modelrig 0.8.1 → 0.9.0

package/dist/settings/api-fetcher.js

@@ -13,12 +13,16 @@
  */
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.createApiTaskSettingsFetcher = createApiTaskSettingsFetcher;
+exports.createApiOrgPostureFetcher = createApiOrgPostureFetcher;
 exports.startApiSettings = startApiSettings;
 const task_settings_1 = require("./task-settings");
 const SCRUB_MODES = ["off", "detect", "redact", "block"];
-/** Narrow an unknown JSON body into a `TaskSettings`, or null when the shape is
- * not what the endpoint promises. A malformed 200 is treated like a miss
- * (fail-open) rather than trusted — we never fabricate a capture-on from junk. */
+const ARTIFACT_POSTURES = ["off", "metadata", "managed"];
+/** Narrow an unknown JSON body into a `TaskSettingsFetchResult`, or null when the
+ * shape is not what the endpoint promises. A malformed 200 is treated like a miss
+ * (fail-open) rather than trusted — we never fabricate a capture-on from junk. The
+ * body is `{ org_id, task, settings }`; `org_id` is carried through so the
+ * resolver can address the org-posture read (older servers omit it → null). */
 function parseSettings(body) {
     if (typeof body !== "object" || body === null)
         return null;
@@ -34,17 +38,31 @@ function parseSettings(body) {
         return null;
     if (!SCRUB_MODES.includes(s.scrub))
         return null;
-    return {
+    const parsed = {
         capture: s.capture,
         artifacts_enabled: s.artifacts_enabled,
         artifact_content: s.artifact_content,
         scrub: s.scrub,
     };
+    const rawOrg = body.org_id;
+    const orgId = typeof rawOrg === "string" && rawOrg !== "" ? rawOrg : null;
+    return { settings: parsed, orgId };
+}
+/** Narrow an org-settings body (`{ org_id, settings: { artifact_posture, … } }`)
+ * into an `ArtifactPosture`, or null when the value is not one of the three. */
+function parsePosture(body) {
+    if (typeof body !== "object" || body === null)
+        return null;
+    const settings = body.settings;
+    if (typeof settings !== "object" || settings === null)
+        return null;
+    const p = settings.artifact_posture;
+    return ARTIFACT_POSTURES.includes(p) ? p : null;
 }
 /**
  * Build the api-mode fetcher. `fetch(task)` GETs `/v1/tasks/:task/settings` and
- * returns the parsed settings, or null on ANY non-200, network error, or
- * malformed body — the resolver reads null as "leave the cache as it is".
+ * returns the parsed result (settings + org id), or null on ANY non-200, network
+ * error, or malformed body — the resolver reads null as "leave the cache as it is".
  */
 function createApiTaskSettingsFetcher(config) {
     const base = config.ingestUrl.replace(/\/$/, "");
@@ -71,6 +89,39 @@ function createApiTaskSettingsFetcher(config) {
         },
     };
 }
+/**
+ * Build the api-mode ORG-posture fetcher (P15 CP-3). `fetch(orgId)` GETs
+ * `GET /v1/orgs/:org/settings` (any `rig_sk_` key of the caller's own org — no
+ * scope required) and returns the `artifact_posture`, or null on ANY non-200,
+ * network error, or malformed body. The org id comes from the task channel's
+ * echoed `org_id` — one control-plane channel, one credential (T8). Mirrors the
+ * task fetcher's leak discipline: Bearer key in a header, never the URL/body in
+ * an error, never a throw for a network/HTTP failure (the resolver reads null as
+ * "leave the last-known posture" — fail-open; the server ingest gate backstops).
+ */
+function createApiOrgPostureFetcher(config) {
+    const base = config.ingestUrl.replace(/\/$/, "");
+    const fetchFn = config.fetchFn ?? fetch;
+    return {
+        async fetch(orgId) {
+            const url = `${base}/v1/orgs/${encodeURIComponent(orgId)}/settings`;
+            let response;
+            try {
+                response = await fetchFn(url, {
+                    method: "GET",
+                    headers: { authorization: `Bearer ${config.apiKey}` },
+                });
+            }
+            catch {
+                return null;
+            }
+            if (!response.ok)
+                return null;
+            const body = (await response.json().catch(() => null));
+            return parsePosture(body);
+        },
+    };
+}
 /**
  * Construct AND start the api-mode settings resolver from a rig config, or null
  * when the rig is not in api mode (local-only/direct keep env/YAML). Folds the
@@ -80,11 +131,11 @@ function createApiTaskSettingsFetcher(config) {
 function startApiSettings(config, defaultIntervalMs) {
     if (config.export?.mode !== "api")
         return null;
+    const fetcherConfig = { ingestUrl: config.export.ingestUrl, apiKey: config.export.apiKey };
     const resolver = (0, task_settings_1.createTaskSettingsResolver)({
-        fetcher: createApiTaskSettingsFetcher({
-            ingestUrl: config.export.ingestUrl,
-            apiKey: config.export.apiKey,
-        }),
+        fetcher: createApiTaskSettingsFetcher(fetcherConfig),
+        // P15 CP-3: resolve the org's capture posture from the same channel + key.
+        postureFetcher: createApiOrgPostureFetcher(fetcherConfig),
         intervalMs: config.export.intervalMs ?? defaultIntervalMs,
     });
     resolver.start();

package/dist/settings/grading-guide.d.ts

@@ -0,0 +1,76 @@
+/**
+ * Grading-guide DTO types (improvement-path IP-0, spec §3 / plan §2).
+ *
+ * The guide is the grader's textbook: the per-route rubric an expert writes so
+ * the AI grader (model-judge) can be assembled from it. It is stored as
+ * `tasks.grading_guide jsonb` (00071) and travels ONLY over the task-settings
+ * surface (GET/PATCH /v1/tasks/:task/settings + the oracle's
+ * get/set_task_settings) — these types are that wire contract, shared by the
+ * server, the oracle, and any SDK consumer reading settings (T7: a jsonb column
+ * is not proof of shape; the boundary narrows to THIS).
+ *
+ * Deliberately NOT here:
+ *   - `pass_threshold` — that is route config (GP-1's `grade:` block,
+ *     routes/objective-loader.ts). The settings write path REJECTS the key.
+ *   - any runtime resolution — the SDK's fail-open TaskSettings resolver
+ *     (task-settings.ts) carries only the four governance flags; the guide is
+ *     server-plane data and never gates a run.
+ *
+ * TYPES ONLY — no behavior. Validation lives at the single write boundary
+ * (modelrig-server's task-settings path).
+ */
+/** One binary criterion — the unit the expert authors and the judge applies. */
+export interface GradingGuideCriterion {
+    /** Stable handle, unique within the guide (per-criterion grades key on it). */
+    readonly id: string;
+    readonly title: string;
+    /** One sentence describing what a PASS on this criterion looks like. */
+    readonly pass: string;
+    /** One sentence describing what a FAIL on this criterion looks like. */
+    readonly fail: string;
+}
+/** Escalation jury knobs (ruling §7.6 — defaults: single judge for volume,
+ * jury on escalation only). All optional; absent = server defaults at judge
+ * assembly time (IP-1, not stored here). */
+export interface GradingGuideJury {
+    readonly size?: number;
+    readonly families?: readonly string[];
+    readonly envelope_usd_month?: number;
+}
+/** When the judge escalates to the human queue / jury. */
+export interface GradingGuideEscalation {
+    /** Judge-uncertain band: escalate when |score − pass_threshold| ≤ epsilon.
+     * In (0, 0.5] — the threshold itself stays route config. */
+    readonly epsilon: number;
+    readonly jury?: GradingGuideJury;
+}
+/** The write shape a caller PATCHes — everything the customer authors.
+ * `version` is deliberately absent: it is server-owned and bumped on every
+ * write (a client-supplied version is ignored, T3's spirit). */
+export interface GradingGuideInput {
+    /** Ordered binary criteria (empty while authoring is legal; an empty guide
+     * still assembles no judge — that is IP-1's concern, not storage's). */
+    readonly criteria: readonly GradingGuideCriterion[];
+    /** Grade ids whose critiques become few-shots ("teach from this"). Defaults
+     * to [] when omitted. A deleted grade degrades gracefully to fewer few-shots. */
+    readonly teach_grade_ids?: readonly string[];
+    /** Per-grader agreement override in [0.75, 1] (ruling §7.2: floor 0.75,
+     * default target 0.85 when absent). */
+    readonly agreement_target?: number;
+    readonly escalation?: GradingGuideEscalation;
+}
+/** The stored/read shape — the input plus the server-stamped version. This is
+ * what `GET /v1/tasks/:task/settings` returns under `settings.grading_guide`
+ * (or null when the route has no guide: UNGRADED / NOT CALIBRATED, never a
+ * fabricated default — S9c). */
+export interface GradingGuide {
+    /** Server-owned write counter, starting at 1. Judge grades stamp it into
+     * their grader string (e.g. `route-judge@v1+guide:3`) so every judge grade
+     * names the guide edition it was taught from. */
+    readonly version: number;
+    readonly criteria: readonly GradingGuideCriterion[];
+    readonly teach_grade_ids: readonly string[];
+    readonly agreement_target?: number;
+    readonly escalation?: GradingGuideEscalation;
+}
+//# sourceMappingURL=grading-guide.d.ts.map

package/dist/settings/grading-guide.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"grading-guide.d.ts","sourceRoot":"","sources":["../../src/settings/grading-guide.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,gFAAgF;AAChF,MAAM,WAAW,qBAAqB;IACpC,+EAA+E;IAC/E,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,wEAAwE;IACxE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,wEAAwE;IACxE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB;AAED;;4CAE4C;AAC5C,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,QAAQ,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACtC,QAAQ,CAAC,kBAAkB,CAAC,EAAE,MAAM,CAAC;CACtC;AAED,0DAA0D;AAC1D,MAAM,WAAW,sBAAsB;IACrC;gEAC4D;IAC5D,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,IAAI,CAAC,EAAE,gBAAgB,CAAC;CAClC;AAED;;gEAEgE;AAChE,MAAM,WAAW,iBAAiB;IAChC;4EACwE;IACxE,QAAQ,CAAC,QAAQ,EAAE,SAAS,qBAAqB,EAAE,CAAC;IACpD;qFACiF;IACjF,QAAQ,CAAC,eAAe,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC7C;2CACuC;IACvC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IACnC,QAAQ,CAAC,UAAU,CAAC,EAAE,sBAAsB,CAAC;CAC9C;AAED;;;gCAGgC;AAChC,MAAM,WAAW,YAAY;IAC3B;;qDAEiD;IACjD,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,QAAQ,EAAE,SAAS,qBAAqB,EAAE,CAAC;IACpD,QAAQ,CAAC,eAAe,EAAE,SAAS,MAAM,EAAE,CAAC;IAC5C,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IACnC,QAAQ,CAAC,UAAU,CAAC,EAAE,sBAAsB,CAAC;CAC9C"}

package/dist/settings/grading-guide.js

@@ -0,0 +1,23 @@
+"use strict";
+/**
+ * Grading-guide DTO types (improvement-path IP-0, spec §3 / plan §2).
+ *
+ * The guide is the grader's textbook: the per-route rubric an expert writes so
+ * the AI grader (model-judge) can be assembled from it. It is stored as
+ * `tasks.grading_guide jsonb` (00071) and travels ONLY over the task-settings
+ * surface (GET/PATCH /v1/tasks/:task/settings + the oracle's
+ * get/set_task_settings) — these types are that wire contract, shared by the
+ * server, the oracle, and any SDK consumer reading settings (T7: a jsonb column
+ * is not proof of shape; the boundary narrows to THIS).
+ *
+ * Deliberately NOT here:
+ *   - `pass_threshold` — that is route config (GP-1's `grade:` block,
+ *     routes/objective-loader.ts). The settings write path REJECTS the key.
+ *   - any runtime resolution — the SDK's fail-open TaskSettings resolver
+ *     (task-settings.ts) carries only the four governance flags; the guide is
+ *     server-plane data and never gates a run.
+ *
+ * TYPES ONLY — no behavior. Validation lives at the single write boundary
+ * (modelrig-server's task-settings path).
+ */
+Object.defineProperty(exports, "__esModule", { value: true });

package/dist/settings/index.d.ts

@@ -4,7 +4,8 @@
  * the settings surface has one home.
  */
 export { createTaskSettingsResolver, effectiveCapture, effectiveScrubMode, DEFAULT_TASK_SETTINGS, } from "./task-settings";
-export type { TaskSettings, TaskSettingsResolver, TaskSettingsFetcher } from "./task-settings";
-export { createApiTaskSettingsFetcher, startApiSettings } from "./api-fetcher";
+export type { ArtifactPosture, OrgPostureFetcher, TaskSettings, TaskSettingsResolver, TaskSettingsFetcher, TaskSettingsFetchResult, } from "./task-settings";
+export { createApiTaskSettingsFetcher, createApiOrgPostureFetcher, startApiSettings, } from "./api-fetcher";
 export type { ApiTaskSettingsFetcherConfig } from "./api-fetcher";
+export type { GradingGuide, GradingGuideCriterion, GradingGuideEscalation, GradingGuideInput, GradingGuideJury, } from "./grading-guide";
 //# sourceMappingURL=index.d.ts.map

package/dist/settings/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/settings/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EACL,0BAA0B,EAC1B,gBAAgB,EAChB,kBAAkB,EAClB,qBAAqB,GACtB,MAAM,iBAAiB,CAAC;AACzB,YAAY,EAAE,YAAY,EAAE,oBAAoB,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AAC/F,OAAO,EAAE,4BAA4B,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAC/E,YAAY,EAAE,4BAA4B,EAAE,MAAM,eAAe,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/settings/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EACL,0BAA0B,EAC1B,gBAAgB,EAChB,kBAAkB,EAClB,qBAAqB,GACtB,MAAM,iBAAiB,CAAC;AACzB,YAAY,EACV,eAAe,EACf,iBAAiB,EACjB,YAAY,EACZ,oBAAoB,EACpB,mBAAmB,EACnB,uBAAuB,GACxB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACL,4BAA4B,EAC5B,0BAA0B,EAC1B,gBAAgB,GACjB,MAAM,eAAe,CAAC;AACvB,YAAY,EAAE,4BAA4B,EAAE,MAAM,eAAe,CAAC;AAClE,YAAY,EACV,YAAY,EACZ,qBAAqB,EACrB,sBAAsB,EACtB,iBAAiB,EACjB,gBAAgB,GACjB,MAAM,iBAAiB,CAAC"}

package/dist/settings/index.js

@@ -5,7 +5,7 @@
  * the settings surface has one home.
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.startApiSettings = exports.createApiTaskSettingsFetcher = exports.DEFAULT_TASK_SETTINGS = exports.effectiveScrubMode = exports.effectiveCapture = exports.createTaskSettingsResolver = void 0;
+exports.startApiSettings = exports.createApiOrgPostureFetcher = exports.createApiTaskSettingsFetcher = exports.DEFAULT_TASK_SETTINGS = exports.effectiveScrubMode = exports.effectiveCapture = exports.createTaskSettingsResolver = void 0;
 var task_settings_1 = require("./task-settings");
 Object.defineProperty(exports, "createTaskSettingsResolver", { enumerable: true, get: function () { return task_settings_1.createTaskSettingsResolver; } });
 Object.defineProperty(exports, "effectiveCapture", { enumerable: true, get: function () { return task_settings_1.effectiveCapture; } });
@@ -13,4 +13,5 @@ Object.defineProperty(exports, "effectiveScrubMode", { enumerable: true, get: fu
 Object.defineProperty(exports, "DEFAULT_TASK_SETTINGS", { enumerable: true, get: function () { return task_settings_1.DEFAULT_TASK_SETTINGS; } });
 var api_fetcher_1 = require("./api-fetcher");
 Object.defineProperty(exports, "createApiTaskSettingsFetcher", { enumerable: true, get: function () { return api_fetcher_1.createApiTaskSettingsFetcher; } });
+Object.defineProperty(exports, "createApiOrgPostureFetcher", { enumerable: true, get: function () { return api_fetcher_1.createApiOrgPostureFetcher; } });
 Object.defineProperty(exports, "startApiSettings", { enumerable: true, get: function () { return api_fetcher_1.startApiSettings; } });

package/dist/settings/task-settings.d.ts

@@ -37,12 +37,34 @@ export interface TaskSettings {
  * run that reaches the cache before the first fetch lands sees this — never a
  * block, never a silent capture-on. */
 export declare const DEFAULT_TASK_SETTINGS: TaskSettings;
-/** Pulls one task's settings from the control plane. Returns the settings, or
+/** The ORG-level capture posture (00032 + P15 CP-1), the single account-settings
+ * opt-out. `off` = capture nothing (metadata dropped server-side at ingest);
+ * `metadata` = counts + hashes only (content 403'd); `managed` = full custody
+ * (signup default). The SDK resolves it from the control plane at boot and gates
+ * capture locally (no wasted work); the SERVER is the authoritative backstop. */
+export type ArtifactPosture = "off" | "metadata" | "managed";
+/** One task-settings pull's result. Carries the settings AND the `org_id` the
+ * server echoes (`GET /v1/tasks/:task/settings` → `{ org_id, task, settings }`),
+ * so the resolver can learn the caller's org — the key the org-posture read is
+ * addressed by, without a separate identity endpoint (T8, one channel). */
+export interface TaskSettingsFetchResult {
+    readonly settings: TaskSettings;
+    /** The resolved org id, or null when the body omitted it (older server). */
+    readonly orgId: string | null;
+}
+/** Pulls one task's settings from the control plane. Returns the result, or
  * `null` when the task is unknown (404) or the read is unreadable — the resolver
  * treats null as "leave the cache as it is" (fail-open). NEVER throws for a
  * network/HTTP failure; it resolves null so the caller stays fail-open. */
 export interface TaskSettingsFetcher {
-    fetch(task: string): Promise<TaskSettings | null>;
+    fetch(task: string): Promise<TaskSettingsFetchResult | null>;
+}
+/** Pulls one org's capture posture from the control plane (`artifact_posture`).
+ * Returns the posture, or `null` when unreadable — the resolver treats null as
+ * "leave the last-known posture" (fail-OPEN to the namespace default; the server
+ * ingest gate is the authoritative backstop). NEVER throws. */
+export interface OrgPostureFetcher {
+    fetch(orgId: string): Promise<ArtifactPosture | null>;
 }
 export interface TaskSettingsResolver {
     /** The effective settings for a task, from the cache only — synchronous,
@@ -51,12 +73,19 @@ export interface TaskSettingsResolver {
     /** A copy of every tracked task's last-known settings — for `rig.status()` /
      * the boot posture. Empty until the first run tracks a task. */
     snapshot(): ReadonlyMap<string, TaskSettings>;
+    /** The org's capture posture (P15), or null when not yet resolved — the SDK
+     * gates capture on this (an `off` org captures nothing) and the banner/status
+     * report it. Null until the first task pull learns the org id and the posture
+     * read lands (fail-OPEN: capture continues; the server ingest gate backstops). */
+    posture(): ArtifactPosture | null;
+    /** The resolved org id (from the task channel), or null before the first pull. */
+    orgId(): string | null;
     /** Register a task so the interval refresh keeps it fresh, and kick a
      * one-shot fetch now if it has never been seen. Fire-and-forget; fail-open.
      * Called on the first run that carries this `opts.task`. */
     track(task: string): void;
-    /** Re-pull every tracked task once. The boot pull and each exporter-interval
-     * tick call this. Resolves after all fetches settle; never rejects. */
+    /** Re-pull every tracked task once, then re-read the org posture. The boot pull
+     * and each exporter-interval tick call this. Settles; never rejects. */
     refresh(): Promise<void>;
     /** Begin the interval loop (idempotent). */
     start(): void;
@@ -65,6 +94,9 @@ export interface TaskSettingsResolver {
 }
 export interface TaskSettingsResolverConfig {
     readonly fetcher: TaskSettingsFetcher;
+    /** Org-posture reader (P15). Optional so local/test resolvers may omit it; when
+     * absent, `posture()` stays null (fail-open) and no org read is attempted. */
+    readonly postureFetcher?: OrgPostureFetcher;
     /** Refresh cadence — the exporter interval, threaded from index.ts so the two
      * loops beat together (spec §1.5: "refreshes on the exporter interval"). */
     readonly intervalMs: number;
@@ -80,12 +112,17 @@ export interface TaskSettingsResolverConfig {
  */
 export declare function createTaskSettingsResolver(config: TaskSettingsResolverConfig): TaskSettingsResolver;
 /**
- * The EFFECTIVE capture flag for a run (spec §1.5 precedence). When a control
- * plane is configured (resolver present) it WINS: the YAML flag is ignored
- * entirely — deprecated, warned about at load (routes/loader.ts). Only a
+ * The EFFECTIVE capture flag for a run (spec §1.5 precedence + P15 org floor).
+ * When a control plane is configured (resolver present) it WINS: the YAML flag is
+ * ignored entirely — deprecated, warned about at load (routes/loader.ts). Only a
  * local-only rig (resolver null) lets the YAML flag govern. A run with no task
  * identity to key on (`opts.task` absent) falls back to YAML even in api mode,
  * because there is no control-plane row to resolve.
+ *
+ * The ORG posture is a FLOOR above the per-task flag (P15): an `off` org captures
+ * nothing regardless of any task's `capture`, so a resolved `off` posture forces
+ * this false (no wasted work). A null/unresolved posture leaves the per-task flag
+ * to decide (fail-OPEN; the server ingest gate is the authoritative backstop).
  */
 export declare function effectiveCapture(resolver: TaskSettingsResolver | null, task: string | undefined, yamlCapture: boolean): boolean;
 /**

package/dist/settings/task-settings.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"task-settings.d.ts","sourceRoot":"","sources":["../../src/settings/task-settings.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAG3C;0EAC0E;AAC1E,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,2EAA2E;IAC3E,QAAQ,CAAC,iBAAiB,EAAE,OAAO,GAAG,IAAI,CAAC;IAC3C,QAAQ,CAAC,gBAAgB,EAAE,OAAO,CAAC;IACnC,QAAQ,CAAC,KAAK,EAAE,SAAS,CAAC;CAC3B;AAED;;;uCAGuC;AACvC,eAAO,MAAM,qBAAqB,EAAE,YAKnC,CAAC;AAEF;;;2EAG2E;AAC3E,MAAM,WAAW,mBAAmB;IAClC,KAAK,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,CAAC;CACnD;AAED,MAAM,WAAW,oBAAoB;IACnC;sFACkF;IAClF,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,YAAY,CAAC;IAChC;oEACgE;IAChE,QAAQ,IAAI,WAAW,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;IAC9C;;gEAE4D;IAC5D,KAAK,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B;2EACuE;IACvE,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACzB,4CAA4C;IAC5C,KAAK,IAAI,IAAI,CAAC;IACd,2CAA2C;IAC3C,IAAI,IAAI,IAAI,CAAC;CACd;AAED,MAAM,WAAW,0BAA0B;IACzC,QAAQ,CAAC,OAAO,EAAE,mBAAmB,CAAC;IACtC;gFAC4E;IAC5E,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,yDAAyD;IACzD,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,IAAI,EAAE,EAAE,EAAE,MAAM,KAAK,UAAU,CAAC,OAAO,WAAW,CAAC,CAAC;IACtF,QAAQ,CAAC,aAAa,CAAC,EAAE,CAAC,MAAM,EAAE,UAAU,CAAC,OAAO,WAAW,CAAC,KAAK,IAAI,CAAC;CAC3E;AAED;;;;;GAKG;AACH,wBAAgB,0BAA0B,CACxC,MAAM,EAAE,0BAA0B,GACjC,oBAAoB,CA4DtB;AAED;;;;;;;GAOG;AACH,wBAAgB,gBAAgB,CAC9B,QAAQ,EAAE,oBAAoB,GAAG,IAAI,EACrC,IAAI,EAAE,MAAM,GAAG,SAAS,EACxB,WAAW,EAAE,OAAO,GACnB,OAAO,CAGT;AAED;;;;;;;;GAQG;AACH,wBAAgB,kBAAkB,CAChC,UAAU,EAAE,SAAS,EACrB,cAAc,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GACxC,SAAS,CAIX"}
+{"version":3,"file":"task-settings.d.ts","sourceRoot":"","sources":["../../src/settings/task-settings.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAG3C;0EAC0E;AAC1E,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,2EAA2E;IAC3E,QAAQ,CAAC,iBAAiB,EAAE,OAAO,GAAG,IAAI,CAAC;IAC3C,QAAQ,CAAC,gBAAgB,EAAE,OAAO,CAAC;IACnC,QAAQ,CAAC,KAAK,EAAE,SAAS,CAAC;CAC3B;AAED;;;uCAGuC;AACvC,eAAO,MAAM,qBAAqB,EAAE,YAKnC,CAAC;AAEF;;;;iFAIiF;AACjF,MAAM,MAAM,eAAe,GAAG,KAAK,GAAG,UAAU,GAAG,SAAS,CAAC;AAE7D;;;2EAG2E;AAC3E,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,QAAQ,EAAE,YAAY,CAAC;IAChC,4EAA4E;IAC5E,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;CAC/B;AAED;;;2EAG2E;AAC3E,MAAM,WAAW,mBAAmB;IAClC,KAAK,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,uBAAuB,GAAG,IAAI,CAAC,CAAC;CAC9D;AAED;;;+DAG+D;AAC/D,MAAM,WAAW,iBAAiB;IAChC,KAAK,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,GAAG,IAAI,CAAC,CAAC;CACvD;AAED,MAAM,WAAW,oBAAoB;IACnC;sFACkF;IAClF,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,YAAY,CAAC;IAChC;oEACgE;IAChE,QAAQ,IAAI,WAAW,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;IAC9C;;;sFAGkF;IAClF,OAAO,IAAI,eAAe,GAAG,IAAI,CAAC;IAClC,kFAAkF;IAClF,KAAK,IAAI,MAAM,GAAG,IAAI,CAAC;IACvB;;gEAE4D;IAC5D,KAAK,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B;4EACwE;IACxE,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACzB,4CAA4C;IAC5C,KAAK,IAAI,IAAI,CAAC;IACd,2CAA2C;IAC3C,IAAI,IAAI,IAAI,CAAC;CACd;AAED,MAAM,WAAW,0BAA0B;IACzC,QAAQ,CAAC,OAAO,EAAE,mBAAmB,CAAC;IACtC;kFAC8E;IAC9E,QAAQ,CAAC,cAAc,CAAC,EAAE,iBAAiB,CAAC;IAC5C;gFAC4E;IAC5E,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,yDAAyD;IACzD,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,IAAI,EAAE,EAAE,EAAE,MAAM,KAAK,UAAU,CAAC,OAAO,WAAW,CAAC,CAAC;IACtF,QAAQ,CAAC,aAAa,CAAC,EAAE,CAAC,MAAM,EAAE,UAAU,CAAC,OAAO,WAAW,CAAC,KAAK,IAAI,CAAC;CAC3E;AAED;;;;;GAKG;AACH,wBAAgB,0BAA0B,CACxC,MAAM,EAAE,0BAA0B,GACjC,oBAAoB,CA4FtB;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,gBAAgB,CAC9B,QAAQ,EAAE,oBAAoB,GAAG,IAAI,EACrC,IAAI,EAAE,MAAM,GAAG,SAAS,EACxB,WAAW,EAAE,OAAO,GACnB,OAAO,CAKT;AAED;;;;;;;;GAQG;AACH,wBAAgB,kBAAkB,CAChC,UAAU,EAAE,SAAS,EACrB,cAAc,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GACxC,SAAS,CAIX"}

package/dist/settings/task-settings.js

@@ -51,13 +51,21 @@ function createTaskSettingsResolver(config) {
     const setIntervalFn = config.setInterval ?? setInterval;
     const clearIntervalFn = config.clearInterval ?? clearInterval;
     let timer = null;
-    /** Pull one task and fold the result into the cache. Fail-open: a thrown
-     * error or a null result is swallowed and the cache is left untouched. */
+    // Org identity + posture learned from the control plane (P15). Fail-open: both
+    // stay null until a pull lands, and a null posture read leaves last-known.
+    let orgId = null;
+    let posture = null;
+    /** Pull one task and fold the result into the cache. Also learns the org id
+     * the server echoed, so the org-posture read can be addressed. Fail-open: a
+     * thrown error or a null result is swallowed and the cache is left untouched. */
     async function pull(task) {
         try {
-            const settings = await config.fetcher.fetch(task);
-            if (settings !== null)
-                cache.set(task, settings);
+            const result = await config.fetcher.fetch(task);
+            if (result !== null) {
+                cache.set(task, result.settings);
+                if (result.orgId !== null)
+                    orgId = result.orgId;
+            }
         }
         catch {
             // Fail-open: keep the last-known value. A settings read must never take a
@@ -65,6 +73,21 @@ function createTaskSettingsResolver(config) {
             // noise. The value simply does not advance until the plane answers again.
         }
     }
+    /** Re-read the org posture once the org id is known. Fail-open: a null result
+     * (unreadable/unreachable) leaves the last-known posture — a transient control
+     * plane blip must not silently stop capture; the server ingest gate backstops. */
+    async function pullPosture() {
+        if (config.postureFetcher === undefined || orgId === null)
+            return;
+        try {
+            const p = await config.postureFetcher.fetch(orgId);
+            if (p !== null)
+                posture = p;
+        }
+        catch {
+            // Fail-open to last-known.
+        }
+    }
     return {
         get(task) {
             return cache.get(task) ?? exports.DEFAULT_TASK_SETTINGS;
@@ -72,18 +95,27 @@ function createTaskSettingsResolver(config) {
         snapshot() {
             return new Map(cache);
         },
+        posture() {
+            return posture;
+        },
+        orgId() {
+            return orgId;
+        },
         track(task) {
             if (tracked.has(task))
                 return;
             tracked.add(task);
             // First sighting: pull now so the value is fresh as soon as possible,
-            // rather than waiting up to a full interval. Fire-and-forget.
-            void pull(task);
+            // rather than waiting up to a full interval. The posture read chains off
+            // the org id this pull learns. Fire-and-forget.
+            void pull(task).then(() => pullPosture());
         },
         async refresh() {
             // Settle all, never reject — one task's failure must not abort the others'
-            // refresh (Promise.allSettled, though each pull already swallows its own).
+            // refresh (each pull already swallows its own). Re-read the posture after,
+            // so a console posture flip is honored within one interval (like capture).
             await Promise.all([...tracked].map((t) => pull(t)));
+            await pullPosture();
         },
         start() {
             if (timer !== null)
@@ -104,15 +136,24 @@ function createTaskSettingsResolver(config) {
     };
 }
 /**
- * The EFFECTIVE capture flag for a run (spec §1.5 precedence). When a control
- * plane is configured (resolver present) it WINS: the YAML flag is ignored
- * entirely — deprecated, warned about at load (routes/loader.ts). Only a
+ * The EFFECTIVE capture flag for a run (spec §1.5 precedence + P15 org floor).
+ * When a control plane is configured (resolver present) it WINS: the YAML flag is
+ * ignored entirely — deprecated, warned about at load (routes/loader.ts). Only a
  * local-only rig (resolver null) lets the YAML flag govern. A run with no task
  * identity to key on (`opts.task` absent) falls back to YAML even in api mode,
  * because there is no control-plane row to resolve.
+ *
+ * The ORG posture is a FLOOR above the per-task flag (P15): an `off` org captures
+ * nothing regardless of any task's `capture`, so a resolved `off` posture forces
+ * this false (no wasted work). A null/unresolved posture leaves the per-task flag
+ * to decide (fail-OPEN; the server ingest gate is the authoritative backstop).
  */
 function effectiveCapture(resolver, task, yamlCapture) {
-    if (resolver === null || task === undefined)
+    if (resolver === null)
+        return yamlCapture;
+    if (resolver.posture() === "off")
+        return false; // org opt-out floor
+    if (task === undefined)
         return yamlCapture;
     return resolver.get(task).capture;
 }

package/dist/status.d.ts

@@ -12,12 +12,13 @@
  * one banner line to stderr — kept here so index.ts calls it in a single line.
  */
 import type { RigConfig } from "./config";
-import type { TaskSettings } from "./settings/task-settings";
+import type { ArtifactPosture, TaskSettings } from "./settings/task-settings";
 import type { RunsRecorded } from "./status-runs";
 export type ExportMode = "api" | "direct" | "local-only";
 export interface ArtifactsPosture {
     readonly enabled: boolean;
-    /** A human sentence naming WHY — so a flipped default is observable. */
+    /** A human sentence naming WHY — so the posture and its SOURCE (account
+     * settings, never an env var — P15) are observable without reading source. */
     readonly reason: string;
 }
 export interface RigStatus {
@@ -54,27 +55,32 @@ export interface CachePosture {
 export declare function cachePosture(): CachePosture;
 export declare function exportModeOf(config: RigConfig): ExportMode;
 /**
- * The artifact-namespace posture as a boolean + a reason, derivable from config
- * ALONE (so both the banner and `/status` agree). The four cases the §2 flip
- * creates, each named honestly:
- *   on  + control plane → the default is now on (a sink exists to ship to)
- *   on  + local-only    → an explicit MODELRIG_ARTIFACTS opt-in
- *   off + control plane → an explicit MODELRIG_ARTIFACTS=0 opt-out
- *   off + local-only    → nothing to ship to; off is the local-only default
+ * The artifact-namespace posture as a boolean + a reason (P15 CP-3). The on/off
+ * SOURCE is the ORG's account posture (`artifact_posture`), resolved from the
+ * control plane — never an env var. The cases, each named honestly:
+ *   control plane, posture off      → capture off — your account settings
+ *   control plane, posture managed/metadata → capture on — your account settings
+ *   control plane, posture resolving (null) → capture on — account settings (resolving)
+ *   local-only, dev force-on        → MODELRIG_ARTIFACTS=1 (dev-only, local rig)
+ *   local-only, off                 → nothing to ship to; off is the local default
+ * `posture` is the resolver's current value (null until the first run resolves
+ * it, or always null for local-only / hand-built configs).
  */
-export declare function artifactsPosture(config: RigConfig): ArtifactsPosture;
-/** Build the full status snapshot from config + the resolver's per-task cache,
- * plus (GS-1) an optional runs-recorded summary read from the local buffer. */
-export declare function buildRigStatus(config: RigConfig, tasks?: ReadonlyMap<string, TaskSettings>, runs?: RunsRecorded | null): RigStatus;
-/** The one-line boot banner (§2). Concise on purpose — mode, artifacts (+why),
- * content, otlp. */
-export declare function formatBootBanner(config: RigConfig): string;
+export declare function artifactsPosture(config: RigConfig, posture?: ArtifactPosture | null): ArtifactsPosture;
+/** Build the full status snapshot from config + the resolver's per-task cache and
+ * org posture (P15), plus (GS-1) an optional runs-recorded summary from the buffer. */
+export declare function buildRigStatus(config: RigConfig, tasks?: ReadonlyMap<string, TaskSettings>, runs?: RunsRecorded | null, posture?: ArtifactPosture | null): RigStatus;
+/** The one-line boot banner (§2 + P15). Concise on purpose — mode, artifacts
+ * (+source), content, otlp. `posture` is null at boot (resolves on the first run),
+ * so the banner names the SOURCE (account settings) rather than a stale value. */
+export declare function formatBootBanner(config: RigConfig, posture?: ArtifactPosture | null): string;
 /**
  * Emit the boot banner to stderr — ONCE at rig construction, and ONLY when a
- * control plane is configured (the case where the §2 default flip is in effect
- * and the posture is non-obvious). A pure local-only rig with artifacts off is
- * the boring, expected default and stays silent (no banner noise in tests or
- * embedders). Stderr, so it never pollutes a command's stdout.
+ * control plane is configured (the case where capture is on by default and the
+ * posture — resolved from account settings — is non-obvious). A pure local-only
+ * rig with artifacts off is the boring, expected default and stays silent (no
+ * banner noise in tests or embedders). Stderr, so it never pollutes stdout.
+ * Posture is null at boot; the banner names its source (account settings).
  */
 export declare function emitBootBanner(config: RigConfig): void;
 /** Render a `/status` report as multi-line text for the CLI. */

package/dist/status.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"status.d.ts","sourceRoot":"","sources":["../src/status.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AAC1C,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AAE7D,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAElD,MAAM,MAAM,UAAU,GAAG,KAAK,GAAG,QAAQ,GAAG,YAAY,CAAC;AAEzD,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,wEAAwE;IACxE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,UAAU,EAAE,UAAU,CAAC;IAChC,QAAQ,CAAC,SAAS,EAAE,gBAAgB,CAAC;IACrC,gFAAgF;IAChF,QAAQ,CAAC,cAAc,EAAE,OAAO,CAAC;IACjC,QAAQ,CAAC,IAAI,EAAE,YAAY,GAAG,UAAU,CAAC;IACzC;;;qFAGiF;IACjF,QAAQ,CAAC,KAAK,EAAE,YAAY,CAAC;IAC7B;gEAC4D;IAC5D,QAAQ,CAAC,KAAK,EAAE,aAAa,CAAC;QAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;KAAE,GAAG,YAAY,CAAC,CAAC;IACxE;iFAC6E;IAC7E,QAAQ,CAAC,IAAI,CAAC,EAAE,YAAY,CAAC;CAC9B;AAED,MAAM,WAAW,YAAY;IAC3B;6BACyB;IACzB,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B;8EAC0E;IAC1E,QAAQ,CAAC,iBAAiB,EAAE,SAAS,MAAM,EAAE,CAAC;CAC/C;AAED;;0EAE0E;AAC1E,wBAAgB,YAAY,IAAI,YAAY,CAI3C;AAED,wBAAgB,YAAY,CAAC,MAAM,EAAE,SAAS,GAAG,UAAU,CAE1D;AAED;;;;;;;;GAQG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,SAAS,GAAG,gBAAgB,CAapE;AAED;+EAC+E;AAC/E,wBAAgB,cAAc,CAC5B,MAAM,EAAE,SAAS,EACjB,KAAK,GAAE,WAAW,CAAC,MAAM,EAAE,YAAY,CAAa,EACpD,IAAI,CAAC,EAAE,YAAY,GAAG,IAAI,GACzB,SAAS,CAUX;AAED;oBACoB;AACpB,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,SAAS,GAAG,MAAM,CAS1D;AAED;;;;;;GAMG;AACH,wBAAgB,cAAc,CAAC,MAAM,EAAE,SAAS,GAAG,IAAI,CAGtD;AAED,gEAAgE;AAChE,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,SAAS,GAAG,MAAM,CAiC5D"}
+{"version":3,"file":"status.d.ts","sourceRoot":"","sources":["../src/status.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AAC1C,OAAO,KAAK,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AAE9E,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAElD,MAAM,MAAM,UAAU,GAAG,KAAK,GAAG,QAAQ,GAAG,YAAY,CAAC;AAEzD,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B;kFAC8E;IAC9E,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,UAAU,EAAE,UAAU,CAAC;IAChC,QAAQ,CAAC,SAAS,EAAE,gBAAgB,CAAC;IACrC,gFAAgF;IAChF,QAAQ,CAAC,cAAc,EAAE,OAAO,CAAC;IACjC,QAAQ,CAAC,IAAI,EAAE,YAAY,GAAG,UAAU,CAAC;IACzC;;;qFAGiF;IACjF,QAAQ,CAAC,KAAK,EAAE,YAAY,CAAC;IAC7B;gEAC4D;IAC5D,QAAQ,CAAC,KAAK,EAAE,aAAa,CAAC;QAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;KAAE,GAAG,YAAY,CAAC,CAAC;IACxE;iFAC6E;IAC7E,QAAQ,CAAC,IAAI,CAAC,EAAE,YAAY,CAAC;CAC9B;AAED,MAAM,WAAW,YAAY;IAC3B;6BACyB;IACzB,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B;8EAC0E;IAC1E,QAAQ,CAAC,iBAAiB,EAAE,SAAS,MAAM,EAAE,CAAC;CAC/C;AAED;;0EAE0E;AAC1E,wBAAgB,YAAY,IAAI,YAAY,CAI3C;AAED,wBAAgB,YAAY,CAAC,MAAM,EAAE,SAAS,GAAG,UAAU,CAE1D;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,gBAAgB,CAC9B,MAAM,EAAE,SAAS,EACjB,OAAO,GAAE,eAAe,GAAG,IAAW,GACrC,gBAAgB,CAkBlB;AAWD;uFACuF;AACvF,wBAAgB,cAAc,CAC5B,MAAM,EAAE,SAAS,EACjB,KAAK,GAAE,WAAW,CAAC,MAAM,EAAE,YAAY,CAAa,EACpD,IAAI,CAAC,EAAE,YAAY,GAAG,IAAI,EAC1B,OAAO,GAAE,eAAe,GAAG,IAAW,GACrC,SAAS,CAUX;AAED;;kFAEkF;AAClF,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,SAAS,EAAE,OAAO,GAAE,eAAe,GAAG,IAAW,GAAG,MAAM,CASlG;AAED;;;;;;;GAOG;AACH,wBAAgB,cAAc,CAAC,MAAM,EAAE,SAAS,GAAG,IAAI,CAGtD;AAED,gEAAgE;AAChE,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,SAAS,GAAG,MAAM,CAiC5D"}