlpHeaders; } });
+Object.defineProperty(exports, "resolveOtlpConfig", { enumerable: true, get: function () { return config_3.resolveOtlpConfig; } });
 // Artifact / execution-graph namespace (Expansion E2) — the barrel re-exports
 // step/run-context/types; the run lifecycle is bound per-rig via rig.artifacts.
 __exportStar(require("./artifacts"), exports);
-var config_3 = require("./config");
-Object.defineProperty(exports, "resolveArtifactsConfig", { enumerable: true, get: function () { return config_3.resolveArtifactsConfig; } });
+// PSR-1 — the structure-only assembly-manifest model (spec §2.1), re-exported
+// EXPLICITLY from the package entry (not only transitively via the artifacts
+// star-export) so an external consumer resolving the built `dist/index.d.ts`
+// gets `Manifest`/`Slot` + the validators on the public surface unambiguously.
+var manifest_2 = require("./prompts/manifest");
+Object.defineProperty(exports, "validateManifest", { enumerable: true, get: function () { return manifest_2.validateManifest; } });
+Object.defineProperty(exports, "assertValidManifest", { enumerable: true, get: function () { return manifest_2.assertValidManifest; } });
+Object.defineProperty(exports, "parseAuthoringDoc", { enumerable: true, get: function () { return manifest_2.parseAuthoringDoc; } });
+Object.defineProperty(exports, "normalizeManifest", { enumerable: true, get: function () { return manifest_2.normalizeManifest; } });
+// PSR-2 — the content-hash id (`template_sha`) the version store dedupes on.
+var version_hash_1 = require("./prompts/version-hash");
+Object.defineProperty(exports, "promptTemplateSha", { enumerable: true, get: function () { return version_hash_1.promptTemplateSha; } });
+// PSR-2b — SDK fetch-by-label + content cache + fail-open resolver + the
+// client-fill engine (slot resolver) + the tool-binding registry (rig.tools).
+// All client-side / in-process (spec §3–§4).
+var prompt_fetch_1 = require("./prompts/prompt-fetch");
+Object.defineProperty(exports, "createApiPromptFetcher", { enumerable: true, get: function () { return prompt_fetch_1.createApiPromptFetcher; } });
+Object.defineProperty(exports, "createPromptCache", { enumerable: true, get: function () { return prompt_fetch_1.createPromptCache; } });
+Object.defineProperty(exports, "parseServedPrompt", { enumerable: true, get: function () { return prompt_fetch_1.parseServedPrompt; } });
+var prompt_resolve_1 = require("./prompts/prompt-resolve");
+Object.defineProperty(exports, "createPromptResolver", { enumerable: true, get: function () { return prompt_resolve_1.createPromptResolver; } });
+Object.defineProperty(exports, "createEmbeddedPrompts", { enumerable: true, get: function () { return prompt_resolve_1.createEmbeddedPrompts; } });
+var slot_resolver_1 = require("./prompts/slot-resolver");
+Object.defineProperty(exports, "assemblePrompt", { enumerable: true, get: function () { return slot_resolver_1.assemblePrompt; } });
+Object.defineProperty(exports, "SlotResolutionError", { enumerable: true, get: function () { return slot_resolver_1.SlotResolutionError; } });
+var tools_register_2 = require("./prompts/tools-register");
+Object.defineProperty(exports, "createToolRegistry", { enumerable: true, get: function () { return tools_register_2.createToolRegistry; } });
+var config_4 = require("./config");
+Object.defineProperty(exports, "resolveArtifactsConfig", { enumerable: true, get: function () { return config_4.resolveArtifactsConfig; } });
 __exportStar(require("./detect/detector"), exports); // shared Detector interface (screening A1, types-only)
 // Control-plane settings resolution (settings-plane §1.5) — the gateway + any
 // future capture-write consume `effectiveCapture`; the server shares the types.
@@ -360,6 +432,18 @@ var scrub_1 = require("./tenancy/scrub");
 Object.defineProperty(exports, "scrubSecrets", { enumerable: true, get: function () { return scrub_1.scrubSecrets; } });
 Object.defineProperty(exports, "containsKeyShapedString", { enumerable: true, get: function () { return scrub_1.containsKeyShapedString; } });
 Object.defineProperty(exports, "KEY_SHAPED_PREFIXES", { enumerable: true, get: function () { return scrub_1.KEY_SHAPED_PREFIXES; } });
+var quality_1 = require("./bakeoff/quality"); // LRE-1b graders
+Object.defineProperty(exports, "exactMatch", { enumerable: true, get: function () { return quality_1.exactMatch; } });
+Object.defineProperty(exports, "fieldAccuracy", { enumerable: true, get: function () { return quality_1.fieldAccuracy; } });
+Object.defineProperty(exports, "resolveDeterministicQuality", { enumerable: true, get: function () { return quality_1.resolveDeterministicQuality; } });
+var groundedness_1 = require("./bakeoff/groundedness"); // call-QA F3/G6 evidence-grounded grader
+Object.defineProperty(exports, "groundednessScore", { enumerable: true, get: function () { return groundedness_1.groundednessScore; } });
+Object.defineProperty(exports, "extractEvidenceQuotes", { enumerable: true, get: function () { return groundedness_1.extractEvidenceQuotes; } });
+// LRE-1b server runner: the from-eval-cases orchestrator + injected-store contract so modelrig-server drives a cross-plane golden bake-off with the rig's keyed adapters (rig.bakeoffFromEvalCasesWith).
+var eval_cases_1 = require("./bakeoff/eval-cases");
+Object.defineProperty(exports, "runBakeoffFromEvalCases", { enumerable: true, get: function () { return eval_cases_1.runBakeoffFromEvalCases; } });
+Object.defineProperty(exports, "selectEvalCaseCaptures", { enumerable: true, get: function () { return eval_cases_1.selectEvalCaseCaptures; } });
+Object.defineProperty(exports, "evalCaseCaptureStore", { enumerable: true, get: function () { return eval_cases_1.evalCaseCaptureStore; } });
 // Streaming surface (G-1/G-5 Phase A).
 var stream_2 = require("./run/stream");
 Object.defineProperty(exports, "runStream", { enumerable: true, get: function () { return stream_2.runStream; } });
@@ -369,6 +453,20 @@ var resolved_bundle_2 = require("./routes/resolved-bundle");
 Object.defineProperty(exports, "bundleFromResolved", { enumerable: true, get: function () { return resolved_bundle_2.bundleFromResolved; } });
 Object.defineProperty(exports, "resolveRouteBundle", { enumerable: true, get: function () { return resolved_bundle_2.resolveRouteBundle; } });
 Object.defineProperty(exports, "hashResolvedBundle", { enumerable: true, get: function () { return resolved_bundle_2.hashResolvedBundle; } });
+Object.defineProperty(exports, "assertMirrorSafe", { enumerable: true, get: function () { return resolved_bundle_2.assertMirrorSafe; } });
+var call_config_1 = require("./routes/call-config"); // + live-routing call-config (LRE-1a §4 pin; LRE-2 experiment arm-draw)
+Object.defineProperty(exports, "applyCallConfig", { enumerable: true, get: function () { return call_config_1.applyCallConfig; } });
+Object.defineProperty(exports, "createApiCallConfigFetcher", { enumerable: true, get: function () { return call_config_1.createApiCallConfigFetcher; } });
+Object.defineProperty(exports, "createCallConfigResolver", { enumerable: true, get: function () { return call_config_1.createCallConfigResolver; } });
+Object.defineProperty(exports, "getCallConfig", { enumerable: true, get: function () { return call_config_1.getCallConfig; } });
+Object.defineProperty(exports, "narrowCallConfigPin", { enumerable: true, get: function () { return call_config_1.narrowPin; } });
+Object.defineProperty(exports, "parseCallConfig", { enumerable: true, get: function () { return call_config_1.parseCallConfig; } });
+Object.defineProperty(exports, "pinFromResolved", { enumerable: true, get: function () { return call_config_1.pinFromResolved; } });
+Object.defineProperty(exports, "narrowExperiment", { enumerable: true, get: function () { return call_config_1.narrowExperiment; } });
+Object.defineProperty(exports, "drawArm", { enumerable: true, get: function () { return call_config_1.drawArm; } });
+Object.defineProperty(exports, "armName", { enumerable: true, get: function () { return call_config_1.armName; } });
+Object.defineProperty(exports, "hashUnitKey", { enumerable: true, get: function () { return call_config_1.hashUnitKey; } });
+Object.defineProperty(exports, "resolveCallConfigForRun", { enumerable: true, get: function () { return call_config_1.resolveCallConfigForRun; } });
 // G-1/G-5 Phase C — the raw-lane BYOK passthrough (spec §4.2).
 var raw_2 = require("./run/raw");
 Object.defineProperty(exports, "runRaw", { enumerable: true, get: function () { return raw_2.runRaw; } });
@@ -403,6 +501,7 @@ Object.defineProperty(exports, "runBakeoff", { enumerable: true, get: function (
 Object.defineProperty(exports, "mirrorBakeoff", { enumerable: true, get: function () { return engine_2.mirrorBakeoff; } });
 Object.defineProperty(exports, "computeProposal", { enumerable: true, get: function () { return engine_2.computeProposal; } });
 Object.defineProperty(exports, "bakeoffEvidence", { enumerable: true, get: function () { return engine_2.bakeoffEvidence; } });
+Object.defineProperty(exports, "deriveSwapDirection", { enumerable: true, get: function () { return engine_2.deriveSwapDirection; } });
 var samples_2 = require("./bakeoff/samples");
 Object.defineProperty(exports, "createBakeoffSamplesClient", { enumerable: true, get: function () { return samples_2.createBakeoffSamplesClient; } });
 Object.defineProperty(exports, "buildBakeoffSamples", { enumerable: true, get: function () { return samples_2.buildBakeoffSamples; } });
@@ -466,16 +565,22 @@ Object.defineProperty(exports, "writeRouteDraft", { enumerable: true, get: funct
 var serveability_2 = require("./routes/serveability");
 Object.defineProperty(exports, "checkServeability", { enumerable: true, get: function () { return serveability_2.checkServeability; } });
 Object.defineProperty(exports, "serveabilityWarnings", { enumerable: true, get: function () { return serveability_2.serveabilityWarnings; } });
-var config_4 = require("./config");
-Object.defineProperty(exports, "PROVIDER_KEY_ENV", { enumerable: true, get: function () { return config_4.PROVIDER_KEY_ENV; } });
+var config_5 = require("./config");
+Object.defineProperty(exports, "PROVIDER_KEY_ENV", { enumerable: true, get: function () { return config_5.PROVIDER_KEY_ENV; } });
 // Probe-suite surface (Phase 2 plan §4: probes drive adapters DIRECTLY, and
 // mint CandidateRefs through resolveCandidates — the single brand site —
 // against their own single-candidate probe routes).
 var gemini_1 = require("./adapters/gemini");
 Object.defineProperty(exports, "createGeminiAdapter", { enumerable: true, get: function () { return gemini_1.createGeminiAdapter; } });
 Object.defineProperty(exports, "GEMINI_THINKING_CAPABLE_MODELS", { enumerable: true, get: function () { return gemini_1.GEMINI_THINKING_CAPABLE_MODELS; } });
-// CE-9 R5/R6 — the raw-lane provider × knob support matrix (single source of truth for the guard AND the docs) + `rawKnobSupport(p)` so customers don't duplicate our provider lists.
+// CE-9 R5/R6 + Unified Route U1 — the one provider × capability vocabulary (single source of truth for the guard, the docs matrix, AND the serving-destination lookups) + `rawKnobSupport(p)` / `destinationSupport(p)` so customers don't duplicate our provider lists.
 __exportStar(require("./run/raw-support"), exports);
+// Unified Route U1 (ruling D-2) — the serving `destination` vocabulary; its lookups read the `serving` cell of the capability table above (one source of truth). Managed serving is gated behind the `config.managedServing` flag (set in code via createRig, default off; U3).
+var destination_1 = require("./run/destination");
+Object.defineProperty(exports, "DESTINATIONS", { enumerable: true, get: function () { return destination_1.DESTINATIONS; } });
+Object.defineProperty(exports, "DEFAULT_DESTINATION", { enumerable: true, get: function () { return destination_1.DEFAULT_DESTINATION; } });
+Object.defineProperty(exports, "servedDestinations", { enumerable: true, get: function () { return destination_1.servedDestinations; } });
+Object.defineProperty(exports, "destinationSupported", { enumerable: true, get: function () { return destination_1.destinationSupported; } });
 var openai_1 = require("./adapters/openai");
 Object.defineProperty(exports, "createOpenAIAdapter", { enumerable: true, get: function () { return openai_1.createOpenAIAdapter; } });
 var deepseek_1 = require("./adapters/deepseek");
@@ -510,8 +615,8 @@ Object.defineProperty(exports, "synthesizeFromFlat", { enumerable: true, get: fu
 Object.defineProperty(exports, "tierRates", { enumerable: true, get: function () { return pricing_shape_1.tierRates; } });
 Object.defineProperty(exports, "describePricingV2", { enumerable: true, get: function () { return pricing_shape_1.describePricingV2; } });
 Object.defineProperty(exports, "SNAPSHOT_BASIS", { enumerable: true, get: function () { return pricing_shape_1.SNAPSHOT_BASIS; } });
-var manifest_2 = require("./routes/manifest");
-Object.defineProperty(exports, "loadManifest", { enumerable: true, get: function () { return manifest_2.loadManifest; } });
+var manifest_3 = require("./routes/manifest");
+Object.defineProperty(exports, "loadManifest", { enumerable: true, get: function () { return manifest_3.loadManifest; } });
 var fingerprint_1 = require("./registry/fingerprint");
 Object.defineProperty(exports, "fingerprintSchema", { enumerable: true, get: function () { return fingerprint_1.fingerprintSchema; } });
 var facts_2 = require("./registry/facts");
@@ -540,18 +645,34 @@ Object.defineProperty(exports, "factsFor", { enumerable: true, get: function ()
 Object.defineProperty(exports, "factsUnderCredential", { enumerable: true, get: function () { return claims_1.factsUnderCredential; } });
 var parity_1 = require("./registry/parity");
 Object.defineProperty(exports, "computeParity", { enumerable: true, get: function () { return parity_1.computeParity; } });
-var feedback_2 = require("./feedback/feedback");
-Object.defineProperty(exports, "buildFeedbackRow", { enumerable: true, get: function () { return feedback_2.buildFeedbackRow; } });
 var coverage_1 = require("./feedback/coverage");
 Object.defineProperty(exports, "computeCoverage", { enumerable: true, get: function () { return coverage_1.computeCoverage; } });
-Object.defineProperty(exports, "RUNG1_MIN_FEEDBACK", { enumerable: true, get: function () { return coverage_1.RUNG1_MIN_FEEDBACK; } });
+Object.defineProperty(exports, "RUNG1_MIN_GRADES", { enumerable: true, get: function () { return coverage_1.RUNG1_MIN_GRADES; } });
 // Watch loop + proposals (Phase 4 WS1).
 var evaluate_1 = require("./watch/evaluate");
 Object.defineProperty(exports, "evaluateEvents", { enumerable: true, get: function () { return evaluate_1.evaluateEvents; } });
 Object.defineProperty(exports, "triggerHash", { enumerable: true, get: function () { return evaluate_1.triggerHash; } });
 Object.defineProperty(exports, "manualChallengerTriggerHash", { enumerable: true, get: function () { return evaluate_1.manualChallengerTriggerHash; } });
+Object.defineProperty(exports, "upgradeTriggerHash", { enumerable: true, get: function () { return evaluate_1.upgradeTriggerHash; } });
+Object.defineProperty(exports, "regretBreachTriggerHash", { enumerable: true, get: function () { return evaluate_1.regretBreachTriggerHash; } });
 Object.defineProperty(exports, "PROPOSAL_TTL_DAYS", { enumerable: true, get: function () { return evaluate_1.PROPOSAL_TTL_DAYS; } });
 Object.defineProperty(exports, "explainCacheContext", { enumerable: true, get: function () { return evaluate_1.explainCacheContext; } });
+// N4 up-swap trigger (near-optimal spec §4.1) + Q1 regret monitor (spec §5).
+var upgrade_1 = require("./watch/upgrade");
+Object.defineProperty(exports, "evaluateUpgradeOpportunities", { enumerable: true, get: function () { return upgrade_1.evaluateUpgradeOpportunities; } });
+var regret_monitor_1 = require("./watch/regret-monitor");
+Object.defineProperty(exports, "runRegretMonitorCycle", { enumerable: true, get: function () { return regret_monitor_1.runRegretMonitorCycle; } });
+Object.defineProperty(exports, "evaluateRegretDrift", { enumerable: true, get: function () { return regret_monitor_1.evaluateRegretDrift; } });
+Object.defineProperty(exports, "aggregateRegretBand", { enumerable: true, get: function () { return regret_monitor_1.aggregateRegretBand; } });
+Object.defineProperty(exports, "cyclePointFromArtifact", { enumerable: true, get: function () { return regret_monitor_1.cyclePointFromArtifact; } });
+Object.defineProperty(exports, "regretMonitorConfig", { enumerable: true, get: function () { return regret_monitor_1.regretMonitorConfig; } });
+Object.defineProperty(exports, "createRegretMonitorReads", { enumerable: true, get: function () { return regret_monitor_1.createRegretMonitorReads; } });
+Object.defineProperty(exports, "REGRET_MONITOR_WINDOW_DAYS", { enumerable: true, get: function () { return regret_monitor_1.REGRET_MONITOR_WINDOW_DAYS; } });
+Object.defineProperty(exports, "REGRET_MONITOR_BASELINE_DAYS", { enumerable: true, get: function () { return regret_monitor_1.REGRET_MONITOR_BASELINE_DAYS; } });
+Object.defineProperty(exports, "REGRET_MONITOR_MIN_N", { enumerable: true, get: function () { return regret_monitor_1.REGRET_MONITOR_MIN_N; } });
+Object.defineProperty(exports, "REGRET_MONITOR_MARGIN", { enumerable: true, get: function () { return regret_monitor_1.REGRET_MONITOR_MARGIN; } });
+Object.defineProperty(exports, "MONITOR_CYCLE_MARKER", { enumerable: true, get: function () { return regret_monitor_1.MONITOR_CYCLE_MARKER; } });
+Object.defineProperty(exports, "MONITOR_SOURCE_PREFIX", { enumerable: true, get: function () { return regret_monitor_1.MONITOR_SOURCE_PREFIX; } });
 var proposals_1 = require("./watch/proposals");
 Object.defineProperty(exports, "createProposalsClient", { enumerable: true, get: function () { return proposals_1.createProposalsClient; } });
 Object.defineProperty(exports, "assertTransition", { enumerable: true, get: function () { return proposals_1.assertTransition; } });

package/dist/init/observe-cli.js

@@ -69,6 +69,6 @@ function cmdObserve(flags) {
     console.log(`\nwrote ${result.written.length} file(s) to ${outDir}` +
         (result.skipped.length > 0 ? ` (${result.skipped.length} left alone — already there)` : "") +
         `\nread ${(0, node_path_1.join)(outDir, "OBSERVE.md")} next — apply the wiring diffs one step at a time.` +
-        "\nObserve changes no behaviour; with MODELRIG_ARTIFACTS off your pipeline is byte-for-byte the same.");
+        "\nObserve changes no behaviour; with no control plane configured your pipeline is byte-for-byte the same.");
     return 0;
 }

package/dist/init/observe.d.ts

@@ -15,8 +15,8 @@
  * agent (or human) to apply with judgment, one step at a time.
  *
  * Observe is deliberately NOT migration: it drafts no routes, reroutes no
- * model calls, and changes no behaviour. With `MODELRIG_ARTIFACTS` off the
- * pipeline is byte-for-byte identical (instrumentation.md).
+ * model calls, and changes no behaviour. With no control plane configured (or the
+ * org capture posture `off`) the pipeline is byte-for-byte identical (instrumentation.md).
  */
 import type { CallSite, FileSystemLike } from "./finder";
 import type { FinderOptions } from "./finder";

package/dist/init/observe.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"observe.d.ts","sourceRoot":"","sources":["../../src/init/observe.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAGH,OAAO,KAAK,EAAE,QAAQ,EAAE,cAAc,EAAE,MAAM,UAAU,CAAC;AACzD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAE9C;kFACkF;AAClF,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IACxB,gFAAgF;IAChF,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,wDAAwD;IACxD,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B;AAED,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,KAAK,EAAE,SAAS,WAAW,EAAE,CAAC;IACvC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,YAAY,EAAE,SAAS,MAAM,EAAE,CAAC;IACzC,6DAA6D;IAC7D,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,wDAAwD;IACxD,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,uEAAuE;IACvE,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAClC,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;IACpC,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;CACrC;AAED,MAAM,WAAW,cAAe,SAAQ,aAAa;IACnD,0CAA0C;IAC1C,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,CAAC;CAC3B;AAED,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,iFAAiF;IACjF,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,EAAE,EAAE,cAAc,GAAG;QAC5B,UAAU,EAAE,CAAC,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC;QACnC,SAAS,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE;YAAE,SAAS,EAAE,OAAO,CAAA;SAAE,KAAK,IAAI,CAAC;QAC1D,aAAa,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,KAAK,IAAI,CAAC;KAC1D,CAAC;IACF,QAAQ,CAAC,IAAI,EAAE;QACb,IAAI,EAAE,CAAC,GAAG,KAAK,EAAE,MAAM,EAAE,KAAK,MAAM,CAAC;QACrC,QAAQ,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,KAAK,MAAM,CAAC;QAC/C,OAAO,EAAE,CAAC,CAAC,EAAE,MAAM,KAAK,MAAM,CAAC;QAC/B,QAAQ,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,MAAM,KAAK,MAAM,CAAC;KAC/C,CAAC;CACH;AAKD;iFACiF;AACjF,wBAAgB,UAAU,CAAC,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,GAAG,CAAC,MAAM,CAAC,GAAG,MAAM,CAQpE;AAED;;4EAE4E;AAC5E,wBAAgB,WAAW,IAAI,MAAM,CA6DpC;AAoCD,wBAAgB,oBAAoB,CAClC,KAAK,EAAE,SAAS,WAAW,EAAE,EAC7B,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE;IAAE,UAAU,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,EACrF,IAAI,EAAE,WAAW,CAAC,MAAM,CAAC,GACxB,MAAM,CA+GR;AAED,wBAAgB,UAAU,CAAC,IAAI,EAAE,WAAW,EAAE,OAAO,GAAE,cAAmB,GAAG,aAAa,CA6DzF"}
+{"version":3,"file":"observe.d.ts","sourceRoot":"","sources":["../../src/init/observe.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAGH,OAAO,KAAK,EAAE,QAAQ,EAAE,cAAc,EAAE,MAAM,UAAU,CAAC;AACzD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAE9C;kFACkF;AAClF,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IACxB,gFAAgF;IAChF,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,wDAAwD;IACxD,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B;AAED,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,KAAK,EAAE,SAAS,WAAW,EAAE,CAAC;IACvC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,YAAY,EAAE,SAAS,MAAM,EAAE,CAAC;IACzC,6DAA6D;IAC7D,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,wDAAwD;IACxD,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,uEAAuE;IACvE,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAClC,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;IACpC,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;CACrC;AAED,MAAM,WAAW,cAAe,SAAQ,aAAa;IACnD,0CAA0C;IAC1C,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,CAAC;CAC3B;AAED,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,iFAAiF;IACjF,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,EAAE,EAAE,cAAc,GAAG;QAC5B,UAAU,EAAE,CAAC,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC;QACnC,SAAS,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE;YAAE,SAAS,EAAE,OAAO,CAAA;SAAE,KAAK,IAAI,CAAC;QAC1D,aAAa,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,KAAK,IAAI,CAAC;KAC1D,CAAC;IACF,QAAQ,CAAC,IAAI,EAAE;QACb,IAAI,EAAE,CAAC,GAAG,KAAK,EAAE,MAAM,EAAE,KAAK,MAAM,CAAC;QACrC,QAAQ,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,KAAK,MAAM,CAAC;QAC/C,OAAO,EAAE,CAAC,CAAC,EAAE,MAAM,KAAK,MAAM,CAAC;QAC/B,QAAQ,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,MAAM,KAAK,MAAM,CAAC;KAC/C,CAAC;CACH;AAKD;iFACiF;AACjF,wBAAgB,UAAU,CAAC,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,GAAG,CAAC,MAAM,CAAC,GAAG,MAAM,CAQpE;AAED;;4EAE4E;AAC5E,wBAAgB,WAAW,IAAI,MAAM,CA6DpC;AAoCD,wBAAgB,oBAAoB,CAClC,KAAK,EAAE,SAAS,WAAW,EAAE,EAC7B,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE;IAAE,UAAU,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,EACrF,IAAI,EAAE,WAAW,CAAC,MAAM,CAAC,GACxB,MAAM,CAmHR;AAED,wBAAgB,UAAU,CAAC,IAAI,EAAE,WAAW,EAAE,OAAO,GAAE,cAAmB,GAAG,aAAa,CA6DzF"}

package/dist/init/observe.js

@@ -16,8 +16,8 @@
  * agent (or human) to apply with judgment, one step at a time.
  *
  * Observe is deliberately NOT migration: it drafts no routes, reroutes no
- * model calls, and changes no behaviour. With `MODELRIG_ARTIFACTS` off the
- * pipeline is byte-for-byte identical (instrumentation.md).
+ * model calls, and changes no behaviour. With no control plane configured (or the
+ * org capture posture `off`) the pipeline is byte-for-byte identical (instrumentation.md).
  */
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.stepKeyFor = stepKeyFor;
@@ -49,8 +49,8 @@ function seamContent() {
  * deleted seam) so it always matches the current SDK. It records each pipeline
  * run as a run -> step -> artifact chain you click through in the console.
  *
- * Observe-only: no routes move, no model calls are rerouted. With
- * MODELRIG_ARTIFACTS off (or no control plane configured) every call here is
+ * Observe-only: no routes move, no model calls are rerouted. With no control
+ * plane configured (or the org capture posture set to off) every call here is
  * inert and your pipeline behaves byte-for-byte as before. Nothing here ever
  * throws into your pipeline — a telemetry write that fails is logged and
  * dropped (instrumentation.md, "Never throws into your pipeline").
@@ -99,7 +99,7 @@ export function recordStep(
   const parsed = rig.artifacts.artifact.save(work.json, { name: \`\${stepKey}.output\`, type: "step_output", task: stepKey, stepKey });
   if (p && parsed) rig.artifacts.artifact.link(parsed, p, "derived_from");
   if (raw && parsed) rig.artifacts.artifact.link(parsed, raw, "derived_from");
-  if (parsed) rig.artifacts.artifact.evaluate(parsed, { evaluator: "schema-check", kind: "deterministic", passed: work.conforms });
+  if (parsed) rig.grade({ kind: "artifact", id: parsed.id }, { score: work.conforms ? 1 : 0, kind: "deterministic", grader: "schema-check" });
 }
 `;
 }
@@ -146,10 +146,14 @@ function buildObserveMarkdown(plans, seamPath, result, path) {
         "each is proposed as one instrumented **step**. Apply the diffs one step at a time — a step",
         "you do not understand yet is a step you can leave for later.",
         "",
-        "## 1. Turn the namespace on",
+        "## 1. Point at the console (one step, once)",
+        "",
+        "Capture is **on by default** — one API key turns everything on, and you opt out later in",
+        "your **account settings** (the org capture posture), never with an env var. There is no",
+        "capture flag to set: once `MODELRIG_API_KEY` is present the run/step/artifact namespace is on.",
         "",
         "```bash",
-        "export MODELRIG_ARTIFACTS=1                 # enable the artifact namespace",
+        "export MODELRIG_API_KEY=<key>               # mint at https://app.modelrig.ai (/keys)",
         "# export MODELRIG_ARTIFACT_STEPS=step_a,step_b   # optional: instrument a subset",
         "```",
         "",