modelrig 0.8.1 → 0.10.0

package/dist/detect/safe-harbor.js

@@ -0,0 +1,278 @@
+"use strict";
+/**
+ * SC-2 — deterministic HIPAA Safe Harbor identifier detectors (spec-sc2 §2).
+ *
+ * These EXTEND scrub v1 (S1: extend, don't twin) as new `Detector`s over the
+ * shared interface (src/detect/detector.ts) — `kind: "deterministic"`,
+ * `confidence: 1`. They live BESIDE scrub v1's five detectors, NOT inside
+ * `scrubContent`: adding one here never widens the custody scrub floor. The
+ * composition point is the screen policy `detectors: [...]` opt-in — a route
+ * turns a Safe Harbor detector on explicitly (spec-sc2 §2, builder confirmation:
+ * "never silently added to the custody scrub floor"). `scrubContent` and the
+ * five v1 detectors stay BYTE-IDENTICAL (golden).
+ *
+ * LEAK INVARIANT (spec-sc2 §1.4): a detector emits SPANS (offsets + type +
+ * confidence) — never the matched substring. The matched value is read only to
+ * validate (Luhn / VIN checksum / octet range / age bound) and is discarded
+ * immediately; nothing here returns, logs, or persists it.
+ *
+ * SCOPE (honest limits, stated in the coverage table): US-English-shaped,
+ * deterministic regex/checksum rules — NOT a model, NOT DLP. Free-text names and
+ * street addresses need the customer-run sidecar (src/screen/sidecar.ts); those
+ * classes are `sidecar`/`out-of-scope` in the coverage table, never claimed here.
+ * Recall on synthetic PHI is MEASURED by the SC-3 probe, not asserted here.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SAFE_HARBOR_IDS = exports.SAFE_HARBOR_PACK_ID = void 0;
+exports.vinValid = vinValid;
+exports.isSafeHarborId = isSafeHarborId;
+exports.safeHarborDetectors = safeHarborDetectors;
+exports.safeHarborDetectorById = safeHarborDetectorById;
+exports.safeHarborIdentities = safeHarborIdentities;
+exports.safeHarborDetectorsFor = safeHarborDetectorsFor;
+const scrub_1 = require("../artifacts/scrub");
+/** Cap on spans emitted per detect() call ("per-result cap", spec-sc2 §2): a
+ * pathological document (a table of dates) yields COUNTS, not an unbounded span
+ * list. The count is truthful up to the cap; beyond it the receipt reads
+ * "≥ cap", which is enough to drive a policy action. */
+const MAX_SPANS_PER_TYPE = 512;
+/** Push a `{start,end,type,confidence:1}` span, capped. The matched value is the
+ * caller's local variable; it never enters the span. */
+function emit(spans, type, start, len) {
+    if (spans.length >= MAX_SPANS_PER_TYPE)
+        return;
+    spans.push({ start, end: start + len, type, confidence: 1 });
+}
+/** Iterate global-regex matches with a fresh RegExp (so /g `lastIndex` never
+ * leaks across calls), passing each match to `onMatch`. */
+function eachMatch(re, text, onMatch) {
+    const fresh = new RegExp(re.source, re.flags);
+    for (const m of text.matchAll(fresh))
+        onMatch(m[0], m.index ?? 0);
+}
+// ── date (Safe Harbor: dates except year — DOB/admit/discharge/death) ────────
+// ISO YYYY-MM-DD, US M/D/YYYY (and M/D/YY), and month-name forms. Many formats;
+// per-result cap applies. Conservative: a bare 4-digit year alone is NOT a date
+// (Safe Harbor exempts the year), so the year-only shape is deliberately unmatched.
+const MONTHS = "jan(?:uary)?|feb(?:ruary)?|mar(?:ch)?|apr(?:il)?|may|jun(?:e)?|jul(?:y)?|aug(?:ust)?|sep(?:t(?:ember)?)?|oct(?:ober)?|nov(?:ember)?|dec(?:ember)?";
+const DATE_ISO = /\b\d{4}-(?:0[1-9]|1[0-2])-(?:0[1-9]|[12]\d|3[01])\b/g;
+const DATE_NUMERIC = /\b(?:0?[1-9]|1[0-2])[/-](?:0?[1-9]|[12]\d|3[01])[/-](?:\d{4}|\d{2})\b/g;
+const DATE_MONTH_DMY = new RegExp(`\\b(?:0?[1-9]|[12]\\d|3[01])\\s+(?:${MONTHS})\\.?\\s+\\d{4}\\b`, "gi");
+const DATE_MONTH_MDY = new RegExp(`\\b(?:${MONTHS})\\.?\\s+(?:0?[1-9]|[12]\\d|3[01])(?:st|nd|rd|th)?,?\\s+\\d{4}\\b`, "gi");
+function findDates(text) {
+    const spans = [];
+    for (const re of [DATE_ISO, DATE_NUMERIC, DATE_MONTH_DMY, DATE_MONTH_MDY]) {
+        eachMatch(re, text, (v, i) => emit(spans, "pii:date", i, v.length));
+    }
+    return spans;
+}
+// ── age-over-89 (Safe Harbor: ages > 89 / dates indicating such age) ─────────
+// A numeric RULE, not a regex-of-content (spec-sc2 §2): match an age-shaped
+// phrase, then ACCEPT only when the number is 90..130 (a sane human-age bound —
+// above it the digits are almost certainly something else, e.g. a quantity).
+const AGE_CONTEXT = /\b(?:age[ds]?|aged)\b[^.\n\d]{0,12}(\d{2,3})\b|\b(\d{2,3})[ -]?(?:years?[ -]old|y(?:rs?)?[ -]?old|yo)\b/gi;
+function findAgeOver89(text) {
+    const spans = [];
+    const fresh = new RegExp(AGE_CONTEXT.source, AGE_CONTEXT.flags);
+    for (const m of text.matchAll(fresh)) {
+        const digits = m[1] ?? m[2];
+        if (digits === undefined)
+            continue;
+        const n = Number.parseInt(digits, 10);
+        if (n < 90 || n > 130)
+            continue; // Safe Harbor floor is >89; 130 caps a human age
+        emit(spans, "pii:age_over_89", m.index ?? 0, m[0].length);
+    }
+    return spans;
+}
+// ── fax (Safe Harbor: telephone / fax) — label-anchored phone shape ──────────
+const FAX = /\bfax\b[^.\n]{0,8}(?:\+?\d{1,3}[ .-]?)?(?:\(\d{3}\)|\d{3})[ .-]\d{3}[ .-]\d{4}\b/gi;
+function findFax(text) {
+    const spans = [];
+    eachMatch(FAX, text, (v, i) => emit(spans, "pii:fax", i, v.length));
+    return spans;
+}
+// ── url (Safe Harbor: URLs; also the INJ-6 egress channel) ───────────────────
+const URL_RE = /\bhttps?:\/\/[^\s"'<>)\]\\]+/gi;
+function findUrls(text) {
+    const spans = [];
+    eachMatch(URL_RE, text, (v, i) => {
+        // Trim trailing sentence punctuation from the span length (the URL proper).
+        const trimmed = v.replace(/[.,;:]+$/, "");
+        emit(spans, "pii:url", i, trimmed.length);
+    });
+    return spans;
+}
+// ── ip (Safe Harbor: IP addresses) — v4 (octet-validated) + v6 ───────────────
+const IPV4 = /\b(?:(?:25[0-5]|2[0-4]\d|1?\d?\d)\.){3}(?:25[0-5]|2[0-4]\d|1?\d?\d)\b/g;
+const IPV6 = /\b(?:[0-9A-Fa-f]{1,4}:){2,7}[0-9A-Fa-f]{1,4}\b|\b(?:[0-9A-Fa-f]{1,4}:){1,7}:\b/g;
+function findIps(text) {
+    const spans = [];
+    eachMatch(IPV4, text, (v, i) => emit(spans, "pii:ip", i, v.length));
+    eachMatch(IPV6, text, (v, i) => {
+        if (v.split(":").filter((p) => p !== "").length < 2)
+            return; // avoid a lone "a:" style false hit
+        emit(spans, "pii:ip", i, v.length);
+    });
+    return spans;
+}
+// ── zip (Safe Harbor: geographic < state) — conservative, anchored ───────────
+// A bare 5-digit run floods (SSN-comment doctrine). Claimed only when it is
+// distinctive: ZIP+4 (`12345-6789`), a `ST 12345` state+ZIP shape, or a labelled
+// `ZIP: 12345`. Street/city need the sidecar and are NOT claimed here.
+const ZIP_PLUS4 = /\b\d{5}-\d{4}\b/g;
+const ZIP_STATE = /\b[A-Z]{2}\s+\d{5}(?:-\d{4})?\b/g;
+const ZIP_LABELLED = /\bzip(?:\s*code)?\b[^.\n\d]{0,6}\d{5}(?:-\d{4})?\b/gi;
+function findZips(text) {
+    const spans = [];
+    for (const re of [ZIP_PLUS4, ZIP_STATE, ZIP_LABELLED]) {
+        eachMatch(re, text, (v, i) => emit(spans, "pii:zip", i, v.length));
+    }
+    return spans;
+}
+// ── account-id (health-plan beneficiary #, account #, member #) ──────────────
+// Label-anchored + shape — a bare id is unclaimable without a false-positive
+// flood, so the label is what makes it real (the MRN doctrine).
+const ACCOUNT_ID = /\b(?:account|acct|member|beneficiary|policy|plan|subscriber|group)\b[^.\n]{0,4}(?:id|no|number|#)?\s*[:#]?\s*[A-Za-z0-9][A-Za-z0-9-]{3,}\b/gi;
+function findAccountIds(text) {
+    const spans = [];
+    eachMatch(ACCOUNT_ID, text, (v, i) => emit(spans, "pii:account_id", i, v.length));
+    return spans;
+}
+// ── license-id (certificate / license #) — label-anchored ────────────────────
+const LICENSE_ID = /\b(?:licen[cs]e|licence|certificate|cert|permit|dl|driver'?s?\s+licen[cs]e)\b[^.\n]{0,4}(?:id|no|number|#)?\s*[:#]?\s*[A-Za-z0-9][A-Za-z0-9-]{3,}\b/gi;
+function findLicenseIds(text) {
+    const spans = [];
+    eachMatch(LICENSE_ID, text, (v, i) => emit(spans, "pii:license_id", i, v.length));
+    return spans;
+}
+// ── vin (vehicle identifier) — 17-char VIN with check-digit validation ───────
+const VIN_SHAPE = /\b[A-HJ-NPR-Z0-9]{17}\b/gi;
+const VIN_TRANSLIT = {
+    A: 1, B: 2, C: 3, D: 4, E: 5, F: 6, G: 7, H: 8, J: 1, K: 2, L: 3, M: 4, N: 5,
+    P: 7, R: 9, S: 2, T: 3, U: 4, V: 5, W: 6, X: 7, Y: 8, Z: 9,
+};
+const VIN_WEIGHTS = [8, 7, 6, 5, 4, 3, 2, 10, 0, 9, 8, 7, 6, 5, 4, 3, 2];
+/** VIN check-digit rule (position 9): weighted transliteration mod 11, where 10
+ * ⇒ 'X'. Separates a real VIN from any 17 alphanumerics — the difference between
+ * a false-positive flood and a claimable identifier. */
+function vinValid(vin) {
+    const up = vin.toUpperCase();
+    if (up.length !== 17)
+        return false;
+    let sum = 0;
+    for (let i = 0; i < 17; i += 1) {
+        const ch = up[i];
+        const val = ch >= "0" && ch <= "9" ? ch.charCodeAt(0) - 48 : VIN_TRANSLIT[ch];
+        if (val === undefined)
+            return false; // I/O/Q or other invalid char
+        sum += val * VIN_WEIGHTS[i];
+    }
+    const check = sum % 11;
+    const expected = check === 10 ? "X" : String(check);
+    return up[8] === expected;
+}
+function findVins(text) {
+    const spans = [];
+    eachMatch(VIN_SHAPE, text, (v, i) => {
+        if (!vinValid(v))
+            return;
+        emit(spans, "pii:vin", i, v.length);
+    });
+    return spans;
+}
+// ── device-id (device / serial identifiers) — MAC, IMEI, label-anchored ──────
+const MAC = /\b(?:[0-9A-Fa-f]{2}:){5}[0-9A-Fa-f]{2}\b/g;
+const IMEI_LABELLED = /\bimei\b[^.\n\d]{0,6}(\d{15})\b/gi;
+const DEVICE_LABELLED = /\b(?:device|serial|udid|s\/n|sn)\b[^.\n]{0,4}(?:id|no|number|#)?\s*[:#]?\s*[A-Za-z0-9][A-Za-z0-9-]{3,}\b/gi;
+function findDeviceIds(text) {
+    const spans = [];
+    eachMatch(MAC, text, (v, i) => emit(spans, "pii:device_id", i, v.length));
+    const fresh = new RegExp(IMEI_LABELLED.source, IMEI_LABELLED.flags);
+    for (const m of text.matchAll(fresh)) {
+        const digits = m[1];
+        if (digits === undefined || !(0, scrub_1.luhnValid)(digits))
+            continue; // IMEI is Luhn-valid
+        emit(spans, "pii:device_id", m.index ?? 0, m[0].length);
+    }
+    eachMatch(DEVICE_LABELLED, text, (v, i) => emit(spans, "pii:device_id", i, v.length));
+    return spans;
+}
+/** The SC-2 deterministic rule set (spec-sc2 §2). One rule per Safe Harbor class
+ * that has a deterministic shape; names/streets/biometrics are NOT here (they
+ * are `sidecar`/`out-of-scope` in the coverage table). */
+const RULES = [
+    { type: "pii:date", id: "pii:date@v1", find: findDates },
+    { type: "pii:age_over_89", id: "pii:age_over_89@v1", find: findAgeOver89 },
+    { type: "pii:fax", id: "pii:fax@v1", find: findFax },
+    { type: "pii:url", id: "pii:url@v1", find: findUrls },
+    { type: "pii:ip", id: "pii:ip@v1", find: findIps },
+    { type: "pii:zip", id: "pii:zip@v1", find: findZips },
+    { type: "pii:account_id", id: "pii:account_id@v1", find: findAccountIds },
+    { type: "pii:license_id", id: "pii:license_id@v1", find: findLicenseIds },
+    { type: "pii:vin", id: "pii:vin@v1", find: findVins },
+    { type: "pii:device_id", id: "pii:device_id@v1", find: findDeviceIds },
+];
+/** The registry id of the convenience PACK — configuring it in a route's
+ * `screen.detectors` opts in to ALL ten deterministic Safe Harbor detectors at
+ * once. Individual `pii:<slug>@v1` ids opt in to just that one. */
+exports.SAFE_HARBOR_PACK_ID = "safe-harbor@v1";
+/** All individual Safe Harbor detector ids, for policy validation. */
+exports.SAFE_HARBOR_IDS = new Set(RULES.map((r) => r.id));
+/** True when `id` names a Safe Harbor detector (a `pii:<slug>@v1` or the pack).
+ * The screen policy validator uses this to accept the id at load time. */
+function isSafeHarborId(id) {
+    return id === exports.SAFE_HARBOR_PACK_ID || exports.SAFE_HARBOR_IDS.has(id);
+}
+/** Collapse overlapping spans of one detector to a single span so one underlying
+ * identifier matched by two sub-patterns (e.g. a ZIP caught by both the ZIP+4 and
+ * the state+ZIP rule) COUNTS ONCE. Sorted by start; a span whose range overlaps a
+ * kept span is dropped (conservative — an adjacency undercount is cheaper than a
+ * double count). Offsets only, never a value. */
+function dedupeOverlaps(spans) {
+    const sorted = [...spans].sort((a, b) => a.start - b.start || b.end - a.end);
+    const kept = [];
+    let lastEnd = -1;
+    for (const s of sorted) {
+        if (s.start >= lastEnd) {
+            kept.push(s);
+            lastEnd = s.end;
+        }
+    }
+    return kept;
+}
+/** Wrap one rule as the shared `Detector` (kind deterministic, confidence 1). */
+function detectorFor(rule) {
+    return {
+        id: rule.id,
+        kind: "deterministic",
+        detect: (input) => Promise.resolve(dedupeOverlaps(rule.find(input.text))),
+    };
+}
+/** Every Safe Harbor detector (one per type), for the pack. */
+function safeHarborDetectors() {
+    return RULES.map(detectorFor);
+}
+/** The Safe Harbor detector for one id, or `undefined` if `id` is not one.
+ * `SAFE_HARBOR_PACK_ID` returns `undefined` here — the pack expands to
+ * {@link safeHarborDetectors}; a caller resolves the pack separately. */
+function safeHarborDetectorById(id) {
+    const rule = RULES.find((r) => r.id === id);
+    return rule === undefined ? undefined : detectorFor(rule);
+}
+/** The detector identities (id + version) for a configured id — the pack
+ * expands to all ten; a single id resolves to one. Used to populate the
+ * receipt's `detectors[]` at resolve time (counts-only, never a value). */
+function safeHarborIdentities(id) {
+    if (id === exports.SAFE_HARBOR_PACK_ID)
+        return RULES.map((r) => ({ id: r.id, version: "v1" }));
+    return exports.SAFE_HARBOR_IDS.has(id) ? [{ id, version: "v1" }] : [];
+}
+/** Build the Detector instances a configured id contributes (pack ⇒ all ten,
+ * single id ⇒ one, unknown ⇒ none). */
+function safeHarborDetectorsFor(id) {
+    if (id === exports.SAFE_HARBOR_PACK_ID)
+        return safeHarborDetectors();
+    const one = safeHarborDetectorById(id);
+    return one === undefined ? [] : [one];
+}

package/dist/doctor-cli.d.ts

@@ -0,0 +1,7 @@
+export interface DoctorOptions {
+    /** `--expect-org <slug>`: exit 1 (printing both slugs) when the key resolves
+     * to a different org — the valid-key-wrong-org mistake (M5). */
+    readonly expectOrg?: string;
+}
+export declare function runDoctorCli(opts?: DoctorOptions): Promise<number>;
+//# sourceMappingURL=doctor-cli.d.ts.map

package/dist/doctor-cli.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"doctor-cli.d.ts","sourceRoot":"","sources":["../src/doctor-cli.ts"],"names":[],"mappings":"AAiBA,MAAM,WAAW,aAAa;IAC5B;oEACgE;IAChE,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;CAC7B;AAED,wBAAsB,YAAY,CAAC,IAAI,GAAE,aAAkB,GAAG,OAAO,CAAC,MAAM,CAAC,CAuD5E"}

package/dist/doctor-cli.js

@@ -0,0 +1,67 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.runDoctorCli = runDoctorCli;
+/**
+ * `modelrig doctor` — confirm, in one line, which org your key resolves to.
+ *
+ * The explicit form of the auth preflight (doctor-preflight.ts). Run it in a
+ * worker shell, a CI step, or setup step 0 to answer the question the missing-
+ * runs incident could not: is MODELRIG_API_KEY valid, and does it belong to the
+ * org you expect? Prints the key → org line (✓ on success, a loud line on 401),
+ * and exits non-zero when the key is rejected or unconfirmed — so CI can gate on
+ * it. `--expect-org <slug>` also exits non-zero when the key is valid but
+ * belongs to a different org, printing both slugs. Never prints the key itself
+ * (last-four only, via redactApiKey).
+ *
+ * Kept in its own file so cli.ts stays under the LOC cap (like status-cli.ts).
+ */
+const config_1 = require("./config");
+const doctor_preflight_1 = require("./doctor-preflight");
+async function runDoctorCli(opts = {}) {
+    // An empty --expect-org would make the gate unable to fail: refuse it (usage error).
+    if (opts.expectOrg !== undefined && opts.expectOrg.trim() === "") {
+        console.error("[modelrig] usage: modelrig doctor --expect-org <slug> — the slug must not be empty.");
+        return 2;
+    }
+    // config.ts is the only env reader (package-invariants) — doctor reads the
+    // resolved config, never process.env.
+    const config = (0, config_1.loadConfigFromEnv)();
+    const exp = config.export;
+    if (exp === undefined) {
+        console.error([
+            "[modelrig] no export sink configured — nothing to check.",
+            "Set MODELRIG_API_KEY (a rig_sk_ key minted at app.modelrig.ai) so the SDK",
+            "ships telemetry to the hosted API. Without it, runs are recorded locally only.",
+        ].join("\n"));
+        return 1;
+    }
+    if (exp.mode !== "api") {
+        console.log(`[modelrig] export sink is ${exp.mode} mode (self-hosted control plane) — whoami is an ` +
+            "api-mode check, so there is nothing to confirm here.");
+        return 0;
+    }
+    const result = await (0, doctor_preflight_1.runAuthPreflight)(config);
+    if (result === null) {
+        // Unreachable given the api-mode guard above, but keep the contract total.
+        console.log("[modelrig] nothing to check.");
+        return 0;
+    }
+    if (result.ok) {
+        const expectOrg = opts.expectOrg?.trim();
+        if (expectOrg !== undefined && expectOrg !== "") {
+            const actual = (0, doctor_preflight_1.expectedOrgMismatch)(result, expectOrg);
+            if (actual !== null) {
+                console.error(`[modelrig] ORG MISMATCH: key resolves to «${actual}», --expect-org is «${expectOrg}» — ` +
+                    `telemetry from this key lands in «${actual}». Mint a key in the «${expectOrg}» org at ` +
+                    "app.modelrig.ai, or fix --expect-org.");
+                return 1;
+            }
+            console.log(`${result.line}  (org «${expectOrg}» as expected)`);
+            return 0;
+        }
+        console.log(result.line);
+        return 0;
+    }
+    console.error(result.line);
+    return 1;
+}

package/dist/doctor-preflight.d.ts

@@ -0,0 +1,52 @@
+import type { RigConfig } from "./config";
+/** The subset of the whoami response we render. Every field optional/narrowed —
+ * an older or partial server response degrades to "(unknown org)", never a throw. */
+export interface WhoamiResponse {
+    readonly org?: {
+        readonly id?: string;
+        readonly name?: string;
+        readonly slug?: string;
+    } | null;
+    readonly key?: {
+        readonly name?: string;
+        readonly last_four?: string;
+    } | null;
+    readonly posture?: {
+        readonly telemetry?: string;
+        readonly artifact?: string;
+    } | null;
+}
+export interface PreflightResult {
+    readonly ok: boolean;
+    /** HTTP status, or "network_error" when the request never completed. */
+    readonly status: number | "network_error";
+    /** One human line, ready to print or log. */
+    readonly line: string;
+    readonly whoami?: WhoamiResponse;
+}
+/**
+ * Ask the configured api-mode sink who the key is. Returns null when there is
+ * nothing to check (no export, or a direct/local sink — whoami is an api-mode
+ * concept). Never throws: a network error is a `PreflightResult`, not an
+ * exception, so no caller can be broken by turning this on.
+ */
+export declare function runAuthPreflight(config: RigConfig, fetchFn?: typeof fetch): Promise<PreflightResult | null>;
+/**
+ * The shared whoami worker: `runAuthPreflight` (doctor) and the api sink's
+ * first-flush org line (telemetry/org-identity.ts) both call it, so the two
+ * surfaces can never disagree about what a key resolves to. Never throws.
+ */
+export declare function whoamiPreflight(ingestUrl: string, apiKey: string, fetchFn?: typeof fetch, 
+/** Abort the request (e.g. `AbortSignal.timeout(ms)`) — the sink passes one so
+ * a hanging whoami can never hold the process open. An abort is a network_error. */
+signal?: AbortSignal): Promise<PreflightResult>;
+/** The org slug a successful preflight resolved, or null when unknown. */
+export declare function resolvedOrgSlug(result: PreflightResult): string | null;
+/**
+ * Compare a resolved org with the slug the caller expects (`--expect-org`,
+ * `createRig({ expectOrg })`). Returns null when they match, or the resolved
+ * slug (`"(unknown org)"` when the server did not name one) when they do not.
+ * Comparison is exact on the slug, case-insensitive — slugs are lowercase.
+ */
+export declare function expectedOrgMismatch(result: PreflightResult, expectOrg: string): string | null;
+//# sourceMappingURL=doctor-preflight.d.ts.map

package/dist/doctor-preflight.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"doctor-preflight.d.ts","sourceRoot":"","sources":["../src/doctor-preflight.ts"],"names":[],"mappings":"AAwBA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AAE1C;qFACqF;AACrF,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,GAAG,CAAC,EAAE;QAAE,QAAQ,CAAC,EAAE,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;IAC/F,QAAQ,CAAC,GAAG,CAAC,EAAE;QAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;IAC9E,QAAQ,CAAC,OAAO,CAAC,EAAE;QAAE,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;CACvF;AAED,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,EAAE,EAAE,OAAO,CAAC;IACrB,wEAAwE;IACxE,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,eAAe,CAAC;IAC1C,6CAA6C;IAC7C,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,CAAC,EAAE,cAAc,CAAC;CAClC;AAED;;;;;GAKG;AACH,wBAAsB,gBAAgB,CACpC,MAAM,EAAE,SAAS,EACjB,OAAO,GAAE,OAAO,KAAa,GAC5B,OAAO,CAAC,eAAe,GAAG,IAAI,CAAC,CAIjC;AAED;;;;GAIG;AACH,wBAAsB,eAAe,CACnC,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,MAAM,EACd,OAAO,GAAE,OAAO,KAAa;AAC7B;oFACoF;AACpF,MAAM,CAAC,EAAE,WAAW,GACnB,OAAO,CAAC,eAAe,CAAC,CA6C1B;AAED,0EAA0E;AAC1E,wBAAgB,eAAe,CAAC,MAAM,EAAE,eAAe,GAAG,MAAM,GAAG,IAAI,CAGtE;AAED;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,eAAe,EAAE,SAAS,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAI7F"}

package/dist/doctor-preflight.js

@@ -0,0 +1,112 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.runAuthPreflight = runAuthPreflight;
+exports.whoamiPreflight = whoamiPreflight;
+exports.resolvedOrgSlug = resolvedOrgSlug;
+exports.expectedOrgMismatch = expectedOrgMismatch;
+/**
+ * Auth preflight — one legible line where there used to be silent 401 drops.
+ *
+ * Telemetry export is fire-and-forget by design: a rejected batch only logs a
+ * warning, never fails the pipeline. That is correct, but it means a WRONG key
+ * (revoked, or belonging to a different org than the console you watch) drops
+ * every run silently — the failure mode that cost InferWealth days of invisible
+ * telemetry. This module turns that into one line, by asking `GET /v1/whoami`
+ * (server-side companion) which org the key actually resolves to.
+ *
+ * `runAuthPreflight` is the pure worker: given the resolved config (config.ts is
+ * the only env reader) it returns a legible result and NEVER throws. `modelrig
+ * doctor` (doctor-cli.ts) calls it and prints the line — ✓ on success, a loud
+ * line on a rejected key.
+ *
+ * `--expect-org <slug>` (doctor) and `createRig({ expectOrg })` (the sink's
+ * first-flush line) compare the resolved slug with `expectedOrgMismatch` below.
+ *
+ * NOTE: there is no automatic boot-time preflight. The automatic safety net lives
+ * on the export path itself — the api sink emits a loud once-per-failure-streak
+ * "AUTH FAILED" warning when an ingest POST is rejected (telemetry/sinks.ts) — so
+ * a customer needs no extra env var: the one key they set is enough.
+ */
+const api_key_format_1 = require("./tenancy/api-key-format");
+/**
+ * Ask the configured api-mode sink who the key is. Returns null when there is
+ * nothing to check (no export, or a direct/local sink — whoami is an api-mode
+ * concept). Never throws: a network error is a `PreflightResult`, not an
+ * exception, so no caller can be broken by turning this on.
+ */
+async function runAuthPreflight(config, fetchFn = fetch) {
+    const exp = config.export;
+    if (exp === undefined || exp.mode !== "api")
+        return null;
+    return whoamiPreflight(exp.ingestUrl, exp.apiKey, fetchFn);
+}
+/**
+ * The shared whoami worker: `runAuthPreflight` (doctor) and the api sink's
+ * first-flush org line (telemetry/org-identity.ts) both call it, so the two
+ * surfaces can never disagree about what a key resolves to. Never throws.
+ */
+async function whoamiPreflight(ingestUrl, apiKey, fetchFn = fetch, 
+/** Abort the request (e.g. `AbortSignal.timeout(ms)`) — the sink passes one so
+ * a hanging whoami can never hold the process open. An abort is a network_error. */
+signal) {
+    const base = new URL(ingestUrl).origin;
+    const redacted = (0, api_key_format_1.redactApiKey)(apiKey);
+    try {
+        const res = await fetchFn(`${base}/v1/whoami`, {
+            headers: { authorization: `Bearer ${apiKey}` },
+            ...(signal !== undefined ? { signal } : {}),
+        });
+        if (res.status === 401 || res.status === 403) {
+            return {
+                ok: false,
+                status: res.status,
+                line: `[modelrig] AUTH FAILED (${res.status}) at ${base} — key ${redacted} is not recognized ` +
+                    "by this server/org. Check MODELRIG_API_KEY, and that the key belongs to the org you " +
+                    "expect (mint it in that org at app.modelrig.ai). Telemetry is dropping silently until this is fixed.",
+            };
+        }
+        if (!res.ok) {
+            return {
+                ok: false,
+                status: res.status,
+                line: `[modelrig] whoami ${res.status} at ${base} — could not confirm the key's org (retry \`modelrig doctor\`).`,
+            };
+        }
+        const who = (await res.json().catch(() => null));
+        const org = who?.org ?? null;
+        const orgLabel = org !== null && org !== undefined ? `«${org.name ?? org.id ?? "?"}»` : "(unknown org)";
+        const posture = who?.posture?.telemetry;
+        const postureLabel = typeof posture === "string" ? `, telemetry: ${posture}` : "";
+        return {
+            ok: true,
+            status: res.status,
+            line: `[modelrig] key ${redacted} → org ${orgLabel} ✓  (ingest ${base}${postureLabel})`,
+            ...(who !== null ? { whoami: who } : {}),
+        };
+    }
+    catch (err) {
+        return {
+            ok: false,
+            status: "network_error",
+            line: `[modelrig] whoami unreachable at ${base} (${err instanceof Error ? err.message : String(err)}) — ` +
+                "export is fire-and-forget, so this only means the preflight could not confirm your key.",
+        };
+    }
+}
+/** The org slug a successful preflight resolved, or null when unknown. */
+function resolvedOrgSlug(result) {
+    const slug = result.whoami?.org?.slug;
+    return typeof slug === "string" && slug !== "" ? slug : null;
+}
+/**
+ * Compare a resolved org with the slug the caller expects (`--expect-org`,
+ * `createRig({ expectOrg })`). Returns null when they match, or the resolved
+ * slug (`"(unknown org)"` when the server did not name one) when they do not.
+ * Comparison is exact on the slug, case-insensitive — slugs are lowercase.
+ */
+function expectedOrgMismatch(result, expectOrg) {
+    const actual = resolvedOrgSlug(result);
+    if (actual !== null && actual.toLowerCase() === expectOrg.trim().toLowerCase())
+        return null;
+    return actual ?? "(unknown org)";
+}

package/dist/feedback/coverage.d.ts

@@ -7,12 +7,12 @@
  *   rung 0 — implicit signals only: conformance / repair / refusal rates
  *            from telemetry. Enough confidence for schema-mechanical swap
  *            proposals (the bake-off gate).
- *   rung 1 — ≥ RUNG1_MIN_FEEDBACK human/agent verdicts attached: prose
+ *   rung 1 — ≥ RUNG1_MIN_GRADES grades attached: prose
  *            routes (no schema to conform to) gain proposal confidence.
  *   rung 2+ — judges; Phase 5+, out of scope by decision.
  */
-import type { FeedbackRow, TelemetryRow } from "../types/telemetry";
-export declare const RUNG1_MIN_FEEDBACK = 10;
+import type { GradeRow, TelemetryRow } from "../types/telemetry";
+export declare const RUNG1_MIN_GRADES = 10;
 export interface RouteCoverage {
     readonly route: string;
     readonly samples: number;
@@ -20,13 +20,16 @@ export interface RouteCoverage {
     readonly conformRate: number;
     readonly repairRate: number;
     readonly refusalRate: number;
-    readonly feedbackCount: number;
+    readonly gradeCount: number;
     readonly rung: 0 | 1;
     /** Teaching copy: what reaching the next rung takes and unlocks. */
     readonly nextRungUnlock: string;
 }
-/** Attribution: a feedback row joins a route via its inference id, or via
- * its episode key matching a row's run_id tag. Unmatched feedback attaches
- * to nothing (never guessed). */
-export declare function computeCoverage(rows: readonly TelemetryRow[], feedback: readonly FeedbackRow[]): RouteCoverage[];
+/** Attribution: a grade joins a route via its inference-subject id, or via its
+ * run-subject (episode) id matching a row's run_id tag. Unmatched grades attach
+ * to nothing (never guessed). Grade primitive (R6): every grade counts toward
+ * readiness — a wrapper-written feedback IS now a grade, so this is
+ * behaviour-preserving for the Rung-1 threshold. Artifact-subject grades never
+ * resolve to a route here (no artifact→route join) and simply do not count. */
+export declare function computeCoverage(rows: readonly TelemetryRow[], grades: readonly GradeRow[]): RouteCoverage[];
 //# sourceMappingURL=coverage.d.ts.map

package/dist/feedback/coverage.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"coverage.d.ts","sourceRoot":"","sources":["../../src/feedback/coverage.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAEpE,eAAO,MAAM,kBAAkB,KAAK,CAAC;AAErC,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,6EAA6E;IAC7E,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC;IACrB,oEAAoE;IACpE,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;CACjC;AAED;;iCAEiC;AACjC,wBAAgB,eAAe,CAC7B,IAAI,EAAE,SAAS,YAAY,EAAE,EAC7B,QAAQ,EAAE,SAAS,WAAW,EAAE,GAC/B,aAAa,EAAE,CA2EjB"}
+{"version":3,"file":"coverage.d.ts","sourceRoot":"","sources":["../../src/feedback/coverage.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,KAAK,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAEjE,eAAO,MAAM,gBAAgB,KAAK,CAAC;AAEnC,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,6EAA6E;IAC7E,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC;IACrB,oEAAoE;IACpE,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;CACjC;AAED;;;;;+EAK+E;AAC/E,wBAAgB,eAAe,CAC7B,IAAI,EAAE,SAAS,YAAY,EAAE,EAC7B,MAAM,EAAE,SAAS,QAAQ,EAAE,GAC1B,aAAa,EAAE,CAqFjB"}