okengine 0.23.2 → 0.24.0

package/site/content/docs/elements/ai/deciders.mdx

@@ -0,0 +1,154 @@
+---
+title: "Deciders"
+description: "One model that can answer a decision, with its protocol, secret, and certificate."
+icon: "Cpu"
+source: "docs/spec/unified-theory.md"
+---
+
+A decider is the model behind a decision. Two presets are filled in. Every other host passes the protocol, the URL, and what it can answer.
+
+<Callout title="The one rule">
+  Use `provider: "openrouter"` or `provider: "openai"` when that is the host. Any other host needs
+  `driverId`, `baseUrl`, `secret`, and `capabilities`.
+</Callout>
+
+## Quick start
+
+<Steps>
+
+<Step>
+### OpenRouter
+
+Certificates bind to the dated model id the host echoes.
+
+```typescript
+import { ai } from "okengine";
+
+export const jev = ai.decider("jev", {
+  provider: "openrouter",
+  model: "typesafe/jev-1.13-20260917",
+});
+```
+
+The request is System One: `POST https://openrouter.ai/api/alpha/decisions` with `{ model, state, questions }`. The secret is `OPENROUTER_API_KEY`.
+
+</Step>
+
+<Step>
+### OpenAI
+
+The certificate binds to the echoed id, stays unpinned, and expires 30 days after certify.
+
+```typescript
+export const luna = ai.decider("luna", {
+  provider: "openai",
+  model: "gpt-6-luna",
+});
+```
+
+The request is `{ model, input, questions }` at `https://api.openai.com/v1/decisions`. Object state is sent as JSON text. The secret is `OPENAI_API_KEY`.
+
+</Step>
+
+<Step>
+### Any other host
+
+Name the protocol. Do not invent a preset.
+
+```typescript
+export const local = ai.decider("local", {
+  driverId: "systemone",
+  baseUrl: "https://decisions.example.com/v1",
+  model: "local-decider",
+  secret: "DECISION_API_KEY",
+  capabilities: { boolean: true, choice: true, score: true, refusal: false },
+  region: "self",
+});
+```
+
+`region` and `zdr` are your declaration. The Manifest marks them `declared`.
+
+</Step>
+
+</Steps>
+
+## Presets
+
+| Provider     | Protocol           | URL                                         | Secret               | Pinning | Answers                         |
+| ------------ | ------------------ | ------------------------------------------- | -------------------- | ------- | ------------------------------- |
+| `openrouter` | `systemone`        | `https://openrouter.ai/api/alpha/decisions` | `OPENROUTER_API_KEY` | `dated` | boolean, choice, score          |
+| `openai`     | `openai-decisions` | `https://api.openai.com/v1/decisions`       | `OPENAI_API_KEY`     | `alias` | boolean, choice, score, refusal |
+
+No other host is filled in. A dated certificate stores the echoed canonical slug. An alias certificate stores `pinned: false` and `expiresAt`. Console shows the unpinned flag. `oke decide certify` prints it.
+
+If OpenRouter lists a dated id for the model, autonomy requires the decider to use that id.
+
+## Capabilities
+
+| Field                                      | Meaning                                                        |
+| ------------------------------------------ | -------------------------------------------------------------- |
+| `boolean` / `choice` / `score` / `refusal` | Whether that question kind is allowed.                         |
+| `maxChoices`                               | Enforced only when the row sets it.                            |
+| `minLevels` / `maxLevels`                  | Enforced only when the row sets it.                            |
+| `maxContext`                               | Estimated input tokens. Over the limit throws before the call. |
+
+Presets do not set a numeric limit. A custom row's `false` flag rejects that question at compile time.
+
+Both wires become one answer: `boolean`, `choice`, `score`, `refusal`, or `malformed`. A refusal carries no text.
+
+## Options
+
+| Option           | Preset                          | Custom host                       |
+| ---------------- | ------------------------------- | --------------------------------- |
+| `provider`       | `openrouter` or `openai`        | Optional label                    |
+| `driverId`       | Filled in                       | `systemone` or `openai-decisions` |
+| `baseUrl`        | Filled in                       | Required                          |
+| `model`          | Required                        | Required                          |
+| `secret`         | Preset secret, or your override | Required                          |
+| `region` / `zdr` | Stored as `declared`            | Stored as `declared`              |
+| `timeout`        | Optional                        | Optional                          |
+| `concurrency`    | Optional cap for this decider   | Optional                          |
+
+One decider has one breaker. Three HTTP 5xx responses open it for 30 seconds. The next call skips that decider and tries `backup`.
+
+## Troubleshooting
+
+<Accordions>
+
+<Accordion title="autonomy requires model">
+  `oke decide certify: autonomy requires model "…" on decider "…"`. The catalog lists a dated id.
+  Put that id on the decider.
+</Accordion>
+
+<Accordion title="model is unpinned">
+  Certify prints `model "…" is unpinned`. An alias certificate expires 30 days later. After that,
+  answers take `otherwise` with `why: "uncertified"`.
+</Accordion>
+
+<Accordion title="cannot answer choice">
+  `ai.decision("…"): decider "…" cannot answer choice "…"`. The capability row has that kind set to
+  `false`.
+</Accordion>
+
+</Accordions>
+
+## Learn more
+
+- [Decisions](/docs/elements/ai/decide) — `otherwise`, certificates, and `fx.decide`
+- [Configuration](/docs/reference/configuration) — `drivers.decide`
+
+## Next
+
+<Cards>
+  <Card
+    title="Decisions"
+    description="Questions, otherwise, and the lockfile."
+    href="/docs/elements/ai/decide"
+  />
+  <Card title="Models" description="Chat and embed providers." href="/docs/elements/ai/models" />
+  <Card
+    title="CLI"
+    description="Certify, promote, labels, and models."
+    href="/docs/reference/cli"
+  />
+</Cards>

package/site/content/docs/elements/ai/index.mdx

@@ -321,7 +321,8 @@ Compose does not pin inference — BYO URL + keys, or [OpenRouter](/docs/recipes
 - [Models](/docs/elements/ai/models) — provider registry and `baseUrl` rules
 - [Prompts](/docs/elements/ai/prompts) — `via`, budgets, versions, evals
 - [Agents](/docs/elements/ai/agents) — `fx.run`, tools, `maxSteps`
-- [Decisions](/docs/elements/ai/decide) — `fx.decide`, `how`, and the lockfile
+- [Deciders](/docs/elements/ai/deciders) — the model that answers, and how its certificate is pinned
+- [Decisions](/docs/elements/ai/decide) — `fx.decide`, `otherwise`, and the lockfile
 - [MCP](/docs/elements/ai/mcp) — inbound `mcp.tool` and outbound `ai.mcpServer`
 - [OpenRouter](/docs/recipes/openrouter) — zero-Docker cloud path
 - [fx](/docs/reference/fx) — `fx.ask` / `fx.run` / `fx.decide` / `fx.embed`

package/site/content/docs/elements/ai/meta.json

@@ -1,5 +1,5 @@
 {
   "title": "AI",
   "icon": "Sparkles",
-  "pages": ["index", "models", "prompts", "agents", "decide", "events", "mcp"]
+  "pages": ["index", "models", "prompts", "agents", "deciders", "decide", "events", "mcp"]
 }

package/site/content/docs/reference/cli.mdx

@@ -134,8 +134,8 @@ Override app / console / mcp listen ports in `oke.config.ts` `ports` — see
 | `docker`     | Derive compose · clean leftover stacks                       | `--prod\|-p`, `--out`, `--config`, `--manifest`; sub `clean`                                                                                              |
 | `images`     | List / pin digests                                           | `list` · `pin`                                                                                                                                            |
 | `build`      | Tree-shaken bundle                                           | `--target\|-t bun\|node\|edge`, `--entry`, `--outdir`                                                                                                     |
-| `eval`       | Prompt eval sets (CI gate)                                   | `--manifest`, `--certify` (decision seed certificate; prompt evals stay as they are)                                                                      |
-| `decide`     | Write a decision lockfile from the operator candidate        | `promote <name>` (`--origin`, `--lock`)                                                                                                                   |
+| `eval`       | Prompt eval sets (CI gate)                                   | `--manifest`                                                                                                                                              |
+| `decide`     | Certify, promote, export labels, list models                 | `certify <name> --deciders a,b` · `promote <name>` (`--origin`, `--lock`) · `labels <name> --export` · `models`                                           |
 | `ai`         | Configure AI driver + models                                 | `setup` (`--provider`, `--chat`, `--vision`, `--embed`, `--yes`)                                                                                          |
 | `branch`     | Fork journaled state                                         | `<name>`, `--at\|-a`                                                                                                                                      |
 | `replay`     | Re-invoke a past Flow from Runs                              | `--request-id\|-r`, `--entry`, `--dry-run`, `--live`                                                                                                      |

package/site/content/docs/reference/configuration.mdx

@@ -99,7 +99,7 @@ Built-in defaults (`DRIVER_DEFAULTS`) when a key is omitted:
 | `channel.sms`   | — (opt-in) | —         | —          |
 | `runs`          | `files`    | `memory`  | `files`    |
 
-`store.index`, `channel.whatsapp` / `push`, and `ai` have no single three-env default table — set them explicitly when you need them. create-oke templates pin `vault.dev: "vault"` (built-in) because the default `dev` driver is `env`.
+`store.index`, `channel.whatsapp` / `push`, and `ai` have no single three-env default table — set them explicitly when you need them. `drivers.decide` defaults to `{ test: "mock" }`. Unset `dev` and `prod` call the decider host. create-oke templates pin `vault.dev: "vault"` (built-in) because the default `dev` driver is `env`.
 
 ## Driver keys and ids
 
@@ -118,6 +118,7 @@ Built-in defaults (`DRIVER_DEFAULTS`) when a key is omitted:
 | `channel.whatsapp` | env driver map | `console` · `wa-cloud`                                                           |
 | `channel.push`     | env driver map | `console` · `webpush` · `fcm`                                                    |
 | `ai`               | env driver map | `mock` · `anthropic` · `openai-compatible` · `bedrock` · `vertex`                |
+| `decide`           | env driver map | `mock` in `test` when omitted. Unset `dev` and `prod` call the decider host.     |
 | `runs`             | env driver map | `memory` · `files` (Parquet + DuckDB at `.oke/runs`) · `postgres` · `clickhouse` |
 | `prod`             | `string[]`     | flat protocol list for the Manifest — nested maps are preferred                  |
 

package/site/content/docs/reference/fx.mdx

@@ -163,6 +163,7 @@ Read `fx.principal` for audit — it does not copy into `fx.auth`. Passing a Flo
 
 `fx.store(db).transaction(async (tx) => { … })` pins one SQL connection. `fx.emit` inside the
 callback stages on the signal outbox and publishes after commit. A throw rolls that batch back.
+
 `fx.store(db).run(builder)` runs a Drizzle builder through `toSQL()`. Joins stay on that builder;
 the hand-rolled chain does not grow a join API. Inference still records every joined table.
 
@@ -246,13 +247,13 @@ elements.
 
 ## AI
 
-| Signature                                             | Records                   | Returns                                                                                                                             |
-| ----------------------------------------------------- | ------------------------- | ----------------------------------------------------------------------------------------------------------------------------------- |
-| `fx.ask(prompt, input?, { via?, tools?, maxSteps? })` | `ask` (+ `call` per tool) | Object validated against the prompt's `out`                                                                                         |
-| `fx.run(agent, input?)`                               | `ask`                     | Agent result                                                                                                                        |
-| `fx.stream(model, { prompt?, data?, via? })`          | `ask`                     | `AsyncIterable<string>` — real driver stream; cancels via ambient `fx.signal` (HTTP disconnect included)                            |
-| `fx.search(embed, query, { topK? })`                  | `read`                    | Matches from the index/embed                                                                                                        |
-| `fx.decide(decision, input)`                          | `decide`                  | `$.<question>.how` is `auto`, `reviewed`, or `abstained`. `audited` is a boolean flag, not a `how`. Abstain makes the value `null`. |
+| Signature                                             | Records                   | Returns                                                                                                                                                                                                     |
+| ----------------------------------------------------- | ------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `fx.ask(prompt, input?, { via?, tools?, maxSteps? })` | `ask` (+ `call` per tool) | Object validated against the prompt's `out`                                                                                                                                                                 |
+| `fx.run(agent, input?)`                               | `ask`                     | Agent result                                                                                                                                                                                                |
+| `fx.stream(model, { prompt?, data?, via? })`          | `ask`                     | `AsyncIterable<string>` — real driver stream; cancels via ambient `fx.signal` (HTTP disconnect included)                                                                                                    |
+| `fx.search(embed, query, { topK? })`                  | `read`                    | Matches from the index/embed                                                                                                                                                                                |
+| `fx.decide(decision, input)`                          | `decide`                  | `$.<question>.how` is `auto`, `reviewed`, or `abstained`. `by` is the decider. `why` is set only when the question is not `auto`. `audited` is a boolean flag, not a `how`. Abstain makes the value `null`. |
 
 AI calls are nondeterministic: journaling is forced on and auto-cache disabled around them. `tools` are Flow refs — each model tool call goes through `fx.call` (same capability and Runs path).
 
@@ -289,8 +290,9 @@ Durations: `"200ms"` · `"30s"` · `"2m"` · `"1h"` · `"7d"`. A `"d"` is 86_400
 
 Pure store-read flows cache by default. A send, emit, fetch, vault read, ask,
 decide, or `fx.call` is never cached. The key includes tenant, locale, scopes,
-and membership roles. Writes through `fx` invalidate those keys. `cache: false`
-always disables. `oke({ cache: { auto: false } })` turns the default off.
+and membership roles. Writes through `fx` invalidate those keys.
+
+`cache: false` always disables. `oke({ cache: { auto: false } })` turns the default off.
 Cross-instance invalidation and out-of-band writes are not covered.
 
 `fx.cache` is the manual (tier-3) surface:

package/src/cli/agents-md.test.ts

@@ -4,7 +4,7 @@
 
 import { readFileSync } from "node:fs";
 import { describe, expect, test } from "bun:test";
-import { commandNames } from "./registry.ts";
+import { commandNames, OKE_COMMANDS } from "./registry.ts";
 
 describe("AGENTS.md commands", () => {
   test("every oke command mentioned in AGENTS.md is registered", () => {
@@ -17,7 +17,13 @@ describe("AGENTS.md commands", () => {
     }
     expect(mentioned.has("eval")).toBe(true);
     expect(mentioned.has("decide")).toBe(true);
-    expect(text).not.toContain("oke decide certify");
+    const decide = OKE_COMMANDS.find((command) => command.name === "decide");
+    expect(decide?.subcommands?.map((command) => command.name).sort()).toEqual([
+      "certify",
+      "labels",
+      "models",
+      "promote",
+    ]);
     for (const name of mentioned) {
       expect(registered.has(name)).toBe(true);
     }

package/src/cli/decide-certify.test.ts

@@ -0,0 +1,166 @@
+/**
+ * `oke decide certify` writes one certificate per decider.
+ */
+
+import { afterEach, describe, expect, test } from "bun:test";
+import { mkdtemp } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { ai, resetAiDecls } from "../elements/ai.ts";
+import { resetDecisionCertificates } from "../elements/ai/decisions/certificate.ts";
+import { ALIAS_CERTIFICATE_MS } from "../elements/ai/deciders/presets.ts";
+import { certifyDecisionDeciders } from "./decide.ts";
+
+afterEach(() => {
+  resetAiDecls();
+  resetDecisionCertificates();
+});
+
+function seed(): string {
+  return Array.from({ length: 160 }, () =>
+    JSON.stringify({ input: { ticket: "1" }, expect: { team: "technical" } }),
+  ).join("\n");
+}
+
+function body(model: string) {
+  return {
+    model,
+    answers: {
+      team: {
+        type: "choice" as const,
+        choice: "technical",
+        probabilities: { billing: 0.05, technical: 0.93, none_of_these: 0.02 },
+      },
+    },
+    usage: { cost: 0.01 },
+  };
+}
+
+describe("oke decide certify", () => {
+  test("two mock deciders each get a certificate and an alias is unpinned", async () => {
+    const question = ai.choice("which team", { billing: "Billing", technical: "Technical" });
+    ai.decider("jev", { provider: "openrouter", model: "typesafe/jev-1.13.0" });
+    ai.decider("luna", { provider: "openai", model: "gpt-6-luna" });
+    ai.decision("triage", {
+      decider: ai.decider("jev", { provider: "openrouter", model: "typesafe/jev-1.13.0" }),
+      backup: [ai.decider("luna", { provider: "openai", model: "gpt-6-luna" })],
+      otherwise: "abstain",
+      autonomy: { maxError: 0.05, audit: 0 },
+      ask: { team: question },
+    });
+    const root = await mkdtemp(join(tmpdir(), "oke-certify-"));
+    const evals = join(root, "seed.jsonl");
+    await Bun.write(evals, seed());
+    const lines: string[] = [];
+    const now = 1_700_000_000_000;
+    const lock = await certifyDecisionDeciders({
+      root,
+      decision: "triage",
+      deciders: ["jev", "luna"],
+      now: () => now,
+      fetcher: async () => new Response("offline", { status: 404 }),
+      write: (line) => {
+        lines.push(line);
+      },
+      evaluate: {
+        jev: async () => body("typesafe/jev-1.13.0"),
+        luna: async () => body("gpt-6-luna"),
+      },
+      manifest: {
+        oke: "1.0",
+        app: "cert",
+        ai: {
+          deciders: {
+            jev: {
+              driverId: "systemone",
+              baseUrl: "https://openrouter.ai/api/alpha/decisions",
+              model: "typesafe/jev-1.13.0",
+              secret: "OPENROUTER_API_KEY",
+              pinning: "dated",
+              capabilities: { boolean: true, choice: true, score: true, refusal: false },
+            },
+            luna: {
+              driverId: "openai-decisions",
+              baseUrl: "https://api.openai.com/v1/decisions",
+              model: "gpt-6-luna",
+              secret: "OPENAI_API_KEY",
+              pinning: "alias",
+              capabilities: { boolean: true, choice: true, score: true, refusal: true },
+            },
+          },
+          decisions: {
+            triage: {
+              mode: "abstain",
+              decider: "jev",
+              backup: ["luna"],
+              otherwise: "abstain",
+              questions: ["team"],
+              evals,
+              autonomy: { maxError: 0.05, audit: 0 },
+            },
+          },
+        },
+      },
+    });
+    expect(lock.version).toBe(2);
+    expect(lock.decisions.triage?.deciders.jev?.pinned).toBe(true);
+    expect(lock.decisions.triage?.deciders.jev?.model).toBe("typesafe/jev-1.13.0");
+    expect(lock.decisions.triage?.deciders.luna).toMatchObject({
+      model: "gpt-6-luna",
+      pinned: false,
+      expiresAt: now + ALIAS_CERTIFICATE_MS,
+    });
+    expect(lines.some((line) => line.includes('decider "luna"') && line.includes("unpinned"))).toBe(
+      true,
+    );
+    expect(lines.some((line) => line.startsWith("jev\tteam\taccuracy"))).toBe(true);
+    expect(lines.some((line) => line.startsWith("luna\tteam\taccuracy"))).toBe(true);
+  });
+
+  test("a dated catalog slug is required when it differs from the configured model", async () => {
+    ai.decider("jev", { provider: "openrouter", model: "typesafe/jev-1.13" });
+    ai.decision("triage", {
+      decider: ai.decider("jev", { provider: "openrouter", model: "typesafe/jev-1.13" }),
+      otherwise: "abstain",
+      ask: { team: ai.choice("which", { a: "A" }) },
+    });
+    const root = await mkdtemp(join(tmpdir(), "oke-dated-"));
+    const evals = join(root, "seed.jsonl");
+    await Bun.write(evals, seed());
+    await expect(
+      certifyDecisionDeciders({
+        root,
+        decision: "triage",
+        deciders: ["jev"],
+        evaluate: { jev: async () => body("typesafe/jev-1.13") },
+        fetcher: async () =>
+          new Response(
+            JSON.stringify({
+              data: [
+                {
+                  id: "typesafe/jev-1.13",
+                  canonical_slug: "typesafe/jev-1.13-20260917",
+                },
+              ],
+            }),
+            { status: 200 },
+          ),
+        manifest: {
+          oke: "1.0",
+          app: "cert",
+          ai: {
+            decisions: {
+              triage: {
+                mode: "abstain",
+                decider: "jev",
+                otherwise: "abstain",
+                questions: ["team"],
+                evals,
+              },
+            },
+          },
+        },
+      }),
+    ).rejects.toThrow(/autonomy requires model "typesafe\/jev-1.13-20260917"/);
+  });
+});

package/src/cli/decide.ts

@@ -11,6 +11,10 @@ import {
   type DecisionLockfile,
 } from "../elements/ai/decisions/certificate.ts";
 import { DECISION_EXPORT_WARNING } from "../elements/ai/decisions/export.ts";
+import { ALIAS_CERTIFICATE_MS } from "../elements/ai/deciders/presets.ts";
+import { requiredDatedModel } from "../elements/ai/decisions/catalog.ts";
+import type { Manifest } from "../manifest/types.ts";
+import type { DecisionEvaluate } from "../elements/ai/decisions/certify.ts";
 
 /** Options for {@link promoteDecision}. */
 export interface PromoteDecisionOptions {
@@ -137,22 +141,115 @@ async function exportLabelsCommand(name: string | undefined, rest: string[]): Pr
  *
  * @param args - Remaining argv after `decide`
  */
+/**
+ * Certify one decision for each named decider and write lockfile version 2.
+ *
+ * @param options - Decision, deciders, and injected evaluators
+ */
+export async function certifyDecisionDeciders(options: {
+  readonly root: string;
+  readonly manifest: Manifest;
+  readonly decision: string;
+  readonly deciders: readonly string[];
+  readonly evaluate: Readonly<Record<string, DecisionEvaluate>>;
+  readonly now?: () => number;
+  readonly fetcher?: (input: string, init?: RequestInit) => Promise<Response>;
+  readonly write?: (text: string) => void;
+}): Promise<DecisionLockfile> {
+  const { certifySeed } = await import("../elements/ai/decisions/certify.ts");
+  const { aiDecisionRegistry, aiDeciderRegistry } = await import("../kernel/element-registries.ts");
+  const decl = aiDecisionRegistry.find((item) => item.name === options.decision);
+  const decision = options.manifest.ai?.decisions?.[options.decision];
+  if (!decl || !decision) {
+    throw new Error(`oke decide certify: decision "${options.decision}" is not loaded`);
+  }
+  if (!decision.evals) {
+    throw new Error(`oke decide certify: decision "${options.decision}" has no evals`);
+  }
+  const text = await Bun.file(resolve(options.root, decision.evals)).text();
+  const lockPath = resolve(options.root, DECISION_LOCK_FILENAME);
+  const existing = Bun.file(lockPath);
+  let current: DecisionLockfile | undefined;
+  if (await existing.exists()) current = parseDecisionLockfile(await existing.json());
+  const write = options.write ?? ((line: string) => process.stdout.write(line));
+  const deciders: Record<string, DecisionLockfile["decisions"][string]["deciders"][string]> = {
+    ...(current?.decisions[options.decision]?.deciders ?? {}),
+  };
+  for (const name of options.deciders) {
+    const decider = aiDeciderRegistry.find((item) => item.name === name) ?? undefined;
+    const manifestDecider = options.manifest.ai?.deciders?.[name];
+    if (!decider && !manifestDecider) {
+      throw new Error(`oke decide certify: decider "${name}" is not loaded`);
+    }
+    const model = decider?.model ?? manifestDecider?.model ?? "";
+    const pinning = decider?.pinning ?? manifestDecider?.pinning ?? "dated";
+    const baseUrl = decider?.baseUrl ?? manifestDecider?.baseUrl ?? "";
+    const required = await requiredDatedModel(model, baseUrl, pinning, options.fetcher);
+    if (required && required !== model) {
+      throw new Error(
+        `oke decide certify: autonomy requires model "${required}" on decider "${name}"`,
+      );
+    }
+    const evaluate = options.evaluate[name];
+    if (!evaluate) throw new Error(`oke decide certify: no evaluator for decider "${name}"`);
+    const alias = pinning === "alias";
+    const now = options.now ?? Date.now;
+    const result = await certifySeed({
+      model,
+      pinned: !alias,
+      ...(alias ? { expiresAt: now() + ALIAS_CERTIFICATE_MS } : {}),
+      maxError: decision.autonomy?.maxError ?? decl.autonomy?.maxError ?? 0.05,
+      delta: decision.autonomy?.risk ?? decl.autonomy?.risk ?? 0.1,
+      jsonl: text,
+      ask: decl.ask,
+      evaluate,
+      now,
+    });
+    deciders[name] = result.cert;
+    if (result.unpinned) {
+      write(`oke decide certify: decider "${name}" model "${result.cert.model}" is unpinned\n`);
+    }
+    for (const [question, row] of Object.entries(result.report)) {
+      write(
+        `${name}\t${question}\taccuracy ${row.accuracy.toFixed(3)}\tECE ${row.ece.toFixed(3)}\tcoverage ${row.coverage.toFixed(3)}\tp50 ${row.p50Ms}ms\tp95 ${row.p95Ms}ms\tcost ${row.cost}\n`,
+      );
+    }
+  }
+  const next: DecisionLockfile = {
+    version: 2,
+    decisions: { ...(current?.decisions ?? {}), [options.decision]: { deciders } },
+  };
+  await Bun.write(lockPath, `${JSON.stringify(next, null, 2)}\n`);
+  const { setDecisionDrift } = await import("../elements/ai/decisions/certificate.ts");
+  const { persistDecisionDrift } = await import("../elements/ai/decisions/labels.ts");
+  setDecisionDrift(options.decision, false);
+  persistDecisionDrift(options.decision, false);
+  return next;
+}
+
 export async function decideCli(args: string[]): Promise<number> {
   const [sub, name, ...rest] = args;
   if (sub === "--help" || sub === "-h" || !sub) {
     console.log(`oke decide promote <name> [--origin URL] [--lock path]
 oke decide labels <name> --export [--out file] [--origin URL]
+oke decide certify <name> --deciders a,b
+oke decide models
 
 promote fetches the operator candidate and writes oke-decisions.lock.json.
 labels --export writes reviewed labels as seed JSONL. The file contains production data.
+certify writes one certificate per decider. models lists decision models.
 `);
     return sub ? 0 : 1;
   }
   if (sub === "labels") return exportLabelsCommand(name, rest);
+  if (sub === "models") {
+    const { fetchDecisionModels } = await import("../elements/ai/decisions/catalog.ts");
+    process.stdout.write(await fetchDecisionModels());
+    return 0;
+  }
+  if (sub === "certify") return certifyCommand(name, rest);
   if (sub !== "promote" || !name) {
-    console.error(
-      "oke decide: expected `oke decide promote <name>` or `oke decide labels <name> --export`",
-    );
+    console.error("oke decide: expected promote, labels, certify, or models");
     return 1;
   }
   let origin = process.env.OKE_ORIGIN ?? "http://127.0.0.1:6530";
@@ -172,3 +269,73 @@ labels --export writes reviewed labels as seed JSONL. The file contains producti
   });
   return 0;
 }
+
+async function certifyCommand(name: string | undefined, rest: string[]): Promise<number> {
+  if (!name) {
+    console.error("oke decide: expected `oke decide certify <name> --deciders a,b`");
+    return 1;
+  }
+  const flag = rest.indexOf("--deciders");
+  const list = flag >= 0 ? rest[flag + 1] : undefined;
+  if (!list) {
+    console.error("oke decide certify: --deciders is required");
+    return 1;
+  }
+  const deciders = list
+    .split(",")
+    .map((item) => item.trim())
+    .filter((item) => item.length > 0);
+  const { resolveStartEntry } = await import("./start.ts");
+  const root = resolve(process.env["OKE_ROOT_DIR"] ?? ".");
+  try {
+    await import(await resolveStartEntry(root));
+  } catch (error) {
+    console.error(
+      `oke decide certify: failed to load the app: ${error instanceof Error ? error.message : String(error)}`,
+    );
+    return 1;
+  }
+  const manifestPath = resolve(root, "oke.manifest.json");
+  const file = Bun.file(manifestPath);
+  if (!(await file.exists())) {
+    console.error(`oke decide certify: manifest not found: ${manifestPath}`);
+    return 1;
+  }
+  const manifest = (await file.json()) as Manifest;
+  const { aiDeciderRegistry, aiDecisionRegistry } = await import("../kernel/element-registries.ts");
+  const decl = aiDecisionRegistry.find((item) => item.name === name);
+  if (!decl) {
+    console.error(`oke decide certify: decision "${name}" is not loaded`);
+    return 1;
+  }
+  const evaluate: Record<string, DecisionEvaluate> = {};
+  for (const id of deciders) {
+    const decider = aiDeciderRegistry.find((item) => item.name === id);
+    if (!decider) {
+      console.error(`oke decide certify: decider "${id}" is not loaded`);
+      return 1;
+    }
+    const apiKey = process.env[decider.secret];
+    if (!apiKey) {
+      console.error(`oke decide certify: secret "${decider.secret}" is not configured`);
+      return 1;
+    }
+    evaluate[id] = async (input) => {
+      const { decisionHttp } = await import("../elements/ai/decisions/http.ts");
+      const { encodeDecisionRequest, normalizeDecisionResponse, wireQuestions } =
+        await import("../elements/ai/decisions/codec.ts");
+      const request = { model: decider.model, state: input, questions: wireQuestions(decl.ask) };
+      const raw = await decisionHttp({
+        url: decider.baseUrl,
+        apiKey,
+        request,
+        body: encodeDecisionRequest(decider.protocol, request),
+        timeoutMs: 30_000,
+        breakerKey: decider.name,
+      });
+      return normalizeDecisionResponse(decider.protocol, raw);
+    };
+  }
+  await certifyDecisionDeciders({ root, manifest, decision: name, deciders, evaluate });
+  return 0;
+}