modelrig 0.9.0 → 0.10.0

package/dist/telemetry/ingest-protocol.d.ts

@@ -31,6 +31,7 @@
  * holds a credential that can write any row in the database.
  */
 import type { FailureClass } from "../types/failures";
+import type { EvalCaseOrigin } from "../types/telemetry";
 import type { ResolvedRouteBundle } from "../routes/resolved-bundle";
 export { foreignOrgGrades } from "./grade-mappers";
 /** The path the api sink posts to. Spelled once. */
@@ -129,6 +130,20 @@ export interface WireGrade {
     readonly ts: string | null;
     /** The grade's OWN org, when it differs from the exporter's (feedback doctrine). */
     readonly org_id?: string;
+    /** OPTIONAL per-criterion breakdown (call-qa F4). Carried on the wire so a
+     * client-recorded HUMAN scorecard reaches the server, which fans it out to
+     * `grade_criteria` (kind=human) after the parent grades row lands. NOT written
+     * to `public.grades` (no column there — `gradeToRow` drops it). Absent ⇒ a
+     * single-score grade. `turn_id` is optional on each evidence citation. */
+    readonly criteria?: readonly {
+        readonly id: string;
+        readonly score: number;
+        readonly evidence?: readonly {
+            readonly quote: string;
+            readonly turn_id?: number;
+        }[];
+        readonly comment?: string;
+    }[];
 }
 export interface WireEnvelope {
     readonly envelope_key: string;
@@ -244,7 +259,7 @@ export interface WireEvalCase {
     readonly task: string;
     readonly source_artifact_id: string;
     readonly corrected_artifact_id: string | null;
-    readonly origin: "promoted-failure" | "human-corrected" | "manual";
+    readonly origin: EvalCaseOrigin;
     readonly note: string | null;
     readonly created_by: string | null;
 }
@@ -305,7 +320,16 @@ export interface TableWrite {
  * telemetry row. If you are about to add a table to the export, add it here
  * and both modes gain it at once — which is the point.
  */
-export declare function stampBatch(batch: IngestBatch, tenancy: Tenancy): TableWrite[];
+/** How `stampBatch` treats route bundles. `declaredBundles` (the HOSTED ingest,
+ * RV-1): a bundle that arrived over `/v1/ingest` is stored as route CONFIG with
+ * `synced_at = null` — readable for pins/effective/bake-offs, but never picked
+ * by the hosted gateway, which serves only `synced_at`-stamped bundles (written
+ * by a trusted sync path). An `ingest`-scoped key must not decide what the
+ * gateway serves. Absent ⇒ the direct-mode behaviour (`synced_at = now`). */
+export interface StampOptions {
+    readonly declaredBundles?: boolean;
+}
+export declare function stampBatch(batch: IngestBatch, tenancy: Tenancy, opts?: StampOptions): TableWrite[];
 /** What `/v1/ingest` answers. Counts only — a per-row error list on a
  * fire-and-forget telemetry path is a payload nobody reads and a leak surface
  * nobody audits. */

package/dist/telemetry/ingest-protocol.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ingest-protocol.d.ts","sourceRoot":"","sources":["../../src/telemetry/ingest-protocol.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACtD,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AAIrE,OAAO,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AAEnD,oDAAoD;AACpD,eAAO,MAAM,WAAW,eAAe,CAAC;AAExC;;;;6DAI6D;AAC7D,eAAO,MAAM,uBAAuB,IAAI,CAAC;AAEzC;;+EAE+E;AAC/E,eAAO,MAAM,0BAA0B,IAAI,CAAC;AAE5C,kEAAkE;AAClE,eAAO,MAAM,kBAAkB,4BAA4B,CAAC;AAE5D;kBACkB;AAClB,MAAM,WAAW,OAAO;IACtB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IACnC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAED,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;IACnC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,QAAQ,CAAC,aAAa,EAAE,YAAY,GAAG,IAAI,CAAC;IAC5C,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;IAC3B,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IACvB,QAAQ,CAAC,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IACzC,QAAQ,CAAC,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IACvC,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IACpC,QAAQ,CAAC,eAAe,EAAE,OAAO,CAAC;IAClC;;;+EAG2E;IAC3E,QAAQ,CAAC,kBAAkB,CAAC,EAAE,MAAM,CAAC;IACrC,QAAQ,CAAC,qBAAqB,CAAC,EAAE,MAAM,CAAC;IACxC,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACnC,QAAQ,CAAC,kBAAkB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5C;;;2EAGuE;IACvE,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC;IAClC;;;;;mEAK+D;IAC/D,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC;IACxB;;;;;;oDAMgD;IAChD,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC;CACzB;AAED;;;;;;GAMG;AACH,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,YAAY,EAAE,WAAW,GAAG,KAAK,GAAG,UAAU,CAAC;IACxD,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IACpC,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,QAAQ,CAAC,IAAI,EAAE,OAAO,GAAG,aAAa,GAAG,eAAe,CAAC;IACzD,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IACnC,QAAQ,CAAC,EAAE,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,oFAAoF;IACpF,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,WAAW,CAAC;CACvC;AAED,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,UAAU,EAAE,aAAa,CAAC;QAAE,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC1F,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B;;;;2EAIuE;IACvE,QAAQ,CAAC,MAAM,CAAC,EAAE,mBAAmB,CAAC;IACtC;sBACkB;IAClB,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;CAC9B;AAED;;oDAEoD;AACpD,MAAM,WAAW,OAAO;IACtB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IACzC,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IACpC,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IACpC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,QAAQ,CAAC,MAAM,EAAE,SAAS,GAAG,WAAW,GAAG,QAAQ,GAAG,WAAW,CAAC;IAClE;;kFAE8E;IAC9E,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC;CACzB;AAED;;;;;oEAKoE;AACpE,MAAM,WAAW,QAAQ;IACvB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,QAAQ,CAAC,UAAU,EAAE,cAAc,GAAG,UAAU,CAAC;IACjD,QAAQ,CAAC,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IACrC,QAAQ,CAAC,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IACtC,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,QAAQ,CAAC,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IACtC;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC;CAC7B;AAED;;oEAEoE;AACpE,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IACnC,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,sBAAsB,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/C,QAAQ,CAAC,eAAe,EAAE,OAAO,CAAC;IAClC,QAAQ,CAAC,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IACzC,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IACpC,QAAQ,CAAC,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IACrC,QAAQ,CAAC,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IACtC,QAAQ,CAAC,mBAAmB,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5C,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IACnC;;;yEAGqE;IACrE,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC;CAC1B;AAED,8DAA8D;AAC9D,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAClC,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,IAAI,EAAE,UAAU,GAAG,cAAc,CAAC;CAC5C;AAED;;;;kBAIkB;AAClB,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAC;IACpC,QAAQ,CAAC,qBAAqB,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9C,QAAQ,CAAC,MAAM,EAAE,kBAAkB,GAAG,iBAAiB,GAAG,QAAQ,CAAC;IACnE,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;CACpC;AAED,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC;IAC7B,QAAQ,CAAC,YAAY,EAAE,OAAO,CAAC;IAC/B,QAAQ,CAAC,YAAY,EAAE,SAAS,OAAO,EAAE,CAAC;IAC1C;;;;wBAIoB;IACpB,QAAQ,CAAC,WAAW,CAAC,EAAE,SAAS,OAAO,EAAE,CAAC;CAC3C;AAED;gDACgD;AAChD,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,CAAC,EAAE,MAAM,CAAC;IACnB;;8CAE0C;IAC1C,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,UAAU,CAAC,EAAE,SAAS,aAAa,EAAE,CAAC;IAC/C;2CACuC;IACvC,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,SAAS,EAAE,CAAC;IACvC,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,YAAY,EAAE,CAAC;IAC7C,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,SAAS,EAAE,CAAC;IACvC;gFAC4E;IAC5E,QAAQ,CAAC,IAAI,CAAC,EAAE,SAAS,OAAO,EAAE,CAAC;IACnC,QAAQ,CAAC,KAAK,CAAC,EAAE,SAAS,QAAQ,EAAE,CAAC;IACrC,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,YAAY,EAAE,CAAC;IAC7C,QAAQ,CAAC,cAAc,CAAC,EAAE,SAAS,gBAAgB,EAAE,CAAC;IACtD;oFACgF;IAChF,QAAQ,CAAC,UAAU,CAAC,EAAE,SAAS,YAAY,EAAE,CAAC;IAC9C,QAAQ,CAAC,QAAQ,CAAC,EAAE,YAAY,CAAC;IACjC,2EAA2E;IAC3E,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;CAC/B;AAED;mEACmE;AACnE,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,IAAI,EAAE,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC;IAClD,0DAA0D;IAC1D,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B;2EACuE;IACvE,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;CACzB;AAED;;;;;;GAMG;AACH,wBAAgB,UAAU,CAAC,KAAK,EAAE,WAAW,EAAE,OAAO,EAAE,OAAO,GAAG,UAAU,EAAE,CAsR7E;AAED;;oBAEoB;AACpB,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IACpD,QAAQ,CAAC,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IACnD;qCACiC;IACjC,QAAQ,CAAC,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;CACpD"}
+{"version":3,"file":"ingest-protocol.d.ts","sourceRoot":"","sources":["../../src/telemetry/ingest-protocol.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACtD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AACzD,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AAIrE,OAAO,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AAEnD,oDAAoD;AACpD,eAAO,MAAM,WAAW,eAAe,CAAC;AAExC;;;;6DAI6D;AAC7D,eAAO,MAAM,uBAAuB,IAAI,CAAC;AAEzC;;+EAE+E;AAC/E,eAAO,MAAM,0BAA0B,IAAI,CAAC;AAE5C,kEAAkE;AAClE,eAAO,MAAM,kBAAkB,4BAA4B,CAAC;AAE5D;kBACkB;AAClB,MAAM,WAAW,OAAO;IACtB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IACnC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAED,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;IACnC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,QAAQ,CAAC,aAAa,EAAE,YAAY,GAAG,IAAI,CAAC;IAC5C,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;IAC3B,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IACvB,QAAQ,CAAC,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IACzC,QAAQ,CAAC,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IACvC,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IACpC,QAAQ,CAAC,eAAe,EAAE,OAAO,CAAC;IAClC;;;+EAG2E;IAC3E,QAAQ,CAAC,kBAAkB,CAAC,EAAE,MAAM,CAAC;IACrC,QAAQ,CAAC,qBAAqB,CAAC,EAAE,MAAM,CAAC;IACxC,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACnC,QAAQ,CAAC,kBAAkB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5C;;;2EAGuE;IACvE,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC;IAClC;;;;;mEAK+D;IAC/D,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC;IACxB;;;;;;oDAMgD;IAChD,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC;CACzB;AAED;;;;;;GAMG;AACH,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,YAAY,EAAE,WAAW,GAAG,KAAK,GAAG,UAAU,CAAC;IACxD,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IACpC,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,QAAQ,CAAC,IAAI,EAAE,OAAO,GAAG,aAAa,GAAG,eAAe,CAAC;IACzD,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IACnC,QAAQ,CAAC,EAAE,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,oFAAoF;IACpF,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB;;;;8EAI0E;IAC1E,QAAQ,CAAC,QAAQ,CAAC,EAAE,SAAS;QAC3B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;QACpB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;QACvB,QAAQ,CAAC,QAAQ,CAAC,EAAE,SAAS;YAAE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;YAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAA;SAAE,EAAE,CAAC;QACrF,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;KAC3B,EAAE,CAAC;CACL;AAED,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,WAAW,CAAC;CACvC;AAED,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,UAAU,EAAE,aAAa,CAAC;QAAE,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC1F,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B;;;;2EAIuE;IACvE,QAAQ,CAAC,MAAM,CAAC,EAAE,mBAAmB,CAAC;IACtC;sBACkB;IAClB,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;CAC9B;AAED;;oDAEoD;AACpD,MAAM,WAAW,OAAO;IACtB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IACzC,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IACpC,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IACpC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,QAAQ,CAAC,MAAM,EAAE,SAAS,GAAG,WAAW,GAAG,QAAQ,GAAG,WAAW,CAAC;IAClE;;kFAE8E;IAC9E,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC;CACzB;AAED;;;;;oEAKoE;AACpE,MAAM,WAAW,QAAQ;IACvB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,QAAQ,CAAC,UAAU,EAAE,cAAc,GAAG,UAAU,CAAC;IACjD,QAAQ,CAAC,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IACrC,QAAQ,CAAC,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IACtC,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,QAAQ,CAAC,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IACtC;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC;CAC7B;AAED;;oEAEoE;AACpE,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IACnC,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,sBAAsB,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/C,QAAQ,CAAC,eAAe,EAAE,OAAO,CAAC;IAClC,QAAQ,CAAC,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IACzC,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IACpC,QAAQ,CAAC,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IACrC,QAAQ,CAAC,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IACtC,QAAQ,CAAC,mBAAmB,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5C,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IACnC;;;yEAGqE;IACrE,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC;CAC1B;AAED,8DAA8D;AAC9D,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAClC,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,IAAI,EAAE,UAAU,GAAG,cAAc,CAAC;CAC5C;AAED;;;;kBAIkB;AAClB,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAC;IACpC,QAAQ,CAAC,qBAAqB,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9C,QAAQ,CAAC,MAAM,EAAE,cAAc,CAAC;IAChC,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;CACpC;AAED,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC;IAC7B,QAAQ,CAAC,YAAY,EAAE,OAAO,CAAC;IAC/B,QAAQ,CAAC,YAAY,EAAE,SAAS,OAAO,EAAE,CAAC;IAC1C;;;;wBAIoB;IACpB,QAAQ,CAAC,WAAW,CAAC,EAAE,SAAS,OAAO,EAAE,CAAC;CAC3C;AAED;gDACgD;AAChD,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,CAAC,EAAE,MAAM,CAAC;IACnB;;8CAE0C;IAC1C,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,UAAU,CAAC,EAAE,SAAS,aAAa,EAAE,CAAC;IAC/C;2CACuC;IACvC,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,SAAS,EAAE,CAAC;IACvC,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,YAAY,EAAE,CAAC;IAC7C,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,SAAS,EAAE,CAAC;IACvC;gFAC4E;IAC5E,QAAQ,CAAC,IAAI,CAAC,EAAE,SAAS,OAAO,EAAE,CAAC;IACnC,QAAQ,CAAC,KAAK,CAAC,EAAE,SAAS,QAAQ,EAAE,CAAC;IACrC,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,YAAY,EAAE,CAAC;IAC7C,QAAQ,CAAC,cAAc,CAAC,EAAE,SAAS,gBAAgB,EAAE,CAAC;IACtD;oFACgF;IAChF,QAAQ,CAAC,UAAU,CAAC,EAAE,SAAS,YAAY,EAAE,CAAC;IAC9C,QAAQ,CAAC,QAAQ,CAAC,EAAE,YAAY,CAAC;IACjC,2EAA2E;IAC3E,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;CAC/B;AAED;mEACmE;AACnE,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,IAAI,EAAE,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC;IAClD,0DAA0D;IAC1D,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B;2EACuE;IACvE,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;CACzB;AAED;;;;;;GAMG;AACH;;;;;6EAK6E;AAC7E,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,eAAe,CAAC,EAAE,OAAO,CAAC;CACpC;AAED,wBAAgB,UAAU,CAAC,KAAK,EAAE,WAAW,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,GAAE,YAAiB,GAAG,UAAU,EAAE,CA+RtG;AAED;;oBAEoB;AACpB,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IACpD,QAAQ,CAAC,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IACnD;qCACiC;IACjC,QAAQ,CAAC,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;CACpD"}

package/dist/telemetry/ingest-protocol.js

@@ -52,14 +52,7 @@ exports.INGEST_PROTOCOL_VERSION = 2;
 exports.INGEST_PROTOCOL_VERSION_V1 = 1;
 /** Default ingest host — telemetry-ingestion-boundary.md §2.1. */
 exports.DEFAULT_INGEST_URL = "https://api.modelrig.ai";
-/**
- * Turn a batch plus a tenant into the writes it becomes.
- *
- * THE conformance seam. Both transports call this; nothing else builds a
- * telemetry row. If you are about to add a table to the export, add it here
- * and both modes gain it at once — which is the point.
- */
-function stampBatch(batch, tenancy) {
+function stampBatch(batch, tenancy, opts = {}) {
     const writes = [];
     const now = new Date().toISOString();
     if (batch.routes !== undefined && batch.routes.length > 0) {
@@ -103,28 +96,38 @@ function stampBatch(batch, tenancy) {
             merge: true,
             rows: taskRows,
         });
-        writes.push({
-            table: "routes",
-            onConflict: "org_id,route,version",
-            merge: true,
-            rows: batch.routes.map((r) => ({
-                org_id: tenancy.org_id,
-                route: r.route,
-                version: r.version,
-                candidates: r.candidates,
-                capture: r.capture,
-                updated_at: now,
-                // Phase D (spec §13): the resolved bundle + its hash + the sync stamp.
-                // Written only when the batch carries a bundle, so an older SDK's
-                // metadata-only mirror leaves any existing bundle intact (a merge
-                // upsert touches only the columns present in the row). `synced_at` is
-                // the BUNDLE's timestamp — stamped iff a bundle synced — distinct from
-                // `updated_at`, the row's metadata timestamp.
-                ...(r.bundle !== undefined
-                    ? { bundle: r.bundle, bundle_sha: r.bundle_sha ?? null, synced_at: now }
-                    : {}),
-            })),
+        const routeRow = (r) => ({
+            org_id: tenancy.org_id,
+            route: r.route,
+            version: r.version,
+            candidates: r.candidates,
+            capture: r.capture,
+            updated_at: now,
+            // Phase D (spec §13): the resolved bundle + its hash + the sync stamp.
+            // Written only when the route carries a bundle, so an older SDK's
+            // metadata-only mirror leaves any existing bundle intact (a merge
+            // upsert touches only the columns present in the row). `synced_at` is
+            // the BUNDLE's timestamp — stamped iff a bundle synced through a trusted
+            // path — distinct from `updated_at`, the row's metadata timestamp.
+            ...(r.bundle !== undefined
+                ? { bundle: r.bundle, bundle_sha: r.bundle_sha ?? null, synced_at: opts.declaredBundles === true ? null : now }
+                : {}),
         });
+        // TWO writes, split by bundle presence: a PostgREST bulk insert requires
+        // every row to carry the SAME keys (PGRST102), so one route whose bundle was
+        // dropped must not fail — or null out — its neighbours' bundles.
+        const withBundle = batch.routes.filter((r) => r.bundle !== undefined);
+        const withoutBundle = batch.routes.filter((r) => r.bundle === undefined);
+        for (const group of [withBundle, withoutBundle]) {
+            if (group.length === 0)
+                continue;
+            writes.push({
+                table: "routes",
+                onConflict: "org_id,route,version",
+                merge: true,
+                rows: group.map(routeRow),
+            });
+        }
     }
     if (batch.runs !== undefined && batch.runs.length > 0) {
         writes.push({

package/dist/telemetry/org-identity.d.ts

@@ -0,0 +1,44 @@
+/**
+ * The first-flush org line + the `expectOrg` mismatch signal (REL-1, ruling M5).
+ *
+ * A VALID key minted in the WRONG org is the failure the AUTH FAILED latch in
+ * sinks.ts cannot see: every POST is a 200, and the runs land in someone else's
+ * console. (Six weeks of InferWealth pipeline telemetry went to Nunexa this
+ * way.) So on the first successful flush in each process the api sink asks
+ * `GET /v1/whoami` once — through the same `whoamiPreflight` helper that
+ * `modelrig doctor` uses — and logs which org it is exporting to:
+ *
+ *   [modelrig] exporting to org «InferWealth» (inferwealth) as key «InferWealth2» …ab12
+ *
+ * With `createRig({ expectOrg: "<slug>" })` a different resolved slug logs
+ * `ORG MISMATCH` loudly on EVERY successful flush (ruling M5), because nobody
+ * reads boot logs. It is a code option, not an env var (P15).
+ *
+ * Contract: non-blocking (never awaited by the sink), once per process per
+ * key, never throws, never drops or delays telemetry. A failed whoami is
+ * SILENT: a 401 already has its own loud line, and a network blip must not
+ * become noise.
+ */
+import { type PreflightResult } from "../doctor-preflight";
+/** The whoami call is aborted after this long, so it can never hold a
+ * process open (AbortSignal.timeout's timer is unref'd by Node). */
+export declare const WHOAMI_TIMEOUT_MS = 5000;
+/** TESTS ONLY — forget every key, so "once per process" cases are independent. */
+export declare function __resetOrgIdentityForTest(): void;
+export interface OrgIdentityInput {
+    readonly ingestUrl: string;
+    readonly apiKey: string;
+    readonly expectOrg?: string;
+    readonly fetchFn: typeof fetch;
+    /** Override WHOAMI_TIMEOUT_MS (tests). */
+    readonly timeoutMs?: number;
+}
+/** Build the one-line org banner from a successful whoami. */
+export declare function formatOrgLine(result: PreflightResult, apiKey: string): string;
+/**
+ * Record one successful flush. Returns immediately; the whoami (first flush
+ * only) runs in the background. Exposed as a promise-returning helper ONLY so
+ * tests can await the background work — the sink calls it with `void`.
+ */
+export declare function noteSuccessfulFlush(input: OrgIdentityInput): Promise<void>;
+//# sourceMappingURL=org-identity.d.ts.map

package/dist/telemetry/org-identity.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"org-identity.d.ts","sourceRoot":"","sources":["../../src/telemetry/org-identity.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,OAAO,EAAwC,KAAK,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAGjG;oEACoE;AACpE,eAAO,MAAM,iBAAiB,OAAO,CAAC;AAYtC,kFAAkF;AAClF,wBAAgB,yBAAyB,IAAI,IAAI,CAEhD;AAED,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,OAAO,EAAE,OAAO,KAAK,CAAC;IAC/B,0CAA0C;IAC1C,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;CAC7B;AAED,8DAA8D;AAC9D,wBAAgB,aAAa,CAAC,MAAM,EAAE,eAAe,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAO7E;AAgBD;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,gBAAgB,GAAG,OAAO,CAAC,IAAI,CAAC,CA+B1E"}

package/dist/telemetry/org-identity.js

@@ -0,0 +1,98 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.WHOAMI_TIMEOUT_MS = void 0;
+exports.__resetOrgIdentityForTest = __resetOrgIdentityForTest;
+exports.formatOrgLine = formatOrgLine;
+exports.noteSuccessfulFlush = noteSuccessfulFlush;
+/**
+ * The first-flush org line + the `expectOrg` mismatch signal (REL-1, ruling M5).
+ *
+ * A VALID key minted in the WRONG org is the failure the AUTH FAILED latch in
+ * sinks.ts cannot see: every POST is a 200, and the runs land in someone else's
+ * console. (Six weeks of InferWealth pipeline telemetry went to Nunexa this
+ * way.) So on the first successful flush in each process the api sink asks
+ * `GET /v1/whoami` once — through the same `whoamiPreflight` helper that
+ * `modelrig doctor` uses — and logs which org it is exporting to:
+ *
+ *   [modelrig] exporting to org «InferWealth» (inferwealth) as key «InferWealth2» …ab12
+ *
+ * With `createRig({ expectOrg: "<slug>" })` a different resolved slug logs
+ * `ORG MISMATCH` loudly on EVERY successful flush (ruling M5), because nobody
+ * reads boot logs. It is a code option, not an env var (P15).
+ *
+ * Contract: non-blocking (never awaited by the sink), once per process per
+ * key, never throws, never drops or delays telemetry. A failed whoami is
+ * SILENT: a 401 already has its own loud line, and a network blip must not
+ * become noise.
+ */
+const doctor_preflight_1 = require("../doctor-preflight");
+const api_key_format_1 = require("../tenancy/api-key-format");
+/** The whoami call is aborted after this long, so it can never hold a
+ * process open (AbortSignal.timeout's timer is unref'd by Node). */
+exports.WHOAMI_TIMEOUT_MS = 5000;
+/** Keyed by ingest origin + key, so two rigs sharing a key share one whoami. */
+const states = new Map();
+/** TESTS ONLY — forget every key, so "once per process" cases are independent. */
+function __resetOrgIdentityForTest() {
+    states.clear();
+}
+/** Build the one-line org banner from a successful whoami. */
+function formatOrgLine(result, apiKey) {
+    const org = result.whoami?.org ?? null;
+    const name = org?.name ?? org?.id ?? "?";
+    const slug = org?.slug ?? "?";
+    const keyName = result.whoami?.key?.name;
+    const keyLabel = typeof keyName === "string" && keyName !== "" ? `«${keyName}» ` : "";
+    return `[modelrig] exporting to org «${name}» (${slug}) as key ${keyLabel}${(0, api_key_format_1.redactApiKey)(apiKey)}`;
+}
+function mismatchLine(actual, expectOrg) {
+    return (`[modelrig] ORG MISMATCH: key resolves to «${actual}», expectOrg is «${expectOrg}» — ` +
+        `telemetry is landing in «${actual}»`);
+}
+function warnIfMismatch(result, expectOrg) {
+    const expected = expectOrg?.trim();
+    if (expected === undefined || expected === "")
+        return;
+    const actual = (0, doctor_preflight_1.expectedOrgMismatch)(result, expected);
+    if (actual !== null)
+        console.warn(mismatchLine(actual, expected));
+}
+/**
+ * Record one successful flush. Returns immediately; the whoami (first flush
+ * only) runs in the background. Exposed as a promise-returning helper ONLY so
+ * tests can await the background work — the sink calls it with `void`.
+ */
+function noteSuccessfulFlush(input) {
+    let origin;
+    try {
+        origin = new URL(input.ingestUrl).origin;
+    }
+    catch {
+        return Promise.resolve();
+    }
+    const id = `${origin}|${input.apiKey}`;
+    let state = states.get(id);
+    if (state === undefined) {
+        state = { flushes: 0, resolved: null };
+        states.set(id, state);
+    }
+    state.flushes += 1;
+    const s = state;
+    if (s.flushes === 1) {
+        return (0, doctor_preflight_1.whoamiPreflight)(input.ingestUrl, input.apiKey, input.fetchFn, AbortSignal.timeout(input.timeoutMs ?? exports.WHOAMI_TIMEOUT_MS))
+            .then((result) => {
+            if (!result.ok)
+                return; // silent: a 401 has its own loud line
+            s.resolved = result;
+            console.log(formatOrgLine(result, input.apiKey));
+            warnIfMismatch(result, input.expectOrg);
+        })
+            .catch(() => {
+            // whoamiPreflight never throws, and logging must never break the sink.
+        });
+    }
+    // M5: loud on EVERY flush once the org is known (flush 1 warns when whoami lands).
+    if (s.resolved !== null)
+        warnIfMismatch(s.resolved, input.expectOrg);
+    return Promise.resolve();
+}

package/dist/telemetry/route-registration.d.ts

@@ -0,0 +1,48 @@
+/**
+ * RV-1 declare-on-startup — a rig with routes AND a control plane tells the
+ * control plane which routes it serves the moment it is created, so a route is
+ * visible (console, MCP `get_call_config`, `GET /v1/routes/:route/call-config
+ * ?include=effective`) BEFORE its first call.
+ *
+ * ── WHY A SEPARATE ONE-SHOT, WHEN THE EXPORTER ALREADY MIRRORS ROUTES ─────
+ * The exporter folds the routes mirror into its FIRST flush (one interval —
+ * 10s — after start). A short-lived process (a CLI, a cron, a lazily-built
+ * pipeline rig) that exits before that tick without `close()` never mirrors, and
+ * a long-lived one is invisible for the first interval. This sends the same
+ * metadata once, immediately. The exporter's header stays as the at-least-once
+ * retry path: the routes upsert is a merge on (org_id, route, version), so the
+ * duplicate is harmless.
+ *
+ * ── WHAT IT CARRIES (and does not) ────────────────────────────────────────
+ * route, version, candidates (provider/model), capture flag, AND the declared
+ * resolved bundle + its `bundle_sha` — the same payload the exporter's
+ * first-flush mirror has always carried (Matt's RV-1 ruling 1, 2026-10-10). The
+ * bundle is ROUTE CONFIGURATION (the authored prompt TEMPLATE with its
+ * placeholders, schema, candidates, policy — never per-call values); the control
+ * plane needs it so a call-config pin passes the eligibility gate (`loadBundle`)
+ * on a mirror-mode server. The server re-validates the bundle and recomputes the
+ * sha; once a PSR prompt has been promoted for the route, PSR's template wins
+ * over the declared one (modelrig-server ingest-route-config.ts). The org is
+ * never on the wire — the server stamps it from the key's principal (T3/T11).
+ * It travels through the SAME sink as telemetry, so in `api` mode it is a
+ * `POST /v1/ingest` with the rig's own key and needs only the `ingest` scope.
+ *
+ * ── FAIL-OPEN BY CONSTRUCTION ─────────────────────────────────────────────
+ * Fire-and-forget. Never awaited by createRig, never throws (sync or async),
+ * one console.warn on failure. It cannot change what THIS process serves (the
+ * SDK serves from its local bundles); it writes only the control-plane `routes`
+ * mirror, exactly as the exporter's first flush already does.
+ */
+import type { IngestBatch } from "./ingest-protocol";
+import type { ExportedRouteMirror } from "./exporter";
+import type { TelemetrySink } from "./sinks";
+/** The routes-only batch (metadata + declared bundle). v1 so any server vintage
+ * accepts it (an older server keeps the metadata and ignores the bundle). */
+export declare function buildRouteRegistrationBatch(sourceId: string, routes: readonly ExportedRouteMirror[]): IngestBatch;
+/**
+ * Register `routes` with the control plane through `sink`, once, now. Returns
+ * the in-flight promise (always resolves — for tests and callers that want to
+ * await it); createRig ignores it. No routes ⇒ no request.
+ */
+export declare function registerRoutesOnStartup(sink: TelemetrySink, sourceId: string, routes: readonly ExportedRouteMirror[]): Promise<void>;
+//# sourceMappingURL=route-registration.d.ts.map

package/dist/telemetry/route-registration.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"route-registration.d.ts","sourceRoot":"","sources":["../../src/telemetry/route-registration.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AAGH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AACrD,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC;AACtD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAE7C;6EAC6E;AAC7E,wBAAgB,2BAA2B,CACzC,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,SAAS,mBAAmB,EAAE,GACrC,WAAW,CAYb;AAED;;;;GAIG;AACH,wBAAgB,uBAAuB,CACrC,IAAI,EAAE,aAAa,EACnB,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,SAAS,mBAAmB,EAAE,GACrC,OAAO,CAAC,IAAI,CAAC,CAgBf"}

package/dist/telemetry/route-registration.js

@@ -0,0 +1,77 @@
+"use strict";
+/**
+ * RV-1 declare-on-startup — a rig with routes AND a control plane tells the
+ * control plane which routes it serves the moment it is created, so a route is
+ * visible (console, MCP `get_call_config`, `GET /v1/routes/:route/call-config
+ * ?include=effective`) BEFORE its first call.
+ *
+ * ── WHY A SEPARATE ONE-SHOT, WHEN THE EXPORTER ALREADY MIRRORS ROUTES ─────
+ * The exporter folds the routes mirror into its FIRST flush (one interval —
+ * 10s — after start). A short-lived process (a CLI, a cron, a lazily-built
+ * pipeline rig) that exits before that tick without `close()` never mirrors, and
+ * a long-lived one is invisible for the first interval. This sends the same
+ * metadata once, immediately. The exporter's header stays as the at-least-once
+ * retry path: the routes upsert is a merge on (org_id, route, version), so the
+ * duplicate is harmless.
+ *
+ * ── WHAT IT CARRIES (and does not) ────────────────────────────────────────
+ * route, version, candidates (provider/model), capture flag, AND the declared
+ * resolved bundle + its `bundle_sha` — the same payload the exporter's
+ * first-flush mirror has always carried (Matt's RV-1 ruling 1, 2026-10-10). The
+ * bundle is ROUTE CONFIGURATION (the authored prompt TEMPLATE with its
+ * placeholders, schema, candidates, policy — never per-call values); the control
+ * plane needs it so a call-config pin passes the eligibility gate (`loadBundle`)
+ * on a mirror-mode server. The server re-validates the bundle and recomputes the
+ * sha; once a PSR prompt has been promoted for the route, PSR's template wins
+ * over the declared one (modelrig-server ingest-route-config.ts). The org is
+ * never on the wire — the server stamps it from the key's principal (T3/T11).
+ * It travels through the SAME sink as telemetry, so in `api` mode it is a
+ * `POST /v1/ingest` with the rig's own key and needs only the `ingest` scope.
+ *
+ * ── FAIL-OPEN BY CONSTRUCTION ─────────────────────────────────────────────
+ * Fire-and-forget. Never awaited by createRig, never throws (sync or async),
+ * one console.warn on failure. It cannot change what THIS process serves (the
+ * SDK serves from its local bundles); it writes only the control-plane `routes`
+ * mirror, exactly as the exporter's first flush already does.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.buildRouteRegistrationBatch = buildRouteRegistrationBatch;
+exports.registerRoutesOnStartup = registerRoutesOnStartup;
+const ingest_protocol_1 = require("./ingest-protocol");
+/** The routes-only batch (metadata + declared bundle). v1 so any server vintage
+ * accepts it (an older server keeps the metadata and ignores the bundle). */
+function buildRouteRegistrationBatch(sourceId, routes) {
+    return {
+        v: ingest_protocol_1.INGEST_PROTOCOL_VERSION_V1,
+        source: sourceId,
+        routes: routes.map((r) => ({
+            route: r.route,
+            version: r.version,
+            candidates: r.candidates.map((c) => ({ provider: c.provider, model: c.model })),
+            capture: r.capture ?? false,
+            ...(r.bundle !== undefined ? { bundle: r.bundle, bundle_sha: r.bundleSha } : {}),
+        })),
+    };
+}
+/**
+ * Register `routes` with the control plane through `sink`, once, now. Returns
+ * the in-flight promise (always resolves — for tests and callers that want to
+ * await it); createRig ignores it. No routes ⇒ no request.
+ */
+function registerRoutesOnStartup(sink, sourceId, routes) {
+    if (routes.length === 0)
+        return Promise.resolve();
+    let batch;
+    try {
+        batch = buildRouteRegistrationBatch(sourceId, routes);
+    }
+    catch {
+        return Promise.resolve();
+    }
+    return Promise.resolve()
+        .then(() => sink.send(batch))
+        .catch((err) => {
+        console.warn(`[modelrig] route registration (declare-on-startup) failed — routes will still be mirrored ` +
+            `by the exporter's first flush: ${err instanceof Error ? err.message : String(err)}`);
+    });
+}

package/dist/telemetry/sinks.d.ts

@@ -21,6 +21,9 @@
  */
 import type { IngestBatch, IngestOutcome, Tenancy } from "./ingest-protocol";
 import type { ApiExportConfig, DirectExportConfig } from "../config";
+/** Reset the auth-failure latch — TESTS ONLY, so warn-once cases are independent
+ * of run order (mirrors deprecations.ts). */
+export declare function __resetApiSinkWarningsForTest(): void;
 export interface TelemetrySink {
     /** Named so a boot banner and `/status` can say which lane is live without
      * inspecting config — the "which mode am I in?" question got asked enough
@@ -77,6 +80,10 @@ export interface ApiSinkConfig {
      * rows are being dropped must hear about it from their own process rather
      * than by noticing a gap in a chart weeks later. */
     readonly onOutcome?: (outcome: IngestOutcome) => void;
+    /** `createRig({ expectOrg })` (M5): the org slug this process expects its key
+     * to resolve to. A mismatch logs ORG MISMATCH on every flush (org-identity.ts);
+     * it never throws and never drops telemetry. */
+    readonly expectOrg?: string;
 }
 export declare function createApiSink(config: ApiSinkConfig): TelemetrySink;
 /**
@@ -86,5 +93,7 @@ export declare function createApiSink(config: ApiSinkConfig): TelemetrySink;
  * index.ts until Phase D; moved here — its natural home — to keep that file
  * under the LOC cap.)
  */
-export declare function buildTelemetrySink(exportConfig: ApiExportConfig | DirectExportConfig, sourceId: string): TelemetrySink;
+export declare function buildTelemetrySink(exportConfig: ApiExportConfig | DirectExportConfig, sourceId: string, opts?: {
+    readonly expectOrg?: string;
+}): TelemetrySink;
 //# sourceMappingURL=sinks.d.ts.map

package/dist/telemetry/sinks.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sinks.d.ts","sourceRoot":"","sources":["../../src/telemetry/sinks.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAIH,OAAO,KAAK,EAAE,WAAW,EAAE,aAAa,EAAE,OAAO,EAAE,MAAM,mBAAmB,CAAC;AAC7E,OAAO,KAAK,EAAE,eAAe,EAAE,kBAAkB,EAAE,MAAM,WAAW,CAAC;AAGrE,MAAM,WAAW,aAAa;IAC5B;;yDAEqD;IACrD,QAAQ,CAAC,IAAI,EAAE,QAAQ,GAAG,KAAK,CAAC;IAChC;;6EAEyE;IACzE,IAAI,CAAC,KAAK,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACzC;AAED;;;;;;;;;;;;;;;GAeG;AACH,qBAAa,aAAc,SAAQ,KAAK;IACtC,wEAAwE;IACxE,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB;;qCAEiC;IACjC,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;gBAEhB,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,SAAS;CAMxD;AAMD,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,oEAAoE;IACpE,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,yEAAyE;IACzE,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,KAAK,CAAC;CACjC;AAED,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,gBAAgB,GAAG,aAAa,CA0CxE;AAMD,MAAM,WAAW,aAAa;IAC5B,mEAAmE;IACnE,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B;4EACwE;IACxE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,KAAK,CAAC;IAChC;;;wDAGoD;IACpD,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC,OAAO,EAAE,aAAa,KAAK,IAAI,CAAC;CACvD;AAKD,wBAAgB,aAAa,CAAC,MAAM,EAAE,aAAa,GAAG,aAAa,CA4ClE;AAED;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAChC,YAAY,EAAE,eAAe,GAAG,kBAAkB,EAClD,QAAQ,EAAE,MAAM,GACf,aAAa,CA0Bf"}
+{"version":3,"file":"sinks.d.ts","sourceRoot":"","sources":["../../src/telemetry/sinks.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAIH,OAAO,KAAK,EAAE,WAAW,EAAE,aAAa,EAAE,OAAO,EAAE,MAAM,mBAAmB,CAAC;AAC7E,OAAO,KAAK,EAAE,eAAe,EAAE,kBAAkB,EAAE,MAAM,WAAW,CAAC;AAmBrE;6CAC6C;AAC7C,wBAAgB,6BAA6B,IAAI,IAAI,CAEpD;AAED,MAAM,WAAW,aAAa;IAC5B;;yDAEqD;IACrD,QAAQ,CAAC,IAAI,EAAE,QAAQ,GAAG,KAAK,CAAC;IAChC;;6EAEyE;IACzE,IAAI,CAAC,KAAK,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACzC;AAED;;;;;;;;;;;;;;;GAeG;AACH,qBAAa,aAAc,SAAQ,KAAK;IACtC,wEAAwE;IACxE,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB;;qCAEiC;IACjC,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;gBAEhB,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,SAAS;CAMxD;AAMD,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,oEAAoE;IACpE,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,yEAAyE;IACzE,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,KAAK,CAAC;CACjC;AAED,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,gBAAgB,GAAG,aAAa,CA0CxE;AAMD,MAAM,WAAW,aAAa;IAC5B,mEAAmE;IACnE,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B;4EACwE;IACxE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,KAAK,CAAC;IAChC;;;wDAGoD;IACpD,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC,OAAO,EAAE,aAAa,KAAK,IAAI,CAAC;IACtD;;oDAEgD;IAChD,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;CAC7B;AAKD,wBAAgB,aAAa,CAAC,MAAM,EAAE,aAAa,GAAG,aAAa,CAsElE;AAED;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAChC,YAAY,EAAE,eAAe,GAAG,kBAAkB,EAClD,QAAQ,EAAE,MAAM,EAChB,IAAI,GAAE;IAAE,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAA;CAAO,GACzC,aAAa,CA2Bf"}

package/dist/telemetry/sinks.js

@@ -22,12 +22,33 @@
  */
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.SinkSendError = void 0;
+exports.__resetApiSinkWarningsForTest = __resetApiSinkWarningsForTest;
 exports.createDirectSink = createDirectSink;
 exports.createApiSink = createApiSink;
 exports.buildTelemetrySink = buildTelemetrySink;
 const node_zlib_1 = require("node:zlib");
 const ingest_protocol_1 = require("./ingest-protocol");
 const constants_1 = require("../tenancy/constants");
+const api_key_format_1 = require("../tenancy/api-key-format");
+const org_identity_1 = require("./org-identity");
+/**
+ * Auth-failure latch (once per FAILURE STREAK, not once per process).
+ *
+ * A 401/403 from ingest means the key is rejected and EVERY run is being dropped
+ * org-wide — categorically different from a single poison batch (422), and the
+ * exact silent failure that cost InferWealth days of invisible telemetry. The
+ * export path is fire-and-forget, so the only way this surfaces is a log line —
+ * and it must be loud, legible, and NOT drowned in per-batch noise. We warn ONCE
+ * and latch; a subsequent successful send clears the latch, so if the key breaks
+ * again later it re-alerts. No env var, no extra request — it rides the POST that
+ * is already failing.
+ */
+let apiAuthFailureWarned = false;
+/** Reset the auth-failure latch — TESTS ONLY, so warn-once cases are independent
+ * of run order (mirrors deprecations.ts). */
+function __resetApiSinkWarningsForTest() {
+    apiAuthFailureWarned = false;
+}
 /**
  * A sink send failed — the typed error both transports throw (E2 hardening
  * Phase 2, spec §2.3.1). It carries the HTTP status the sink observed (absent
@@ -127,14 +148,38 @@ function createApiSink(config) {
                 throw new SinkSendError("ingest POST → network error", undefined);
             }
             if (!response.ok) {
-                // Status only — never the response body. The key never appears in the
-                // message (C2's leak gate covers failure text), and an exporter's
-                // warnings are the likeliest place for a secret to reach someone else's
-                // log aggregator. The status is the exporter's transient-vs-poison
-                // signal: the server sends 422 for a deterministic control-plane
+                // A rejected KEY (401/403) is not one bad batch — it means every run is
+                // being dropped org-wide, silently. Say so, loudly, ONCE per failure
+                // streak. Safe to name here: the host is the public ingest endpoint and
+                // `redactApiKey` is the sanctioned last-four form (the same one the boot
+                // banner and `modelrig doctor` print) — never the body, never the secret.
+                if ((response.status === 401 || response.status === 403) && !apiAuthFailureWarned) {
+                    apiAuthFailureWarned = true;
+                    console.warn(`[modelrig] AUTH FAILED — telemetry is being DROPPED (${response.status} at ` +
+                        `${new URL(url).origin}, key ${(0, api_key_format_1.redactApiKey)(config.apiKey)}). MODELRIG_API_KEY is not ` +
+                        "accepted by this server/org; check the key and that it belongs to the org you expect " +
+                        "at app.modelrig.ai. Runs will not appear until this is fixed. Confirm with `modelrig doctor`.");
+                }
+                // Status only in the THROWN error — never the response body. The key never
+                // appears in the message (C2's leak gate covers failure text), and an
+                // exporter's warnings are the likeliest place for a secret to reach
+                // someone else's log aggregator. The status is the exporter's transient-
+                // vs-poison signal: the server sends 422 for a deterministic control-plane
                 // rejection, 503 for a transient one (spec §2.2/§2.3.1).
                 throw new SinkSendError(`ingest POST → ${response.status}`, response.status);
             }
+            // A good send clears the auth-failure latch, so a later key breakage
+            // re-alerts instead of staying silent behind a once-per-process guard.
+            apiAuthFailureWarned = false;
+            // M5: name the org this key exports to (first flush per process, via
+            // /v1/whoami) and log ORG MISMATCH on every flush when `expectOrg` disagrees. Fire-
+            // and-forget — never awaited, never throws, never touches the batch.
+            void (0, org_identity_1.noteSuccessfulFlush)({
+                ingestUrl: config.ingestUrl,
+                apiKey: config.apiKey,
+                fetchFn,
+                ...(config.expectOrg !== undefined ? { expectOrg: config.expectOrg } : {}),
+            });
             if (config.onOutcome !== undefined) {
                 const outcome = (await response.json().catch(() => null));
                 if (outcome !== null)
@@ -150,11 +195,12 @@ function createApiSink(config) {
  * index.ts until Phase D; moved here — its natural home — to keep that file
  * under the LOC cap.)
  */
-function buildTelemetrySink(exportConfig, sourceId) {
+function buildTelemetrySink(exportConfig, sourceId, opts = {}) {
     return exportConfig.mode === "api"
         ? createApiSink({
             ingestUrl: exportConfig.ingestUrl,
             apiKey: exportConfig.apiKey,
+            ...(opts.expectOrg !== undefined ? { expectOrg: opts.expectOrg } : {}),
             // A batch the server partly refused comes back 200. Without this, a
             // customer whose rows are being dropped would find out by noticing a
             // gap in a chart weeks later.

package/dist/telemetry/store-migrations.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"store-migrations.d.ts","sourceRoot":"","sources":["../../src/telemetry/store-migrations.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,KAAK,QAAQ,MAAM,gBAAgB,CAAC;AAG3C;sCACsC;AACtC,wBAAgB,kBAAkB,CAAC,EAAE,EAAE,QAAQ,CAAC,QAAQ,GAAG,IAAI,CAmL9D"}
+{"version":3,"file":"store-migrations.d.ts","sourceRoot":"","sources":["../../src/telemetry/store-migrations.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,KAAK,QAAQ,MAAM,gBAAgB,CAAC;AAG3C;sCACsC;AACtC,wBAAgB,kBAAkB,CAAC,EAAE,EAAE,QAAQ,CAAC,QAAQ,GAAG,IAAI,CAgM9D"}

package/dist/telemetry/store-migrations.js

@@ -193,4 +193,17 @@ function runStoreMigrations(db) {
         }
         db.pragma("user_version = 15");
     }
+    // v16 (call-qa F4): the per-criterion `criteria` column on the local `grades`
+    // table — a JSON breakdown a HUMAN scorecard carries so it can ride the wire
+    // to the server's `grade_criteria` (kind=human). Additive, nullable; old rows
+    // read null ("a single-score grade, or recorded before F4"). SCHEMA_SQL's
+    // CREATE handles a fresh database; this ALTER-if-absent gives a migrating one
+    // the column. Same pattern as v6/v13.
+    if (db.pragma("user_version", { simple: true }) < 16) {
+        const gradeCols = db.prepare("PRAGMA table_info(grades)").all();
+        if (gradeCols.length > 0 && !gradeCols.some((c) => c.name === "criteria")) {
+            db.exec("ALTER TABLE grades ADD COLUMN criteria TEXT");
+        }
+        db.pragma("user_version = 16");
+    }
 }

package/dist/tenancy/api-key-format.d.ts

@@ -53,6 +53,21 @@ export declare const API_KEY_BODY_MIN_LENGTH = 43;
  * settings needs no scope — any org-scoped key may read, since they ride the
  * already-readable orgs row.
  *
+ * `serve` (managed-serving-keyless K2, 00084): SERVE a managed inference on the
+ * hosted gateway's MANAGED mirror lane (`POST /v1/chat/completions` resolving an
+ * org's mirrored route against OUR managed provider keys). This is the first-class
+ * inference authority the mirror lane was always meant to gate on — it replaces the
+ * overloaded `oracle-act` placeholder there (gateway-routes.ts flagged that as an
+ * interim stand-in for a real inference/serve scope). It is an ORDINARY machine
+ * grant (not owner-only to mint): serving is a delegated coding-agent act, like
+ * `route-config`/`prompt-write`, not a money/deletion authority. It is DISTINCT
+ * from per-org PROVISIONING: a key may carry `serve` and still be refused because
+ * the org is not provisioned for managed serving (orgs.managed_serving_enabled,
+ * 00085) — the scope says "this key may serve", the column says "this org may".
+ * During the K2 deprecation window the mirror lane still ALSO accepts `oracle-act`
+ * so keys minted before the remint keep working; that acceptance is removed once
+ * keys are reminted with `serve`.
+ *
  * `artifact-delete` (CD-1 / R-7, 00068): DELETE an org's own stored artifact
  * CONTENT (`DELETE /v1/artifacts/:id/content`) or PURGE the record
  * (`DELETE /v1/artifacts/:id`). Held by an automation deleting on the org's
@@ -68,7 +83,7 @@ export declare const API_KEY_BODY_MIN_LENGTH = 43;
  * owner-only session gate on the routes would be decorative, since the cheapest
  * way past a role check would be to issue yourself a credential that has none.
  */
-export declare const API_KEY_SCOPES: readonly ["ingest", "query", "grade", "decision", "oracle-act", "artifact-write", "artifact-read", "task-settings", "route-config", "org-settings", "artifact-delete"];
+export declare const API_KEY_SCOPES: readonly ["ingest", "query", "grade", "decision", "oracle-act", "artifact-write", "artifact-read", "task-settings", "route-config", "org-settings", "artifact-delete", "prompt-write", "serve"];
 export type ApiKeyScope = (typeof API_KEY_SCOPES)[number];
 /** sha256 of the WHOLE presented string, prefix included — so a caller cannot
  * strip the prefix and land on a different row. */