modelrig 0.9.0 → 0.11.0

package/dist/artifacts/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/artifacts/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAElE,OAAO,KAAK,EAAE,WAAW,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC;AAGnE,OAAO,KAAK,EAAE,qBAAqB,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AAExE,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAC;AACtE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAC;AAEjE,OAAO,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AACxE,YAAY,EACV,YAAY,EACZ,SAAS,EACT,eAAe,EACf,SAAS,EACT,gBAAgB,EAChB,cAAc,EACd,oBAAoB,GACrB,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,IAAI,EAAE,MAAM,QAAQ,CAAC;AAC9B,OAAO,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAC/C,OAAO,EAAE,iBAAiB,EAAE,MAAM,6BAA6B,CAAC;AAChE,YAAY,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAC;AACjE,YAAY,EACV,WAAW,EACX,cAAc,EACd,mBAAmB,EACnB,sBAAsB,EACtB,mBAAmB,EACnB,uBAAuB,GACxB,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AAC3D,YAAY,EACV,mBAAmB,EACnB,kBAAkB,EAClB,oBAAoB,GACrB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,YAAY,EAAE,SAAS,EAAE,WAAW,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AAC/E,YAAY,EAAE,SAAS,EAAE,YAAY,EAAE,WAAW,EAAE,iBAAiB,EAAE,MAAM,SAAS,CAAC;AAGvF,OAAO,EACL,oBAAoB,EACpB,yBAAyB,EACzB,oBAAoB,EACpB,uBAAuB,GACxB,MAAM,kBAAkB,CAAC;AAC1B,YAAY,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AAC3D,OAAO,EACL,wBAAwB,EACxB,uBAAuB,EACvB,iBAAiB,GAClB,MAAM,SAAS,CAAC;AACjB,YAAY,EACV,SAAS,EACT,YAAY,EACZ,SAAS,EACT,YAAY,EACZ,YAAY,GACb,MAAM,SAAS,CAAC;AACjB,YAAY,EACV,MAAM,EACN,OAAO,EACP,WAAW,EACX,eAAe,EACf,WAAW,EACX,cAAc,GACf,MAAM,oBAAoB,CAAC;AAE5B;oDACoD;AACpD,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC;IAC3B,QAAQ,CAAC,QAAQ,EAAE,WAAW,CAAC;CAChC;AAED;;;2DAG2D;AAC3D,wBAAgB,gBAAgB,CAAC,IAAI,EAAE;IACrC,QAAQ,CAAC,MAAM,EAAE,cAAc,CAAC;IAChC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,aAAa,EAAE,aAAa,GAAG,IAAI,CAAC;IAC7C,QAAQ,CAAC,SAAS,CAAC,EAAE,eAAe,CAAC;IACrC;6EACyE;IACzE,QAAQ,CAAC,QAAQ,CAAC,EAAE,oBAAoB,GAAG,IAAI,CAAC;CACjD,GAAG;IAAE,QAAQ,CAAC,SAAS,EAAE,iBAAiB,CAAC;IAAC,QAAQ,CAAC,kBAAkB,CAAC,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAA;CAAE,CAa/F;AAED;;;;GAIG;AACH,wBAAgB,wBAAwB,CACtC,OAAO,EAAE,qBAAqB,GAAG,SAAS,EAC1C,QAAQ,EAAE,oBAAoB,GAAG,IAAI,GACpC,mBAAmB,GAAG,SAAS,CAcjC;AAED;;2EAE2E;AAC3E,wBAAgB,uBAAuB,CAAC,IAAI,EAAE;IAC5C,QAAQ,CAAC,MAAM,EAAE,cAAc,CAAC;IAChC,QAAQ,CAAC,aAAa,CAAC,EAAE,aAAa,CAAC;IACvC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B;;4BAEwB;IACxB,QAAQ,CAAC,OAAO,CAAC,EAAE,qBAAqB,CAAC;IACzC;;kEAE8D;IAC9D,QAAQ,CAAC,QAAQ,CAAC,EAAE,oBAAoB,GAAG,IAAI,CAAC;CACjD,GAAG,iBAAiB,CAcpB"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/artifacts/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAElE,OAAO,KAAK,EAAE,WAAW,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC;AAGnE,OAAO,KAAK,EAAE,qBAAqB,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AAExE,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAC;AACtE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAC;AAEjE,OAAO,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AACxE,YAAY,EACV,YAAY,EACZ,SAAS,EACT,eAAe,EACf,SAAS,EACT,gBAAgB,EAChB,cAAc,EACd,oBAAoB,GACrB,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,IAAI,EAAE,MAAM,QAAQ,CAAC;AAC9B,OAAO,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAC/C,OAAO,EAAE,iBAAiB,EAAE,MAAM,6BAA6B,CAAC;AAChE,YAAY,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAC;AACjE,YAAY,EACV,WAAW,EACX,cAAc,EACd,mBAAmB,EACnB,uBAAuB,EACvB,sBAAsB,EACtB,mBAAmB,EACnB,uBAAuB,GACxB,MAAM,YAAY,CAAC;AAIpB,OAAO,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AAC/F,YAAY,EACV,IAAI,EACJ,QAAQ,EACR,QAAQ,EACR,aAAa,EACb,iBAAiB,EACjB,WAAW,EACX,UAAU,EACV,kBAAkB,EAClB,YAAY,GACb,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AAC3D,YAAY,EACV,mBAAmB,EACnB,kBAAkB,EAClB,oBAAoB,GACrB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,YAAY,EAAE,SAAS,EAAE,WAAW,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AAC/E,YAAY,EAAE,SAAS,EAAE,YAAY,EAAE,WAAW,EAAE,iBAAiB,EAAE,MAAM,SAAS,CAAC;AAGvF,OAAO,EACL,oBAAoB,EACpB,yBAAyB,EACzB,oBAAoB,EACpB,uBAAuB,GACxB,MAAM,kBAAkB,CAAC;AAC1B,YAAY,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AAC3D,OAAO,EACL,wBAAwB,EACxB,uBAAuB,EACvB,iBAAiB,GAClB,MAAM,SAAS,CAAC;AACjB,YAAY,EACV,SAAS,EACT,YAAY,EACZ,SAAS,EACT,YAAY,EACZ,YAAY,GACb,MAAM,SAAS,CAAC;AACjB,YAAY,EACV,MAAM,EACN,OAAO,EACP,WAAW,EACX,eAAe,EACf,WAAW,EACX,cAAc,GACf,MAAM,oBAAoB,CAAC;AAE5B;oDACoD;AACpD,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC;IAC3B,QAAQ,CAAC,QAAQ,EAAE,WAAW,CAAC;CAChC;AAED;;;2DAG2D;AAC3D,wBAAgB,gBAAgB,CAAC,IAAI,EAAE;IACrC,QAAQ,CAAC,MAAM,EAAE,cAAc,CAAC;IAChC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,aAAa,EAAE,aAAa,GAAG,IAAI,CAAC;IAC7C,QAAQ,CAAC,SAAS,CAAC,EAAE,eAAe,CAAC;IACrC;6EACyE;IACzE,QAAQ,CAAC,QAAQ,CAAC,EAAE,oBAAoB,GAAG,IAAI,CAAC;CACjD,GAAG;IAAE,QAAQ,CAAC,SAAS,EAAE,iBAAiB,CAAC;IAAC,QAAQ,CAAC,kBAAkB,CAAC,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAA;CAAE,CAa/F;AAED;;;;GAIG;AACH,wBAAgB,wBAAwB,CACtC,OAAO,EAAE,qBAAqB,GAAG,SAAS,EAC1C,QAAQ,EAAE,oBAAoB,GAAG,IAAI,GACpC,mBAAmB,GAAG,SAAS,CAcjC;AAED;;2EAE2E;AAC3E,wBAAgB,uBAAuB,CAAC,IAAI,EAAE;IAC5C,QAAQ,CAAC,MAAM,EAAE,cAAc,CAAC;IAChC,QAAQ,CAAC,aAAa,CAAC,EAAE,aAAa,CAAC;IACvC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B;;4BAEwB;IACxB,QAAQ,CAAC,OAAO,CAAC,EAAE,qBAAqB,CAAC;IACzC;;kEAE8D;IAC9D,QAAQ,CAAC,QAAQ,CAAC,EAAE,oBAAoB,GAAG,IAAI,CAAC;CACjD,GAAG,iBAAiB,CAcpB"}

package/dist/artifacts/index.js

@@ -7,7 +7,7 @@
  * lifecycle + `@step`; chunk B adds the artifact primitives (save/load/link).
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.TAINT_DEFAULT_CAP = exports.TAINT_DEFAULT_MAX_DEPTH = exports.computeDownstreamClosure = exports.normalizeClassification = exports.isDataClassification = exports.SENSITIVE_CLASSIFICATIONS = exports.DATA_CLASSIFICATIONS = exports.scrubDetectors = exports.detectSpans = exports.luhnValid = exports.scrubContent = exports.uploadArtifactContent = exports.openArtifactStore = exports.createArtifactApi = exports.step = exports.createRunNamespace = exports.getActiveRunContext = void 0;
+exports.TAINT_DEFAULT_CAP = exports.TAINT_DEFAULT_MAX_DEPTH = exports.computeDownstreamClosure = exports.normalizeClassification = exports.isDataClassification = exports.SENSITIVE_CLASSIFICATIONS = exports.DATA_CLASSIFICATIONS = exports.scrubDetectors = exports.detectSpans = exports.luhnValid = exports.scrubContent = exports.uploadArtifactContent = exports.parseAuthoringDoc = exports.assertValidManifest = exports.validateManifest = exports.openArtifactStore = exports.createArtifactApi = exports.step = exports.createRunNamespace = exports.getActiveRunContext = void 0;
 exports.wireRigArtifacts = wireRigArtifacts;
 exports.buildArtifactContentDeps = buildArtifactContentDeps;
 exports.createArtifactNamespace = createArtifactNamespace;
@@ -24,6 +24,13 @@ var artifact_2 = require("./artifact");
 Object.defineProperty(exports, "createArtifactApi", { enumerable: true, get: function () { return artifact_2.createArtifactApi; } });
 var artifact_store_1 = require("../telemetry/artifact-store");
 Object.defineProperty(exports, "openArtifactStore", { enumerable: true, get: function () { return artifact_store_1.openArtifactStore; } });
+// PSR-1 — the structure-only assembly-manifest model (spec §2.1). Re-exported
+// here so `export * from "./artifacts"` in index.ts puts it on the public
+// `modelrig` surface for the InferWealth inference + a future MCP write path.
+var manifest_1 = require("../prompts/manifest");
+Object.defineProperty(exports, "validateManifest", { enumerable: true, get: function () { return manifest_1.validateManifest; } });
+Object.defineProperty(exports, "assertValidManifest", { enumerable: true, get: function () { return manifest_1.assertValidManifest; } });
+Object.defineProperty(exports, "parseAuthoringDoc", { enumerable: true, get: function () { return manifest_1.parseAuthoringDoc; } });
 var content_uploader_2 = require("./content-uploader");
 Object.defineProperty(exports, "uploadArtifactContent", { enumerable: true, get: function () { return content_uploader_2.uploadArtifactContent; } });
 var scrub_1 = require("./scrub");

package/dist/bakeoff/groundedness.d.ts

@@ -0,0 +1,58 @@
+/**
+ * Evidence groundedness grader (call-QA F3 / research §4 G6, spec §5). A
+ * DETERMINISTIC bake-off tier that scores a scorecard OUTPUT by whether its
+ * evidence quotes are actually present in the replayed INPUT (the transcript /
+ * source). A scorer that invents justifications — quotes that never appear in
+ * the input — is penalized; this is what stops a model from fabricating
+ * evidence to defend a score.
+ *
+ * Unlike the golden tiers (exact / field-level / llm-judge in quality.ts), this
+ * grades the output against the INPUT, not a corrected golden, so it applies
+ * whether or not an eval-case `expected` value is present.
+ *
+ * The scorecard OUTPUT shape (call-QA F2 emit):
+ *   { criteria: [{ id, score, evidence: [{ quote, turn_id? }], comment }], score, comment }
+ *
+ * Grounding is a normalized SUBSTRING match against the DECODED input values
+ * (inputHaystack): the string leaf values the model was actually shown — never
+ * the JSON envelope's escaping or its keys — so a truthful quote spanning escaped
+ * chars is grounded and a fabricated quote equal to a key is not. Trivially short
+ * quotes never ground (MIN_GROUNDED_QUOTE_LEN).
+ *
+ * SCOPE NOTE (F3 vs F5): `turn_id` on an evidence entry is carried but NOT
+ * hard-validated — turn-scoped matching against the diarized transcript-with-
+ * turns artifact is F5's job (spec §7). F3 is substring grounding only.
+ *
+ * Pure; no I/O. Unit-tested directly (groundedness.test.ts).
+ */
+/**
+ * Pull every `criteria[].evidence[].quote` string from a scorecard output.
+ * Tolerant of missing / malformed shapes: a non-object output, a missing or
+ * non-array `criteria`, a criterion without an `evidence` array, or an evidence
+ * entry without a string `quote` are all skipped rather than throwing. Returns
+ * [] for anything it cannot read. Empty (whitespace-only) quotes are dropped —
+ * they carry no evidence to ground.
+ */
+export declare function extractEvidenceQuotes(output: unknown): string[];
+/**
+ * The fraction in [0,1] of a scorecard's evidence quotes that are grounded in
+ * the input, or null when there is nothing to ground.
+ *
+ * A quote is GROUNDED when its whitespace-collapsed, case-insensitive form is a
+ * substring of the DECODED input's whitespace-collapsed, case-insensitive text
+ * ({@link inputHaystack} — the string leaf VALUES the model was shown, not the
+ * serialized envelope or its keys) AND it is at least {@link MIN_GROUNDED_QUOTE_LEN}
+ * chars long (a too-trivial quote is never grounded).
+ *
+ * Edge cases (explicit, tested):
+ *   • ZERO evidence quotes across the whole scorecard (none present, or a
+ *     malformed shape yields none) ⇒ null. There is nothing to ground, so the
+ *     caller falls through to the next quality tier — NOT a spurious 1.0 or 0.0.
+ *   • An empty / absent input WITH quotes ⇒ every quote is ungrounded ⇒ 0.
+ *   • Quotes present but ALL below the min length ⇒ 0, NOT null — they were
+ *     emitted, they just carry no evidentiary weight (null is only for ZERO
+ *     emitted quotes).
+ *   • All quotes grounded ⇒ 1; some grounded ⇒ grounded / total.
+ */
+export declare function groundednessScore(output: unknown, input: unknown): number | null;
+//# sourceMappingURL=groundedness.d.ts.map

package/dist/bakeoff/groundedness.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"groundedness.d.ts","sourceRoot":"","sources":["../../src/bakeoff/groundedness.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAoEH;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,OAAO,GAAG,MAAM,EAAE,CAgB/D;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,GAAG,MAAM,GAAG,IAAI,CAYhF"}

package/dist/bakeoff/groundedness.js

@@ -0,0 +1,165 @@
+"use strict";
+/**
+ * Evidence groundedness grader (call-QA F3 / research §4 G6, spec §5). A
+ * DETERMINISTIC bake-off tier that scores a scorecard OUTPUT by whether its
+ * evidence quotes are actually present in the replayed INPUT (the transcript /
+ * source). A scorer that invents justifications — quotes that never appear in
+ * the input — is penalized; this is what stops a model from fabricating
+ * evidence to defend a score.
+ *
+ * Unlike the golden tiers (exact / field-level / llm-judge in quality.ts), this
+ * grades the output against the INPUT, not a corrected golden, so it applies
+ * whether or not an eval-case `expected` value is present.
+ *
+ * The scorecard OUTPUT shape (call-QA F2 emit):
+ *   { criteria: [{ id, score, evidence: [{ quote, turn_id? }], comment }], score, comment }
+ *
+ * Grounding is a normalized SUBSTRING match against the DECODED input values
+ * (inputHaystack): the string leaf values the model was actually shown — never
+ * the JSON envelope's escaping or its keys — so a truthful quote spanning escaped
+ * chars is grounded and a fabricated quote equal to a key is not. Trivially short
+ * quotes never ground (MIN_GROUNDED_QUOTE_LEN).
+ *
+ * SCOPE NOTE (F3 vs F5): `turn_id` on an evidence entry is carried but NOT
+ * hard-validated — turn-scoped matching against the diarized transcript-with-
+ * turns artifact is F5's job (spec §7). F3 is substring grounding only.
+ *
+ * Pure; no I/O. Unit-tested directly (groundedness.test.ts).
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.extractEvidenceQuotes = extractEvidenceQuotes;
+exports.groundednessScore = groundednessScore;
+function isObject(v) {
+    return typeof v === "object" && v !== null && !Array.isArray(v);
+}
+/** Collapse all runs of whitespace to a single space, trim, and lowercase — the
+ * comparison basis for grounding. This makes a quote grounded regardless of
+ * incidental whitespace (newlines, tabs, doubled spaces) or letter case, while
+ * never doing a fuzzy match: a quote whose WORDS are not in the input is still
+ * ungrounded. Mirrors quality.ts's "normalized, never fuzzy" discipline. */
+function collapse(text) {
+    return text.replace(/\s+/g, " ").trim().toLowerCase();
+}
+/**
+ * Quotes whose collapsed length is below this count as UNGROUNDED, never
+ * grounded (they still count toward the denominator — see {@link groundednessScore}).
+ * A 1–2 char fragment ("a", "no", "ok") is a substring of almost any transcript,
+ * so a raw substring match would let a fabricator score 1.0 with trivial
+ * "evidence"; too-short quotes carry no evidentiary weight. 12 chars ≈ a few
+ * words — enough to be a real span, not an accidental hit. */
+const MIN_GROUNDED_QUOTE_LEN = 12;
+/** Collect every STRING LEAF from a decoded JSON value — object VALUES and array
+ * items, NEVER object KEYS. This is the text the model was actually shown (the
+ * decoded variable values), so grounding is checked against values, and a
+ * fabricated quote equal to a structural KEY (e.g. "transcript") cannot
+ * false-pass. */
+function collectStringLeaves(v, out) {
+    if (typeof v === "string") {
+        out.push(v);
+    }
+    else if (Array.isArray(v)) {
+        for (const item of v)
+            collectStringLeaves(item, out);
+    }
+    else if (isObject(v)) {
+        for (const key of Object.keys(v))
+            collectStringLeaves(v[key], out);
+    }
+}
+/**
+ * Render the replayed input to the haystack grounding is checked against: the
+ * DECODED string leaf values, joined by spaces — NOT the serialized envelope.
+ *
+ * The model was shown the decoded variable VALUES, not the JSON wrapper, so:
+ *   • a string input (the serialized route variables) is JSON.parse'd first,
+ *     which un-escapes `\"`→`"` and `\n`→newline, then its string leaves are
+ *     collected — a parse failure means a bare (non-JSON) transcript, used as-is;
+ *   • an object/array input is walked directly.
+ * Object KEYS are excluded (leaves are values only), so a quote equal to a key
+ * ("transcript") is not grounded. `undefined`/`null` ⇒ "" (every quote
+ * ungrounded). */
+function inputHaystack(input) {
+    if (input === undefined || input === null)
+        return "";
+    if (typeof input === "string") {
+        try {
+            const parsed = JSON.parse(input);
+            const leaves = [];
+            collectStringLeaves(parsed, leaves);
+            return leaves.join(" ");
+        }
+        catch {
+            return input; // not JSON — a bare transcript string; use as-is.
+        }
+    }
+    const leaves = [];
+    collectStringLeaves(input, leaves);
+    return leaves.join(" ");
+}
+/**
+ * Pull every `criteria[].evidence[].quote` string from a scorecard output.
+ * Tolerant of missing / malformed shapes: a non-object output, a missing or
+ * non-array `criteria`, a criterion without an `evidence` array, or an evidence
+ * entry without a string `quote` are all skipped rather than throwing. Returns
+ * [] for anything it cannot read. Empty (whitespace-only) quotes are dropped —
+ * they carry no evidence to ground.
+ */
+function extractEvidenceQuotes(output) {
+    if (!isObject(output))
+        return [];
+    const criteria = output.criteria;
+    if (!Array.isArray(criteria))
+        return [];
+    const quotes = [];
+    for (const criterion of criteria) {
+        if (!isObject(criterion))
+            continue;
+        const evidence = criterion.evidence;
+        if (!Array.isArray(evidence))
+            continue;
+        for (const item of evidence) {
+            if (!isObject(item))
+                continue;
+            const quote = item.quote;
+            if (typeof quote === "string" && quote.trim() !== "")
+                quotes.push(quote);
+        }
+    }
+    return quotes;
+}
+/**
+ * The fraction in [0,1] of a scorecard's evidence quotes that are grounded in
+ * the input, or null when there is nothing to ground.
+ *
+ * A quote is GROUNDED when its whitespace-collapsed, case-insensitive form is a
+ * substring of the DECODED input's whitespace-collapsed, case-insensitive text
+ * ({@link inputHaystack} — the string leaf VALUES the model was shown, not the
+ * serialized envelope or its keys) AND it is at least {@link MIN_GROUNDED_QUOTE_LEN}
+ * chars long (a too-trivial quote is never grounded).
+ *
+ * Edge cases (explicit, tested):
+ *   • ZERO evidence quotes across the whole scorecard (none present, or a
+ *     malformed shape yields none) ⇒ null. There is nothing to ground, so the
+ *     caller falls through to the next quality tier — NOT a spurious 1.0 or 0.0.
+ *   • An empty / absent input WITH quotes ⇒ every quote is ungrounded ⇒ 0.
+ *   • Quotes present but ALL below the min length ⇒ 0, NOT null — they were
+ *     emitted, they just carry no evidentiary weight (null is only for ZERO
+ *     emitted quotes).
+ *   • All quotes grounded ⇒ 1; some grounded ⇒ grounded / total.
+ */
+function groundednessScore(output, input) {
+    const quotes = extractEvidenceQuotes(output);
+    if (quotes.length === 0)
+        return null;
+    const haystack = collapse(inputHaystack(input));
+    let grounded = 0;
+    for (const q of quotes) {
+        const needle = collapse(q);
+        // Too-trivial quotes never ground (they still count in the denominator).
+        if (needle.length < MIN_GROUNDED_QUOTE_LEN)
+            continue;
+        if (haystack.includes(needle))
+            grounded += 1;
+    }
+    return grounded / quotes.length;
+}

package/dist/bakeoff/quality.d.ts

@@ -20,8 +20,13 @@ import type { ValueCheck } from "../types/route";
  * as of LRE-2), and `llm-judge` (a PAIRWISE comparison of the output against the
  * golden — NOT a deterministic tier, so this resolver returns null for it and the
  * caller's golden judge (golden-judge.ts, LRE-2) scores it against `expected`).
+ *
+ * `evidence-grounded` (call-QA F3 / G6) is a fourth, GOLDEN-FREE deterministic
+ * kind: it scores a scorecard output by whether its evidence quotes appear in
+ * the replayed INPUT (groundedness.ts), not against a corrected golden. It is
+ * dispatched here regardless of whether an `expected` value is present.
  */
-export type GraderType = "exact" | "field-level" | "llm-judge";
+export type GraderType = "exact" | "field-level" | "llm-judge" | "evidence-grounded";
 /**
  * Schema-aware field accuracy in [0,1]: the fraction of the EXPECTED value's leaf
  * fields that the actual output matches. Recurses into objects/arrays keyed by
@@ -50,6 +55,11 @@ export declare function checkPasses(output: unknown, check: ValueCheck): boolean
 export interface DeterministicQualityInput {
     readonly output: unknown;
     readonly valueChecks?: readonly ValueCheck[];
+    /** The replayed capture INPUT (transcript / source). Consulted ONLY by the
+     * `evidence-grounded` grader (F3/G6), which grounds the output's evidence
+     * quotes against it. A string is used as-is; anything else is JSON.stringify'd
+     * (groundedness.ts). Ignored by every other grader kind. */
+    readonly input?: unknown;
     /** The corrected/golden expected output for this capture, when a bake-off runs
      * from eval cases with a corrected artifact. */
     readonly expected?: unknown;
@@ -63,6 +73,9 @@ export interface DeterministicQualityInput {
      *   • `llm-judge`  → NOT a deterministic tier; returns null so the caller's
      *     golden judge (golden-judge.ts) scores the output against the golden via
      *     the N5/N6 pairwise judge (LRE-2).
+     *   • `evidence-grounded` → GOLDEN-FREE (F3/G6); scores the output's evidence
+     *     quotes against {@link DeterministicQualityInput.input}, independent of
+     *     `expected`/`hasExpected`. See {@link groundednessScore}.
      * Absent ⇒ `field-level` behavior (byte-identical to pre-LRE-1b default). */
     readonly graderType?: GraderType;
 }

package/dist/bakeoff/quality.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"quality.d.ts","sourceRoot":"","sources":["../../src/bakeoff/quality.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAEjD;;;;;;;GAOG;AACH,MAAM,MAAM,UAAU,GAAG,OAAO,GAAG,aAAa,GAAG,WAAW,CAAC;AAiB/D;;;;;;GAMG;AACH,wBAAgB,aAAa,CAAC,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,GAAG,MAAM,CAgBxE;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,UAAU,CAAC,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,GAAG,MAAM,CAErE;AAED;iEACiE;AACjE,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAmB3E;AAED,uFAAuF;AACvF,wBAAgB,WAAW,CAAC,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,UAAU,GAAG,OAAO,CAWvE;AAYD,MAAM,WAAW,yBAAyB;IACxC,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;IACzB,QAAQ,CAAC,WAAW,CAAC,EAAE,SAAS,UAAU,EAAE,CAAC;IAC7C;oDACgD;IAChD,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC;IAC5B;8CAC0C;IAC1C,QAAQ,CAAC,WAAW,CAAC,EAAE,OAAO,CAAC;IAC/B;;;;;;;iFAO6E;IAC7E,QAAQ,CAAC,UAAU,CAAC,EAAE,UAAU,CAAC;CAClC;AAED;;;GAGG;AACH,wBAAgB,2BAA2B,CAAC,KAAK,EAAE,yBAAyB,GAAG,MAAM,GAAG,IAAI,CAc3F"}
+{"version":3,"file":"quality.d.ts","sourceRoot":"","sources":["../../src/bakeoff/quality.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAGjD;;;;;;;;;;;;GAYG;AACH,MAAM,MAAM,UAAU,GAAG,OAAO,GAAG,aAAa,GAAG,WAAW,GAAG,mBAAmB,CAAC;AAiBrF;;;;;;GAMG;AACH,wBAAgB,aAAa,CAAC,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,GAAG,MAAM,CAgBxE;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,UAAU,CAAC,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,GAAG,MAAM,CAErE;AAED;iEACiE;AACjE,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAmB3E;AAED,uFAAuF;AACvF,wBAAgB,WAAW,CAAC,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,UAAU,GAAG,OAAO,CAWvE;AAYD,MAAM,WAAW,yBAAyB;IACxC,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;IACzB,QAAQ,CAAC,WAAW,CAAC,EAAE,SAAS,UAAU,EAAE,CAAC;IAC7C;;;gEAG4D;IAC5D,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC;IACzB;oDACgD;IAChD,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC;IAC5B;8CAC0C;IAC1C,QAAQ,CAAC,WAAW,CAAC,EAAE,OAAO,CAAC;IAC/B;;;;;;;;;;iFAU6E;IAC7E,QAAQ,CAAC,UAAU,CAAC,EAAE,UAAU,CAAC;CAClC;AAED;;;GAGG;AACH,wBAAgB,2BAA2B,CAAC,KAAK,EAAE,yBAAyB,GAAG,MAAM,GAAG,IAAI,CAuB3F"}

package/dist/bakeoff/quality.js

@@ -19,6 +19,7 @@ exports.exactMatch = exactMatch;
 exports.resolveJsonPointer = resolveJsonPointer;
 exports.checkPasses = checkPasses;
 exports.resolveDeterministicQuality = resolveDeterministicQuality;
+const groundedness_1 = require("./groundedness");
 /** Normalize a scalar for comparison: trim strings; leave numbers/booleans as-is.
  * "normalized match" (spec §4.3) means insensitivity to surrounding whitespace,
  * never a fuzzy match — a wrong value is still wrong. */
@@ -129,6 +130,15 @@ function normalizeDeep(v) {
  * expected value nor a value check applies (the caller then tries the judge).
  */
 function resolveDeterministicQuality(input) {
+    // evidence-grounded (F3/G6): GOLDEN-FREE. Scores the output's evidence quotes
+    // against the replayed INPUT, NOT a golden — so it runs whether or not an
+    // eval-case `expected` value is present, and does not disturb the exact/
+    // field-level/llm-judge/hasExpected/valueChecks precedence below. A null
+    // (no evidence quotes to ground) defers to the next tier exactly like the
+    // other deterministic kinds.
+    if (input.graderType === "evidence-grounded") {
+        return (0, groundedness_1.groundednessScore)(input.output, input.input);
+    }
     if (input.hasExpected === true) {
         // llm-judge is not deterministic — defer to the judge tier (LRE-2 seam).
         if (input.graderType === "llm-judge")

package/dist/bakeoff/replay.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"replay.d.ts","sourceRoot":"","sources":["../../src/bakeoff/replay.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAGH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AAGzD,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,YAAY,CAAC;AAI1C,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAC5C,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AAC3C,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AAExD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAGpD,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B;;uCAEmC;IACnC,QAAQ,CAAC,WAAW,CAAC,EAAE,OAAO,CAAC;IAC/B;;;;kFAI8E;IAC9E,QAAQ,CAAC,uBAAuB,CAAC,EAAE,OAAO,CAAC;IAC3C;;yEAEqE;IACrE,QAAQ,CAAC,QAAQ,CAAC,EAAE,WAAW,CAAC,MAAM,EAAE;QAAE,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;IACrE;;sEAEkE;IAClE,QAAQ,CAAC,UAAU,CAAC,EAAE,UAAU,CAAC;IACjC;sFACkF;IAClF,QAAQ,CAAC,KAAK,CAAC,EAAE,WAAW,CAAC;IAC7B;;;sFAGkF;IAClF,QAAQ,CAAC,WAAW,CAAC,EAAE,iBAAiB,CAAC;IACzC;;;;;iFAK6E;IAC7E,QAAQ,CAAC,WAAW,CAAC,EAAE,WAAW,CAAC;CACpC;AAED,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;IAC3B;wEACoE;IACpE,QAAQ,CAAC,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IACtC;;;oCAGgC;IAChC,QAAQ,CAAC,aAAa,EAAE,OAAO,GAAG,IAAI,CAAC;IACvC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,mEAAmE;IACnE,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B;yDACqD;IACrD,QAAQ,CAAC,cAAc,EAAE,OAAO,CAAC;IACjC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IACrC,oEAAoE;IACpE,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B;sDACkD;IAClD,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACrC;AAED,wBAAsB,aAAa,CACjC,IAAI,EAAE,OAAO,EACb,QAAQ,EAAE,YAAY,EACtB,GAAG,EAAE,aAAa,GACjB,OAAO,CAAC,SAAS,kBAAkB,EAAE,CAAC,CAgJxC"}
+{"version":3,"file":"replay.d.ts","sourceRoot":"","sources":["../../src/bakeoff/replay.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAGH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AAGzD,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,YAAY,CAAC;AAI1C,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAC5C,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AAC3C,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AAExD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAGpD,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B;;uCAEmC;IACnC,QAAQ,CAAC,WAAW,CAAC,EAAE,OAAO,CAAC;IAC/B;;;;kFAI8E;IAC9E,QAAQ,CAAC,uBAAuB,CAAC,EAAE,OAAO,CAAC;IAC3C;;yEAEqE;IACrE,QAAQ,CAAC,QAAQ,CAAC,EAAE,WAAW,CAAC,MAAM,EAAE;QAAE,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;IACrE;;sEAEkE;IAClE,QAAQ,CAAC,UAAU,CAAC,EAAE,UAAU,CAAC;IACjC;sFACkF;IAClF,QAAQ,CAAC,KAAK,CAAC,EAAE,WAAW,CAAC;IAC7B;;;sFAGkF;IAClF,QAAQ,CAAC,WAAW,CAAC,EAAE,iBAAiB,CAAC;IACzC;;;;;iFAK6E;IAC7E,QAAQ,CAAC,WAAW,CAAC,EAAE,WAAW,CAAC;CACpC;AAED,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;IAC3B;wEACoE;IACpE,QAAQ,CAAC,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IACtC;;;oCAGgC;IAChC,QAAQ,CAAC,aAAa,EAAE,OAAO,GAAG,IAAI,CAAC;IACvC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,mEAAmE;IACnE,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B;yDACqD;IACrD,QAAQ,CAAC,cAAc,EAAE,OAAO,CAAC;IACjC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IACrC,oEAAoE;IACpE,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B;sDACkD;IAClD,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACrC;AAED,wBAAsB,aAAa,CACjC,IAAI,EAAE,OAAO,EACb,QAAQ,EAAE,YAAY,EACtB,GAAG,EAAE,aAAa,GACjB,OAAO,CAAC,SAAS,kBAAkB,EAAE,CAAC,CAoJxC"}

package/dist/bakeoff/replay.js

@@ -110,6 +110,10 @@ async function replayVariant(deps, captures, req) {
             const expected = req.expected?.get(capture.inferenceId);
             const det = (0, quality_1.resolveDeterministicQuality)({
                 output: outputValue,
+                // The replayed capture INPUT, for the `evidence-grounded` grader (F3/G6)
+                // — the serialized route variables (which carry the transcript/source),
+                // used as-is since it is already text. Ignored by every other grader.
+                input: capture.variablesJson,
                 ...(route.valueChecks !== undefined ? { valueChecks: route.valueChecks } : {}),
                 ...(expected !== undefined ? { hasExpected: true, expected: expected.value } : {}),
                 ...(req.graderType !== undefined ? { graderType: req.graderType } : {}),

package/dist/cli.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":";AACA;;;;;;;;;;;;;;;;GAgBG;AAoDH,MAAM,WAAW,KAAK;IACpB,QAAQ,CAAC,UAAU,EAAE,SAAS,MAAM,EAAE,CAAC;IACvC,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC5C,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;CACpC;AAeD,wBAAgB,SAAS,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG,KAAK,CAuBxD;AA6eD,wBAAsB,IAAI,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CA2CnE"}
+{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":";AACA;;;;;;;;;;;;;;;;GAgBG;AAsDH,MAAM,WAAW,KAAK;IACpB,QAAQ,CAAC,UAAU,EAAE,SAAS,MAAM,EAAE,CAAC;IACvC,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC5C,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;CACpC;AAeD,wBAAgB,SAAS,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG,KAAK,CAuBxD;AA+eD,wBAAsB,IAAI,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CA+CnE"}

package/dist/cli.js

@@ -31,6 +31,7 @@ const failures_teaching_1 = require("./types/failures-teaching");
 const config_1 = require("./config");
 const index_1 = require("./index");
 const status_cli_1 = require("./status-cli");
+const doctor_cli_1 = require("./doctor-cli");
 const engine_1 = require("./bakeoff/engine");
 const samples_1 = require("./bakeoff/samples");
 const report_1 = require("./bakeoff/report");
@@ -59,6 +60,7 @@ const state_store_1 = require("./watch/state-store");
 const swaps_client_1 = require("./savings/swaps-client");
 const swap_execute_1 = require("./savings/swap-execute");
 const cli_query_1 = require("./cli-query");
+const prompts_export_cli_1 = require("./prompts-export-cli");
 const cli_judge_1 = require("./cli-judge");
 const regret_monitor_cli_1 = require("./watch/regret-monitor-cli");
 const screen_cli_1 = require("./screen/screen-cli");
@@ -507,6 +509,7 @@ const USAGE = [
     "  modelrig screen pull <classifier:name@version> [--url <weights-url>]   (SC-1a: fetch an optional classifier's weights to the local cache — never bundled, A3)",
     "  modelrig screen probe [--detectors <ids>] [--corpus <ids>]   (SC-3: measured TPR/FP per license-clean synthetic corpus — counts + rates only)",
     "  modelrig status                      (print export/artifact/otlp posture)",
+    "  modelrig doctor [--expect-org <slug>]   (confirm which org MODELRIG_API_KEY resolves to via /v1/whoami — ✓ or a loud 401; exits non-zero on a bad key or, with --expect-org, a different org)",
     "  modelrig serve                       (needs the modelrig-server package)",
     "  modelrig bakeoff --route <route> --variants a,b,c --replay-last N [--budget-usd usd] [--objective quality-first|balanced|cost-first] [--keep-outputs[=all]] [--json] [--no-mirror]",
     "  modelrig bakeoff --from-proposal <id> [--replay-last N] [--keep-outputs[=all]] [--json]",
@@ -518,6 +521,7 @@ const USAGE = [
     "  modelrig swap revert <swapId>",
     "  modelrig judge <runId>               (E5: score a run with the bounded model-judge; explicit + metered)",
     '  modelrig query "<grammar>" | query --saved <id>   (WI-1b: telemetry analytics — metadata only, never content)',
+    "  modelrig prompts export --route <route> [--out modelrig/routes] [--label prod | --version N] [--segment default] [--json]   (PSR-3: export a prompt version back to git, byte-faithful — proves the round-trip)",
     "  modelrig samples purge [--bakeoff <id>]",
 ].join("\n");
 async function main(argv) {
@@ -533,6 +537,8 @@ async function main(argv) {
     switch (command) {
         case "status":
             return (0, status_cli_1.runStatusCli)();
+        case "doctor":
+            return (0, doctor_cli_1.runDoctorCli)(flags.named.has("expect-org") ? { expectOrg: flags.named.get("expect-org") ?? "" } : {});
         case "validate":
             return (0, validate_cli_1.runValidateCli)();
         case "screen":
@@ -559,6 +565,8 @@ async function main(argv) {
             return (0, regret_monitor_cli_1.cmdRegretMonitor)(flags);
         case "serve":
             return cmdServe();
+        case "prompts":
+            return (0, prompts_export_cli_1.cmdPromptsExport)(flags);
         default:
             console.error(USAGE);
             return 1;

package/dist/config.d.ts

@@ -35,6 +35,9 @@ export interface RigConfig {
         /** A1 aggregator hosts (generic openai-compatible adapter). */
         readonly deepinfra?: string;
         readonly fireworks?: string;
+        /** Z.ai / Zhipu (B4a) — env: ZAI_API_KEY (unprefixed vendor key). Reached via
+         * the generic openai-compatible adapter (same family as the A1 hosts). */
+        readonly zai?: string;
     };
     /** Budget for envelopes first opened by this rig (default: envelope.ts's $25). */
     readonly envelopeBudgetUsd?: number;
@@ -101,6 +104,34 @@ export interface RigConfig {
      * spell out the off case.
      */
     readonly artifacts?: ArtifactsConfig;
+    /**
+     * Managed serving (Unified Route U3, ruling D-2) — the switch for
+     * `destination: modelrig-served`. Set IN CODE at construction, NOT via an env
+     * var (Matt, 2026-09-09): `createRig({ ...loadConfigFromEnv(), managedServing: true })`
+     * or `loadConfigFromEnv({ managedServing: true })`. `loadConfigFromEnv` defaults
+     * it to `false` and reads NO `process.env` key for it; like `otlp`/`artifacts`
+     * it is ALWAYS resolved so `/status` can answer "enabled|disabled" honestly.
+     * Optional so a hand-built config may omit it — an absent value reads as `false`.
+     * When off, a run whose resolved destination is `modelrig-served` FAILS CLOSED
+     * pre-dispatch (run/resolve-destination.ts) — never a silent `direct` fallback
+     * (fail-closed-but-discoverable). Threaded to the routed run path as
+     * RunDeps.managedServingEnabled. Turning it on is a deliberate operator/owner
+     * action (P9 money/isolation path); the per-org console toggle is the future GA
+     * mechanism (server-resolved). CODE ONLY — no GA, no outward copy; true
+     * customer-keyless serving is a hosted-server capability, deferred (spec §4 U3).
+     */
+    readonly managedServing?: boolean;
+    /**
+     * The org slug this process expects its `MODELRIG_API_KEY` to resolve to
+     * (REL-1, ruling M5). On the first successful flush the api sink asks
+     * `GET /v1/whoami` and logs the org it is exporting to; when the resolved slug
+     * differs from `expectOrg` it logs `[modelrig] ORG MISMATCH …` loudly on every
+     * flush. It NEVER throws and NEVER drops telemetry — the
+     * rows still land in the key's org. Set IN CODE, not via an env var (P15):
+     * `createRig({ ...loadConfigFromEnv(), expectOrg: "inferwealth" })`. Absent ⇒
+     * the org line is still logged, with no comparison.
+     */
+    readonly expectOrg?: string;
 }
 /** Scrub mode applied to content BEFORE upload (E2-C chunk B). Default `detect`
  * when content custody is on. The EFFECTIVE mode is resolved per task/account

package/dist/config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,OAAO,KAAK,EAAE,cAAc,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAEnE;;;;kFAIkF;AAClF,wBAAgB,kBAAkB,IAAI,MAAM,GAAG,SAAS,CAMvD;AAED,MAAM,WAAW,SAAS;IACxB;;;;;4EAKwE;IACxE,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC;;;;qFAIiF;IACjF,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,IAAI,EAAE;QACb,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;QACzB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;QACzB,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;QAC3B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;QAC5B,qDAAqD;QACrD,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QACvB,+DAA+D;QAC/D,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;QAC5B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;KAC7B,CAAC;IACF,kFAAkF;IAClF,QAAQ,CAAC,iBAAiB,CAAC,EAAE,MAAM,CAAC;IACpC;8EAC0E;IAC1E,QAAQ,CAAC,sBAAsB,CAAC,EAAE,MAAM,CAAC;IACzC;;;6CAGyC;IACzC,QAAQ,CAAC,mBAAmB,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,UAAU,EAAE,SAAS,cAAc,EAAE,CAAC,CAAC,CAAC;IACtF;8DAC0D;IAC1D,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B;;eAEW;IACX,QAAQ,CAAC,MAAM,CAAC,EAAE;QAChB,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;QAC9B,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;QACnC,QAAQ,CAAC,WAAW,CAAC,EAAE,OAAO,GAAG,UAAU,CAAC;KAC7C,CAAC;IACF;;wCAEoC;IACpC,QAAQ,CAAC,KAAK,CAAC,EAAE;QACf,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;QAC7B,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;KAChC,CAAC;IACF;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,eAAe,GAAG,kBAAkB,CAAC;IACvD;;;;;;;;OAQG;IACH,QAAQ,CAAC,IAAI,CAAC,EAAE,UAAU,GAAG,IAAI,CAAC;IAClC;;;;;;;;;;;;;OAaG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,eAAe,CAAC;CACtC;AAED;;;;uBAIuB;AACvB,MAAM,MAAM,SAAS,GAAG,KAAK,GAAG,QAAQ,GAAG,QAAQ,GAAG,OAAO,CAAC;AAE9D;;;8DAG8D;AAC9D,eAAO,MAAM,0BAA0B,EAAE,SAAoB,CAAC;AAE9D;;;;kFAIkF;AAClF,MAAM,WAAW,qBAAqB;IACpC,qEAAqE;IACrE,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,qFAAqF;IACrF,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,2EAA2E;IAC3E,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B;AAED;6EAC6E;AAC7E,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,OAAO,CAAC,EAAE,qBAAqB,CAAC;CAC1C;AAID;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAgB,sBAAsB,CACpC,GAAG,EAAE;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;CAC5B;AACD;;4EAE4E;AAC5E,sBAAsB,UAAQ;AAC9B;iFACiF;AACjF,UAAU,UAAQ,GACjB,eAAe,CAsBjB;AAKD;;;;;wDAKwD;AACxD,wBAAgB,wBAAwB,CAAC,YAAY,CAAC,EAAE,MAAM,GAAG,MAAM,CAGtE;AAED;uEACuE;AACvE,MAAM,WAAW,UAAU;IACzB,kFAAkF;IAClF,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,mFAAmF;IACnF,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC1C;AAED;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAYhF;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAC/B,QAAQ,EAAE,MAAM,GAAG,SAAS,EAC5B,UAAU,EAAE,MAAM,GAAG,SAAS,GAC7B,UAAU,GAAG,IAAI,CAGnB;AAED,UAAU,YAAY;IACpB,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;CAC9B;AAED,MAAM,WAAW,eAAgB,SAAQ,YAAY;IACnD,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAC;IACrB;+EAC2E;IAC3E,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAED,MAAM,WAAW,kBAAmB,SAAQ,YAAY;IACtD,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IACxB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC;;uCAEmC;IACnC,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACpC;AAED;;kEAEkE;AAClE,eAAO,MAAM,gBAAgB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAQ7D,CAAC;AAKF,wBAAgB,iBAAiB,CAAC,SAAS,CAAC,EAAE,OAAO,CAAC,SAAS,CAAC,GAAG,SAAS,CAyJ3E;AAED;;;;;;;;GAQG;AACH,wBAAgB,cAAc,CAC5B,MAAM,EAAE,SAAS,EACjB,IAAI,EAAE,MAAM,GACX;IAAE,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;CAAE,CAgB/F"}
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,OAAO,KAAK,EAAE,cAAc,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAEnE;;;;kFAIkF;AAClF,wBAAgB,kBAAkB,IAAI,MAAM,GAAG,SAAS,CAMvD;AAED,MAAM,WAAW,SAAS;IACxB;;;;;4EAKwE;IACxE,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC;;;;qFAIiF;IACjF,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,IAAI,EAAE;QACb,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;QACzB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;QACzB,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;QAC3B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;QAC5B,qDAAqD;QACrD,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QACvB,+DAA+D;QAC/D,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;QAC5B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;QAC5B;kFAC0E;QAC1E,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;KACvB,CAAC;IACF,kFAAkF;IAClF,QAAQ,CAAC,iBAAiB,CAAC,EAAE,MAAM,CAAC;IACpC;8EAC0E;IAC1E,QAAQ,CAAC,sBAAsB,CAAC,EAAE,MAAM,CAAC;IACzC;;;6CAGyC;IACzC,QAAQ,CAAC,mBAAmB,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,UAAU,EAAE,SAAS,cAAc,EAAE,CAAC,CAAC,CAAC;IACtF;8DAC0D;IAC1D,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B;;eAEW;IACX,QAAQ,CAAC,MAAM,CAAC,EAAE;QAChB,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;QAC9B,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;QACnC,QAAQ,CAAC,WAAW,CAAC,EAAE,OAAO,GAAG,UAAU,CAAC;KAC7C,CAAC;IACF;;wCAEoC;IACpC,QAAQ,CAAC,KAAK,CAAC,EAAE;QACf,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;QAC7B,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;KAChC,CAAC;IACF;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,eAAe,GAAG,kBAAkB,CAAC;IACvD;;;;;;;;OAQG;IACH,QAAQ,CAAC,IAAI,CAAC,EAAE,UAAU,GAAG,IAAI,CAAC;IAClC;;;;;;;;;;;;;OAaG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,eAAe,CAAC;IACrC;;;;;;;;;;;;;;;OAeG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,OAAO,CAAC;IAClC;;;;;;;;;OASG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;CAC7B;AAED;;;;uBAIuB;AACvB,MAAM,MAAM,SAAS,GAAG,KAAK,GAAG,QAAQ,GAAG,QAAQ,GAAG,OAAO,CAAC;AAE9D;;;8DAG8D;AAC9D,eAAO,MAAM,0BAA0B,EAAE,SAAoB,CAAC;AAE9D;;;;kFAIkF;AAClF,MAAM,WAAW,qBAAqB;IACpC,qEAAqE;IACrE,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,qFAAqF;IACrF,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,2EAA2E;IAC3E,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B;AAED;6EAC6E;AAC7E,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,OAAO,CAAC,EAAE,qBAAqB,CAAC;CAC1C;AAID;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAgB,sBAAsB,CACpC,GAAG,EAAE;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;CAC5B;AACD;;4EAE4E;AAC5E,sBAAsB,UAAQ;AAC9B;iFACiF;AACjF,UAAU,UAAQ,GACjB,eAAe,CAsBjB;AAKD;;;;;wDAKwD;AACxD,wBAAgB,wBAAwB,CAAC,YAAY,CAAC,EAAE,MAAM,GAAG,MAAM,CAGtE;AAED;uEACuE;AACvE,MAAM,WAAW,UAAU;IACzB,kFAAkF;IAClF,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,mFAAmF;IACnF,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC1C;AAED;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAYhF;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAC/B,QAAQ,EAAE,MAAM,GAAG,SAAS,EAC5B,UAAU,EAAE,MAAM,GAAG,SAAS,GAC7B,UAAU,GAAG,IAAI,CAGnB;AAED,UAAU,YAAY;IACpB,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;CAC9B;AAED,MAAM,WAAW,eAAgB,SAAQ,YAAY;IACnD,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAC;IACrB;+EAC2E;IAC3E,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAED,MAAM,WAAW,kBAAmB,SAAQ,YAAY;IACtD,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IACxB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC;;uCAEmC;IACnC,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACpC;AAED;;kEAEkE;AAClE,eAAO,MAAM,gBAAgB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAa7D,CAAC;AAKF,wBAAgB,iBAAiB,CAAC,SAAS,CAAC,EAAE,OAAO,CAAC,SAAS,CAAC,GAAG,SAAS,CA4K3E;AAED;;;;;;;;GAQG;AACH,wBAAgB,cAAc,CAC5B,MAAM,EAAE,SAAS,EACjB,IAAI,EAAE,MAAM,GACX;IAAE,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;CAAE,CAgB/F"}

package/dist/config.js

@@ -137,6 +137,11 @@ exports.PROVIDER_KEY_ENV = {
     grok: "XAI_API_KEY",
     deepinfra: "MODELRIG_DEEPINFRA_API_KEY",
     fireworks: "MODELRIG_FIREWORKS_API_KEY",
+    // Z.ai (B4a): UNPREFIXED on purpose — matches the XAI_API_KEY/ANTHROPIC_API_KEY
+    // vendor-key convention (only the aggregator hosts deepinfra/fireworks + tavily
+    // carry the MODELRIG_ prefix, for host-app env collision-avoidance, which does
+    // not apply to a first-party vendor key).
+    zai: "ZAI_API_KEY",
 };
 const DEFAULT_ROUTES_DIR = "./modelrig/routes";
 const DEFAULT_TELEMETRY_DB = "./.modelrig/telemetry.db";
@@ -150,6 +155,19 @@ function loadConfigFromEnv(overrides) {
     // OTLP span emission (E1) — off unless an endpoint is set. Additive to
     // `export`; a rig may emit OTLP with no control-plane sink and vice-versa.
     const otlp = resolveOtlpConfig(env.MODELRIG_OTLP_ENDPOINT, env.MODELRIG_OTLP_HEADERS);
+    // Managed serving (Unified Route U3, ruling D-2) is deliberately NOT an env var
+    // (Matt, 2026-09-09): `config.managedServing` is set IN CODE at construction —
+    // `createRig({ ...loadConfigFromEnv(), managedServing: true })`, or
+    // `loadConfigFromEnv({ managedServing: true })` (overrides win below) — and
+    // defaults OFF (`false` in `fromEnv`). It is intentionally read from NO
+    // `process.env` key. The per-org console/settings toggle is the future GA
+    // mechanism (server-resolved, like `artifact_posture`). When off/absent, a
+    // resolved `modelrig-served` FAILS CLOSED pre-dispatch (run/resolve-destination.ts)
+    // — never a silent `direct` fallback. This is NOT a customer-key override: the
+    // fireworks/deepinfra adapters already carry ModelRig-owned keys on the routed
+    // lane, so U3 is a config-flag + capability SEAM, not a key switch (true
+    // customer-keyless serving now ships as a hosted-server capability behind this
+    // same flag — no longer deferred).
     // Artifact / execution-graph namespace (E2; P15 CP-3) — ON by default when a
     // control plane is configured (api key OR the direct supabase pair). The ORG's
     // account posture (`artifact_posture`), resolved from the control plane at
@@ -190,6 +208,9 @@ function loadConfigFromEnv(overrides) {
         telemetryDbPath: env.MODELRIG_TELEMETRY_DB ?? DEFAULT_TELEMETRY_DB,
         otlp,
         artifacts,
+        // U3 (D-2): default OFF; enabled in code via `createRig`/`loadConfigFromEnv`
+        // overrides (spread below), NOT from an env var (Matt, 2026-09-09).
+        managedServing: false,
         ...(env.MODELRIG_REGISTRY_PATH ? { registryPath: env.MODELRIG_REGISTRY_PATH } : {}),
         keys: {
             ...(env.GEMINI_API_KEY ? { gemini: env.GEMINI_API_KEY } : {}),
@@ -200,6 +221,8 @@ function loadConfigFromEnv(overrides) {
             // A1 hosts: ModelRig-scoped names on purpose (same doctrine as Tavily).
             ...(env.MODELRIG_DEEPINFRA_API_KEY ? { deepinfra: env.MODELRIG_DEEPINFRA_API_KEY } : {}),
             ...(env.MODELRIG_FIREWORKS_API_KEY ? { fireworks: env.MODELRIG_FIREWORKS_API_KEY } : {}),
+            // Z.ai (B4a): unprefixed vendor key (see PROVIDER_KEY_ENV).
+            ...(env.ZAI_API_KEY ? { zai: env.ZAI_API_KEY } : {}),
         },
         ...(budget !== undefined && Number.isFinite(budget) ? { envelopeBudgetUsd: budget } : {}),
         ...(env.MODELRIG_UNPRICED_RATE_USD_PER_MTOK &&

package/dist/doctor-cli.d.ts

@@ -0,0 +1,7 @@
+export interface DoctorOptions {
+    /** `--expect-org <slug>`: exit 1 (printing both slugs) when the key resolves
+     * to a different org — the valid-key-wrong-org mistake (M5). */
+    readonly expectOrg?: string;
+}
+export declare function runDoctorCli(opts?: DoctorOptions): Promise<number>;
+//# sourceMappingURL=doctor-cli.d.ts.map

package/dist/doctor-cli.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"doctor-cli.d.ts","sourceRoot":"","sources":["../src/doctor-cli.ts"],"names":[],"mappings":"AAiBA,MAAM,WAAW,aAAa;IAC5B;oEACgE;IAChE,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;CAC7B;AAED,wBAAsB,YAAY,CAAC,IAAI,GAAE,aAAkB,GAAG,OAAO,CAAC,MAAM,CAAC,CAwD5E"}

package/dist/doctor-cli.js

@@ -0,0 +1,68 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.runDoctorCli = runDoctorCli;
+/**
+ * `modelrig doctor` — confirm, in one line, which org your key resolves to.
+ *
+ * The explicit form of the auth preflight (doctor-preflight.ts). Run it in a
+ * worker shell, a CI step, or setup step 0 to answer the question the missing-
+ * runs incident could not: is MODELRIG_API_KEY valid, and does it belong to the
+ * org you expect? Prints the key → org line (✓ on success, a loud line on 401),
+ * and exits non-zero when the key is rejected or unconfirmed — so CI can gate on
+ * it. `--expect-org <slug>` also exits non-zero when the key is valid but
+ * belongs to a different org, printing both slugs. Never prints the key itself
+ * (last-four only, via redactApiKey).
+ *
+ * Kept in its own file so cli.ts stays under the LOC cap (like status-cli.ts).
+ */
+const config_1 = require("./config");
+const doctor_preflight_1 = require("./doctor-preflight");
+async function runDoctorCli(opts = {}) {
+    // An empty --expect-org would make the gate unable to fail: refuse it (usage error).
+    if (opts.expectOrg !== undefined && opts.expectOrg.trim() === "") {
+        console.error("[modelrig] usage: modelrig doctor --expect-org <slug> — the slug must not be empty.");
+        return 2;
+    }
+    // config.ts is the only env reader (package-invariants) — doctor reads the
+    // resolved config, never process.env.
+    const config = (0, config_1.loadConfigFromEnv)();
+    const exp = config.export;
+    if (exp === undefined) {
+        console.error([
+            "[modelrig] no export sink configured — nothing to check.",
+            "Set MODELRIG_API_KEY (a rig_sk_ key minted at app.modelrig.ai) so the SDK",
+            "ships telemetry to the hosted API. Without it, runs are recorded locally only.",
+        ].join("\n"));
+        return 1;
+    }
+    if (exp.mode !== "api") {
+        console.log(`[modelrig] export sink is ${exp.mode} mode (self-hosted control plane) — whoami is an ` +
+            "api-mode check, so there is nothing to confirm here.");
+        return 0;
+    }
+    const result = await (0, doctor_preflight_1.runAuthPreflight)(config);
+    if (result === null) {
+        // Unreachable given the api-mode guard above, but keep the contract total.
+        console.log("[modelrig] nothing to check.");
+        return 0;
+    }
+    if (result.ok) {
+        const expectOrg = opts.expectOrg?.trim();
+        if (expectOrg !== undefined && expectOrg !== "") {
+            const actual = (0, doctor_preflight_1.expectedOrgMismatch)(result, expectOrg);
+            if (actual !== null) {
+                console.error(`[modelrig] ORG MISMATCH: key resolves to «${actual}», --expect-org is «${expectOrg}» — ` +
+                    `telemetry from this key lands in «${actual}». Mint a key in the «${expectOrg}» org at ` +
+                    "app.modelrig.ai, or fix --expect-org.");
+                return 1;
+            }
+            console.log(`${result.line}  (org «${expectOrg}» as expected)`);
+            return 0;
+        }
+        console.log(result.line);
+        return 0;
+    }
+    console.error(result.line);
+    // L6 NIT-6: the wrong kind of secret is a usage error (exit 2), not a failed check.
+    return result.status === "not_rig_key" ? 2 : 1;
+}