modelrig 0.8.1 → 0.10.0

package/dist/telemetry/ingest-protocol.js

@@ -23,19 +23,21 @@
  * stamped by whoever holds the principal — the exporter's config in direct
  * mode, the resolved key in api mode.
  *
- * The single exception is `feedback.org_id`, and it is the reason WS2 exists.
- * A verdict recorded on OUR hosted server belongs to the org of the person who
+ * The single exception is `grade.org_id`, and it is the reason WS2 exists.
+ * A judgment recorded on OUR hosted server belongs to the org of the person who
  * recorded it, not to the org the server runs as, and one SQLite store holds
- * verdicts for many orgs. So a feedback row may name its own org — and the
- * ingest endpoint VERIFIES that name against the key rather than trusting it
- * (see `foreignOrgFeedback`). A service-role exporter needs no such check: it
- * already holds a credential that can write any row in the database.
+ * grades for many orgs. So a grade row may name its own org — and the ingest
+ * endpoint VERIFIES that name against the key rather than trusting it (see
+ * `foreignOrgGrades`). A service-role exporter needs no such check: it already
+ * holds a credential that can write any row in the database.
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.DEFAULT_INGEST_URL = exports.INGEST_PROTOCOL_VERSION_V1 = exports.INGEST_PROTOCOL_VERSION = exports.INGEST_PATH = void 0;
+exports.DEFAULT_INGEST_URL = exports.INGEST_PROTOCOL_VERSION_V1 = exports.INGEST_PROTOCOL_VERSION = exports.INGEST_PATH = exports.foreignOrgGrades = void 0;
 exports.stampBatch = stampBatch;
-exports.foreignOrgFeedback = foreignOrgFeedback;
 const fingerprint_1 = require("../registry/fingerprint");
+const grade_mappers_1 = require("./grade-mappers");
+var grade_mappers_2 = require("./grade-mappers");
+Object.defineProperty(exports, "foreignOrgGrades", { enumerable: true, get: function () { return grade_mappers_2.foreignOrgGrades; } });
 /** The path the api sink posts to. Spelled once. */
 exports.INGEST_PATH = "/v1/ingest";
 /** The CURRENT protocol version — the maximum the SDK can speak (ruling d).
@@ -50,14 +52,7 @@ exports.INGEST_PROTOCOL_VERSION = 2;
 exports.INGEST_PROTOCOL_VERSION_V1 = 1;
 /** Default ingest host — telemetry-ingestion-boundary.md §2.1. */
 exports.DEFAULT_INGEST_URL = "https://api.modelrig.ai";
-/**
- * Turn a batch plus a tenant into the writes it becomes.
- *
- * THE conformance seam. Both transports call this; nothing else builds a
- * telemetry row. If you are about to add a table to the export, add it here
- * and both modes gain it at once — which is the point.
- */
-function stampBatch(batch, tenancy) {
+function stampBatch(batch, tenancy, opts = {}) {
     const writes = [];
     const now = new Date().toISOString();
     if (batch.routes !== undefined && batch.routes.length > 0) {
@@ -101,28 +96,38 @@ function stampBatch(batch, tenancy) {
             merge: true,
             rows: taskRows,
         });
-        writes.push({
-            table: "routes",
-            onConflict: "org_id,route,version",
-            merge: true,
-            rows: batch.routes.map((r) => ({
-                org_id: tenancy.org_id,
-                route: r.route,
-                version: r.version,
-                candidates: r.candidates,
-                capture: r.capture,
-                updated_at: now,
-                // Phase D (spec §13): the resolved bundle + its hash + the sync stamp.
-                // Written only when the batch carries a bundle, so an older SDK's
-                // metadata-only mirror leaves any existing bundle intact (a merge
-                // upsert touches only the columns present in the row). `synced_at` is
-                // the BUNDLE's timestamp — stamped iff a bundle synced — distinct from
-                // `updated_at`, the row's metadata timestamp.
-                ...(r.bundle !== undefined
-                    ? { bundle: r.bundle, bundle_sha: r.bundle_sha ?? null, synced_at: now }
-                    : {}),
-            })),
+        const routeRow = (r) => ({
+            org_id: tenancy.org_id,
+            route: r.route,
+            version: r.version,
+            candidates: r.candidates,
+            capture: r.capture,
+            updated_at: now,
+            // Phase D (spec §13): the resolved bundle + its hash + the sync stamp.
+            // Written only when the route carries a bundle, so an older SDK's
+            // metadata-only mirror leaves any existing bundle intact (a merge
+            // upsert touches only the columns present in the row). `synced_at` is
+            // the BUNDLE's timestamp — stamped iff a bundle synced through a trusted
+            // path — distinct from `updated_at`, the row's metadata timestamp.
+            ...(r.bundle !== undefined
+                ? { bundle: r.bundle, bundle_sha: r.bundle_sha ?? null, synced_at: opts.declaredBundles === true ? null : now }
+                : {}),
         });
+        // TWO writes, split by bundle presence: a PostgREST bulk insert requires
+        // every row to carry the SAME keys (PGRST102), so one route whose bundle was
+        // dropped must not fail — or null out — its neighbours' bundles.
+        const withBundle = batch.routes.filter((r) => r.bundle !== undefined);
+        const withoutBundle = batch.routes.filter((r) => r.bundle === undefined);
+        for (const group of [withBundle, withoutBundle]) {
+            if (group.length === 0)
+                continue;
+            writes.push({
+                table: "routes",
+                onConflict: "org_id,route,version",
+                merge: true,
+                rows: group.map(routeRow),
+            });
+        }
     }
     if (batch.runs !== undefined && batch.runs.length > 0) {
         writes.push({
@@ -225,28 +230,6 @@ function stampBatch(batch, tenancy) {
             })),
         });
     }
-    if (batch.artifact_evaluations !== undefined && batch.artifact_evaluations.length > 0) {
-        writes.push({
-            table: "artifact_evaluations",
-            onConflict: "org_id,id",
-            merge: false,
-            rows: batch.artifact_evaluations.map((v) => ({
-                org_id: tenancy.org_id,
-                id: v.id,
-                artifact_id: v.artifact_id,
-                // Subject-one-of (00051): a run-subject row carries run_id, artifact_id
-                // null; the CHECK rejects a row that sets both or neither.
-                run_id: v.run_id ?? null,
-                evaluator: v.evaluator,
-                evaluator_kind: v.evaluator_kind,
-                score: v.score,
-                passed: v.passed,
-                label: v.label,
-                explanation: v.explanation,
-                created_by: v.created_by,
-            })),
-        });
-    }
     if (batch.eval_cases !== undefined && batch.eval_cases.length > 0) {
         writes.push({
             // An eval case is created once (via promote); a retry must not rewrite it.
@@ -319,20 +302,14 @@ function stampBatch(batch, tenancy) {
             ],
         });
     }
-    if (batch.feedback !== undefined && batch.feedback.length > 0) {
+    if (batch.grades !== undefined && batch.grades.length > 0) {
+        // The SDK's current judgment write path. A grade may name its own org
+        // (feedback doctrine, verified by foreignOrgGrades before this).
         writes.push({
-            table: "feedback",
-            onConflict: "id",
+            table: "grades",
+            onConflict: "org_id,id",
             merge: false,
-            rows: batch.feedback.map(({ org_id, ...row }) => ({
-                // The verdict's own org wins when it has one — that is the whole of
-                // QA-P6-010's fix. Note that `source_id` is deliberately absent:
-                // `feedback.source` already means "who judged", and two columns a
-                // letter apart meaning different things is N2's cautionary tale.
-                org_id: org_id ?? tenancy.org_id,
-                project_id: tenancy.project_id,
-                ...row,
-            })),
+            rows: batch.grades.map((g) => (0, grade_mappers_1.gradeToRow)(g, tenancy)),
         });
     }
     if (batch.envelopes !== undefined && batch.envelopes.length > 0) {
@@ -352,15 +329,3 @@ function stampBatch(batch, tenancy) {
     }
     return writes;
 }
-/**
- * Feedback rows naming an org other than the presented key's.
- *
- * Exists as its own exported function because the ingest endpoint must drop
- * these and COUNT them, and a check that lives inline in a request handler is
- * a check nobody can test in isolation. Returns the offending ids.
- */
-function foreignOrgFeedback(rows, keyOrgId) {
-    return rows
-        .filter((r) => r.org_id !== undefined && r.org_id !== keyOrgId)
-        .map((r) => r.id);
-}

package/dist/telemetry/org-identity.d.ts

@@ -0,0 +1,44 @@
+/**
+ * The first-flush org line + the `expectOrg` mismatch signal (REL-1, ruling M5).
+ *
+ * A VALID key minted in the WRONG org is the failure the AUTH FAILED latch in
+ * sinks.ts cannot see: every POST is a 200, and the runs land in someone else's
+ * console. (Six weeks of InferWealth pipeline telemetry went to Nunexa this
+ * way.) So on the first successful flush in each process the api sink asks
+ * `GET /v1/whoami` once — through the same `whoamiPreflight` helper that
+ * `modelrig doctor` uses — and logs which org it is exporting to:
+ *
+ *   [modelrig] exporting to org «InferWealth» (inferwealth) as key «InferWealth2» …ab12
+ *
+ * With `createRig({ expectOrg: "<slug>" })` a different resolved slug logs
+ * `ORG MISMATCH` loudly on EVERY successful flush (ruling M5), because nobody
+ * reads boot logs. It is a code option, not an env var (P15).
+ *
+ * Contract: non-blocking (never awaited by the sink), once per process per
+ * key, never throws, never drops or delays telemetry. A failed whoami is
+ * SILENT: a 401 already has its own loud line, and a network blip must not
+ * become noise.
+ */
+import { type PreflightResult } from "../doctor-preflight";
+/** The whoami call is aborted after this long, so it can never hold a
+ * process open (AbortSignal.timeout's timer is unref'd by Node). */
+export declare const WHOAMI_TIMEOUT_MS = 5000;
+/** TESTS ONLY — forget every key, so "once per process" cases are independent. */
+export declare function __resetOrgIdentityForTest(): void;
+export interface OrgIdentityInput {
+    readonly ingestUrl: string;
+    readonly apiKey: string;
+    readonly expectOrg?: string;
+    readonly fetchFn: typeof fetch;
+    /** Override WHOAMI_TIMEOUT_MS (tests). */
+    readonly timeoutMs?: number;
+}
+/** Build the one-line org banner from a successful whoami. */
+export declare function formatOrgLine(result: PreflightResult, apiKey: string): string;
+/**
+ * Record one successful flush. Returns immediately; the whoami (first flush
+ * only) runs in the background. Exposed as a promise-returning helper ONLY so
+ * tests can await the background work — the sink calls it with `void`.
+ */
+export declare function noteSuccessfulFlush(input: OrgIdentityInput): Promise<void>;
+//# sourceMappingURL=org-identity.d.ts.map

package/dist/telemetry/org-identity.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"org-identity.d.ts","sourceRoot":"","sources":["../../src/telemetry/org-identity.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,OAAO,EAAwC,KAAK,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAGjG;oEACoE;AACpE,eAAO,MAAM,iBAAiB,OAAO,CAAC;AAYtC,kFAAkF;AAClF,wBAAgB,yBAAyB,IAAI,IAAI,CAEhD;AAED,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,OAAO,EAAE,OAAO,KAAK,CAAC;IAC/B,0CAA0C;IAC1C,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;CAC7B;AAED,8DAA8D;AAC9D,wBAAgB,aAAa,CAAC,MAAM,EAAE,eAAe,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAO7E;AAgBD;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,gBAAgB,GAAG,OAAO,CAAC,IAAI,CAAC,CA+B1E"}

package/dist/telemetry/org-identity.js

@@ -0,0 +1,98 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.WHOAMI_TIMEOUT_MS = void 0;
+exports.__resetOrgIdentityForTest = __resetOrgIdentityForTest;
+exports.formatOrgLine = formatOrgLine;
+exports.noteSuccessfulFlush = noteSuccessfulFlush;
+/**
+ * The first-flush org line + the `expectOrg` mismatch signal (REL-1, ruling M5).
+ *
+ * A VALID key minted in the WRONG org is the failure the AUTH FAILED latch in
+ * sinks.ts cannot see: every POST is a 200, and the runs land in someone else's
+ * console. (Six weeks of InferWealth pipeline telemetry went to Nunexa this
+ * way.) So on the first successful flush in each process the api sink asks
+ * `GET /v1/whoami` once — through the same `whoamiPreflight` helper that
+ * `modelrig doctor` uses — and logs which org it is exporting to:
+ *
+ *   [modelrig] exporting to org «InferWealth» (inferwealth) as key «InferWealth2» …ab12
+ *
+ * With `createRig({ expectOrg: "<slug>" })` a different resolved slug logs
+ * `ORG MISMATCH` loudly on EVERY successful flush (ruling M5), because nobody
+ * reads boot logs. It is a code option, not an env var (P15).
+ *
+ * Contract: non-blocking (never awaited by the sink), once per process per
+ * key, never throws, never drops or delays telemetry. A failed whoami is
+ * SILENT: a 401 already has its own loud line, and a network blip must not
+ * become noise.
+ */
+const doctor_preflight_1 = require("../doctor-preflight");
+const api_key_format_1 = require("../tenancy/api-key-format");
+/** The whoami call is aborted after this long, so it can never hold a
+ * process open (AbortSignal.timeout's timer is unref'd by Node). */
+exports.WHOAMI_TIMEOUT_MS = 5000;
+/** Keyed by ingest origin + key, so two rigs sharing a key share one whoami. */
+const states = new Map();
+/** TESTS ONLY — forget every key, so "once per process" cases are independent. */
+function __resetOrgIdentityForTest() {
+    states.clear();
+}
+/** Build the one-line org banner from a successful whoami. */
+function formatOrgLine(result, apiKey) {
+    const org = result.whoami?.org ?? null;
+    const name = org?.name ?? org?.id ?? "?";
+    const slug = org?.slug ?? "?";
+    const keyName = result.whoami?.key?.name;
+    const keyLabel = typeof keyName === "string" && keyName !== "" ? `«${keyName}» ` : "";
+    return `[modelrig] exporting to org «${name}» (${slug}) as key ${keyLabel}${(0, api_key_format_1.redactApiKey)(apiKey)}`;
+}
+function mismatchLine(actual, expectOrg) {
+    return (`[modelrig] ORG MISMATCH: key resolves to «${actual}», expectOrg is «${expectOrg}» — ` +
+        `telemetry is landing in «${actual}»`);
+}
+function warnIfMismatch(result, expectOrg) {
+    const expected = expectOrg?.trim();
+    if (expected === undefined || expected === "")
+        return;
+    const actual = (0, doctor_preflight_1.expectedOrgMismatch)(result, expected);
+    if (actual !== null)
+        console.warn(mismatchLine(actual, expected));
+}
+/**
+ * Record one successful flush. Returns immediately; the whoami (first flush
+ * only) runs in the background. Exposed as a promise-returning helper ONLY so
+ * tests can await the background work — the sink calls it with `void`.
+ */
+function noteSuccessfulFlush(input) {
+    let origin;
+    try {
+        origin = new URL(input.ingestUrl).origin;
+    }
+    catch {
+        return Promise.resolve();
+    }
+    const id = `${origin}|${input.apiKey}`;
+    let state = states.get(id);
+    if (state === undefined) {
+        state = { flushes: 0, resolved: null };
+        states.set(id, state);
+    }
+    state.flushes += 1;
+    const s = state;
+    if (s.flushes === 1) {
+        return (0, doctor_preflight_1.whoamiPreflight)(input.ingestUrl, input.apiKey, input.fetchFn, AbortSignal.timeout(input.timeoutMs ?? exports.WHOAMI_TIMEOUT_MS))
+            .then((result) => {
+            if (!result.ok)
+                return; // silent: a 401 has its own loud line
+            s.resolved = result;
+            console.log(formatOrgLine(result, input.apiKey));
+            warnIfMismatch(result, input.expectOrg);
+        })
+            .catch(() => {
+            // whoamiPreflight never throws, and logging must never break the sink.
+        });
+    }
+    // M5: loud on EVERY flush once the org is known (flush 1 warns when whoami lands).
+    if (s.resolved !== null)
+        warnIfMismatch(s.resolved, input.expectOrg);
+    return Promise.resolve();
+}

package/dist/telemetry/route-registration.d.ts

@@ -0,0 +1,48 @@
+/**
+ * RV-1 declare-on-startup — a rig with routes AND a control plane tells the
+ * control plane which routes it serves the moment it is created, so a route is
+ * visible (console, MCP `get_call_config`, `GET /v1/routes/:route/call-config
+ * ?include=effective`) BEFORE its first call.
+ *
+ * ── WHY A SEPARATE ONE-SHOT, WHEN THE EXPORTER ALREADY MIRRORS ROUTES ─────
+ * The exporter folds the routes mirror into its FIRST flush (one interval —
+ * 10s — after start). A short-lived process (a CLI, a cron, a lazily-built
+ * pipeline rig) that exits before that tick without `close()` never mirrors, and
+ * a long-lived one is invisible for the first interval. This sends the same
+ * metadata once, immediately. The exporter's header stays as the at-least-once
+ * retry path: the routes upsert is a merge on (org_id, route, version), so the
+ * duplicate is harmless.
+ *
+ * ── WHAT IT CARRIES (and does not) ────────────────────────────────────────
+ * route, version, candidates (provider/model), capture flag, AND the declared
+ * resolved bundle + its `bundle_sha` — the same payload the exporter's
+ * first-flush mirror has always carried (Matt's RV-1 ruling 1, 2026-10-10). The
+ * bundle is ROUTE CONFIGURATION (the authored prompt TEMPLATE with its
+ * placeholders, schema, candidates, policy — never per-call values); the control
+ * plane needs it so a call-config pin passes the eligibility gate (`loadBundle`)
+ * on a mirror-mode server. The server re-validates the bundle and recomputes the
+ * sha; once a PSR prompt has been promoted for the route, PSR's template wins
+ * over the declared one (modelrig-server ingest-route-config.ts). The org is
+ * never on the wire — the server stamps it from the key's principal (T3/T11).
+ * It travels through the SAME sink as telemetry, so in `api` mode it is a
+ * `POST /v1/ingest` with the rig's own key and needs only the `ingest` scope.
+ *
+ * ── FAIL-OPEN BY CONSTRUCTION ─────────────────────────────────────────────
+ * Fire-and-forget. Never awaited by createRig, never throws (sync or async),
+ * one console.warn on failure. It cannot change what THIS process serves (the
+ * SDK serves from its local bundles); it writes only the control-plane `routes`
+ * mirror, exactly as the exporter's first flush already does.
+ */
+import type { IngestBatch } from "./ingest-protocol";
+import type { ExportedRouteMirror } from "./exporter";
+import type { TelemetrySink } from "./sinks";
+/** The routes-only batch (metadata + declared bundle). v1 so any server vintage
+ * accepts it (an older server keeps the metadata and ignores the bundle). */
+export declare function buildRouteRegistrationBatch(sourceId: string, routes: readonly ExportedRouteMirror[]): IngestBatch;
+/**
+ * Register `routes` with the control plane through `sink`, once, now. Returns
+ * the in-flight promise (always resolves — for tests and callers that want to
+ * await it); createRig ignores it. No routes ⇒ no request.
+ */
+export declare function registerRoutesOnStartup(sink: TelemetrySink, sourceId: string, routes: readonly ExportedRouteMirror[]): Promise<void>;
+//# sourceMappingURL=route-registration.d.ts.map

package/dist/telemetry/route-registration.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"route-registration.d.ts","sourceRoot":"","sources":["../../src/telemetry/route-registration.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AAGH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AACrD,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC;AACtD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAE7C;6EAC6E;AAC7E,wBAAgB,2BAA2B,CACzC,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,SAAS,mBAAmB,EAAE,GACrC,WAAW,CAYb;AAED;;;;GAIG;AACH,wBAAgB,uBAAuB,CACrC,IAAI,EAAE,aAAa,EACnB,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,SAAS,mBAAmB,EAAE,GACrC,OAAO,CAAC,IAAI,CAAC,CAgBf"}

package/dist/telemetry/route-registration.js

@@ -0,0 +1,77 @@
+"use strict";
+/**
+ * RV-1 declare-on-startup — a rig with routes AND a control plane tells the
+ * control plane which routes it serves the moment it is created, so a route is
+ * visible (console, MCP `get_call_config`, `GET /v1/routes/:route/call-config
+ * ?include=effective`) BEFORE its first call.
+ *
+ * ── WHY A SEPARATE ONE-SHOT, WHEN THE EXPORTER ALREADY MIRRORS ROUTES ─────
+ * The exporter folds the routes mirror into its FIRST flush (one interval —
+ * 10s — after start). A short-lived process (a CLI, a cron, a lazily-built
+ * pipeline rig) that exits before that tick without `close()` never mirrors, and
+ * a long-lived one is invisible for the first interval. This sends the same
+ * metadata once, immediately. The exporter's header stays as the at-least-once
+ * retry path: the routes upsert is a merge on (org_id, route, version), so the
+ * duplicate is harmless.
+ *
+ * ── WHAT IT CARRIES (and does not) ────────────────────────────────────────
+ * route, version, candidates (provider/model), capture flag, AND the declared
+ * resolved bundle + its `bundle_sha` — the same payload the exporter's
+ * first-flush mirror has always carried (Matt's RV-1 ruling 1, 2026-10-10). The
+ * bundle is ROUTE CONFIGURATION (the authored prompt TEMPLATE with its
+ * placeholders, schema, candidates, policy — never per-call values); the control
+ * plane needs it so a call-config pin passes the eligibility gate (`loadBundle`)
+ * on a mirror-mode server. The server re-validates the bundle and recomputes the
+ * sha; once a PSR prompt has been promoted for the route, PSR's template wins
+ * over the declared one (modelrig-server ingest-route-config.ts). The org is
+ * never on the wire — the server stamps it from the key's principal (T3/T11).
+ * It travels through the SAME sink as telemetry, so in `api` mode it is a
+ * `POST /v1/ingest` with the rig's own key and needs only the `ingest` scope.
+ *
+ * ── FAIL-OPEN BY CONSTRUCTION ─────────────────────────────────────────────
+ * Fire-and-forget. Never awaited by createRig, never throws (sync or async),
+ * one console.warn on failure. It cannot change what THIS process serves (the
+ * SDK serves from its local bundles); it writes only the control-plane `routes`
+ * mirror, exactly as the exporter's first flush already does.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.buildRouteRegistrationBatch = buildRouteRegistrationBatch;
+exports.registerRoutesOnStartup = registerRoutesOnStartup;
+const ingest_protocol_1 = require("./ingest-protocol");
+/** The routes-only batch (metadata + declared bundle). v1 so any server vintage
+ * accepts it (an older server keeps the metadata and ignores the bundle). */
+function buildRouteRegistrationBatch(sourceId, routes) {
+    return {
+        v: ingest_protocol_1.INGEST_PROTOCOL_VERSION_V1,
+        source: sourceId,
+        routes: routes.map((r) => ({
+            route: r.route,
+            version: r.version,
+            candidates: r.candidates.map((c) => ({ provider: c.provider, model: c.model })),
+            capture: r.capture ?? false,
+            ...(r.bundle !== undefined ? { bundle: r.bundle, bundle_sha: r.bundleSha } : {}),
+        })),
+    };
+}
+/**
+ * Register `routes` with the control plane through `sink`, once, now. Returns
+ * the in-flight promise (always resolves — for tests and callers that want to
+ * await it); createRig ignores it. No routes ⇒ no request.
+ */
+function registerRoutesOnStartup(sink, sourceId, routes) {
+    if (routes.length === 0)
+        return Promise.resolve();
+    let batch;
+    try {
+        batch = buildRouteRegistrationBatch(sourceId, routes);
+    }
+    catch {
+        return Promise.resolve();
+    }
+    return Promise.resolve()
+        .then(() => sink.send(batch))
+        .catch((err) => {
+        console.warn(`[modelrig] route registration (declare-on-startup) failed — routes will still be mirrored ` +
+            `by the exporter's first flush: ${err instanceof Error ? err.message : String(err)}`);
+    });
+}

package/dist/telemetry/sinks.d.ts

@@ -21,6 +21,9 @@
  */
 import type { IngestBatch, IngestOutcome, Tenancy } from "./ingest-protocol";
 import type { ApiExportConfig, DirectExportConfig } from "../config";
+/** Reset the auth-failure latch — TESTS ONLY, so warn-once cases are independent
+ * of run order (mirrors deprecations.ts). */
+export declare function __resetApiSinkWarningsForTest(): void;
 export interface TelemetrySink {
     /** Named so a boot banner and `/status` can say which lane is live without
      * inspecting config — the "which mode am I in?" question got asked enough
@@ -77,6 +80,10 @@ export interface ApiSinkConfig {
      * rows are being dropped must hear about it from their own process rather
      * than by noticing a gap in a chart weeks later. */
     readonly onOutcome?: (outcome: IngestOutcome) => void;
+    /** `createRig({ expectOrg })` (M5): the org slug this process expects its key
+     * to resolve to. A mismatch logs ORG MISMATCH on every flush (org-identity.ts);
+     * it never throws and never drops telemetry. */
+    readonly expectOrg?: string;
 }
 export declare function createApiSink(config: ApiSinkConfig): TelemetrySink;
 /**
@@ -86,5 +93,7 @@ export declare function createApiSink(config: ApiSinkConfig): TelemetrySink;
  * index.ts until Phase D; moved here — its natural home — to keep that file
  * under the LOC cap.)
  */
-export declare function buildTelemetrySink(exportConfig: ApiExportConfig | DirectExportConfig, sourceId: string): TelemetrySink;
+export declare function buildTelemetrySink(exportConfig: ApiExportConfig | DirectExportConfig, sourceId: string, opts?: {
+    readonly expectOrg?: string;
+}): TelemetrySink;
 //# sourceMappingURL=sinks.d.ts.map

package/dist/telemetry/sinks.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sinks.d.ts","sourceRoot":"","sources":["../../src/telemetry/sinks.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAIH,OAAO,KAAK,EAAE,WAAW,EAAE,aAAa,EAAE,OAAO,EAAE,MAAM,mBAAmB,CAAC;AAC7E,OAAO,KAAK,EAAE,eAAe,EAAE,kBAAkB,EAAE,MAAM,WAAW,CAAC;AAGrE,MAAM,WAAW,aAAa;IAC5B;;yDAEqD;IACrD,QAAQ,CAAC,IAAI,EAAE,QAAQ,GAAG,KAAK,CAAC;IAChC;;6EAEyE;IACzE,IAAI,CAAC,KAAK,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACzC;AAED;;;;;;;;;;;;;;;GAeG;AACH,qBAAa,aAAc,SAAQ,KAAK;IACtC,wEAAwE;IACxE,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB;;qCAEiC;IACjC,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;gBAEhB,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,SAAS;CAMxD;AAMD,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,oEAAoE;IACpE,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,yEAAyE;IACzE,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,KAAK,CAAC;CACjC;AAED,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,gBAAgB,GAAG,aAAa,CA0CxE;AAMD,MAAM,WAAW,aAAa;IAC5B,mEAAmE;IACnE,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B;4EACwE;IACxE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,KAAK,CAAC;IAChC;;;wDAGoD;IACpD,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC,OAAO,EAAE,aAAa,KAAK,IAAI,CAAC;CACvD;AAKD,wBAAgB,aAAa,CAAC,MAAM,EAAE,aAAa,GAAG,aAAa,CA4ClE;AAED;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAChC,YAAY,EAAE,eAAe,GAAG,kBAAkB,EAClD,QAAQ,EAAE,MAAM,GACf,aAAa,CA0Bf"}
+{"version":3,"file":"sinks.d.ts","sourceRoot":"","sources":["../../src/telemetry/sinks.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAIH,OAAO,KAAK,EAAE,WAAW,EAAE,aAAa,EAAE,OAAO,EAAE,MAAM,mBAAmB,CAAC;AAC7E,OAAO,KAAK,EAAE,eAAe,EAAE,kBAAkB,EAAE,MAAM,WAAW,CAAC;AAmBrE;6CAC6C;AAC7C,wBAAgB,6BAA6B,IAAI,IAAI,CAEpD;AAED,MAAM,WAAW,aAAa;IAC5B;;yDAEqD;IACrD,QAAQ,CAAC,IAAI,EAAE,QAAQ,GAAG,KAAK,CAAC;IAChC;;6EAEyE;IACzE,IAAI,CAAC,KAAK,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACzC;AAED;;;;;;;;;;;;;;;GAeG;AACH,qBAAa,aAAc,SAAQ,KAAK;IACtC,wEAAwE;IACxE,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB;;qCAEiC;IACjC,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;gBAEhB,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,SAAS;CAMxD;AAMD,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,oEAAoE;IACpE,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,yEAAyE;IACzE,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,KAAK,CAAC;CACjC;AAED,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,gBAAgB,GAAG,aAAa,CA0CxE;AAMD,MAAM,WAAW,aAAa;IAC5B,mEAAmE;IACnE,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B;4EACwE;IACxE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,KAAK,CAAC;IAChC;;;wDAGoD;IACpD,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC,OAAO,EAAE,aAAa,KAAK,IAAI,CAAC;IACtD;;oDAEgD;IAChD,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;CAC7B;AAKD,wBAAgB,aAAa,CAAC,MAAM,EAAE,aAAa,GAAG,aAAa,CAsElE;AAED;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAChC,YAAY,EAAE,eAAe,GAAG,kBAAkB,EAClD,QAAQ,EAAE,MAAM,EAChB,IAAI,GAAE;IAAE,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAA;CAAO,GACzC,aAAa,CA2Bf"}

package/dist/telemetry/sinks.js

@@ -22,12 +22,33 @@
  */
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.SinkSendError = void 0;
+exports.__resetApiSinkWarningsForTest = __resetApiSinkWarningsForTest;
 exports.createDirectSink = createDirectSink;
 exports.createApiSink = createApiSink;
 exports.buildTelemetrySink = buildTelemetrySink;
 const node_zlib_1 = require("node:zlib");
 const ingest_protocol_1 = require("./ingest-protocol");
 const constants_1 = require("../tenancy/constants");
+const api_key_format_1 = require("../tenancy/api-key-format");
+const org_identity_1 = require("./org-identity");
+/**
+ * Auth-failure latch (once per FAILURE STREAK, not once per process).
+ *
+ * A 401/403 from ingest means the key is rejected and EVERY run is being dropped
+ * org-wide — categorically different from a single poison batch (422), and the
+ * exact silent failure that cost InferWealth days of invisible telemetry. The
+ * export path is fire-and-forget, so the only way this surfaces is a log line —
+ * and it must be loud, legible, and NOT drowned in per-batch noise. We warn ONCE
+ * and latch; a subsequent successful send clears the latch, so if the key breaks
+ * again later it re-alerts. No env var, no extra request — it rides the POST that
+ * is already failing.
+ */
+let apiAuthFailureWarned = false;
+/** Reset the auth-failure latch — TESTS ONLY, so warn-once cases are independent
+ * of run order (mirrors deprecations.ts). */
+function __resetApiSinkWarningsForTest() {
+    apiAuthFailureWarned = false;
+}
 /**
  * A sink send failed — the typed error both transports throw (E2 hardening
  * Phase 2, spec §2.3.1). It carries the HTTP status the sink observed (absent
@@ -127,14 +148,38 @@ function createApiSink(config) {
                 throw new SinkSendError("ingest POST → network error", undefined);
             }
             if (!response.ok) {
-                // Status only — never the response body. The key never appears in the
-                // message (C2's leak gate covers failure text), and an exporter's
-                // warnings are the likeliest place for a secret to reach someone else's
-                // log aggregator. The status is the exporter's transient-vs-poison
-                // signal: the server sends 422 for a deterministic control-plane
+                // A rejected KEY (401/403) is not one bad batch — it means every run is
+                // being dropped org-wide, silently. Say so, loudly, ONCE per failure
+                // streak. Safe to name here: the host is the public ingest endpoint and
+                // `redactApiKey` is the sanctioned last-four form (the same one the boot
+                // banner and `modelrig doctor` print) — never the body, never the secret.
+                if ((response.status === 401 || response.status === 403) && !apiAuthFailureWarned) {
+                    apiAuthFailureWarned = true;
+                    console.warn(`[modelrig] AUTH FAILED — telemetry is being DROPPED (${response.status} at ` +
+                        `${new URL(url).origin}, key ${(0, api_key_format_1.redactApiKey)(config.apiKey)}). MODELRIG_API_KEY is not ` +
+                        "accepted by this server/org; check the key and that it belongs to the org you expect " +
+                        "at app.modelrig.ai. Runs will not appear until this is fixed. Confirm with `modelrig doctor`.");
+                }
+                // Status only in the THROWN error — never the response body. The key never
+                // appears in the message (C2's leak gate covers failure text), and an
+                // exporter's warnings are the likeliest place for a secret to reach
+                // someone else's log aggregator. The status is the exporter's transient-
+                // vs-poison signal: the server sends 422 for a deterministic control-plane
                 // rejection, 503 for a transient one (spec §2.2/§2.3.1).
                 throw new SinkSendError(`ingest POST → ${response.status}`, response.status);
             }
+            // A good send clears the auth-failure latch, so a later key breakage
+            // re-alerts instead of staying silent behind a once-per-process guard.
+            apiAuthFailureWarned = false;
+            // M5: name the org this key exports to (first flush per process, via
+            // /v1/whoami) and log ORG MISMATCH on every flush when `expectOrg` disagrees. Fire-
+            // and-forget — never awaited, never throws, never touches the batch.
+            void (0, org_identity_1.noteSuccessfulFlush)({
+                ingestUrl: config.ingestUrl,
+                apiKey: config.apiKey,
+                fetchFn,
+                ...(config.expectOrg !== undefined ? { expectOrg: config.expectOrg } : {}),
+            });
             if (config.onOutcome !== undefined) {
                 const outcome = (await response.json().catch(() => null));
                 if (outcome !== null)
@@ -150,11 +195,12 @@ function createApiSink(config) {
  * index.ts until Phase D; moved here — its natural home — to keep that file
  * under the LOC cap.)
  */
-function buildTelemetrySink(exportConfig, sourceId) {
+function buildTelemetrySink(exportConfig, sourceId, opts = {}) {
     return exportConfig.mode === "api"
         ? createApiSink({
             ingestUrl: exportConfig.ingestUrl,
             apiKey: exportConfig.apiKey,
+            ...(opts.expectOrg !== undefined ? { expectOrg: opts.expectOrg } : {}),
             // A batch the server partly refused comes back 200. Without this, a
             // customer whose rows are being dropped would find out by noticing a
             // gap in a chart weeks later.

package/dist/telemetry/store-migrations.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"store-migrations.d.ts","sourceRoot":"","sources":["../../src/telemetry/store-migrations.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,KAAK,QAAQ,MAAM,gBAAgB,CAAC;AAE3C;sCACsC;AACtC,wBAAgB,kBAAkB,CAAC,EAAE,EAAE,QAAQ,CAAC,QAAQ,GAAG,IAAI,CAiI9D"}
+{"version":3,"file":"store-migrations.d.ts","sourceRoot":"","sources":["../../src/telemetry/store-migrations.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,KAAK,QAAQ,MAAM,gBAAgB,CAAC;AAG3C;sCACsC;AACtC,wBAAgB,kBAAkB,CAAC,EAAE,EAAE,QAAQ,CAAC,QAAQ,GAAG,IAAI,CAgM9D"}