okengine 0.23.2 → 0.24.0

package/src/cli/decision-lock-watch.test.ts

@@ -20,7 +20,7 @@ describe("decision lockfile watch", () => {
     const path = join(root, DECISION_LOCK_FILENAME);
     await Bun.write(
       path,
-      `${JSON.stringify({ decisions: { triage: { model: "m", questions: {} } } })}\n`,
+      `${JSON.stringify({ version: 2, decisions: { triage: { deciders: { jev: { model: "m", pinned: true, questions: {} } } } } })}\n`,
     );
     let listener: ((event: "rename" | "change", filename: string | null) => void) | undefined;
     const watch = watchDecisionLockfile(root, (_path, _options, next) => {
@@ -29,15 +29,15 @@ describe("decision lockfile watch", () => {
     });
     listener?.("change", DECISION_LOCK_FILENAME);
     await watch.flushed();
-    expect(getDecisionLock()?.decisions.triage?.model).toBe("m");
+    expect(getDecisionLock()?.decisions.triage?.deciders.jev?.model).toBe("m");
 
     await Bun.write(
       path,
-      `${JSON.stringify({ decisions: { route: { model: "n", questions: {} } } })}\n`,
+      `${JSON.stringify({ version: 2, decisions: { route: { deciders: { jev: { model: "n", pinned: true, questions: {} } } } } })}\n`,
     );
     listener?.("change", DECISION_LOCK_FILENAME);
     await watch.flushed();
-    expect(getDecisionLock()?.decisions.route?.model).toBe("n");
+    expect(getDecisionLock()?.decisions.route?.deciders.jev?.model).toBe("n");
     expect(getDecisionLock()?.decisions.triage).toBeUndefined();
     watch.close();
     resetDecisionCertificates();

package/src/cli/eval.ts

@@ -97,23 +97,19 @@ export async function runOkeEval(options: OkeEvalOptions = {}): Promise<number>
  */
 export async function evalCli(args: string[]): Promise<number> {
   let manifestPath: string | undefined;
-  let certify = false;
   for (let i = 0; i < args.length; i++) {
     const a = args[i]!;
     if (a === "--manifest" || a === "-m") {
       manifestPath = args[++i];
-    } else if (a === "--certify") {
-      certify = true;
     } else if (a === "--help" || a === "-h") {
-      console.log(`oke eval [--manifest oke.manifest.json] [--certify]
+      console.log(`oke eval [--manifest oke.manifest.json]
 
 Run prompt eval sets declared in the Manifest. Fails CI on regression.
---certify builds a decision certificate from each decision seed file.
+Decision certificates are \`oke decide certify\`.
 `);
       return 0;
     }
   }
-  if (certify) return runOkeCertify({ manifestPath });
   return runOkeEval({ manifestPath });
 }
 
@@ -131,7 +127,7 @@ export async function runOkeCertify(
   } = {},
 ): Promise<number> {
   const { certifySeed } = await import("../elements/ai/decisions/certify.ts");
-  const { aiDecisionRegistry } = await import("../kernel/element-registries.ts");
+  const { aiDeciderRegistry, aiDecisionRegistry } = await import("../kernel/element-registries.ts");
   const { DECISION_LOCK_FILENAME, parseDecisionLockfile } =
     await import("../elements/ai/decisions/certificate.ts");
   const { resolveStartEntry } = await import("./start.ts");
@@ -168,28 +164,39 @@ export async function runOkeCertify(
   const current = (await existingFile.exists())
     ? parseDecisionLockfile(await existingFile.json())
     : undefined;
-  const next = { decisions: { ...(current?.decisions ?? {}) } };
+  const next: {
+    version: 2;
+    decisions: Record<string, { deciders: Record<string, unknown> }>;
+  } = { version: 2, decisions: { ...(current?.decisions ?? {}) } };
   for (const name of names) {
     const decision = decisions[name];
     if (!decision?.evals) {
-      process.stdout.write(`oke eval: skip ${name} (no evals)\n`);
+      process.stdout.write(`oke decide certify: skip ${name} (no evals)\n`);
       continue;
     }
     const decl = aiDecisionRegistry.find((item) => item.name === name);
     if (!decl) {
-      console.error(`oke eval: decision "${name}" is not loaded`);
+      console.error(`oke decide certify: decision "${name}" is not loaded`);
+      return 1;
+    }
+    const decider = aiDeciderRegistry.find((item) => item.name === decl.decider);
+    if (!decider) {
+      console.error(`oke decide certify: decider "${decl.decider}" is not loaded`);
       return 1;
     }
     const text = await Bun.file(resolve(root, decision.evals)).text();
-    const evaluate = injected ?? (await providerForDecision(decl));
-    next.decisions[name] = await certifySeed({
-      model: decl.model ?? decision.model ?? "",
+    const evaluate = injected ?? (await providerForDecider(decl, decider));
+    const result = await certifySeed({
+      model: decider.model,
+      pinned: decider.pinning !== "alias",
       maxError: decision.autonomy?.maxError ?? 0.05,
       delta: decision.autonomy?.risk ?? decl.autonomy?.risk ?? 0.1,
       jsonl: text,
       ask: decl.ask,
       evaluate,
     });
+    const prev = next.decisions[name]?.deciders ?? {};
+    next.decisions[name] = { deciders: { ...prev, [decider.name]: result.cert } };
   }
   await Bun.write(lockPath, `${JSON.stringify(next, null, 2)}\n`);
   const { setDecisionDrift } = await import("../elements/ai/decisions/certificate.ts");
@@ -201,53 +208,25 @@ export async function runOkeCertify(
   return 0;
 }
 
-async function providerForDecision(
+async function providerForDecider(
   decl: import("../elements/ai/declare.ts").AiDecisionDecl,
+  decider: import("../elements/ai/declare.ts").AiDeciderDecl,
 ): Promise<(input: unknown) => Promise<DecisionResponse>> {
-  const typesafe = decl.driverId === "typesafe";
-  const keyName = typesafe ? "TYPESAFE_API_KEY" : "OPENROUTER_API_KEY";
-  const apiKey = process.env[keyName];
-  if (!apiKey) throw new Error(`oke eval: secret "${keyName}" is not configured`);
-  const { createTypesafeDecisionProvider, TYPESAFE_JEV_MODEL } =
-    await import("../elements/ai/decisions/typesafe.ts");
-  const { createOpenRouterDecisionProvider, OPENROUTER_JEV_MODEL } =
-    await import("../elements/ai/decisions/openrouter.ts");
-  const provider = typesafe
-    ? createTypesafeDecisionProvider(apiKey)
-    : createOpenRouterDecisionProvider(apiKey);
-  const model = decl.model ?? (typesafe ? TYPESAFE_JEV_MODEL : OPENROUTER_JEV_MODEL);
-  return (input) =>
-    provider.evaluate({
-      model,
-      state: input,
-      questions: wireFromDecl(decl),
+  const apiKey = process.env[decider.secret];
+  if (!apiKey) throw new Error(`oke decide certify: secret "${decider.secret}" is not configured`);
+  return async (input) => {
+    const { decisionHttp } = await import("../elements/ai/decisions/http.ts");
+    const { encodeDecisionRequest, normalizeDecisionResponse, wireQuestions } =
+      await import("../elements/ai/decisions/codec.ts");
+    const request = { model: decider.model, state: input, questions: wireQuestions(decl.ask) };
+    const raw = await decisionHttp({
+      url: decider.baseUrl,
+      apiKey,
+      request,
+      body: encodeDecisionRequest(decider.protocol, request),
+      timeoutMs: 30_000,
+      breakerKey: decider.name,
     });
-}
-
-function wireFromDecl(
-  decl: import("../elements/ai/declare.ts").AiDecisionDecl,
-): import("../elements/ai/decisions/provider.ts").DecisionRequest["questions"] {
-  const questions: Record<string, import("../elements/ai/decisions/provider.ts").WireQuestion> = {};
-  for (const [id, question] of Object.entries(decl.ask)) {
-    if (question.kind === "choice") {
-      questions[id] = {
-        type: "choice",
-        instructions: question.instructions,
-        criteria: { ...question.options, none_of_these: null },
-      };
-    } else if (question.kind === "score") {
-      questions[id] = {
-        type: "score",
-        instructions: question.instructions,
-        criteria: question.levels,
-      };
-    } else {
-      questions[id] = {
-        type: "noul",
-        instructions: question.instructions,
-        ...(question.criteria !== undefined ? { criteria: question.criteria } : {}),
-      };
-    }
-  }
-  return questions;
+    return normalizeDecisionResponse(decider.protocol, raw);
+  };
 }

package/src/cli/mcp-from-console.ts

@@ -79,7 +79,7 @@ export function mcpContextFromConsole(state: McpConsoleSurface): McpContext {
         if (row.status !== "pending" || row.labelOnly) continue;
         pending[row.decision] = (pending[row.decision] ?? 0) + 1;
       }
-      return projectMcpDecisions(state.manifest, pending, fitted);
+      return projectMcpDecisions(state.manifest, pending, fitted, queue);
     },
     proposeStructural: async (input) =>
       emitStructuralDiff({

package/src/cli/registry.ts

@@ -550,15 +550,7 @@ export const OKE_COMMANDS: readonly CliCommand[] = [
     name: "eval",
     summary: "prompt eval sets (CI gate)",
     leaf: true,
-    flags: [
-      MANIFEST,
-      {
-        long: "--certify",
-        takesValue: false,
-        summary: "Build a decision certificate from the seed file",
-      },
-      HELP,
-    ],
+    flags: [MANIFEST, HELP],
   },
   {
     name: "decide",
@@ -584,6 +576,50 @@ export const OKE_COMMANDS: readonly CliCommand[] = [
           HELP,
         ],
       },
+      {
+        name: "labels",
+        summary: "Export reviewed labels as seed JSONL",
+        positionals: "<name>",
+        flags: [
+          {
+            long: "--export",
+            takesValue: false,
+            summary: "Write the JSONL file",
+          },
+          {
+            long: "--out",
+            takesValue: true,
+            valueName: "file",
+            summary: "Output path",
+          },
+          {
+            long: "--origin",
+            takesValue: true,
+            valueName: "url",
+            summary: "App origin",
+          },
+          HELP,
+        ],
+      },
+      {
+        name: "certify",
+        summary: "Write one certificate per decider",
+        positionals: "<name>",
+        flags: [
+          {
+            long: "--deciders",
+            takesValue: true,
+            valueName: "a,b",
+            summary: "Decider names",
+          },
+          HELP,
+        ],
+      },
+      {
+        name: "models",
+        summary: "List decision models",
+        flags: [HELP],
+      },
     ],
   },
   {

package/src/compiler/decisions.extract.test.ts

@@ -1,27 +1,37 @@
 /**
- * Decision extraction: exclusive modes, and review cannot sit on HTTP.
+ * Decision extraction: decider, otherwise, and capability limits.
  */
 
 import { describe, expect, test } from "bun:test";
 import { extractFromSources } from "./extract.ts";
 
-const header = `const triage = ai.decision("triage", {\n`;
+const decider = `const jev = ai.decider("jev", { provider: "openrouter", model: "typesafe/jev-1.13" });\n`;
 
 describe("ai.decision extract", () => {
-  test("review and abstain together fail to compile", async () => {
+  test("a decision without otherwise fails to compile", async () => {
     await expect(
       extractFromSources({
-        "src/flows/run.ts": `${header}  review: "ops",\n  onUncertain: "abstain",\n  ask: { team: ai.choice("which", { a: "A" }) },\n});\n`,
+        "src/flows/run.ts": `${decider}ai.decision("triage", {\n  decider: jev,\n  ask: { team: ai.choice("which", { a: "A" }) },\n});\n`,
       }),
-    ).rejects.toThrow(/exactly one of review/);
+    ).rejects.toThrow(/otherwise is required/);
   });
 
-  test("an HTTP trigger that reviews fails to compile", async () => {
+  test("shadow fails to compile as planned", async () => {
+    await expect(
+      extractFromSources({
+        "src/flows/run.ts": `${decider}ai.decision("triage", {\n  decider: jev,\n  otherwise: "abstain",\n  shadow: "other",\n  ask: { team: ai.choice("which", { a: "A" }) },\n});\n`,
+      }),
+    ).rejects.toThrow(/planned/);
+  });
+
+  test("an HTTP trigger that parks fails to compile", async () => {
     await expect(
       extractFromSources({
         "src/flows/run.ts": `
+          const jev = ai.decider("jev", { provider: "openrouter", model: "m" });
           const triage = ai.decision("triage", {
-            review: "ops",
+            decider: jev,
+            otherwise: "ops",
             ask: { team: ai.choice("which", { a: "A" }) },
           });
           on(http.post("/t"), flow("run", {
@@ -33,38 +43,52 @@ describe("ai.decision extract", () => {
     ).rejects.toThrow(/fx\.emit/);
   });
 
-  test("choice, score, and duplicate names fail at compile time", async () => {
-    const many = Array.from({ length: 255 }, (_, i) => `o${i}: "x"`).join(", ");
+  test("a custom decider's max choices fails at compile time", async () => {
     await expect(
       extractFromSources({
-        "src/flows/run.ts": `${header}  onUncertain: "abstain",\n  ask: { team: ai.choice("which", { ${many} }) },\n});\n`,
+        "src/flows/run.ts": `
+          const host = ai.decider("host", {
+            driverId: "systemone",
+            baseUrl: "https://example.test/decisions",
+            model: "m",
+            secret: "HOST_KEY",
+            capabilities: { boolean: true, choice: true, score: true, refusal: false, maxChoices: 1 },
+          });
+          ai.decision("triage", {
+            decider: host,
+            otherwise: "abstain",
+            ask: { team: ai.choice("which", { a: "A", b: "B" }) },
+          });
+        `,
       }),
-    ).rejects.toThrow(/max 254/);
+    ).rejects.toThrow(/allows 1/);
+  });
+
+  test("author none_of_these fails to compile", async () => {
     await expect(
       extractFromSources({
-        "src/flows/run.ts": `${header}  onUncertain: "abstain",\n  ask: { team: ai.choice("which", { none_of_these: null }) },\n});\n`,
+        "src/flows/run.ts": `${decider}ai.decision("triage", {\n  decider: jev,\n  otherwise: "abstain",\n  ask: { team: ai.choice("which", { none_of_these: null }) },\n});\n`,
       }),
     ).rejects.toThrow(/none_of_these/);
+  });
+
+  test("duplicate names fail to compile", async () => {
     await expect(
       extractFromSources({
-        "src/flows/run.ts": `${header}  onUncertain: "abstain",\n  ask: { rank: ai.score("rank", ["only"]) },\n});\n`,
-      }),
-    ).rejects.toThrow(/2–10 levels/);
-    await expect(
-      extractFromSources({
-        "src/flows/a.ts": `${header}  onUncertain: "abstain",\n  ask: { team: ai.choice("which", { a: "A", b: "B" }) },\n});\n`,
-        "src/flows/b.ts": `${header}  onUncertain: "abstain",\n  ask: { team: ai.choice("which", { a: "A", b: "B" }) },\n});\n`,
+        "src/flows/a.ts": `${decider}ai.decision("triage", {\n  decider: jev,\n  otherwise: "abstain",\n  ask: { team: ai.choice("which", { a: "A", b: "B" }) },\n});\n`,
+        "src/flows/b.ts": `${decider}ai.decision("triage", {\n  decider: jev,\n  otherwise: "abstain",\n  ask: { team: ai.choice("which", { a: "A", b: "B" }) },\n});\n`,
       }),
-    ).rejects.toThrow(/duplicate decision name/);
+    ).rejects.toThrow(/duplicate/);
   });
 
-  test("review records the gate name", async () => {
+  test("otherwise resolves a gate and a durable flow parks", async () => {
     const manifest = await extractFromSources({
       "src/flows/run.ts": `
-        const ops = gate.policy("ops", () => true);
+        const jev = ai.decider("jev", { provider: "openrouter", model: "m" });
         const triage = ai.decision("triage", {
-          review: ops,
-          ask: { team: ai.choice("which", { a: "A", b: "B" }) },
+          decider: jev,
+          otherwise: "ops",
+          ask: { team: ai.choice("which", { a: "A" }) },
         });
         on(signal.once("job"), flow("run", {
           durable: true,
@@ -72,15 +96,20 @@ describe("ai.decision extract", () => {
         }));
       `,
     });
+    expect(manifest.ai?.decisions?.triage?.otherwise).toBe("ops");
     expect(manifest.ai?.decisions?.triage?.review).toBe("ops");
+    expect(manifest.flows?.run?.effects?.secrets).toEqual(["OPENROUTER_API_KEY"]);
+    expect(manifest.ai?.deciders?.jev?.pinning).toBe("dated");
   });
 
-  test("review resolves a variable to the gate's declared name", async () => {
+  test("otherwise resolves a variable to the gate's declared name", async () => {
     const manifest = await extractFromSources({
       "src/flows/run.ts": `
+        const jev = ai.decider("jev", { provider: "openrouter", model: "m" });
         const someVar = gate.policy("ops", () => true);
         const triage = ai.decision("triage", {
-          review: someVar,
+          decider: jev,
+          otherwise: someVar,
           ask: { team: ai.choice("which", { a: "A", b: "B" }) },
         });
         on(signal.once("job"), flow("run", {
@@ -95,8 +124,10 @@ describe("ai.decision extract", () => {
   test("autonomy and evals survive extraction", async () => {
     const manifest = await extractFromSources({
       "src/flows/run.ts": `
+        const jev = ai.decider("jev", { provider: "openrouter", model: "m", region: "eu" });
         const triage = ai.decision("triage", {
-          onUncertain: "abstain",
+          decider: jev,
+          otherwise: "abstain",
           evals: "evals/triage.jsonl",
           autonomy: { maxError: 0.05, audit: 0.1, risk: 0.1 },
           ask: { team: ai.choice("which", { a: "A", b: "B" }) },
@@ -109,15 +140,19 @@ describe("ai.decision extract", () => {
       audit: 0.1,
       risk: 0.1,
     });
+    expect(manifest.ai?.deciders?.jev?.region).toBe("eu");
+    expect(manifest.ai?.deciders?.jev?.regionStatus).toBe("declared");
   });
 
   test("choice options passed through a variable fail to compile", async () => {
     await expect(
       extractFromSources({
         "src/flows/run.ts": `
+          const jev = ai.decider("jev", { provider: "openrouter", model: "m" });
           const options = { a: "A", b: "B" };
           ai.decision("triage", {
-            onUncertain: "abstain",
+            decider: jev,
+            otherwise: "abstain",
             ask: { team: ai.choice("which", options) },
           });
         `,
@@ -128,10 +163,12 @@ describe("ai.decision extract", () => {
   test("score levels and a whole question resolve a same-file const", async () => {
     const manifest = await extractFromSources({
       "src/flows/run.ts": `
+        const jev = ai.decider("jev", { provider: "openrouter", model: "m" });
         const levels = ["low", "high"];
         const team = ai.choice("which", { a: "A", b: "B" });
         ai.decision("triage", {
-          onUncertain: "abstain",
+          decider: jev,
+          otherwise: "abstain",
           ask: { team, rank: ai.score("rank", levels) },
         });
       `,
@@ -143,8 +180,10 @@ describe("ai.decision extract", () => {
     await expect(
       extractFromSources({
         "src/flows/run.ts": `
+          const jev = ai.decider("jev", { provider: "openrouter", model: "m" });
           ai.decision("triage", {
-            onUncertain: "abstain",
+            decider: jev,
+            otherwise: "abstain",
             ask: { rank: ai.score("rank", missing) },
           });
         `,
@@ -153,12 +192,28 @@ describe("ai.decision extract", () => {
     await expect(
       extractFromSources({
         "src/flows/run.ts": `
+          const jev = ai.decider("jev", { provider: "openrouter", model: "m" });
           ai.decision("triage", {
-            onUncertain: "abstain",
+            decider: jev,
+            otherwise: "abstain",
             ask: { team: missingQuestion },
           });
         `,
       }),
     ).rejects.toThrow(/not a same-file const/);
   });
+
+  test("a string passed as decider fails to compile", async () => {
+    await expect(
+      extractFromSources({
+        "src/flows/run.ts": `
+          ai.decision("triage", {
+            decider: "jev",
+            otherwise: "abstain",
+            ask: { team: ai.choice("which", { a: "A" }) },
+          });
+        `,
+      }),
+    ).rejects.toThrow(/not a decider/);
+  });
 });

package/src/compiler/effects-infer.ts

@@ -63,6 +63,7 @@ export interface InferBinding {
     | "flow"
     | "embed"
     | "decision"
+    | "decider"
     | "table"
     | "mcp-server"
     | "mcp-tool"