modelrig 0.8.1 → 0.10.0

package/dist/run/dispatch.d.ts

@@ -8,20 +8,25 @@
  * Tool *execution* is never ours (spec §4.4); these helpers normalize the
  * protocol and surface it — nothing here runs a tool.
  */
-import type { AdapterRequest, AdapterResult, CandidateRef, ProviderAdapter, ToolDefinition } from "../types/provider";
+import type { AdapterRequest, AdapterResult, CandidateRef, ProviderAdapter, ServiceTier, ToolDefinition } from "../types/provider";
 import type { RigFailure } from "../types/failures";
-import type { RouteBundle, RunMeta, RunOptions, RunResult, RunTags } from "../types/route";
+import type { OutputKind, RouteBundle, RunMeta, RunOptions, RunResult, RunTags } from "../types/route";
 import type { TelemetryRung, TelemetryStore } from "../types/telemetry";
 import type { AttemptMetaSource } from "../telemetry/attempt-meta";
+import type { Destination } from "./destination";
 import type { LadderKeyMinter } from "./ladder-key";
 import type { MaskReceipt, ResolvedMaskPolicy } from "../mask/types";
 import type { RunVault } from "../mask/vault";
 import { type MaskSeam } from "../mask/seam";
+import { type SearchResultItem } from "./grounding";
+import type { ResolvedScreenPolicy, ScreenReceipt } from "../screen/types";
 /** One telemetry attempt row's inputs — shared with run.ts's recordAttempt so
  * the tool-call helper here can record through the same closure. */
 export interface AttemptTelemetry {
     readonly candidate: CandidateRef;
-    readonly servedTier: string;
+    /** Issue #2 (L6 F1): typed as the tier vocabulary (every producer passes a
+     * `ServiceTier`) so the meta usage can price at the served tier. */
+    readonly servedTier: ServiceTier;
     readonly tokensIn: number;
     readonly tokensOut: number;
     readonly tokensCached: number;
@@ -56,6 +61,11 @@ export interface AttemptTelemetry {
      * this attempt, written to `inferences.mask` by record-attempt.ts. Present
      * only on a masked route; NEVER a matched value. Additive & optional. */
     readonly mask?: MaskReceipt;
+    /** SC-1a screen receipt (spec §5) — the counts-only screen summary for this
+     * attempt, merged onto `inferences.meta.screen` by record-attempt.ts (ZERO
+     * migration, §8). Present only on a screened route; NEVER a matched value.
+     * Additive & optional. */
+    readonly screen?: ScreenReceipt;
 }
 /** Assemble the recorder's `metaInputs` from a completed dispatch (WI-1) — the
  * adapter's native meta plus the rendered request (system+user+schema, hashed)
@@ -65,12 +75,28 @@ export declare function attemptMetaInputs(args: {
     readonly systemPrompt: string;
     readonly userDirective: string;
     readonly outputSchema: object | null;
+    /** QA-S7: the route's `outputKind` (absent on the bundle ⇒ `json`). This
+     * helper serves the ROUTE lane only, so every row it feeds carries the
+     * contract; the raw lane assembles its inputs inline and never sets it. */
+    readonly outputKind?: OutputKind | undefined;
     readonly result: AdapterResult;
     readonly tools?: readonly ToolDefinition[];
 }): AttemptMetaSource;
 /** run.ts's recordAttempt, threaded in so the tool-call path records through
  * the same ledger/tenancy closure the rest of the loop uses. */
 export type RecordAttempt = (attempt: AttemptTelemetry) => string;
+/**
+ * Telemetry tag entry for a serving destination (Unified Route U2, ruling D-2 —
+ * the SINGLE tag literal U3/U4 stamp through). Returns the `destination` tag
+ * ONLY for a NON-default destination; for `direct` (the default) it returns `{}`
+ * so a routed telemetry row gains NO new tag — this is the CRITICAL
+ * absent⇒byte-identical rule (never stamp `destination` when it is `direct`, or
+ * every routed row would drift). DORMANT in U2: `modelrig-served` fails closed
+ * pre-dispatch (resolve-destination.ts), so no successful row reaches recording
+ * with a non-default destination yet; U3 stamps through this one helper once
+ * managed serving is enabled.
+ */
+export declare function destinationTag(destination: Destination): Record<string, string>;
 /** Record the grounding-inject search's own telemetry row (WS3): a $-only line
  * under the synthetic "search" provider. Extracted from run.ts to keep it under
  * the LOC cap; behaviour is byte-identical to the prior inline recorder. */
@@ -93,6 +119,11 @@ export interface PrimaryRequestParts {
     /** True when this candidate has native grounding AND the route requires it. */
     readonly nativeGrounded: boolean;
     readonly opts: RunOptions;
+    /** Screening SC-1a (spec §2.2): the grounding-inject results for THIS candidate
+     * (or null/absent when the run is not spotlight-grounded). Threaded so the
+     * dispatch helper can collect the `search`-source untrusted segments the screen
+     * engine scans + the assembler spotlights. Optional ⇒ treated as null. */
+    readonly injectedSources?: readonly SearchResultItem[] | null;
     /** CE-1 retry-drop: suppress a customer cache handle on THIS dispatch after a
      * prior `cache_invalid` on the same candidate carried it. Additive; absent /
      * false = normal (the handle applies when provider matches). */
@@ -118,28 +149,45 @@ export interface MaskContext {
     readonly policy: ResolvedMaskPolicy;
     readonly vault: RunVault;
 }
-/** The outcome of a build+mask+dispatch (CS-1 seam, spec §1.2). Carries the
- * (possibly masked) request, the adapter result, measured latency, and the
- * per-attempt {@link MaskSeam} the run loop uses to rehydrate the response and
- * build the receipt. `maskRefusal` is set when masking FAILED CLOSED
- * pre-dispatch (`block` found a match, or a detector threw in mask/block) — no
- * request was sent, and the run loop fails the run with `invariant_violation`. */
+/** The per-run guards the run loop hands the dispatch seam: the CS-1 mask
+ * context and the SC-1a resolved screen policy (spec §4). Both null ⇒ the
+ * dispatch path is byte-identical to `buildAdapterRequest` + `dispatchCandidate`
+ * over the assembled request (the golden test). */
+export interface RunGuards {
+    readonly mask: MaskContext | null;
+    readonly screen: ResolvedScreenPolicy | null;
+}
+/** Build the per-run guards for a route (called ONCE at run start). The mask
+ * vault is run-scoped (shared across attempts); the screen policy is resolved at
+ * load and reused. Null members ⇒ that guard is inert (byte-identical). */
+export declare function buildRunGuards(route: RouteBundle, newVault: () => RunVault): RunGuards;
+/** The outcome of an assemble+screen+mask+dispatch (CS-1/SC-1a seam). Carries the
+ * (possibly rewritten) request, the adapter result, measured latency, the
+ * per-attempt {@link MaskSeam} the run loop uses to rehydrate, and the counts-only
+ * screen receipt for `meta.screen`. `maskRefusal` is set when masking failed
+ * closed; `screenRefusal` when screening resolved `block` (spec §4.3) — in both
+ * cases NO request was sent and the run loop fails the run with
+ * `invariant_violation`. */
 export interface DispatchOutcome {
     readonly request: AdapterRequest;
     readonly result: AdapterResult;
     readonly latencyMs: number;
     readonly seam: MaskSeam | null;
     readonly maskRefusal?: "blocked" | "error";
+    readonly screenRefusal?: "block";
+    readonly screenReceipt?: ScreenReceipt;
 }
 /**
- * Build the primary AdapterRequest, mask its outgoing user slot when the route
- * has an active policy (spec §1.2 — "rewrites the AdapterRequest before dispatch
- * and rehydrates the AdapterResult after"), dispatch, and time it. With no mask
- * context this is byte-identical to `buildAdapterRequest` + `dispatchCandidate`
- * (the golden test). The trusted system slot is never masked (B3 keeps untrusted
- * content in the user path).
+ * Assemble the untrusted block, SCREEN it (spec §4 — the request-side seam),
+ * MASK the user slot (CS-1, screening runs BEFORE masking so mask tokens never
+ * confuse a detector), dispatch, and apply the output-side screen (canary /
+ * citations / Unicode strip + quarantine drop-count). With both guards null this
+ * is byte-identical to `buildAdapterRequest(assembled)` + `dispatchCandidate`
+ * (the golden test) — the untrusted-block assembly moved here from run.ts so the
+ * loop stays under the LOC cap (spec §10(i)). The trusted system slot is never
+ * masked (B3 keeps untrusted content in the user path).
  */
-export declare function buildDispatchMaybeMasked(adapter: ProviderAdapter, parts: PrimaryRequestParts, onDelta: StreamDeltaSink | undefined, mask: MaskContext | null): Promise<DispatchOutcome>;
+export declare function buildDispatchMaybeMasked(adapter: ProviderAdapter, parts: PrimaryRequestParts, onDelta: StreamDeltaSink | undefined, guards: RunGuards): Promise<DispatchOutcome>;
 export interface ToolCallResultParts {
     readonly route: RouteBundle;
     readonly candidate: CandidateRef;
@@ -156,6 +204,9 @@ export interface ToolCallResultParts {
     readonly callId: string;
     /** WI-1: the attempt-envelope inputs for the recorded row (spec §2). */
     readonly metaInputs?: AttemptMetaSource;
+    /** Unified Route U2 (D-2): the resolved served destination for `RunMeta`
+     * (always `direct` in U2 — `modelrig-served` fails closed pre-dispatch). */
+    readonly destination?: RunMeta["destination"];
 }
 /**
  * Record a tool-call turn and build its RunResult (spec §4.4). A tool call is

package/dist/run/dispatch.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"dispatch.d.ts","sourceRoot":"","sources":["../../src/run/dispatch.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,KAAK,EACV,cAAc,EACd,aAAa,EACb,YAAY,EACZ,eAAe,EACf,cAAc,EACf,MAAM,mBAAmB,CAAC;AAE3B,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AACpD,OAAO,KAAK,EAAE,WAAW,EAAE,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,gBAAgB,CAAC;AAC3F,OAAO,KAAK,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AACxE,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAInE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AACpD,OAAO,KAAK,EAAE,WAAW,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AACrE,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AAC9C,OAAO,EAAkB,KAAK,QAAQ,EAAE,MAAM,cAAc,CAAC;AAE7D;oEACoE;AACpE,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,SAAS,EAAE,YAAY,CAAC;IACjC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B;6DACyD;IACzD,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IACnC,QAAQ,CAAC,kBAAkB,CAAC,EAAE,MAAM,CAAC;IACrC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B;0BACsB;IACtB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,OAAO,EAAE,UAAU,GAAG,IAAI,CAAC;IACpC,6EAA6E;IAC7E,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,2EAA2E;IAC3E,QAAQ,CAAC,cAAc,CAAC,EAAE,OAAO,CAAC;IAClC;;gEAE4D;IAC5D,QAAQ,CAAC,IAAI,CAAC,EAAE,aAAa,CAAC;IAC9B;;;uFAGmF;IACnF,QAAQ,CAAC,UAAU,CAAC,EAAE,iBAAiB,CAAC;IACxC;;0DAEsD;IACtD,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC5C;;6EAEyE;IACzE,QAAQ,CAAC,IAAI,CAAC,EAAE,WAAW,CAAC;CAC7B;AAED;;;+DAG+D;AAC/D,wBAAgB,iBAAiB,CAAC,IAAI,EAAE;IACtC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IACrC,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAC;IAC/B,QAAQ,CAAC,KAAK,CAAC,EAAE,SAAS,cAAc,EAAE,CAAC;CAC5C,GAAG,iBAAiB,CAWpB;AAED;gEACgE;AAChE,MAAM,MAAM,aAAa,GAAG,CAAC,OAAO,EAAE,gBAAgB,KAAK,MAAM,CAAC;AAElE;;4EAE4E;AAC5E,wBAAgB,mBAAmB,CACjC,SAAS,EAAE,cAAc,EACzB,KAAK,EAAE,WAAW,EAClB,aAAa,EAAE,OAAO,EACtB,aAAa,EAAE,MAAM,GAAG,IAAI,EAC5B,gBAAgB,EAAE,MAAM,EACxB,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,eAAe,GACtB,IAAI,CAoCN;AAED;;8EAE8E;AAC9E,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAYvD;AAED;;0CAE0C;AAC1C,MAAM,MAAM,eAAe,GAAG,CAAC,KAAK,EAAE;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CAAE,KAAK,IAAI,CAAC;AAEzE,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAC;IAC5B,QAAQ,CAAC,SAAS,EAAE,YAAY,CAAC;IACjC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,+EAA+E;IAC/E,QAAQ,CAAC,cAAc,EAAE,OAAO,CAAC;IACjC,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAC1B;;oEAEgE;IAChE,QAAQ,CAAC,qBAAqB,CAAC,EAAE,OAAO,CAAC;CAC1C;AAED;uDACuD;AACvD,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,mBAAmB,GAAG,cAAc,CAgC9E;AAED;4CAC4C;AAC5C,wBAAgB,yBAAyB,CACvC,KAAK,EAAE,WAAW,EAClB,SAAS,EAAE,YAAY,EACvB,YAAY,EAAE,MAAM,EACpB,eAAe,EAAE,MAAM,GACtB,cAAc,CAmBhB;AAED;;;;;;GAMG;AACH,wBAAsB,iBAAiB,CACrC,OAAO,EAAE,eAAe,EACxB,GAAG,EAAE,cAAc,EACnB,OAAO,CAAC,EAAE,eAAe,GACxB,OAAO,CAAC,aAAa,CAAC,CAuBxB;AAED;2EAC2E;AAC3E,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,MAAM,EAAE,kBAAkB,CAAC;IACpC,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC;CAC1B;AAED;;;;;kFAKkF;AAClF,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,OAAO,EAAE,cAAc,CAAC;IACjC,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAC;IAC/B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,IAAI,EAAE,QAAQ,GAAG,IAAI,CAAC;IAC/B,QAAQ,CAAC,WAAW,CAAC,EAAE,SAAS,GAAG,OAAO,CAAC;CAC5C;AAED;;;;;;;GAOG;AACH,wBAAsB,wBAAwB,CAC5C,OAAO,EAAE,eAAe,EACxB,KAAK,EAAE,mBAAmB,EAC1B,OAAO,EAAE,eAAe,GAAG,SAAS,EACpC,IAAI,EAAE,WAAW,GAAG,IAAI,GACvB,OAAO,CAAC,eAAe,CAAC,CAsB1B;AAED,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAC;IAC5B,QAAQ,CAAC,SAAS,EAAE,YAAY,CAAC;IACjC,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC,aAAa,EAAE;QAAE,EAAE,EAAE,IAAI,CAAA;KAAE,CAAC,CAAC;IACtD,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,eAAe,EAAE,OAAO,CAAC,iBAAiB,CAAC,CAAC;IACrD,QAAQ,CAAC,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IACtC,QAAQ,CAAC,cAAc,EAAE,OAAO,CAAC;IACjC;kDAC8C;IAC9C,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,wEAAwE;IACxE,QAAQ,CAAC,UAAU,CAAC,EAAE,iBAAiB,CAAC;CACzC;AAED;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,aAAa,EAAE,KAAK,EAAE,mBAAmB,GAAG,SAAS,CAiD/F"}
+{"version":3,"file":"dispatch.d.ts","sourceRoot":"","sources":["../../src/run/dispatch.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,KAAK,EACV,cAAc,EACd,aAAa,EACb,YAAY,EACZ,eAAe,EACf,WAAW,EACX,cAAc,EACf,MAAM,mBAAmB,CAAC;AAG3B,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AACpD,OAAO,KAAK,EAAE,UAAU,EAAE,WAAW,EAAE,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,gBAAgB,CAAC;AACvG,OAAO,KAAK,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AACxE,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAKnE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAEjD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AACpD,OAAO,KAAK,EAAE,WAAW,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AACrE,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AAC9C,OAAO,EAAkB,KAAK,QAAQ,EAAE,MAAM,cAAc,CAAC;AAC7D,OAAO,EAAsD,KAAK,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAExG,OAAO,KAAK,EAAE,oBAAoB,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAG3E;oEACoE;AACpE,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,SAAS,EAAE,YAAY,CAAC;IACjC;wEACoE;IACpE,QAAQ,CAAC,UAAU,EAAE,WAAW,CAAC;IACjC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B;6DACyD;IACzD,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IACnC,QAAQ,CAAC,kBAAkB,CAAC,EAAE,MAAM,CAAC;IACrC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B;0BACsB;IACtB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,OAAO,EAAE,UAAU,GAAG,IAAI,CAAC;IACpC,6EAA6E;IAC7E,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,2EAA2E;IAC3E,QAAQ,CAAC,cAAc,CAAC,EAAE,OAAO,CAAC;IAClC;;gEAE4D;IAC5D,QAAQ,CAAC,IAAI,CAAC,EAAE,aAAa,CAAC;IAC9B;;;uFAGmF;IACnF,QAAQ,CAAC,UAAU,CAAC,EAAE,iBAAiB,CAAC;IACxC;;0DAEsD;IACtD,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC5C;;6EAEyE;IACzE,QAAQ,CAAC,IAAI,CAAC,EAAE,WAAW,CAAC;IAC5B;;;8BAG0B;IAC1B,QAAQ,CAAC,MAAM,CAAC,EAAE,aAAa,CAAC;CACjC;AAED;;;+DAG+D;AAC/D,wBAAgB,iBAAiB,CAAC,IAAI,EAAE;IACtC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IACrC;;+EAE2E;IAC3E,QAAQ,CAAC,UAAU,CAAC,EAAE,UAAU,GAAG,SAAS,CAAC;IAC7C,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAC;IAC/B,QAAQ,CAAC,KAAK,CAAC,EAAE,SAAS,cAAc,EAAE,CAAC;CAC5C,GAAG,iBAAiB,CAYpB;AAED;gEACgE;AAChE,MAAM,MAAM,aAAa,GAAG,CAAC,OAAO,EAAE,gBAAgB,KAAK,MAAM,CAAC;AAElE;;;;;;;;;;GAUG;AACH,wBAAgB,cAAc,CAAC,WAAW,EAAE,WAAW,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAE/E;AAED;;4EAE4E;AAC5E,wBAAgB,mBAAmB,CACjC,SAAS,EAAE,cAAc,EACzB,KAAK,EAAE,WAAW,EAClB,aAAa,EAAE,OAAO,EACtB,aAAa,EAAE,MAAM,GAAG,IAAI,EAC5B,gBAAgB,EAAE,MAAM,EACxB,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,eAAe,GACtB,IAAI,CAyCN;AAED;;8EAE8E;AAC9E,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAYvD;AAED;;0CAE0C;AAC1C,MAAM,MAAM,eAAe,GAAG,CAAC,KAAK,EAAE;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CAAE,KAAK,IAAI,CAAC;AAEzE,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAC;IAC5B,QAAQ,CAAC,SAAS,EAAE,YAAY,CAAC;IACjC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,+EAA+E;IAC/E,QAAQ,CAAC,cAAc,EAAE,OAAO,CAAC;IACjC,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAC1B;;;8EAG0E;IAC1E,QAAQ,CAAC,eAAe,CAAC,EAAE,SAAS,gBAAgB,EAAE,GAAG,IAAI,CAAC;IAC9D;;oEAEgE;IAChE,QAAQ,CAAC,qBAAqB,CAAC,EAAE,OAAO,CAAC;CAC1C;AAED;uDACuD;AACvD,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,mBAAmB,GAAG,cAAc,CAgC9E;AAED;4CAC4C;AAC5C,wBAAgB,yBAAyB,CACvC,KAAK,EAAE,WAAW,EAClB,SAAS,EAAE,YAAY,EACvB,YAAY,EAAE,MAAM,EACpB,eAAe,EAAE,MAAM,GACtB,cAAc,CAmBhB;AAED;;;;;;GAMG;AACH,wBAAsB,iBAAiB,CACrC,OAAO,EAAE,eAAe,EACxB,GAAG,EAAE,cAAc,EACnB,OAAO,CAAC,EAAE,eAAe,GACxB,OAAO,CAAC,aAAa,CAAC,CAuBxB;AAED;2EAC2E;AAC3E,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,MAAM,EAAE,kBAAkB,CAAC;IACpC,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC;CAC1B;AAED;;;mDAGmD;AACnD,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,IAAI,EAAE,WAAW,GAAG,IAAI,CAAC;IAClC,QAAQ,CAAC,MAAM,EAAE,oBAAoB,GAAG,IAAI,CAAC;CAC9C;AAED;;2EAE2E;AAC3E,wBAAgB,cAAc,CAAC,KAAK,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,QAAQ,GAAG,SAAS,CAKtF;AAED;;;;;;4BAM4B;AAC5B,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,OAAO,EAAE,cAAc,CAAC;IACjC,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAC;IAC/B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,IAAI,EAAE,QAAQ,GAAG,IAAI,CAAC;IAC/B,QAAQ,CAAC,WAAW,CAAC,EAAE,SAAS,GAAG,OAAO,CAAC;IAC3C,QAAQ,CAAC,aAAa,CAAC,EAAE,OAAO,CAAC;IACjC,QAAQ,CAAC,aAAa,CAAC,EAAE,aAAa,CAAC;CACxC;AASD;;;;;;;;;GASG;AACH,wBAAsB,wBAAwB,CAC5C,OAAO,EAAE,eAAe,EACxB,KAAK,EAAE,mBAAmB,EAC1B,OAAO,EAAE,eAAe,GAAG,SAAS,EACpC,MAAM,EAAE,SAAS,GAChB,OAAO,CAAC,eAAe,CAAC,CAwF1B;AAED,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAC;IAC5B,QAAQ,CAAC,SAAS,EAAE,YAAY,CAAC;IACjC,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC,aAAa,EAAE;QAAE,EAAE,EAAE,IAAI,CAAA;KAAE,CAAC,CAAC;IACtD,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,eAAe,EAAE,OAAO,CAAC,iBAAiB,CAAC,CAAC;IACrD,QAAQ,CAAC,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IACtC,QAAQ,CAAC,cAAc,EAAE,OAAO,CAAC;IACjC;kDAC8C;IAC9C,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,wEAAwE;IACxE,QAAQ,CAAC,UAAU,CAAC,EAAE,iBAAiB,CAAC;IACxC;gFAC4E;IAC5E,QAAQ,CAAC,WAAW,CAAC,EAAE,OAAO,CAAC,aAAa,CAAC,CAAC;CAC/C;AAED;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,aAAa,EAAE,KAAK,EAAE,mBAAmB,GAAG,SAAS,CAkD/F"}

package/dist/run/dispatch.js

@@ -11,18 +11,25 @@
  */
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.attemptMetaInputs = attemptMetaInputs;
+exports.destinationTag = destinationTag;
 exports.recordSearchCostRow = recordSearchCostRow;
 exports.jsonModeCoaching = jsonModeCoaching;
 exports.buildAdapterRequest = buildAdapterRequest;
 exports.buildRepairAdapterRequest = buildRepairAdapterRequest;
 exports.dispatchCandidate = dispatchCandidate;
+exports.buildRunGuards = buildRunGuards;
 exports.buildDispatchMaybeMasked = buildDispatchMaybeMasked;
 exports.emitToolCallResult = emitToolCallResult;
+const provider_1 = require("../types/provider");
 const node_crypto_1 = require("node:crypto");
 const attempt_meta_1 = require("../telemetry/attempt-meta");
 const cache_stamp_1 = require("./cache-stamp");
 const cache_handle_1 = require("./cache-handle");
+const destination_1 = require("./destination");
+const telemetry_row_1 = require("./telemetry-row");
 const seam_1 = require("../mask/seam");
+const grounding_1 = require("./grounding");
+const screen_1 = require("../screen/screen");
 /** Assemble the recorder's `metaInputs` from a completed dispatch (WI-1) — the
  * adapter's native meta plus the rendered request (system+user+schema, hashed)
  * and the output text (hashed). One helper so the routed lane's several record
@@ -30,6 +37,7 @@ const seam_1 = require("../mask/seam");
 function attemptMetaInputs(args) {
     return {
         ...(args.result.meta !== undefined ? { adapterMeta: args.result.meta } : {}),
+        outputKind: args.outputKind ?? "json",
         renderedRequest: (0, attempt_meta_1.renderRequestForHash)({
             system: args.systemPrompt,
             user: args.userDirective,
@@ -39,6 +47,20 @@ function attemptMetaInputs(args) {
         ...(args.tools !== undefined ? { declaredToolNames: args.tools.map((t) => t.function.name) } : {}),
     };
 }
+/**
+ * Telemetry tag entry for a serving destination (Unified Route U2, ruling D-2 —
+ * the SINGLE tag literal U3/U4 stamp through). Returns the `destination` tag
+ * ONLY for a NON-default destination; for `direct` (the default) it returns `{}`
+ * so a routed telemetry row gains NO new tag — this is the CRITICAL
+ * absent⇒byte-identical rule (never stamp `destination` when it is `direct`, or
+ * every routed row would drift). DORMANT in U2: `modelrig-served` fails closed
+ * pre-dispatch (resolve-destination.ts), so no successful row reaches recording
+ * with a non-default destination yet; U3 stamps through this one helper once
+ * managed serving is enabled.
+ */
+function destinationTag(destination) {
+    return destination === destination_1.DEFAULT_DESTINATION ? {} : { destination };
+}
 /** Record the grounding-inject search's own telemetry row (WS3): a $-only line
  * under the synthetic "search" provider. Extracted from run.ts to keep it under
  * the LOC cap; behaviour is byte-identical to the prior inline recorder. */
@@ -47,9 +69,11 @@ function recordSearchCostRow(telemetry, route, effectiveTags, servedVariant, sea
     // rides the same monotonic seq; candidate_index is the candidate this search
     // grounds for (the current one — the run loop set it before the search).
     const ladderKey = ladder.stamp();
-    telemetry.record({
+    // U4: assembled by the ONE shared builder (./telemetry-row.ts). This row
+    // carries NO attempt-envelope `meta` — buildTelemetryRow omits the key when
+    // `meta` is not passed, preserving the former shape exactly.
+    telemetry.record((0, telemetry_row_1.buildTelemetryRow)({
         id: (0, node_crypto_1.randomUUID)(),
-        ts: new Date().toISOString(),
         route: route.route,
         routeVersion: route.version,
         provider: "search",
@@ -67,7 +91,8 @@ function recordSearchCostRow(telemetry, route, effectiveTags, servedVariant, sea
         failureClass: null,
         attemptsJson: "{}",
         // Rung tag (R1 review, F1): the grounding-inject search-cost row.
-        tagsJson: JSON.stringify({ ...effectiveTags, rung: "search" }),
+        baseTags: effectiveTags,
+        rung: "search",
         fingerprintCell: route.fingerprintCell,
         servedVariant,
         repairedBy: null,
@@ -77,7 +102,7 @@ function recordSearchCostRow(telemetry, route, effectiveTags, servedVariant, sea
         callId: ladderKey.callId,
         attemptSeq: ladderKey.attemptSeq,
         candidateIndex: ladderKey.candidateIndex,
-    });
+    }));
 }
 /** Schema coaching for the json_mode rung — ported from the production DeepSeek
  * provider's schema-in-prompt guidance (minLength-is-a-FLOOR etc.). Lives here
@@ -181,36 +206,114 @@ async function dispatchCandidate(adapter, req, onDelta) {
         },
     });
 }
+/** Build the per-run guards for a route (called ONCE at run start). The mask
+ * vault is run-scoped (shared across attempts); the screen policy is resolved at
+ * load and reused. Null members ⇒ that guard is inert (byte-identical). */
+function buildRunGuards(route, newVault) {
+    return {
+        mask: route.mask !== undefined ? { policy: route.mask, vault: newVault() } : null,
+        screen: route.screen ?? null,
+    };
+}
+function invariantResult(parts, why) {
+    return {
+        ok: false,
+        failure: { class: "invariant_violation", message: why, provider: parts.candidate.provider, model: parts.candidate.model },
+    };
+}
 /**
- * Build the primary AdapterRequest, mask its outgoing user slot when the route
- * has an active policy (spec §1.2 — "rewrites the AdapterRequest before dispatch
- * and rehydrates the AdapterResult after"), dispatch, and time it. With no mask
- * context this is byte-identical to `buildAdapterRequest` + `dispatchCandidate`
- * (the golden test). The trusted system slot is never masked (B3 keeps untrusted
- * content in the user path).
+ * Assemble the untrusted block, SCREEN it (spec §4 — the request-side seam),
+ * MASK the user slot (CS-1, screening runs BEFORE masking so mask tokens never
+ * confuse a detector), dispatch, and apply the output-side screen (canary /
+ * citations / Unicode strip + quarantine drop-count). With both guards null this
+ * is byte-identical to `buildAdapterRequest(assembled)` + `dispatchCandidate`
+ * (the golden test) — the untrusted-block assembly moved here from run.ts so the
+ * loop stays under the LOC cap (spec §10(i)). The trusted system slot is never
+ * masked (B3 keeps untrusted content in the user path).
  */
-async function buildDispatchMaybeMasked(adapter, parts, onDelta, mask) {
-    const built = buildAdapterRequest(parts);
-    if (mask === null) {
-        const started = Date.now();
-        const result = await dispatchCandidate(adapter, built, onDelta);
-        return { request: built, result, latencyMs: Date.now() - started, seam: null };
+async function buildDispatchMaybeMasked(adapter, parts, onDelta, guards) {
+    const provider = parts.candidate.provider;
+    // The untrusted segments this route+input contribute (search / x-trust
+    // variable / proxy_user). Empty on a plain route ⇒ empty appends below.
+    const segments = (0, grounding_1.collectUntrustedSegments)(parts.route, parts.opts.input, parts.injectedSources ?? null, parts.opts.proxyTrust);
+    // Request-side screening (spec §4.2/§4.3). A `block` outcome fails closed
+    // pre-dispatch (no request sent). `strip` filters segments; `quarantine` gates
+    // tool calls below. Screening runs on the RAW untrusted content, before mask.
+    const screenSeam = guards.screen !== null ? (0, screen_1.createScreenSeam)(guards.screen) : null;
+    let keep = segments;
+    let quarantine = false;
+    if (screenSeam !== null) {
+        const decided = await screenSeam.screenRequest(segments);
+        if (decided.kind === "block") {
+            return {
+                request: buildAdapterRequest(parts),
+                result: invariantResult(parts, "screening resolved block (untrusted content matched an enforce rule)"),
+                latencyMs: 0,
+                seam: null,
+                screenRefusal: "block",
+                screenReceipt: screenSeam.receipt(),
+            };
+        }
+        keep = decided.keepSegments;
+        quarantine = decided.quarantine;
     }
-    const seam = (0, seam_1.createMaskSeam)(mask.policy, mask.vault);
-    const outcome = seam.maskRequest(built);
-    if (outcome.kind !== "ok") {
-        // Fail closed: no request is sent. The run loop refuses pre-dispatch.
-        return {
-            request: built,
-            result: { ok: false, failure: { class: "invariant_violation", message: `masking failed closed (${outcome.kind})`, provider: parts.candidate.provider, model: parts.candidate.model } },
-            latencyMs: 0,
-            seam,
-            maskRefusal: outcome.kind,
-        };
+    // Assemble the (post-strip) untrusted appends + the optional canary into the
+    // trusted system slot. Screening-OFF ⇒ `keep === segments` ⇒ byte-identical.
+    const { systemAppend, userAppend } = (0, grounding_1.assembleUntrustedAppends)(keep, provider);
+    const canaryAppend = screenSeam?.canaryToken != null ? `\n\n${screenSeam.canaryToken}` : "";
+    const assembledParts = {
+        ...parts,
+        systemPrompt: parts.systemPrompt + systemAppend + canaryAppend,
+        userDirective: parts.userDirective + userAppend,
+    };
+    let built = buildAdapterRequest(assembledParts);
+    // Quarantine (spec §4.2): prevent the flagged turn from actuating a tool call
+    // via `tool_choice: "none"` where the served model supports it; otherwise fall
+    // back to dropping + counting tool calls in the response (A7, honest).
+    const capable = (0, provider_1.toolChoiceNoneCapable)(provider);
+    if (quarantine && capable)
+        built = { ...built, toolChoice: "none" };
+    // Mask the (screened) user slot. Fail-closed refusal is unchanged (CS-1 §9).
+    let request = built;
+    let seam = null;
+    if (guards.mask !== null) {
+        seam = (0, seam_1.createMaskSeam)(guards.mask.policy, guards.mask.vault);
+        const outcome = seam.maskRequest(built);
+        if (outcome.kind !== "ok") {
+            return {
+                request: built,
+                result: invariantResult(parts, `masking failed closed (${outcome.kind})`),
+                latencyMs: 0,
+                seam,
+                maskRefusal: outcome.kind,
+                ...(screenSeam !== null ? { screenReceipt: screenSeam.receipt() } : {}),
+            };
+        }
+        request = outcome.request;
     }
     const started = Date.now();
-    const result = await dispatchCandidate(adapter, outcome.request, onDelta);
-    return { request: outcome.request, result, latencyMs: Date.now() - started, seam };
+    let result = await dispatchCandidate(adapter, request, onDelta);
+    const latencyMs = Date.now() - started;
+    // Output-side screening (spec §2.3): strip Unicode tags, allowlist citations,
+    // detect canary leak, and — on a quarantined turn without tool_choice parity —
+    // DROP + COUNT any tool calls the model emitted (A7).
+    if (screenSeam !== null && result.ok) {
+        if (quarantine && result.toolCalls !== undefined && result.toolCalls.length > 0) {
+            screenSeam.noteQuarantineDrop(result.toolCalls.length);
+            result = { ...result, toolCalls: [] };
+        }
+        const injectedUrls = (parts.injectedSources ?? []).map((s) => s.url);
+        const cleaned = screenSeam.screenResponse(result.text, injectedUrls);
+        if (cleaned !== result.text)
+            result = { ...result, text: cleaned };
+    }
+    return {
+        request,
+        result,
+        latencyMs,
+        seam,
+        ...(screenSeam !== null ? { screenReceipt: screenSeam.receipt() } : {}),
+    };
 }
 /**
  * Record a tool-call turn and build its RunResult (spec §4.4). A tool call is
@@ -267,6 +370,7 @@ function emitToolCallResult(record, parts) {
             repairedBy: null,
             callId: parts.callId,
             toolCalls: result.toolCalls,
+            ...(parts.destination !== undefined ? { destination: parts.destination } : {}),
         },
     };
 }

package/dist/run/grounding.d.ts

@@ -16,6 +16,7 @@
  */
 import type { RouteBundle } from "../types/route";
 import { type ProviderId } from "../types/provider";
+import { type ContentSegment } from "../screen/provenance";
 export interface SearchResultItem {
     readonly title: string;
     readonly url: string;
@@ -85,11 +86,36 @@ export declare const SEARCH_SNIPPET_MAX_CHARS = 500;
  * untrusted-input policy sentence is owned by the provenance assembler and added
  * to the system slot via `untrustedSystemAppend` — screening F2, single owner). */
 export declare function groundingSystemAppend(assembly: RouteBundle["groundingAssembly"], results: readonly SearchResultItem[], retrievedAt: string): string;
+/** S3 (SC-0, spec §11.3): the effective system-slot removal set for the template
+ * renderer = `keys(variableTrust)` ∪ `proxyTrust`, expressed in the SAME shape the
+ * x-trust removal path consumes (`Record<name, "untrusted">`, routes/template.ts).
+ * A name in `proxyTrust` therefore renders EMPTY in the trusted system slot,
+ * reusing that path rather than forking it. Absent/empty `proxyTrust` ⇒ the
+ * `variableTrust` reference is returned UNCHANGED, so the render is byte-identical. */
+export declare function systemSlotRemoval(variableTrust: Readonly<Record<string, "untrusted">> | undefined, proxyTrust: readonly string[] | undefined): Readonly<Record<string, "untrusted">> | undefined;
+/** Screening S1 + S2 (SC-0 B3) + S3 (SC-0): the untrusted segments a route+input
+ * contribute — (a) each name in `proxyTrust` present in input, tagged
+ * `proxy_user` (S3); (b) each `x-trust: untrusted` variable (S2), tagged
+ * `variable`; and (c), when `grounding.assembly: spotlight`, the search results
+ * (S1), tagged `search`. Shared by the system- and user-slot builders so the two
+ * slots agree on "is anything untrusted present" (screening F2). Empty ⇒ nothing
+ * untrusted (byte-identical default — `proxyTrust` is unset in S3). */
+export declare function collectUntrustedSegments(route: Pick<RouteBundle, "groundingAssembly" | "variableTrust">, input: Record<string, unknown>, injectedSources: readonly SearchResultItem[] | null, proxyTrust?: readonly string[]): ContentSegment[];
 /** Screening S1 + S2 (SC-0 B3): the USER-slot untrusted block appended after the
  * user directive. Assembles the untrusted segments into a single spotlighted,
  * JSON-encoded, delimiter-wrapped block via the provenance assembler. Returns ""
  * when there is nothing untrusted (byte-identical default). */
-export declare function untrustedUserBlock(route: Pick<RouteBundle, "groundingAssembly" | "variableTrust">, input: Record<string, unknown>, injectedSources: readonly SearchResultItem[] | null, provider: ProviderId): string;
+export declare function untrustedUserBlock(route: Pick<RouteBundle, "groundingAssembly" | "variableTrust">, input: Record<string, unknown>, injectedSources: readonly SearchResultItem[] | null, provider: ProviderId, proxyTrust?: readonly string[]): string;
+/** SC-1a: assemble a GIVEN segment list into the {systemAppend, userAppend} the
+ * dispatch helper appends. Byte-identical to `untrustedSystemAppend` +
+ * `untrustedUserBlock` when `segments` is the full collected set (same
+ * assemblePrompt calls, same nonce semantics) — so the screening-OFF path stays
+ * golden. The screening path passes the POST-strip `keepSegments`, so a stripped
+ * segment vanishes from both slots. Returns empty appends for an empty list. */
+export declare function assembleUntrustedAppends(segments: readonly ContentSegment[], provider: ProviderId): {
+    readonly systemAppend: string;
+    readonly userAppend: string;
+};
 /** Screening F2 (SC-0 B3): the SYSTEM-slot untrusted-input policy sentence. The
  * provenance assembler is the SINGLE owner of this sentence (spec §2.2); this
  * surfaces its system-slot output whenever ANY untrusted segment is delivered —
@@ -97,5 +123,5 @@ export declare function untrustedUserBlock(route: Pick<RouteBundle, "groundingAs
  * template still gets its "this is data" framing. Returns "" when there is
  * nothing untrusted (byte-identical default). The assembler's system slot does
  * not depend on the nonce or the block shape, so fixed placeholders suffice. */
-export declare function untrustedSystemAppend(route: Pick<RouteBundle, "groundingAssembly" | "variableTrust">, input: Record<string, unknown>, injectedSources: readonly SearchResultItem[] | null): string;
+export declare function untrustedSystemAppend(route: Pick<RouteBundle, "groundingAssembly" | "variableTrust">, input: Record<string, unknown>, injectedSources: readonly SearchResultItem[] | null, proxyTrust?: readonly string[]): string;
 //# sourceMappingURL=grounding.d.ts.map

package/dist/run/grounding.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"grounding.d.ts","sourceRoot":"","sources":["../../src/run/grounding.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAGH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAClD,OAAO,EAAqB,KAAK,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAGvE,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;CACjC;AAED,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,OAAO,EAAE,SAAS,gBAAgB,EAAE,CAAC;IAC9C,mEAAmE;IACnE,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B;AAED,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE;QAAE,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;CACzF;AAED,sEAAsE;AACtE,eAAO,MAAM,sBAAsB,MAAM,CAAC;AAE1C,wBAAgB,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAEpD;AAED,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB;uDACmD;IACnD,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IACnC,QAAQ,CAAC,WAAW,CAAC,EAAE,OAAO,GAAG,UAAU,CAAC;IAC5C,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,sDAAsD;IACtD,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,KAAK,CAAC;CACjC;AAaD,wBAAgB,0BAA0B,CAAC,MAAM,EAAE,kBAAkB,GAAG,cAAc,CAoCrF;AAED;gEACgE;AAChE,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,SAAS,gBAAgB,EAAE,EAAE,WAAW,EAAE,MAAM,GAAG,MAAM,CAYtG;AAED,yEAAyE;AACzE,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAC;IAC9B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;CACzB;AAWD;;;;;;mFAMmF;AACnF,wBAAgB,gBAAgB,CAC9B,UAAU,EAAE,MAAM,EAClB,OAAO,EAAE,SAAS,gBAAgB,EAAE,GACnC,WAAW,EAAE,CAYf;AAED;kFACkF;AAClF,wBAAgB,qBAAqB,CACnC,UAAU,EAAE,MAAM,EAClB,OAAO,EAAE,SAAS,gBAAgB,EAAE,GACnC,MAAM,CAGR;AAED;;kFAEkF;AAClF,wBAAgB,aAAa,CAC3B,UAAU,EAAE,MAAM,EAClB,OAAO,EAAE,SAAS,gBAAgB,EAAE,GACnC;IAAE,SAAS,EAAE,WAAW,EAAE,CAAC;IAAC,SAAS,EAAE;QAAE,iBAAiB,EAAE,MAAM,CAAA;KAAE,CAAA;CAAE,CAKxE;AAED;mDACmD;AACnD,eAAO,MAAM,wBAAwB,MAAM,CAAC;AAM5C;;;;mFAImF;AACnF,wBAAgB,qBAAqB,CACnC,QAAQ,EAAE,WAAW,CAAC,mBAAmB,CAAC,EAC1C,OAAO,EAAE,SAAS,gBAAgB,EAAE,EACpC,WAAW,EAAE,MAAM,GAClB,MAAM,CAGR;AAiCD;;;+DAG+D;AAC/D,wBAAgB,kBAAkB,CAChC,KAAK,EAAE,IAAI,CAAC,WAAW,EAAE,mBAAmB,GAAG,eAAe,CAAC,EAC/D,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC9B,eAAe,EAAE,SAAS,gBAAgB,EAAE,GAAG,IAAI,EACnD,QAAQ,EAAE,UAAU,GACnB,MAAM,CAKR;AAED;;;;;;gFAMgF;AAChF,wBAAgB,qBAAqB,CACnC,KAAK,EAAE,IAAI,CAAC,WAAW,EAAE,mBAAmB,GAAG,eAAe,CAAC,EAC/D,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC9B,eAAe,EAAE,SAAS,gBAAgB,EAAE,GAAG,IAAI,GAClD,MAAM,CAKR"}
+{"version":3,"file":"grounding.d.ts","sourceRoot":"","sources":["../../src/run/grounding.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAGH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAClD,OAAO,EAAqB,KAAK,UAAU,EAAE,MAAM,mBAAmB,CAAC;AACvE,OAAO,EAAkB,KAAK,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAE3E,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;CACjC;AAED,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,OAAO,EAAE,SAAS,gBAAgB,EAAE,CAAC;IAC9C,mEAAmE;IACnE,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B;AAED,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE;QAAE,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;CACzF;AAED,sEAAsE;AACtE,eAAO,MAAM,sBAAsB,MAAM,CAAC;AAE1C,wBAAgB,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAEpD;AAED,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB;uDACmD;IACnD,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IACnC,QAAQ,CAAC,WAAW,CAAC,EAAE,OAAO,GAAG,UAAU,CAAC;IAC5C,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,sDAAsD;IACtD,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,KAAK,CAAC;CACjC;AAaD,wBAAgB,0BAA0B,CAAC,MAAM,EAAE,kBAAkB,GAAG,cAAc,CAoCrF;AAED;gEACgE;AAChE,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,SAAS,gBAAgB,EAAE,EAAE,WAAW,EAAE,MAAM,GAAG,MAAM,CAYtG;AAED,yEAAyE;AACzE,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAC;IAC9B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;CACzB;AAWD;;;;;;mFAMmF;AACnF,wBAAgB,gBAAgB,CAC9B,UAAU,EAAE,MAAM,EAClB,OAAO,EAAE,SAAS,gBAAgB,EAAE,GACnC,WAAW,EAAE,CAYf;AAED;kFACkF;AAClF,wBAAgB,qBAAqB,CACnC,UAAU,EAAE,MAAM,EAClB,OAAO,EAAE,SAAS,gBAAgB,EAAE,GACnC,MAAM,CAGR;AAED;;kFAEkF;AAClF,wBAAgB,aAAa,CAC3B,UAAU,EAAE,MAAM,EAClB,OAAO,EAAE,SAAS,gBAAgB,EAAE,GACnC;IAAE,SAAS,EAAE,WAAW,EAAE,CAAC;IAAC,SAAS,EAAE;QAAE,iBAAiB,EAAE,MAAM,CAAA;KAAE,CAAA;CAAE,CAKxE;AAED;mDACmD;AACnD,eAAO,MAAM,wBAAwB,MAAM,CAAC;AAM5C;;;;mFAImF;AACnF,wBAAgB,qBAAqB,CACnC,QAAQ,EAAE,WAAW,CAAC,mBAAmB,CAAC,EAC1C,OAAO,EAAE,SAAS,gBAAgB,EAAE,EACpC,WAAW,EAAE,MAAM,GAClB,MAAM,CAGR;AAED;;;;;uFAKuF;AACvF,wBAAgB,iBAAiB,CAC/B,aAAa,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC,GAAG,SAAS,EAChE,UAAU,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,GACxC,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC,GAAG,SAAS,CAKnD;AAED;;;;;;uEAMuE;AACvE,wBAAgB,wBAAwB,CACtC,KAAK,EAAE,IAAI,CAAC,WAAW,EAAE,mBAAmB,GAAG,eAAe,CAAC,EAC/D,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC9B,eAAe,EAAE,SAAS,gBAAgB,EAAE,GAAG,IAAI,EACnD,UAAU,CAAC,EAAE,SAAS,MAAM,EAAE,GAC7B,cAAc,EAAE,CA8BlB;AAED;;;+DAG+D;AAC/D,wBAAgB,kBAAkB,CAChC,KAAK,EAAE,IAAI,CAAC,WAAW,EAAE,mBAAmB,GAAG,eAAe,CAAC,EAC/D,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC9B,eAAe,EAAE,SAAS,gBAAgB,EAAE,GAAG,IAAI,EACnD,QAAQ,EAAE,UAAU,EACpB,UAAU,CAAC,EAAE,SAAS,MAAM,EAAE,GAC7B,MAAM,CAKR;AAED;;;;;gFAKgF;AAChF,wBAAgB,wBAAwB,CACtC,QAAQ,EAAE,SAAS,cAAc,EAAE,EACnC,QAAQ,EAAE,UAAU,GACnB;IAAE,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;CAAE,CAKhE;AAED;;;;;;gFAMgF;AAChF,wBAAgB,qBAAqB,CACnC,KAAK,EAAE,IAAI,CAAC,WAAW,EAAE,mBAAmB,GAAG,eAAe,CAAC,EAC/D,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC9B,eAAe,EAAE,SAAS,gBAAgB,EAAE,GAAG,IAAI,EACnD,UAAU,CAAC,EAAE,SAAS,MAAM,EAAE,GAC7B,MAAM,CAKR"}

package/dist/run/grounding.js

@@ -24,7 +24,10 @@ exports.extractCitations = extractCitations;
 exports.countDroppedCitations = countDroppedCitations;
 exports.groundingMeta = groundingMeta;
 exports.groundingSystemAppend = groundingSystemAppend;
+exports.systemSlotRemoval = systemSlotRemoval;
+exports.collectUntrustedSegments = collectUntrustedSegments;
 exports.untrustedUserBlock = untrustedUserBlock;
+exports.assembleUntrustedAppends = assembleUntrustedAppends;
 exports.untrustedSystemAppend = untrustedSystemAppend;
 const node_crypto_1 = require("node:crypto");
 const provider_1 = require("../types/provider");
@@ -141,17 +144,45 @@ function groundingSystemAppend(assembly, results, retrievedAt) {
         return "";
     return searchInjectionBlock(results, retrievedAt); // legacy default — byte-identical
 }
-/** Screening S1 + S2 (SC-0 B3): the untrusted segments a route+input contribute
- * — (a) each `x-trust: untrusted` variable (S2) and (b), when
- * `grounding.assembly: spotlight`, the search results (S1). Shared by the system-
- * and user-slot builders so the two slots agree on "is anything untrusted
- * present" (screening F2). Empty ⇒ nothing untrusted (byte-identical default). */
-function collectUntrustedSegments(route, input, injectedSources) {
+/** S3 (SC-0, spec §11.3): the effective system-slot removal set for the template
+ * renderer = `keys(variableTrust)` ∪ `proxyTrust`, expressed in the SAME shape the
+ * x-trust removal path consumes (`Record<name, "untrusted">`, routes/template.ts).
+ * A name in `proxyTrust` therefore renders EMPTY in the trusted system slot,
+ * reusing that path rather than forking it. Absent/empty `proxyTrust` ⇒ the
+ * `variableTrust` reference is returned UNCHANGED, so the render is byte-identical. */
+function systemSlotRemoval(variableTrust, proxyTrust) {
+    if (proxyTrust === undefined || proxyTrust.length === 0)
+        return variableTrust;
+    const merged = { ...(variableTrust ?? {}) };
+    for (const name of proxyTrust)
+        merged[name] = "untrusted";
+    return merged;
+}
+/** Screening S1 + S2 (SC-0 B3) + S3 (SC-0): the untrusted segments a route+input
+ * contribute — (a) each name in `proxyTrust` present in input, tagged
+ * `proxy_user` (S3); (b) each `x-trust: untrusted` variable (S2), tagged
+ * `variable`; and (c), when `grounding.assembly: spotlight`, the search results
+ * (S1), tagged `search`. Shared by the system- and user-slot builders so the two
+ * slots agree on "is anything untrusted present" (screening F2). Empty ⇒ nothing
+ * untrusted (byte-identical default — `proxyTrust` is unset in S3). */
+function collectUntrustedSegments(route, input, injectedSources, proxyTrust) {
     const segments = [];
+    // S3: each per-call proxyTrust name present in input is `proxy_user` untrusted
+    // content — the request-side isolation seam for the slug/proxy lane.
+    const proxyNames = new Set(proxyTrust ?? []);
+    for (const name of proxyNames) {
+        const value = input[name];
+        if (value === undefined)
+            continue;
+        const text = typeof value === "string" ? value : JSON.stringify(value);
+        segments.push({ source: "proxy_user", tier: "untrusted", text });
+    }
     // S2: each variable annotated `x-trust: untrusted` moves out of the system slot.
     for (const [name, trust] of Object.entries(route.variableTrust ?? {})) {
         if (trust !== "untrusted")
             continue;
+        if (proxyNames.has(name))
+            continue; // proxy_user takes precedence — never double-emit
         const value = input[name];
         if (value === undefined)
             continue;
@@ -173,13 +204,26 @@ function collectUntrustedSegments(route, input, injectedSources) {
  * user directive. Assembles the untrusted segments into a single spotlighted,
  * JSON-encoded, delimiter-wrapped block via the provenance assembler. Returns ""
  * when there is nothing untrusted (byte-identical default). */
-function untrustedUserBlock(route, input, injectedSources, provider) {
-    const segments = collectUntrustedSegments(route, input, injectedSources);
+function untrustedUserBlock(route, input, injectedSources, provider, proxyTrust) {
+    const segments = collectUntrustedSegments(route, input, injectedSources, proxyTrust);
     if (segments.length === 0)
         return "";
     const assembled = (0, provenance_1.assemblePrompt)(segments, { nonce: (0, node_crypto_1.randomUUID)(), untrustedBlock: (0, provider_1.untrustedBlockFor)(provider) });
     return `\n\n${assembled.user}`;
 }
+/** SC-1a: assemble a GIVEN segment list into the {systemAppend, userAppend} the
+ * dispatch helper appends. Byte-identical to `untrustedSystemAppend` +
+ * `untrustedUserBlock` when `segments` is the full collected set (same
+ * assemblePrompt calls, same nonce semantics) — so the screening-OFF path stays
+ * golden. The screening path passes the POST-strip `keepSegments`, so a stripped
+ * segment vanishes from both slots. Returns empty appends for an empty list. */
+function assembleUntrustedAppends(segments, provider) {
+    if (segments.length === 0)
+        return { systemAppend: "", userAppend: "" };
+    const sys = (0, provenance_1.assemblePrompt)(segments, { nonce: "", untrustedBlock: "user_json" }).system;
+    const { user } = (0, provenance_1.assemblePrompt)(segments, { nonce: (0, node_crypto_1.randomUUID)(), untrustedBlock: (0, provider_1.untrustedBlockFor)(provider) });
+    return { systemAppend: sys === "" ? "" : `\n\n${sys}`, userAppend: `\n\n${user}` };
+}
 /** Screening F2 (SC-0 B3): the SYSTEM-slot untrusted-input policy sentence. The
  * provenance assembler is the SINGLE owner of this sentence (spec §2.2); this
  * surfaces its system-slot output whenever ANY untrusted segment is delivered —
@@ -187,8 +231,8 @@ function untrustedUserBlock(route, input, injectedSources, provider) {
  * template still gets its "this is data" framing. Returns "" when there is
  * nothing untrusted (byte-identical default). The assembler's system slot does
  * not depend on the nonce or the block shape, so fixed placeholders suffice. */
-function untrustedSystemAppend(route, input, injectedSources) {
-    const segments = collectUntrustedSegments(route, input, injectedSources);
+function untrustedSystemAppend(route, input, injectedSources, proxyTrust) {
+    const segments = collectUntrustedSegments(route, input, injectedSources, proxyTrust);
     if (segments.length === 0)
         return "";
     const { system } = (0, provenance_1.assemblePrompt)(segments, { nonce: "", untrustedBlock: "user_json" });

package/dist/run/raw-defaults.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"raw-defaults.d.ts","sourceRoot":"","sources":["../../src/run/raw-defaults.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAErD;;;;;;;GAOG;AACH,eAAO,MAAM,sBAAsB,EAAE,MAAM,CAAC,WAAW,EAAE,MAAM,CAI9D,CAAC;AAEF,uDAAuD;AACvD,MAAM,WAAW,aAAa;IAC5B,kDAAkD;IAClD,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB;4EACwE;IACxE,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,oDAAoD;IACpD,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB;AAeD;;;;;;;GAOG;AACH,eAAO,MAAM,YAAY,EAAE,SAAS,aAAa,EA6DhD,CAAC;AAEF;;;;;;GAMG;AACH,wBAAgB,iBAAiB,IAAI,MAAM,CAK1C"}
+{"version":3,"file":"raw-defaults.d.ts","sourceRoot":"","sources":["../../src/run/raw-defaults.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAErD;;;;;;;GAOG;AACH,eAAO,MAAM,sBAAsB,EAAE,MAAM,CAAC,WAAW,EAAE,MAAM,CAI9D,CAAC;AAEF,uDAAuD;AACvD,MAAM,WAAW,aAAa;IAC5B,kDAAkD;IAClD,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB;4EACwE;IACxE,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,oDAAoD;IACpD,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB;AAeD;;;;;;;GAOG;AACH,eAAO,MAAM,YAAY,EAAE,SAAS,aAAa,EAkEhD,CAAC;AAEF;;;;;;GAMG;AACH,wBAAgB,iBAAiB,IAAI,MAAM,CAK1C"}

package/dist/run/raw-defaults.js

@@ -55,7 +55,7 @@ exports.RAW_DEFAULTS = [
     {
         knob: "serviceTier",
         default: "standard",
-        note: "forwarded to the adapter; `meta.servedTier` reports what actually served. On `flex`, set `timeoutMs` in minutes (default 900 s)",
+        note: "forwarded to the adapter; `meta.servedTier` reports what actually served, and the cost row is priced at the SERVED tier (gemini flex = 0.5× input + output, cache read NOT discounted; priority = 1.8×). On `flex`, set `timeoutMs` in minutes (default 900 s)",
     },
     {
         knob: "temperature",
@@ -87,6 +87,11 @@ exports.RAW_DEFAULTS = [
         default: "absent ⇒ byte-identical",
         note: "syntactic-JSON forcing (mime-shaping only); provider support per the raw-lane knob matrix",
     },
+    {
+        knob: "responseSchema",
+        default: "absent ⇒ byte-identical (no schema sent, no validation)",
+        note: "JSON Schema forwarded natively AND Ajv-checked client-side — a miss is a billed, terminal `content_invalid` (never repaired); `meta.schema_sha` on the row; provider support per the raw-lane knob matrix",
+    },
     {
         knob: "cache",
         default: "none",