modelrig 0.8.1 → 0.10.0

package/dist/cli.js

@@ -31,6 +31,7 @@ const failures_teaching_1 = require("./types/failures-teaching");
 const config_1 = require("./config");
 const index_1 = require("./index");
 const status_cli_1 = require("./status-cli");
+const doctor_cli_1 = require("./doctor-cli");
 const engine_1 = require("./bakeoff/engine");
 const samples_1 = require("./bakeoff/samples");
 const report_1 = require("./bakeoff/report");
@@ -59,6 +60,10 @@ const state_store_1 = require("./watch/state-store");
 const swaps_client_1 = require("./savings/swaps-client");
 const swap_execute_1 = require("./savings/swap-execute");
 const cli_query_1 = require("./cli-query");
+const prompts_export_cli_1 = require("./prompts-export-cli");
+const cli_judge_1 = require("./cli-judge");
+const regret_monitor_cli_1 = require("./watch/regret-monitor-cli");
+const screen_cli_1 = require("./screen/screen-cli");
 const BARE_FLAGS = new Set([
     "json",
     "no-mirror",
@@ -492,45 +497,6 @@ async function cmdServe() {
     // The server owns the process from here (it holds the listener open).
     return 0;
 }
-/** `modelrig judge <run>` — E5 V.4: explicitly ask the bounded model-judge to
- * score a run. Goes through the API boundary (T12: the CLI never holds a DB
- * client) — POST /v1/runs/:id/judge on the configured server, authed with a
- * rig_sk key. The daily cap + metering are the SERVER's; this just triggers one. */
-async function cmdJudge(flags) {
-    const runId = flags.positional[0] ?? "";
-    // Config is the only env reader (package-invariants rule). The judge endpoint
-    // lives on the same server as the api-mode ingest sink, so the base is that
-    // URL's origin and the credential is the api key.
-    const exp = (0, config_1.loadConfigFromEnv)().export;
-    const api = exp !== undefined && exp.mode === "api" ? exp : undefined;
-    const base = api !== undefined ? new URL(api.ingestUrl).origin : "";
-    const key = api?.apiKey ?? "";
-    if (runId === "" || base === "" || key === "") {
-        console.error([
-            "usage: modelrig judge <runId>",
-            "",
-            "Needs api-mode telemetry configured (the judge is on the same server):",
-            "  MODELRIG_API_KEY    a rig_sk_ key with the `oracle-act` scope",
-            "  MODELRIG_INGEST_URL optional — the server base; defaults to the hosted API",
-            "",
-            "The judge is EXPLICIT-only and metered; scoring rides the gateway (a route),",
-            "so the org's daily cap and spend-stops apply. Nothing schedules it.",
-        ].join("\n"));
-        return 1;
-    }
-    const res = await fetch(`${base}/v1/runs/${encodeURIComponent(runId)}/judge`, {
-        method: "POST",
-        headers: { authorization: `Bearer ${key}`, "content-type": "application/json" },
-        body: "{}",
-    });
-    const body = (await res.json().catch(() => ({})));
-    if (!res.ok) {
-        console.error(`judge ${res.status}: ${typeof body.error === "string" ? body.error : "failed"}`);
-        return 1;
-    }
-    console.log(JSON.stringify(body, null, 2));
-    return 0;
-}
 /** The one usage block, printed to stdout on `--help` (exit 0) and to stderr on
  * an unknown command (exit 1). Kept as a const so the two paths can never
  * drift. */
@@ -538,18 +504,24 @@ const USAGE = [
     "usage:",
     "  modelrig init [path] [--scope glob,glob] [--out dir] [--dry-run] [--include-tests] [--json]",
     "  modelrig observe [path] [--scope glob,glob] [--out dir] [--dry-run] [--json]   (T0/T1: see your runs first — no migration)",
-    "  modelrig validate                    (structurally check rig.yaml + every route bundle — no provider key needed)",
+    "  modelrig validate                    (structurally check rig.yaml + every route bundle + effective screen: policy — no provider key needed)",
+    "  modelrig screen check <file|-> [--source search|variable|proxy_user|tool_result]   (SC-1a: dry-run injection scan — COUNTS only, never values)",
+    "  modelrig screen pull <classifier:name@version> [--url <weights-url>]   (SC-1a: fetch an optional classifier's weights to the local cache — never bundled, A3)",
+    "  modelrig screen probe [--detectors <ids>] [--corpus <ids>]   (SC-3: measured TPR/FP per license-clean synthetic corpus — counts + rates only)",
     "  modelrig status                      (print export/artifact/otlp posture)",
+    "  modelrig doctor [--expect-org <slug>]   (confirm which org MODELRIG_API_KEY resolves to via /v1/whoami — ✓ or a loud 401; exits non-zero on a bad key or, with --expect-org, a different org)",
     "  modelrig serve                       (needs the modelrig-server package)",
     "  modelrig bakeoff --route <route> --variants a,b,c --replay-last N [--budget-usd usd] [--objective quality-first|balanced|cost-first] [--keep-outputs[=all]] [--json] [--no-mirror]",
     "  modelrig bakeoff --from-proposal <id> [--replay-last N] [--keep-outputs[=all]] [--json]",
-    "  modelrig bakeoff --mask-policy <route> [--replay-last N]   (CS-1: prove the masked arm leaks no detected span)",
+    "  modelrig bakeoff --mask-policy <route> [--replay-last N] [--leak-only]   (CS-1: masked-vs-unmasked value-accuracy Δ + leak proof; --leak-only = offline, no dispatch)",
     "  modelrig watch run [--events fixtures.json] [--json]",
+    "  modelrig regret-monitor --route <route> [--dry-run] [--json]   (Q1: one regret-band cycle; files a regret_breach bake-off on breach)",
     "  modelrig verify-swap --route <route> --captures <fixture.json> [--budget-usd usd] [--out report.md] [--json]",
     "  modelrig swap execute <proposalId> --approve [--approved-by name]",
     "  modelrig swap revert <swapId>",
     "  modelrig judge <runId>               (E5: score a run with the bounded model-judge; explicit + metered)",
     '  modelrig query "<grammar>" | query --saved <id>   (WI-1b: telemetry analytics — metadata only, never content)',
+    "  modelrig prompts export --route <route> [--out modelrig/routes] [--label prod | --version N] [--segment default] [--json]   (PSR-3: export a prompt version back to git, byte-faithful — proves the round-trip)",
     "  modelrig samples purge [--bakeoff <id>]",
 ].join("\n");
 async function main(argv) {
@@ -565,8 +537,12 @@ async function main(argv) {
     switch (command) {
         case "status":
             return (0, status_cli_1.runStatusCli)();
+        case "doctor":
+            return (0, doctor_cli_1.runDoctorCli)(flags.named.has("expect-org") ? { expectOrg: flags.named.get("expect-org") ?? "" } : {});
         case "validate":
             return (0, validate_cli_1.runValidateCli)();
+        case "screen":
+            return (0, screen_cli_1.runScreenCli)(flags);
         case "bakeoff":
             return cmdBakeoff(flags);
         case "watch":
@@ -582,11 +558,15 @@ async function main(argv) {
         case "verify-swap":
             return cmdVerifySwap(flags);
         case "judge":
-            return cmdJudge(flags);
+            return (0, cli_judge_1.cmdJudge)(flags);
         case "query":
             return (0, cli_query_1.cmdQuery)(flags);
+        case "regret-monitor":
+            return (0, regret_monitor_cli_1.cmdRegretMonitor)(flags);
         case "serve":
             return cmdServe();
+        case "prompts":
+            return (0, prompts_export_cli_1.cmdPromptsExport)(flags);
         default:
             console.error(USAGE);
             return 1;

package/dist/config.d.ts

@@ -35,6 +35,9 @@ export interface RigConfig {
         /** A1 aggregator hosts (generic openai-compatible adapter). */
         readonly deepinfra?: string;
         readonly fireworks?: string;
+        /** Z.ai / Zhipu (B4a) — env: ZAI_API_KEY (unprefixed vendor key). Reached via
+         * the generic openai-compatible adapter (same family as the A1 hosts). */
+        readonly zai?: string;
     };
     /** Budget for envelopes first opened by this rig (default: envelope.ts's $25). */
     readonly envelopeBudgetUsd?: number;
@@ -87,29 +90,70 @@ export interface RigConfig {
      */
     readonly otlp?: OtlpConfig | null;
     /**
-     * Artifact / execution-graph namespace (Expansion E2). OFF by default —
-     * `enabled: false` (or absent) means the run/artifact SDK surface is inert,
-     * the exporter sends protocol v1 byte-identical to before, and zero new rows
-     * are written (spec §1.4). Set via `MODELRIG_ARTIFACTS=1`. Like `otlp`,
-     * `loadConfigFromEnv` ALWAYS resolves this so `/status` can answer
+     * Artifact / execution-graph namespace (Expansion E2; P15 CP-3). ON by default
+     * when a control plane is configured — a sink exists to ship to, and the ORG's
+     * account posture (`artifact_posture`), resolved from the control plane at
+     * runtime and enforced authoritatively server-side, is the on/off control (NOT
+     * an env var — P15). `enabled: false` (or absent) means the run/artifact SDK
+     * surface is inert, the exporter sends protocol v1 byte-identical to before,
+     * and zero new rows are written (spec §1.4). A pure local-only rig has no
+     * control plane to resolve a posture from, so the namespace is off there unless
+     * a dev forces it on (MODELRIG_ARTIFACTS=1, dev-only — see loadConfigFromEnv).
+     * Like `otlp`, `loadConfigFromEnv` ALWAYS resolves this so `/status` can answer
      * "enabled|disabled" honestly; optional only so hand-built configs need not
      * spell out the off case.
      */
     readonly artifacts?: ArtifactsConfig;
+    /**
+     * Managed serving (Unified Route U3, ruling D-2) — the switch for
+     * `destination: modelrig-served`. Set IN CODE at construction, NOT via an env
+     * var (Matt, 2026-09-09): `createRig({ ...loadConfigFromEnv(), managedServing: true })`
+     * or `loadConfigFromEnv({ managedServing: true })`. `loadConfigFromEnv` defaults
+     * it to `false` and reads NO `process.env` key for it; like `otlp`/`artifacts`
+     * it is ALWAYS resolved so `/status` can answer "enabled|disabled" honestly.
+     * Optional so a hand-built config may omit it — an absent value reads as `false`.
+     * When off, a run whose resolved destination is `modelrig-served` FAILS CLOSED
+     * pre-dispatch (run/resolve-destination.ts) — never a silent `direct` fallback
+     * (fail-closed-but-discoverable). Threaded to the routed run path as
+     * RunDeps.managedServingEnabled. Turning it on is a deliberate operator/owner
+     * action (P9 money/isolation path); the per-org console toggle is the future GA
+     * mechanism (server-resolved). CODE ONLY — no GA, no outward copy; true
+     * customer-keyless serving is a hosted-server capability, deferred (spec §4 U3).
+     */
+    readonly managedServing?: boolean;
+    /**
+     * The org slug this process expects its `MODELRIG_API_KEY` to resolve to
+     * (REL-1, ruling M5). On the first successful flush the api sink asks
+     * `GET /v1/whoami` and logs the org it is exporting to; when the resolved slug
+     * differs from `expectOrg` it logs `[modelrig] ORG MISMATCH …` loudly on every
+     * flush. It NEVER throws and NEVER drops telemetry — the
+     * rows still land in the key's org. Set IN CODE, not via an env var (P15):
+     * `createRig({ ...loadConfigFromEnv(), expectOrg: "inferwealth" })`. Absent ⇒
+     * the org line is still logged, with no comparison.
+     */
+    readonly expectOrg?: string;
 }
 /** Scrub mode applied to content BEFORE upload (E2-C chunk B). Default `detect`
- * when content custody is on. */
+ * when content custody is on. The EFFECTIVE mode is resolved per task/account
+ * from the control-plane settings resolver (P15 — scrub is an account setting,
+ * not a client env var; the `MODELRIG_ARTIFACTS_SCRUB` gate was deleted, R3
+ * follow-up CP-3b). */
 export type ScrubMode = "off" | "detect" | "redact" | "block";
+/** The scrub mode used when NO control-plane resolver answers for a task
+ * (local-only / direct rigs, or a run with no task identity). The content-on
+ * default — scan and count, upload verbatim. Kept in sync with
+ * `settings/task-settings.ts DEFAULT_TASK_SETTINGS.scrub`. */
+export declare const DEFAULT_CONTENT_SCRUB_MODE: ScrubMode;
 /** Per-rig content-custody config (E2-C chunk A/B). Present ONLY when content
  * custody is turned ON and the transport is configured; ABSENT (the default)
  * means metadata + hash only — today's behaviour, unchanged. Consent, off by
- * default (ruling 6). */
+ * default (ruling 6). Scrub is NOT here — it is a per-task/account setting
+ * resolved at runtime from the control plane (P15 CP-3b), not a boot-time env. */
 export interface ArtifactContentConfig {
     /** Full grant endpoint, e.g. https://server/v1/artifacts/uploads. */
     readonly uploadsUrl: string;
     /** `rig_sk_` key with the `artifact-write` scope (header only; never a URL — C2). */
     readonly apiKey: string;
-    readonly scrub: ScrubMode;
     /** Client-side ceiling short-circuit; the server enforces the real one. */
     readonly maxBytes: number;
 }
@@ -120,34 +164,46 @@ export interface ArtifactsConfig {
     readonly content?: ArtifactContentConfig;
 }
 /**
- * Resolve the artifact config from raw env values (E2 / E2-C, default flip §2).
+ * Resolve the artifact-namespace boot shape (E2 / E2-C; P15 CP-3). Env FEATURE
+ * GATES are GONE: capture on/off and content on/off are the ORG's account posture
+ * (`artifact_posture`), resolved from the control plane at runtime
+ * (settings/task-settings.ts) and enforced authoritatively server-side — metadata
+ * is dropped at /v1/ingest for posture `off`; content is 403'd at
+ * /v1/artifacts/uploads for posture `metadata`. This function decides only the
+ * STATIC boot shape:
+ *   • the metadata namespace is ON whenever a control plane is configured (a sink
+ *     exists to ship to); OFF for a pure local-only rig UNLESS `devForceOn` (the
+ *     dev-only MODELRIG_ARTIFACTS=1 escape hatch — NOT a customer control).
+ *   • content upload is ATTEMPTED whenever the namespace is on and a transport
+ *     (uploads URL + key) is present; the SERVER's org posture is the real gate,
+ *     so a `metadata`/`off` org stores nothing and the SDK degrades on the 403. A
+ *     half-configured transport (no key) stays metadata-only (fail-safe).
+ * Remaining env here is NON-gate config (P15-clean): MODELRIG_CONTENT_UPLOAD_URL
+ * (endpoint, defaults to the ingest host + uploads path), MODELRIG_CONTENT_API_KEY
+ * (credential), MODELRIG_CONTENT_MAX_BYTES (numeric ceiling, default 50MB). Scrub
+ * is NOT an env var — it is a per-task/account setting resolved at runtime from
+ * the control plane (P15 CP-3b; `MODELRIG_ARTIFACTS_SCRUB` was deleted).
  * Pure — env is read by the caller (the package's sole env-reader rule).
- *   MODELRIG_ARTIFACTS unset                 → namespace ON when a control plane
- *                                              is configured, OFF for local-only
- *                                              (§2: metadata-on by default).
- *   MODELRIG_ARTIFACTS=1|true|on             → force the namespace ON.
- *   MODELRIG_ARTIFACTS=0|false|off           → force it OFF (the explicit opt-out).
- *   MODELRIG_ARTIFACTS_CONTENT=on|1|true     → content custody ON (E2-C).
- *   MODELRIG_CONTENT_UPLOAD_URL, MODELRIG_CONTENT_API_KEY → transport.
- *   MODELRIG_ARTIFACTS_SCRUB=off|detect|redact|block → scrub mode (default detect).
- *   MODELRIG_CONTENT_MAX_BYTES               → client ceiling (default 50MB).
- * Content custody stays OFF (content absent) unless it is explicitly on AND the
- * transport is fully configured — a half-configured custody is refused into the
- * safe default (metadata only), never silently half-on. The metadata default
- * flip does NOT flip content: content is its own gate (§2 "content unchanged").
  */
 export declare function resolveArtifactsConfig(env: {
-    readonly artifacts?: string;
-    readonly content?: string;
     readonly uploadsUrl?: string;
     readonly apiKey?: string;
-    readonly scrub?: string;
     readonly maxBytes?: string;
 }, 
-/** Is a cloud sink (api or direct) configured? Unset gate defaults ON when so,
- * OFF otherwise. Defaults false so existing callers/tests keep local-only
- * semantics (gate-only) unless they opt into the flip. */
-controlPlaneConfigured?: boolean): ArtifactsConfig;
+/** Is a cloud sink (api or direct) configured? The namespace defaults ON when
+ * so (the org posture governs at runtime), OFF otherwise. Defaults false so
+ * hand-built configs/tests keep local-only semantics unless they opt in. */
+controlPlaneConfigured?: boolean, 
+/** Dev-only local-rig force-on (MODELRIG_ARTIFACTS=1). Ignored when a control
+ * plane is configured; there, posture is the control. NOT a customer opt-out. */
+devForceOn?: boolean): ArtifactsConfig;
+/** Default `MODELRIG_CONTENT_UPLOAD_URL` when it is unset/blank: the ingest host
+ * (`MODELRIG_INGEST_URL`, else the SDK default) + the uploads path. The grant
+ * endpoint is always on the same server as ingest — deriving it removes a
+ * required var AND forecloses the mismatch footgun (uploads pointed at a server
+ * whose control plane lacks the artifact's metadata row would 404 forever). An
+ * explicit `MODELRIG_CONTENT_UPLOAD_URL` still wins. */
+export declare function defaultContentUploadsUrl(ingestUrlEnv?: string): string;
 /** Resolved OTLP config (E1). Endpoint + sink-auth headers only; the emitter
  * derives batch/interval + watermark from defaults + the source id. */
 export interface OtlpConfig {

package/dist/config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,OAAO,KAAK,EAAE,cAAc,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAEnE;;;;kFAIkF;AAClF,wBAAgB,kBAAkB,IAAI,MAAM,GAAG,SAAS,CAMvD;AAED,MAAM,WAAW,SAAS;IACxB;;;;;4EAKwE;IACxE,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC;;;;qFAIiF;IACjF,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,IAAI,EAAE;QACb,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;QACzB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;QACzB,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;QAC3B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;QAC5B,qDAAqD;QACrD,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QACvB,+DAA+D;QAC/D,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;QAC5B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;KAC7B,CAAC;IACF,kFAAkF;IAClF,QAAQ,CAAC,iBAAiB,CAAC,EAAE,MAAM,CAAC;IACpC;8EAC0E;IAC1E,QAAQ,CAAC,sBAAsB,CAAC,EAAE,MAAM,CAAC;IACzC;;;6CAGyC;IACzC,QAAQ,CAAC,mBAAmB,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,UAAU,EAAE,SAAS,cAAc,EAAE,CAAC,CAAC,CAAC;IACtF;8DAC0D;IAC1D,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B;;eAEW;IACX,QAAQ,CAAC,MAAM,CAAC,EAAE;QAChB,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;QAC9B,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;QACnC,QAAQ,CAAC,WAAW,CAAC,EAAE,OAAO,GAAG,UAAU,CAAC;KAC7C,CAAC;IACF;;wCAEoC;IACpC,QAAQ,CAAC,KAAK,CAAC,EAAE;QACf,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;QAC7B,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;KAChC,CAAC;IACF;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,eAAe,GAAG,kBAAkB,CAAC;IACvD;;;;;;;;OAQG;IACH,QAAQ,CAAC,IAAI,CAAC,EAAE,UAAU,GAAG,IAAI,CAAC;IAClC;;;;;;;;OAQG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,eAAe,CAAC;CACtC;AAED;iCACiC;AACjC,MAAM,MAAM,SAAS,GAAG,KAAK,GAAG,QAAQ,GAAG,QAAQ,GAAG,OAAO,CAAC;AAE9D;;;yBAGyB;AACzB,MAAM,WAAW,qBAAqB;IACpC,qEAAqE;IACrE,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,qFAAqF;IACrF,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,KAAK,EAAE,SAAS,CAAC;IAC1B,2EAA2E;IAC3E,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B;AAED;6EAC6E;AAC7E,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,OAAO,CAAC,EAAE,qBAAqB,CAAC;CAC1C;AAWD;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,sBAAsB,CACpC,GAAG,EAAE;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;CAC5B;AACD;;0DAE0D;AAC1D,sBAAsB,UAAQ,GAC7B,eAAe,CAuBjB;AAED;uEACuE;AACvE,MAAM,WAAW,UAAU;IACzB,kFAAkF;IAClF,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,mFAAmF;IACnF,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC1C;AAED;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAYhF;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAC/B,QAAQ,EAAE,MAAM,GAAG,SAAS,EAC5B,UAAU,EAAE,MAAM,GAAG,SAAS,GAC7B,UAAU,GAAG,IAAI,CAGnB;AAED,UAAU,YAAY;IACpB,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;CAC9B;AAED,MAAM,WAAW,eAAgB,SAAQ,YAAY;IACnD,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAC;IACrB;+EAC2E;IAC3E,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAED,MAAM,WAAW,kBAAmB,SAAQ,YAAY;IACtD,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IACxB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC;;uCAEmC;IACnC,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACpC;AAED;;kEAEkE;AAClE,eAAO,MAAM,gBAAgB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAQ7D,CAAC;AAKF,wBAAgB,iBAAiB,CAAC,SAAS,CAAC,EAAE,OAAO,CAAC,SAAS,CAAC,GAAG,SAAS,CAgI3E;AAED;;;;;;;;GAQG;AACH,wBAAgB,cAAc,CAC5B,MAAM,EAAE,SAAS,EACjB,IAAI,EAAE,MAAM,GACX;IAAE,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;CAAE,CAgB/F"}
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,OAAO,KAAK,EAAE,cAAc,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAEnE;;;;kFAIkF;AAClF,wBAAgB,kBAAkB,IAAI,MAAM,GAAG,SAAS,CAMvD;AAED,MAAM,WAAW,SAAS;IACxB;;;;;4EAKwE;IACxE,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC;;;;qFAIiF;IACjF,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,IAAI,EAAE;QACb,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;QACzB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;QACzB,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;QAC3B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;QAC5B,qDAAqD;QACrD,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QACvB,+DAA+D;QAC/D,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;QAC5B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;QAC5B;kFAC0E;QAC1E,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;KACvB,CAAC;IACF,kFAAkF;IAClF,QAAQ,CAAC,iBAAiB,CAAC,EAAE,MAAM,CAAC;IACpC;8EAC0E;IAC1E,QAAQ,CAAC,sBAAsB,CAAC,EAAE,MAAM,CAAC;IACzC;;;6CAGyC;IACzC,QAAQ,CAAC,mBAAmB,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,UAAU,EAAE,SAAS,cAAc,EAAE,CAAC,CAAC,CAAC;IACtF;8DAC0D;IAC1D,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B;;eAEW;IACX,QAAQ,CAAC,MAAM,CAAC,EAAE;QAChB,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;QAC9B,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;QACnC,QAAQ,CAAC,WAAW,CAAC,EAAE,OAAO,GAAG,UAAU,CAAC;KAC7C,CAAC;IACF;;wCAEoC;IACpC,QAAQ,CAAC,KAAK,CAAC,EAAE;QACf,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;QAC7B,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;KAChC,CAAC;IACF;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,eAAe,GAAG,kBAAkB,CAAC;IACvD;;;;;;;;OAQG;IACH,QAAQ,CAAC,IAAI,CAAC,EAAE,UAAU,GAAG,IAAI,CAAC;IAClC;;;;;;;;;;;;;OAaG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,eAAe,CAAC;IACrC;;;;;;;;;;;;;;;OAeG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,OAAO,CAAC;IAClC;;;;;;;;;OASG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;CAC7B;AAED;;;;uBAIuB;AACvB,MAAM,MAAM,SAAS,GAAG,KAAK,GAAG,QAAQ,GAAG,QAAQ,GAAG,OAAO,CAAC;AAE9D;;;8DAG8D;AAC9D,eAAO,MAAM,0BAA0B,EAAE,SAAoB,CAAC;AAE9D;;;;kFAIkF;AAClF,MAAM,WAAW,qBAAqB;IACpC,qEAAqE;IACrE,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,qFAAqF;IACrF,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,2EAA2E;IAC3E,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B;AAED;6EAC6E;AAC7E,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,OAAO,CAAC,EAAE,qBAAqB,CAAC;CAC1C;AAID;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAgB,sBAAsB,CACpC,GAAG,EAAE;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;CAC5B;AACD;;4EAE4E;AAC5E,sBAAsB,UAAQ;AAC9B;iFACiF;AACjF,UAAU,UAAQ,GACjB,eAAe,CAsBjB;AAKD;;;;;wDAKwD;AACxD,wBAAgB,wBAAwB,CAAC,YAAY,CAAC,EAAE,MAAM,GAAG,MAAM,CAGtE;AAED;uEACuE;AACvE,MAAM,WAAW,UAAU;IACzB,kFAAkF;IAClF,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,mFAAmF;IACnF,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC1C;AAED;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAYhF;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAC/B,QAAQ,EAAE,MAAM,GAAG,SAAS,EAC5B,UAAU,EAAE,MAAM,GAAG,SAAS,GAC7B,UAAU,GAAG,IAAI,CAGnB;AAED,UAAU,YAAY;IACpB,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;CAC9B;AAED,MAAM,WAAW,eAAgB,SAAQ,YAAY;IACnD,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAC;IACrB;+EAC2E;IAC3E,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAED,MAAM,WAAW,kBAAmB,SAAQ,YAAY;IACtD,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IACxB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC;;uCAEmC;IACnC,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACpC;AAED;;kEAEkE;AAClE,eAAO,MAAM,gBAAgB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAa7D,CAAC;AAKF,wBAAgB,iBAAiB,CAAC,SAAS,CAAC,EAAE,OAAO,CAAC,SAAS,CAAC,GAAG,SAAS,CA4K3E;AAED;;;;;;;;GAQG;AACH,wBAAgB,cAAc,CAC5B,MAAM,EAAE,SAAS,EACjB,IAAI,EAAE,MAAM,GACX;IAAE,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;CAAE,CAgB/F"}

package/dist/config.js

@@ -5,9 +5,10 @@
  * __tests__/package-invariants.test.ts).
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.PROVIDER_KEY_ENV = void 0;
+exports.PROVIDER_KEY_ENV = exports.DEFAULT_CONTENT_SCRUB_MODE = void 0;
 exports.pipelineShaFromEnv = pipelineShaFromEnv;
 exports.resolveArtifactsConfig = resolveArtifactsConfig;
+exports.defaultContentUploadsUrl = defaultContentUploadsUrl;
 exports.parseOtlpHeaders = parseOtlpHeaders;
 exports.resolveOtlpConfig = resolveOtlpConfig;
 exports.loadConfigFromEnv = loadConfigFromEnv;
@@ -26,54 +27,71 @@ function pipelineShaFromEnv() {
     }
     return undefined;
 }
+/** The scrub mode used when NO control-plane resolver answers for a task
+ * (local-only / direct rigs, or a run with no task identity). The content-on
+ * default — scan and count, upload verbatim. Kept in sync with
+ * `settings/task-settings.ts DEFAULT_TASK_SETTINGS.scrub`. */
+exports.DEFAULT_CONTENT_SCRUB_MODE = "detect";
 const DEFAULT_SDK_CONTENT_MAX_BYTES = 52428800;
-function resolveScrubMode(raw, contentOn) {
-    const v = (raw ?? "").trim().toLowerCase();
-    if (v === "off" || v === "detect" || v === "redact" || v === "block")
-        return v;
-    // Default when content is on is `detect` — scan and count, upload verbatim.
-    return contentOn ? "detect" : "off";
-}
 /**
- * Resolve the artifact config from raw env values (E2 / E2-C, default flip §2).
+ * Resolve the artifact-namespace boot shape (E2 / E2-C; P15 CP-3). Env FEATURE
+ * GATES are GONE: capture on/off and content on/off are the ORG's account posture
+ * (`artifact_posture`), resolved from the control plane at runtime
+ * (settings/task-settings.ts) and enforced authoritatively server-side — metadata
+ * is dropped at /v1/ingest for posture `off`; content is 403'd at
+ * /v1/artifacts/uploads for posture `metadata`. This function decides only the
+ * STATIC boot shape:
+ *   • the metadata namespace is ON whenever a control plane is configured (a sink
+ *     exists to ship to); OFF for a pure local-only rig UNLESS `devForceOn` (the
+ *     dev-only MODELRIG_ARTIFACTS=1 escape hatch — NOT a customer control).
+ *   • content upload is ATTEMPTED whenever the namespace is on and a transport
+ *     (uploads URL + key) is present; the SERVER's org posture is the real gate,
+ *     so a `metadata`/`off` org stores nothing and the SDK degrades on the 403. A
+ *     half-configured transport (no key) stays metadata-only (fail-safe).
+ * Remaining env here is NON-gate config (P15-clean): MODELRIG_CONTENT_UPLOAD_URL
+ * (endpoint, defaults to the ingest host + uploads path), MODELRIG_CONTENT_API_KEY
+ * (credential), MODELRIG_CONTENT_MAX_BYTES (numeric ceiling, default 50MB). Scrub
+ * is NOT an env var — it is a per-task/account setting resolved at runtime from
+ * the control plane (P15 CP-3b; `MODELRIG_ARTIFACTS_SCRUB` was deleted).
  * Pure — env is read by the caller (the package's sole env-reader rule).
- *   MODELRIG_ARTIFACTS unset                 → namespace ON when a control plane
- *                                              is configured, OFF for local-only
- *                                              (§2: metadata-on by default).
- *   MODELRIG_ARTIFACTS=1|true|on             → force the namespace ON.
- *   MODELRIG_ARTIFACTS=0|false|off           → force it OFF (the explicit opt-out).
- *   MODELRIG_ARTIFACTS_CONTENT=on|1|true     → content custody ON (E2-C).
- *   MODELRIG_CONTENT_UPLOAD_URL, MODELRIG_CONTENT_API_KEY → transport.
- *   MODELRIG_ARTIFACTS_SCRUB=off|detect|redact|block → scrub mode (default detect).
- *   MODELRIG_CONTENT_MAX_BYTES               → client ceiling (default 50MB).
- * Content custody stays OFF (content absent) unless it is explicitly on AND the
- * transport is fully configured — a half-configured custody is refused into the
- * safe default (metadata only), never silently half-on. The metadata default
- * flip does NOT flip content: content is its own gate (§2 "content unchanged").
  */
 function resolveArtifactsConfig(env, 
-/** Is a cloud sink (api or direct) configured? Unset gate defaults ON when so,
- * OFF otherwise. Defaults false so existing callers/tests keep local-only
- * semantics (gate-only) unless they opt into the flip. */
-controlPlaneConfigured = false) {
-    const gate = (env.artifacts ?? "").trim().toLowerCase();
-    const explicitOn = gate === "1" || gate === "true" || gate === "on";
-    const explicitOff = gate === "0" || gate === "false" || gate === "off";
-    // §2 default flip: explicit wins; an unset gate follows the control plane.
-    const enabled = explicitOn || (!explicitOff && controlPlaneConfigured);
-    const contentGate = (env.content ?? "").trim().toLowerCase();
-    const contentOn = contentGate === "on" || contentGate === "1" || contentGate === "true";
+/** Is a cloud sink (api or direct) configured? The namespace defaults ON when
+ * so (the org posture governs at runtime), OFF otherwise. Defaults false so
+ * hand-built configs/tests keep local-only semantics unless they opt in. */
+controlPlaneConfigured = false, 
+/** Dev-only local-rig force-on (MODELRIG_ARTIFACTS=1). Ignored when a control
+ * plane is configured; there, posture is the control. NOT a customer opt-out. */
+devForceOn = false) {
+    // Namespace on when there is a control plane to ship to (org posture, resolved
+    // at runtime + the server ingest gate, decides what is kept), or when a dev has
+    // forced it on for a local-only rig that has no posture to resolve.
+    const enabled = controlPlaneConfigured || devForceOn;
     const uploadsUrl = (env.uploadsUrl ?? "").trim();
     const apiKey = (env.apiKey ?? "").trim();
     const maxBytesRaw = env.maxBytes !== undefined && env.maxBytes !== "" ? Number(env.maxBytes) : NaN;
     const maxBytes = Number.isInteger(maxBytesRaw) && maxBytesRaw > 0 ? maxBytesRaw : DEFAULT_SDK_CONTENT_MAX_BYTES;
-    // Content is on ONLY when the namespace is enabled, the gate is on, AND the
-    // transport is present. Missing transport → stays metadata-only (fail-safe).
-    const content = enabled && contentOn && uploadsUrl !== "" && apiKey !== ""
-        ? { uploadsUrl, apiKey, scrub: resolveScrubMode(env.scrub, true), maxBytes }
+    // Content is ATTEMPTED whenever the namespace is enabled and the transport is
+    // present; the server's org posture is the consent gate (a `metadata`/`off` org
+    // 403s and the SDK degrades to metadata-only). No client env gate — the opt-out
+    // is the account posture. Missing transport → metadata-only (fail-safe).
+    const content = enabled && uploadsUrl !== "" && apiKey !== ""
+        ? { uploadsUrl, apiKey, maxBytes }
         : undefined;
     return { enabled, ...(content !== undefined ? { content } : {}) };
 }
+/** The managed content-custody grant endpoint path on the server. */
+const ARTIFACT_UPLOADS_PATH = "/v1/artifacts/uploads";
+/** Default `MODELRIG_CONTENT_UPLOAD_URL` when it is unset/blank: the ingest host
+ * (`MODELRIG_INGEST_URL`, else the SDK default) + the uploads path. The grant
+ * endpoint is always on the same server as ingest — deriving it removes a
+ * required var AND forecloses the mismatch footgun (uploads pointed at a server
+ * whose control plane lacks the artifact's metadata row would 404 forever). An
+ * explicit `MODELRIG_CONTENT_UPLOAD_URL` still wins. */
+function defaultContentUploadsUrl(ingestUrlEnv) {
+    const raw = ingestUrlEnv !== undefined && ingestUrlEnv.trim() !== "" ? ingestUrlEnv.trim() : ingest_protocol_1.DEFAULT_INGEST_URL;
+    return `${raw.replace(/\/+$/, "")}${ARTIFACT_UPLOADS_PATH}`;
+}
 /**
  * Parse `MODELRIG_OTLP_HEADERS` ("k=v,k=v") into a header map (E1). Split on the
  * FIRST `=` only, so a base64 Basic-auth value keeping its `=` padding survives.
@@ -119,6 +137,11 @@ exports.PROVIDER_KEY_ENV = {
     grok: "XAI_API_KEY",
     deepinfra: "MODELRIG_DEEPINFRA_API_KEY",
     fireworks: "MODELRIG_FIREWORKS_API_KEY",
+    // Z.ai (B4a): UNPREFIXED on purpose — matches the XAI_API_KEY/ANTHROPIC_API_KEY
+    // vendor-key convention (only the aggregator hosts deepinfra/fireworks + tavily
+    // carry the MODELRIG_ prefix, for host-app env collision-avoidance, which does
+    // not apply to a first-party vendor key).
+    zai: "ZAI_API_KEY",
 };
 const DEFAULT_ROUTES_DIR = "./modelrig/routes";
 const DEFAULT_TELEMETRY_DB = "./.modelrig/telemetry.db";
@@ -132,25 +155,62 @@ function loadConfigFromEnv(overrides) {
     // OTLP span emission (E1) — off unless an endpoint is set. Additive to
     // `export`; a rig may emit OTLP with no control-plane sink and vice-versa.
     const otlp = resolveOtlpConfig(env.MODELRIG_OTLP_ENDPOINT, env.MODELRIG_OTLP_HEADERS);
-    // Artifact / execution-graph namespace (E2, default flip §2) — ON by default
-    // when a control plane is configured (api key OR the direct supabase pair),
-    // OFF for a pure local-only rig; MODELRIG_ARTIFACTS=0 is the explicit opt-out.
-    // Always resolved so /status + the boot banner answer honestly. Content
-    // custody (E2-C) stays its own gate — the metadata flip never flips content.
+    // Managed serving (Unified Route U3, ruling D-2) is deliberately NOT an env var
+    // (Matt, 2026-09-09): `config.managedServing` is set IN CODE at construction —
+    // `createRig({ ...loadConfigFromEnv(), managedServing: true })`, or
+    // `loadConfigFromEnv({ managedServing: true })` (overrides win below) — and
+    // defaults OFF (`false` in `fromEnv`). It is intentionally read from NO
+    // `process.env` key. The per-org console/settings toggle is the future GA
+    // mechanism (server-resolved, like `artifact_posture`). When off/absent, a
+    // resolved `modelrig-served` FAILS CLOSED pre-dispatch (run/resolve-destination.ts)
+    // — never a silent `direct` fallback. This is NOT a customer-key override: the
+    // fireworks/deepinfra adapters already carry ModelRig-owned keys on the routed
+    // lane, so U3 is a config-flag + capability SEAM, not a key switch (true
+    // customer-keyless serving now ships as a hosted-server capability behind this
+    // same flag — no longer deferred).
+    // Artifact / execution-graph namespace (E2; P15 CP-3) — ON by default when a
+    // control plane is configured (api key OR the direct supabase pair). The ORG's
+    // account posture (`artifact_posture`), resolved from the control plane at
+    // runtime and enforced server-side, is the on/off control — NOT an env var
+    // (P15). The old `MODELRIG_ARTIFACTS` / `MODELRIG_ARTIFACTS_CONTENT` opt-out
+    // gates are DELETED: opt out by setting org posture `off` (capture nothing) or
+    // `metadata` (no content) in the console or via the set_org_settings MCP tool.
+    //
+    // DEV-ONLY escape hatch: a pure LOCAL-ONLY rig has no control plane to resolve
+    // a posture from, so the artifact namespace is off there unless a dev forces it
+    // on for local inspection — `MODELRIG_ARTIFACTS=1` is honored ONLY when NO
+    // control plane is configured. It is NOT a customer control (never advertised
+    // in onboarding/get-started/.env.example) and the deleted `=0` opt-out no
+    // longer does anything. When a control plane IS configured, MODELRIG_ARTIFACTS
+    // is ignored (posture governs) — warn once so a stale `=0` is not read as an
+    // opt-out that silently stopped working. Always resolved so /status + the boot
+    // banner answer honestly.
     const controlPlaneConfigured = Boolean(apiKey) || Boolean(supabaseUrl && serviceRoleKey);
+    const artifactsGate = (env.MODELRIG_ARTIFACTS ?? "").trim().toLowerCase();
+    const devForceOn = !controlPlaneConfigured &&
+        (artifactsGate === "1" || artifactsGate === "true" || artifactsGate === "on");
+    if (controlPlaneConfigured && artifactsGate !== "") {
+        console.warn("[modelrig] MODELRIG_ARTIFACTS is ignored — capture on/off is your account posture " +
+            "(artifact_posture), not an env var (P15). To stop capture, set org posture 'off' " +
+            "(or 'metadata' for no content) in the console or via the set_org_settings MCP tool.");
+    }
     const artifacts = resolveArtifactsConfig({
-        artifacts: env.MODELRIG_ARTIFACTS,
-        content: env.MODELRIG_ARTIFACTS_CONTENT,
-        uploadsUrl: env.MODELRIG_CONTENT_UPLOAD_URL,
+        // Default the grant endpoint to the ingest host so custody needs only the
+        // artifact-write key; an explicit override still wins.
+        uploadsUrl: env.MODELRIG_CONTENT_UPLOAD_URL?.trim()
+            ? env.MODELRIG_CONTENT_UPLOAD_URL
+            : defaultContentUploadsUrl(env.MODELRIG_INGEST_URL),
         apiKey: env.MODELRIG_CONTENT_API_KEY ?? env.MODELRIG_API_KEY,
-        scrub: env.MODELRIG_ARTIFACTS_SCRUB,
         maxBytes: env.MODELRIG_CONTENT_MAX_BYTES,
-    }, controlPlaneConfigured);
+    }, controlPlaneConfigured, devForceOn);
     const fromEnv = {
         routesDir: env.MODELRIG_ROUTES_DIR ?? DEFAULT_ROUTES_DIR,
         telemetryDbPath: env.MODELRIG_TELEMETRY_DB ?? DEFAULT_TELEMETRY_DB,
         otlp,
         artifacts,
+        // U3 (D-2): default OFF; enabled in code via `createRig`/`loadConfigFromEnv`
+        // overrides (spread below), NOT from an env var (Matt, 2026-09-09).
+        managedServing: false,
         ...(env.MODELRIG_REGISTRY_PATH ? { registryPath: env.MODELRIG_REGISTRY_PATH } : {}),
         keys: {
             ...(env.GEMINI_API_KEY ? { gemini: env.GEMINI_API_KEY } : {}),
@@ -161,6 +221,8 @@ function loadConfigFromEnv(overrides) {
             // A1 hosts: ModelRig-scoped names on purpose (same doctrine as Tavily).
             ...(env.MODELRIG_DEEPINFRA_API_KEY ? { deepinfra: env.MODELRIG_DEEPINFRA_API_KEY } : {}),
             ...(env.MODELRIG_FIREWORKS_API_KEY ? { fireworks: env.MODELRIG_FIREWORKS_API_KEY } : {}),
+            // Z.ai (B4a): unprefixed vendor key (see PROVIDER_KEY_ENV).
+            ...(env.ZAI_API_KEY ? { zai: env.ZAI_API_KEY } : {}),
         },
         ...(budget !== undefined && Number.isFinite(budget) ? { envelopeBudgetUsd: budget } : {}),
         ...(env.MODELRIG_UNPRICED_RATE_USD_PER_MTOK &&

package/dist/detect/detector.d.ts

@@ -26,8 +26,10 @@ export type ContentSource = "template" | "variable" | "search" | "tool_result" |
 export type TrustTier = "trusted" | "semi" | "untrusted";
 /** The family a detector belongs to — used only as a receipt/registry label and
  * to decide the fail-closed matrix (deterministic never fails a run open;
- * classifier/sidecar absence degrades to a notice). */
-export type DetectorKind = "deterministic" | "classifier" | "sidecar";
+ * classifier/sidecar/model absence or failure degrades to a notice). The T3
+ * `model` screen (SC-3) is a metered inference over the same interface: a signal
+ * into the deterministic actions, never a control (spec-sc3 §2). */
+export type DetectorKind = "deterministic" | "classifier" | "sidecar" | "model";
 /** The category of a finding. `pii:*` reuses scrub v1's ScrubDetectorType
  * values; `entity:*` is dictionary/field typing; `injection:*` is the
  * screening lane. Open string union — the value only ever appears as a COUNT

package/dist/detect/detector.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"detector.d.ts","sourceRoot":"","sources":["../../src/detect/detector.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH;;wBAEwB;AACxB,MAAM,MAAM,aAAa,GACrB,UAAU,GACV,UAAU,GACV,QAAQ,GACR,aAAa,GACb,YAAY,GACZ,YAAY,GACZ,SAAS,CAAC;AAEd,MAAM,MAAM,SAAS,GAAG,SAAS,GAAG,MAAM,GAAG,WAAW,CAAC;AAEzD;;uDAEuD;AACvD,MAAM,MAAM,YAAY,GAAG,eAAe,GAAG,YAAY,GAAG,SAAS,CAAC;AAEtE;;;oCAGoC;AACpC,MAAM,MAAM,aAAa,GAAG,MAAM,GAAG,EAAE,CAAC;AAExC;+DAC+D;AAC/D,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC;IAC7B;mEAC+D;IAC/D,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;CAC7B;AAED;;oBAEoB;AACpB,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAC;IAC/B,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;CAC1B;AAED;;;;;;;;;;GAUG;AACH,MAAM,WAAW,QAAQ;IACvB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAC;IAC5B;6EACyE;IACzE,MAAM,CAAC,KAAK,EAAE,cAAc,GAAG,OAAO,CAAC,SAAS,aAAa,EAAE,CAAC,CAAC;CAClE;AAED;;;0DAG0D;AAC1D,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,IAAI,GAAG,MAAM,CAAC,CAAC;IACjD;gEAC4D;IAC5D,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC;CAC7B"}
+{"version":3,"file":"detector.d.ts","sourceRoot":"","sources":["../../src/detect/detector.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH;;wBAEwB;AACxB,MAAM,MAAM,aAAa,GACrB,UAAU,GACV,UAAU,GACV,QAAQ,GACR,aAAa,GACb,YAAY,GACZ,YAAY,GACZ,SAAS,CAAC;AAEd,MAAM,MAAM,SAAS,GAAG,SAAS,GAAG,MAAM,GAAG,WAAW,CAAC;AAEzD;;;;oEAIoE;AACpE,MAAM,MAAM,YAAY,GAAG,eAAe,GAAG,YAAY,GAAG,SAAS,GAAG,OAAO,CAAC;AAEhF;;;oCAGoC;AACpC,MAAM,MAAM,aAAa,GAAG,MAAM,GAAG,EAAE,CAAC;AAExC;+DAC+D;AAC/D,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC;IAC7B;mEAC+D;IAC/D,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;CAC7B;AAED;;oBAEoB;AACpB,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAC;IAC/B,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;CAC1B;AAED;;;;;;;;;;GAUG;AACH,MAAM,WAAW,QAAQ;IACvB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAC;IAC5B;6EACyE;IACzE,MAAM,CAAC,KAAK,EAAE,cAAc,GAAG,OAAO,CAAC,SAAS,aAAa,EAAE,CAAC,CAAC;CAClE;AAED;;;0DAG0D;AAC1D,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,IAAI,GAAG,MAAM,CAAC,CAAC;IACjD;gEAC4D;IAC5D,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC;CAC7B"}

package/dist/detect/safe-harbor.d.ts

@@ -0,0 +1,57 @@
+/**
+ * SC-2 — deterministic HIPAA Safe Harbor identifier detectors (spec-sc2 §2).
+ *
+ * These EXTEND scrub v1 (S1: extend, don't twin) as new `Detector`s over the
+ * shared interface (src/detect/detector.ts) — `kind: "deterministic"`,
+ * `confidence: 1`. They live BESIDE scrub v1's five detectors, NOT inside
+ * `scrubContent`: adding one here never widens the custody scrub floor. The
+ * composition point is the screen policy `detectors: [...]` opt-in — a route
+ * turns a Safe Harbor detector on explicitly (spec-sc2 §2, builder confirmation:
+ * "never silently added to the custody scrub floor"). `scrubContent` and the
+ * five v1 detectors stay BYTE-IDENTICAL (golden).
+ *
+ * LEAK INVARIANT (spec-sc2 §1.4): a detector emits SPANS (offsets + type +
+ * confidence) — never the matched substring. The matched value is read only to
+ * validate (Luhn / VIN checksum / octet range / age bound) and is discarded
+ * immediately; nothing here returns, logs, or persists it.
+ *
+ * SCOPE (honest limits, stated in the coverage table): US-English-shaped,
+ * deterministic regex/checksum rules — NOT a model, NOT DLP. Free-text names and
+ * street addresses need the customer-run sidecar (src/screen/sidecar.ts); those
+ * classes are `sidecar`/`out-of-scope` in the coverage table, never claimed here.
+ * Recall on synthetic PHI is MEASURED by the SC-3 probe, not asserted here.
+ */
+import type { Detector } from "./detector";
+/** The finding `type` a Safe Harbor detector emits — a `pii:*` COUNT label
+ * (spec-sc2 §5), never a value. Kept parallel to the detector `id` slug. */
+export type SafeHarborType = "pii:date" | "pii:age_over_89" | "pii:fax" | "pii:url" | "pii:ip" | "pii:zip" | "pii:account_id" | "pii:license_id" | "pii:vin" | "pii:device_id";
+/** VIN check-digit rule (position 9): weighted transliteration mod 11, where 10
+ * ⇒ 'X'. Separates a real VIN from any 17 alphanumerics — the difference between
+ * a false-positive flood and a claimable identifier. */
+export declare function vinValid(vin: string): boolean;
+/** The registry id of the convenience PACK — configuring it in a route's
+ * `screen.detectors` opts in to ALL ten deterministic Safe Harbor detectors at
+ * once. Individual `pii:<slug>@v1` ids opt in to just that one. */
+export declare const SAFE_HARBOR_PACK_ID = "safe-harbor@v1";
+/** All individual Safe Harbor detector ids, for policy validation. */
+export declare const SAFE_HARBOR_IDS: ReadonlySet<string>;
+/** True when `id` names a Safe Harbor detector (a `pii:<slug>@v1` or the pack).
+ * The screen policy validator uses this to accept the id at load time. */
+export declare function isSafeHarborId(id: string): boolean;
+/** Every Safe Harbor detector (one per type), for the pack. */
+export declare function safeHarborDetectors(): Detector[];
+/** The Safe Harbor detector for one id, or `undefined` if `id` is not one.
+ * `SAFE_HARBOR_PACK_ID` returns `undefined` here — the pack expands to
+ * {@link safeHarborDetectors}; a caller resolves the pack separately. */
+export declare function safeHarborDetectorById(id: string): Detector | undefined;
+/** The detector identities (id + version) for a configured id — the pack
+ * expands to all ten; a single id resolves to one. Used to populate the
+ * receipt's `detectors[]` at resolve time (counts-only, never a value). */
+export declare function safeHarborIdentities(id: string): readonly {
+    id: string;
+    version: string;
+}[];
+/** Build the Detector instances a configured id contributes (pack ⇒ all ten,
+ * single id ⇒ one, unknown ⇒ none). */
+export declare function safeHarborDetectorsFor(id: string): Detector[];
+//# sourceMappingURL=safe-harbor.d.ts.map

package/dist/detect/safe-harbor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"safe-harbor.d.ts","sourceRoot":"","sources":["../../src/detect/safe-harbor.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,KAAK,EAAiC,QAAQ,EAAE,MAAM,YAAY,CAAC;AAG1E;4EAC4E;AAC5E,MAAM,MAAM,cAAc,GACtB,UAAU,GACV,iBAAiB,GACjB,SAAS,GACT,SAAS,GACT,QAAQ,GACR,SAAS,GACT,gBAAgB,GAChB,gBAAgB,GAChB,SAAS,GACT,eAAe,CAAC;AAoJpB;;wDAEwD;AACxD,wBAAgB,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAa7C;AA6CD;;mEAEmE;AACnE,eAAO,MAAM,mBAAmB,mBAAmB,CAAC;AAEpD,sEAAsE;AACtE,eAAO,MAAM,eAAe,EAAE,WAAW,CAAC,MAAM,CAAmC,CAAC;AAEpF;0EAC0E;AAC1E,wBAAgB,cAAc,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAElD;AA8BD,+DAA+D;AAC/D,wBAAgB,mBAAmB,IAAI,QAAQ,EAAE,CAEhD;AAED;;yEAEyE;AACzE,wBAAgB,sBAAsB,CAAC,EAAE,EAAE,MAAM,GAAG,QAAQ,GAAG,SAAS,CAGvE;AAED;;2EAE2E;AAC3E,wBAAgB,oBAAoB,CAAC,EAAE,EAAE,MAAM,GAAG,SAAS;IAAE,EAAE,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,EAAE,CAG3F;AAED;uCACuC;AACvC,wBAAgB,sBAAsB,CAAC,EAAE,EAAE,MAAM,GAAG,QAAQ,EAAE,CAI7D"}