open-multi-agent-kit 0.78.8 → 0.79.3

package/dist/commands/mcp/test.js

@@ -5,14 +5,15 @@ import { style, header, status, label } from "../../util/theme.js";
 import { maskSensitiveText } from "../../util/secret-mask.js";
 import { buildSubprocessEnv } from "../../mcp/transports/stdio.js";
 import { McpClientSession } from "../../mcp/client.js";
-import { collectServers, formatArgsForDisplay, resolveAllConfigs, sanitizeMcpUrlForDisplay, selectEffectiveServer, serverTargetText, validateRemoteMcpUrl, } from "./shared.js";
+import { collectServers, formatArgsForDisplay, normalizeMcpEnv, normalizeMcpServerName, resolveAllConfigs, sanitizeMcpUrlForDisplay, selectEffectiveServer, serverTargetText, validateRemoteMcpUrl, } from "./shared.js";
 const JSON_RPC_INTERNAL_ERROR_CODE = -32603;
 export async function mcpTestCommand(serverName) {
+    const normalizedServerName = normalizeMcpServerName(serverName);
     const sources = await resolveAllConfigs();
     const servers = collectServers(sources);
-    const info = servers.get(serverName);
+    const info = servers.get(normalizedServerName);
     if (!info) {
-        console.error(status.error(`Server not found: ${serverName}`));
+        console.error(status.error(`Server not found: ${normalizedServerName}`));
         console.error(style.gray("Run `omk mcp list` to see available servers."));
         process.exit(1);
     }
@@ -20,31 +21,31 @@ export async function mcpTestCommand(serverName) {
     const activePathOrder = await collectMcpConfigs(resources.mcpScope);
     const activeSources = info.sources.filter((source) => activePathOrder.includes(source));
     if (activeSources.length === 0) {
-        console.error(status.error(`Server ${serverName} is not active in MCP scope "${resources.mcpScope}".`));
+        console.error(status.error(`Server ${normalizedServerName} is not active in MCP scope "${resources.mcpScope}".`));
         console.error(style.gray(`Defined in: ${info.sources.join(", ")}`));
         process.exit(1);
     }
     const server = selectEffectiveServer(info, activePathOrder);
     if (!server.url && !server.command) {
-        console.error(status.error(`Server ${serverName} has no command`));
+        console.error(status.error(`Server ${normalizedServerName} has no command`));
         process.exit(1);
     }
-    console.log(header(`MCP Test: ${serverName}`));
+    console.log(header(`MCP Test: ${normalizedServerName}`));
     if (server.url) {
         console.log(label("URL", sanitizeMcpUrlForDisplay(server.url)));
-        await testRemoteMcpServer(serverName, server);
+        await testRemoteMcpServer(normalizedServerName, server);
         return;
     }
     const command = server.command;
     if (!command) {
-        console.error(status.error(`Server ${serverName} has no command`));
+        console.error(status.error(`Server ${normalizedServerName} has no command`));
         process.exit(1);
     }
     console.log(label("Command", maskSensitiveText(command)));
     if (server.args)
         console.log(label("Args", formatArgsForDisplay(server.args)));
     console.log("");
-    const testEnv = buildSubprocessEnv(process.env, server.env ?? {});
+    const testEnv = buildSubprocessEnv(process.env, normalizeMcpEnv(server.env));
     // Test 1: executable exists
     const resolved = await which(command);
     if (resolved.failed) {
@@ -137,8 +138,8 @@ export async function mcpTestCommand(serverName) {
         console.error(status.error(`JSON-RPC initialize failed: ${maskSensitiveText(handshakeResult.stderr || "unknown error")}`));
         process.exit(1);
     }
-    if (shouldRunOmkProjectProbe(serverName, server)) {
-        await runOmkProjectToolProbe(command, smokeArgs, server.env);
+    if (shouldRunOmkProjectProbe(normalizedServerName, server)) {
+        await runOmkProjectToolProbe(command, smokeArgs, normalizeMcpEnv(server.env));
     }
 }
 export async function mcpPrewarmCommand(serverName, options = {}) {
@@ -211,7 +212,7 @@ export async function mcpPrewarmCommand(serverName, options = {}) {
     console.log(header(`${isCheck ? "MCP Check" : "MCP Prewarm/Check"}: ${serverName}`));
     console.log(style.gray("Runs the MCP startup probe outside chat; package-manager caches may warm as a side effect."));
     console.log(style.gray("For a zero-global-noise session, run chat/goal/parallel with `--mcp-scope project` or `--mcp-scope none`."));
-    await mcpTestCommand(serverName);
+    await mcpTestCommand(normalizeMcpServerName(serverName));
 }
 function shouldRunOmkProjectProbe(serverName, server) {
     const target = serverTargetText(server);

package/dist/commands/model.js

@@ -72,6 +72,8 @@ export async function modelResolveCommand(model, options = {}) {
         input: resolved.input,
         provider: resolved.provider,
         model: resolved.model,
+        thinking: resolved.thinkingLevel,
+        modelVariant: resolved.thinkingLevel ? formatThinkingModelVariant(resolved.model, resolved.thinkingLevel) : undefined,
         source: resolved.source,
         secretValuesPrinted: false,
         tokenFilesRead: false,
@@ -91,6 +93,8 @@ export async function modelUseCommand(model, options = {}) {
         input: resolved.input,
         defaultProvider: result.defaults.provider,
         defaultModel: result.defaults.model,
+        thinking: resolved.thinkingLevel,
+        modelVariant: resolved.thinkingLevel ? formatThinkingModelVariant(result.defaults.model, resolved.thinkingLevel) : undefined,
         modelSource: resolved.source,
         configPath: result.configPath,
         secretValuesPrinted: false,

package/dist/commands/provider.js

@@ -538,7 +538,9 @@ export function buildProviderOAuthResult(provider, options = {}) {
         ? "DeepSeek"
         : target === "qwen"
             ? "Qwen/DashScope"
-            : target;
+            : target === "glm"
+                ? "Zhipu GLM"
+                : target;
     const setCommand = `omk provider set ${target} --api-key-env ${apiKeyEnv}`;
     const apiKeySetup = target === "deepseek"
         ? `For user-local DeepSeek secret storage, use \`omk deepseek api --from-env ${apiKeyEnv}\`; this command does not do that storage.`
@@ -594,6 +596,8 @@ function defaultApiKeyEnvForProvider(provider) {
         return "OPENROUTER_API_KEY";
     if (provider === "qwen")
         return "DASHSCOPE_API_KEY";
+    if (provider === "glm")
+        return "BIGMODEL_API_KEY";
     return "PROVIDER_API_KEY";
 }
 function normalizeAuthMethodOption(value) {

package/dist/commands/version.d.ts

@@ -1,6 +1,7 @@
 import type { VersionReport } from "../contracts/index.js";
 export type VersionCommandOptions = {
     json?: boolean;
+    commandEnvelope?: boolean;
 };
 export declare function buildVersionReport(): VersionReport;
 export declare function versionCommand(options?: VersionCommandOptions): Promise<void>;

package/dist/commands/version.js

@@ -5,6 +5,7 @@ import { fileURLToPath } from "node:url";
 import { OMK_PACKAGE_NAME, OMK_RELEASE_CHANNEL, OMK_RUNTIME_VERSION, OMK_SCHEMA_VERSIONS, OMK_VERSION_SCHEMA_VERSION, } from "../version.js";
 import { emitJson } from "../util/cli-contract.js";
 import { createOmkJsonEnvelope } from "../util/json-envelope.js";
+import { createOmkCommandEnvelope } from "../util/command-envelope.js";
 import { getOmkVersionSync } from "../util/version.js";
 function packageRoot() {
     const currentFile = fileURLToPath(import.meta.url);
@@ -65,6 +66,23 @@ export async function versionCommand(options = {}) {
     const started = Date.now();
     const report = buildVersionReport();
     if (options.json) {
+        if (options.commandEnvelope) {
+            emitJson(createOmkCommandEnvelope({
+                command: "version",
+                status: report.consistent ? "pass" : "fail",
+                commit: report.gitCommit,
+                data: report,
+                diagnostics: report.mismatches.map((mismatch) => ({
+                    severity: "error",
+                    code: "VERSION_MISMATCH",
+                    message: `${mismatch.file}: expected ${mismatch.expected} but found ${mismatch.actual}`,
+                    redacted: true,
+                    path: mismatch.file,
+                })),
+                exitCode: report.consistent ? 0 : 1,
+            }));
+            return;
+        }
         emitJson(createOmkJsonEnvelope({
             command: "version",
             status: report.consistent ? "passed" : "failed",

package/dist/contracts/command.d.ts

@@ -0,0 +1,25 @@
+import type { OMK_COMMAND_SCHEMA_VERSION } from "../version.js";
+import type { EvidenceRef } from "./evidence.js";
+export type OmkCommandEnvelopeStatus = "pass" | "warn" | "fail";
+export type OmkCommandDiagnosticSeverity = "info" | "warn" | "error";
+export type OmkCommandDiagnostic = {
+    severity: OmkCommandDiagnosticSeverity;
+    code: string;
+    message: string;
+    redacted: boolean;
+    remediation?: string;
+    path?: string;
+};
+export type OmkCommandEnvelope<TData = unknown> = {
+    schemaVersion: typeof OMK_COMMAND_SCHEMA_VERSION;
+    command: string;
+    status: OmkCommandEnvelopeStatus;
+    runId?: string;
+    commit?: string;
+    startedAt: string;
+    finishedAt: string;
+    data: TData;
+    diagnostics: OmkCommandDiagnostic[];
+    evidenceRefs: EvidenceRef[];
+    exitCode: number;
+};

package/dist/contracts/command.js

@@ -0,0 +1 @@
+export {};

package/dist/contracts/evidence-bundle.d.ts

@@ -0,0 +1,52 @@
+import type { OMK_EVIDENCE_BUNDLE_SCHEMA_VERSION, OMK_RUNTIME_VERSION } from "../version.js";
+import type { DecisionRef } from "./decision.js";
+import type { EvidenceRef } from "./evidence.js";
+export type EvidenceBundleVerdict = "pass" | "warn" | "fail";
+export type EvidenceBundleArtifact = {
+    path: string;
+    sha256: string;
+    required?: boolean;
+    kind?: "file" | "log" | "diff" | "metric" | "review" | "custom";
+};
+export type EvidenceBundle = {
+    schemaVersion: typeof OMK_EVIDENCE_BUNDLE_SCHEMA_VERSION;
+    runId: string;
+    nodeId?: string;
+    commit: string;
+    provider: string;
+    model?: string;
+    runtimeVersion: typeof OMK_RUNTIME_VERSION | string;
+    command: {
+        value: string;
+        exitCode: number;
+    };
+    changedFiles: string[];
+    diffHash?: string;
+    artifacts: EvidenceBundleArtifact[];
+    verifier: {
+        verdict: EvidenceBundleVerdict;
+        version: string;
+        checkedAt?: string;
+    };
+    redaction: {
+        applied: boolean;
+        summary: string;
+        leakedSecretPatterns?: string[];
+    };
+    evidenceRefs?: EvidenceRef[];
+    decisionRefs?: DecisionRef[];
+};
+export type EvidenceBundleIssueKind = "missing_required_field" | "missing_artifact" | "hash_mismatch" | "unlinked_decision" | "stale_commit" | "redaction_violation" | "unsupported_schema";
+export type EvidenceBundleIssue = {
+    kind: EvidenceBundleIssueKind;
+    severity: "error" | "warn";
+    message: string;
+    path?: string;
+    expected?: string;
+    actual?: string;
+};
+export type EvidenceBundleValidationResult = {
+    ok: boolean;
+    verdict: EvidenceBundleVerdict;
+    issues: EvidenceBundleIssue[];
+};

package/dist/contracts/evidence-bundle.js

@@ -0,0 +1 @@
+export {};

package/dist/contracts/index.d.ts

@@ -1,7 +1,9 @@
+export * from "./command.js";
 export * from "./decision.js";
 export * from "./envelope.js";
 export * from "./errors.js";
 export * from "./evidence.js";
+export * from "./evidence-bundle.js";
 export * from "./provider.js";
 export * from "./proof.js";
 export * from "./run.js";

package/dist/contracts/index.js

@@ -1,7 +1,9 @@
+export * from "./command.js";
 export * from "./decision.js";
 export * from "./envelope.js";
 export * from "./errors.js";
 export * from "./evidence.js";
+export * from "./evidence-bundle.js";
 export * from "./provider.js";
 export * from "./proof.js";
 export * from "./run.js";

package/dist/contracts/web-bridge.d.ts

@@ -1,5 +1,5 @@
 export declare const WEB_BRIDGE_SCHEMA_VERSION: 1;
-export declare const WEB_BRIDGE_NATIVE_HOST_NAME = "io.ohmykimi.web_bridge";
+export declare const WEB_BRIDGE_NATIVE_HOST_NAME = "io.omk.web_bridge";
 export declare const WEB_BRIDGE_MCP_SERVER_NAME = "omk-web-bridge";
 export declare const WEB_BRIDGE_MAX_TEXT_CHARS = 120000;
 export declare const WEB_BRIDGE_MAX_PAYLOAD_BYTES = 1000000;

package/dist/contracts/web-bridge.js

@@ -1,6 +1,6 @@
 import { maskSensitiveText } from "../util/secret-mask.js";
 export const WEB_BRIDGE_SCHEMA_VERSION = 1;
-export const WEB_BRIDGE_NATIVE_HOST_NAME = "io.ohmykimi.web_bridge";
+export const WEB_BRIDGE_NATIVE_HOST_NAME = "io.omk.web_bridge";
 export const WEB_BRIDGE_MCP_SERVER_NAME = "omk-web-bridge";
 export const WEB_BRIDGE_MAX_TEXT_CHARS = 120_000;
 export const WEB_BRIDGE_MAX_PAYLOAD_BYTES = 1_000_000;

package/dist/evidence/bundle-validator.d.ts

@@ -0,0 +1,7 @@
+import type { EvidenceBundle, EvidenceBundleValidationResult } from "../contracts/evidence-bundle.js";
+export interface ValidateEvidenceBundleOptions {
+    root?: string;
+    currentCommit?: string;
+    requireDecisionRef?: boolean;
+}
+export declare function validateEvidenceBundle(bundle: EvidenceBundle, options?: ValidateEvidenceBundleOptions): EvidenceBundleValidationResult;

package/dist/evidence/bundle-validator.js

@@ -0,0 +1,103 @@
+import { createHash } from "node:crypto";
+import { readFileSync } from "node:fs";
+import { resolve, isAbsolute, relative } from "node:path";
+import { OMK_EVIDENCE_BUNDLE_SCHEMA_VERSION } from "../version.js";
+function issue(kind, message, details = {}) {
+    return {
+        kind,
+        severity: details.severity ?? "error",
+        message,
+        ...(details.path ? { path: details.path } : {}),
+        ...(details.expected ? { expected: details.expected } : {}),
+        ...(details.actual ? { actual: details.actual } : {}),
+    };
+}
+function sha256File(path) {
+    return createHash("sha256").update(readFileSync(path)).digest("hex");
+}
+function hasText(value) {
+    return typeof value === "string" && value.trim().length > 0;
+}
+export function validateEvidenceBundle(bundle, options = {}) {
+    const issues = [];
+    const root = resolve(options.root ?? process.cwd());
+    if (bundle.schemaVersion !== OMK_EVIDENCE_BUNDLE_SCHEMA_VERSION) {
+        issues.push(issue("unsupported_schema", "Evidence bundle schemaVersion is unsupported", {
+            expected: OMK_EVIDENCE_BUNDLE_SCHEMA_VERSION,
+            actual: String(bundle.schemaVersion),
+        }));
+    }
+    const requiredFields = [
+        ["runId", bundle.runId],
+        ["commit", bundle.commit],
+        ["provider", bundle.provider],
+        ["runtimeVersion", bundle.runtimeVersion],
+        ["command.value", bundle.command?.value],
+        ["verifier.version", bundle.verifier?.version],
+        ["redaction.summary", bundle.redaction?.summary],
+    ];
+    for (const [field, value] of requiredFields) {
+        if (!hasText(value)) {
+            issues.push(issue("missing_required_field", `Evidence bundle is missing ${field}`));
+        }
+    }
+    if (typeof bundle.command?.exitCode !== "number" || !Number.isInteger(bundle.command.exitCode)) {
+        issues.push(issue("missing_required_field", "Evidence bundle command.exitCode must be an integer"));
+    }
+    if (!Array.isArray(bundle.artifacts) || bundle.artifacts.length === 0) {
+        issues.push(issue("missing_artifact", "Evidence bundle must link at least one artifact"));
+    }
+    else {
+        for (const artifact of bundle.artifacts) {
+            if (!hasText(artifact.path)) {
+                issues.push(issue("missing_artifact", "Evidence artifact is missing a path"));
+                continue;
+            }
+            if (isAbsolute(artifact.path) || artifact.path.split(/[\\/]+/u).includes("..")) {
+                issues.push(issue("missing_artifact", "Evidence artifact path must stay inside the validation root", { path: artifact.path }));
+                continue;
+            }
+            const artifactPath = resolve(root, artifact.path);
+            const rel = relative(root, artifactPath);
+            if (rel.startsWith("..") || isAbsolute(rel)) {
+                issues.push(issue("missing_artifact", "Evidence artifact path escapes the validation root", { path: artifact.path }));
+                continue;
+            }
+            try {
+                const actual = sha256File(artifactPath);
+                if (actual !== artifact.sha256) {
+                    issues.push(issue("hash_mismatch", "Evidence artifact sha256 mismatch", {
+                        path: artifact.path,
+                        expected: artifact.sha256,
+                        actual,
+                    }));
+                }
+            }
+            catch {
+                issues.push(issue("missing_artifact", "Evidence artifact file is missing", { path: artifact.path }));
+            }
+        }
+    }
+    if (options.currentCommit && bundle.commit !== options.currentCommit) {
+        issues.push(issue("stale_commit", "Evidence bundle commit does not match current commit", {
+            expected: options.currentCommit,
+            actual: bundle.commit,
+        }));
+    }
+    if (options.requireDecisionRef && (!bundle.decisionRefs || bundle.decisionRefs.length === 0)) {
+        issues.push(issue("unlinked_decision", "Evidence bundle has no linked decision reference"));
+    }
+    if (bundle.redaction?.leakedSecretPatterns && bundle.redaction.leakedSecretPatterns.length > 0) {
+        issues.push(issue("redaction_violation", "Evidence bundle reports leaked secret patterns", {
+            actual: bundle.redaction.leakedSecretPatterns.join(","),
+        }));
+    }
+    const errors = issues.filter((item) => item.severity === "error");
+    const verifierVerdict = bundle.verifier?.verdict ?? "fail";
+    const verdict = errors.length > 0 || verifierVerdict === "fail"
+        ? "fail"
+        : issues.length > 0 || verifierVerdict === "warn"
+            ? "warn"
+            : "pass";
+    return { ok: verdict !== "fail", verdict, issues };
+}

package/dist/evidence/index.d.ts

@@ -15,7 +15,12 @@ export type { DecisionTraceStore } from "./decision-trace.js";
 export { createDecisionTraceStore } from "./decision-trace.js";
 export type { ProofTrustMvpEngine, ProofTrustResult } from "./proof-trust.js";
 export { createProofTrustMvpEngine } from "./proof-trust.js";
+export type { TrustCalibrationExample, TrustCalibrationResult, TrustFieldKey, TrustWeights } from "./trust-calibration.js";
+export { calibrateTrustWeights, DEFAULT_TRUST_WEIGHTS, scoreTrustFeatures, TRUST_FIELD_KEYS } from "./trust-calibration.js";
 export type { EtsClaim, EtsClaimCategory, EtsTaskType, EtsRiskTier, RequiredEvidenceItem, RunArtifactMeta, CollectedEvidence, EvidenceVerificationResult, EtsV2Result, EtsV2Engine, EtsV2Params, EtsV2EngineOptions, } from "./evidence-trust-score.js";
 export { extractClaims, requiredEvidenceForClaim, collectEvidenceFromRunDir, verifyEvidence, createEvidenceTrustScoreV2Engine, createEvidenceTrustScore, } from "./evidence-trust-score.js";
+export type { EvidenceBundle, EvidenceBundleArtifact, EvidenceBundleIssue, EvidenceBundleIssueKind, EvidenceBundleValidationResult, EvidenceBundleVerdict, } from "../contracts/evidence-bundle.js";
+export type { ValidateEvidenceBundleOptions } from "./bundle-validator.js";
+export { validateEvidenceBundle } from "./bundle-validator.js";
 export type { AlgorithmSpec, ReleaseCandidate, RegressionProofMatrixResult, RegressionProofMatrixEngine, RegressionProofMatrixOptions, } from "./regression-proof-matrix.js";
 export { createRegressionProofMatrixEngine } from "./regression-proof-matrix.js";

package/dist/evidence/index.js

@@ -6,5 +6,7 @@ export { createRunTraceStore } from "./run-trace.js";
 export { decideRepair } from "../orchestration/repair-policy.js";
 export { createDecisionTraceStore } from "./decision-trace.js";
 export { createProofTrustMvpEngine } from "./proof-trust.js";
+export { calibrateTrustWeights, DEFAULT_TRUST_WEIGHTS, scoreTrustFeatures, TRUST_FIELD_KEYS } from "./trust-calibration.js";
 export { extractClaims, requiredEvidenceForClaim, collectEvidenceFromRunDir, verifyEvidence, createEvidenceTrustScoreV2Engine, createEvidenceTrustScore, } from "./evidence-trust-score.js";
+export { validateEvidenceBundle } from "./bundle-validator.js";
 export { createRegressionProofMatrixEngine } from "./regression-proof-matrix.js";

package/dist/evidence/proof-trust.js

@@ -8,18 +8,10 @@ import { createHash } from "node:crypto";
 import { existsSync } from "node:fs";
 import { readFile, readdir, stat } from "node:fs/promises";
 import { isAbsolute, join, relative } from "node:path";
+import { DEFAULT_TRUST_WEIGHTS } from "./trust-calibration.js";
 // ─── Constants ─────────────────────────────────────────────────────────────
 const EXPECTED_SCHEMA_VERSION = "omk.proof-bundle.v1";
-const WEIGHTS = {
-    schema: 0.15,
-    commands: 0.15,
-    stdout: 0.10,
-    hashes: 0.15,
-    decisions: 0.15,
-    evidence: 0.15,
-    limitations: 0.05,
-    replay: 0.10,
-};
+const WEIGHTS = DEFAULT_TRUST_WEIGHTS;
 const FIELD_TO_MISSING = {
     schema: "schema",
     commands: "commands",

package/dist/evidence/trust-calibration.d.ts

@@ -0,0 +1,25 @@
+export declare const TRUST_FIELD_KEYS: readonly ["schema", "commands", "stdout", "hashes", "decisions", "evidence", "limitations", "replay"];
+export type TrustFieldKey = typeof TRUST_FIELD_KEYS[number];
+export type TrustWeights = Record<TrustFieldKey, number>;
+export interface TrustCalibrationExample {
+    readonly features: Record<TrustFieldKey, 0 | 1>;
+    readonly success: boolean;
+}
+export interface TrustCalibrationResult {
+    readonly adopted: boolean;
+    readonly weights: TrustWeights;
+    readonly threshold: number;
+    readonly baselineAuc: number;
+    readonly candidateAuc: number;
+    readonly reason: string;
+}
+export declare const DEFAULT_TRUST_WEIGHTS: TrustWeights;
+export declare function scoreTrustFeatures(features: Record<TrustFieldKey, number>, weights?: TrustWeights): number;
+export declare function calibrateTrustWeights(data: readonly TrustCalibrationExample[], options?: {
+    minSamples?: number;
+    epsilon?: number;
+    iterations?: number;
+    learningRate?: number;
+    priorSigma?: number;
+}): TrustCalibrationResult;
+export declare function normalizeTrustWeights(weights: TrustWeights): TrustWeights;

package/dist/evidence/trust-calibration.js

@@ -0,0 +1,151 @@
+export const TRUST_FIELD_KEYS = [
+    "schema",
+    "commands",
+    "stdout",
+    "hashes",
+    "decisions",
+    "evidence",
+    "limitations",
+    "replay",
+];
+export const DEFAULT_TRUST_WEIGHTS = Object.freeze({
+    schema: 0.15,
+    commands: 0.15,
+    stdout: 0.10,
+    hashes: 0.15,
+    decisions: 0.15,
+    evidence: 0.15,
+    limitations: 0.05,
+    replay: 0.10,
+});
+export function scoreTrustFeatures(features, weights = DEFAULT_TRUST_WEIGHTS) {
+    return round6(TRUST_FIELD_KEYS.reduce((sum, key) => sum + (weights[key] * (features[key] ? 1 : 0)), 0));
+}
+export function calibrateTrustWeights(data, options = {}) {
+    const minSamples = options.minSamples ?? 100;
+    if (data.length < minSamples) {
+        return {
+            adopted: false,
+            weights: { ...DEFAULT_TRUST_WEIGHTS },
+            threshold: 0.75,
+            baselineAuc: 0,
+            candidateAuc: 0,
+            reason: `insufficient labeled runs: ${data.length} < ${minSamples}`,
+        };
+    }
+    const beta = fitLogisticMap(data, options);
+    const weights = normalizeTrustWeights(Object.fromEntries(TRUST_FIELD_KEYS.map((key, index) => [key, Math.max(options.epsilon ?? 0.01, beta[index])])));
+    const baselineScores = data.map((example) => scoreTrustFeatures(example.features, DEFAULT_TRUST_WEIGHTS));
+    const candidateScores = data.map((example) => scoreTrustFeatures(example.features, weights));
+    const labels = data.map((example) => example.success);
+    const baselineAuc = auc(baselineScores, labels);
+    const candidateAuc = auc(candidateScores, labels);
+    const threshold = youdenThreshold(candidateScores, labels);
+    const adopted = candidateAuc > baselineAuc;
+    return {
+        adopted,
+        weights: adopted ? weights : { ...DEFAULT_TRUST_WEIGHTS },
+        threshold: adopted ? threshold : 0.75,
+        baselineAuc,
+        candidateAuc,
+        reason: adopted
+            ? `candidate trust weights improved AUC by ${(candidateAuc - baselineAuc).toFixed(4)}`
+            : "current trust weights not yet beaten by labeled evidence",
+    };
+}
+export function normalizeTrustWeights(weights) {
+    const positive = Object.fromEntries(TRUST_FIELD_KEYS.map((key) => [key, Math.max(0, Number(weights[key]) || 0)]));
+    const sum = TRUST_FIELD_KEYS.reduce((acc, key) => acc + positive[key], 0);
+    if (sum <= 0)
+        return { ...DEFAULT_TRUST_WEIGHTS };
+    return Object.fromEntries(TRUST_FIELD_KEYS.map((key) => [key, round6(positive[key] / sum)]));
+}
+function fitLogisticMap(data, options = {}) {
+    const iterations = options.iterations ?? 500;
+    const learningRate = options.learningRate ?? 0.05;
+    const priorSigma = options.priorSigma ?? 1;
+    const prior = TRUST_FIELD_KEYS.map((key) => DEFAULT_TRUST_WEIGHTS[key]);
+    const beta = [...prior];
+    let intercept = 0;
+    for (let iter = 0; iter < iterations; iter += 1) {
+        const grad = new Array(beta.length).fill(0);
+        let interceptGrad = 0;
+        for (const example of data) {
+            const x = TRUST_FIELD_KEYS.map((key) => example.features[key]);
+            const y = example.success ? 1 : 0;
+            const p = sigmoid(intercept + dot(beta, x));
+            const error = p - y;
+            interceptGrad += error;
+            for (let i = 0; i < beta.length; i += 1)
+                grad[i] += error * x[i];
+        }
+        intercept -= learningRate * (interceptGrad / data.length);
+        for (let i = 0; i < beta.length; i += 1) {
+            const shrinkage = (beta[i] - prior[i]) / (priorSigma * priorSigma);
+            beta[i] -= learningRate * ((grad[i] / data.length) + shrinkage);
+        }
+    }
+    return beta;
+}
+function auc(scores, labels) {
+    const positives = [];
+    const negatives = [];
+    for (let i = 0; i < scores.length; i += 1) {
+        if (labels[i])
+            positives.push(scores[i]);
+        else
+            negatives.push(scores[i]);
+    }
+    if (positives.length === 0 || negatives.length === 0)
+        return 0.5;
+    let wins = 0;
+    for (const pos of positives) {
+        for (const neg of negatives) {
+            if (pos > neg)
+                wins += 1;
+            else if (pos === neg)
+                wins += 0.5;
+        }
+    }
+    return round6(wins / (positives.length * negatives.length));
+}
+function youdenThreshold(scores, labels) {
+    const thresholds = [...new Set(scores)].sort((a, b) => a - b);
+    let best = thresholds[0] ?? 0.75;
+    let bestJ = -Infinity;
+    for (const threshold of thresholds) {
+        let tp = 0;
+        let tn = 0;
+        let fp = 0;
+        let fn = 0;
+        for (let i = 0; i < scores.length; i += 1) {
+            const predicted = scores[i] >= threshold;
+            const actual = labels[i];
+            if (predicted && actual)
+                tp += 1;
+            else if (predicted && !actual)
+                fp += 1;
+            else if (!predicted && actual)
+                fn += 1;
+            else
+                tn += 1;
+        }
+        const sensitivity = tp / Math.max(1, tp + fn);
+        const specificity = tn / Math.max(1, tn + fp);
+        const j = sensitivity + specificity - 1;
+        if (j > bestJ) {
+            bestJ = j;
+            best = threshold;
+        }
+    }
+    return round6(best);
+}
+function sigmoid(value) {
+    return 1 / (1 + Math.exp(-value));
+}
+function dot(a, b) {
+    return a.reduce((sum, value, index) => sum + value * b[index], 0);
+}
+function round6(value) {
+    return Math.round(value * 1_000_000) / 1_000_000;
+}

package/dist/mcp/omk-project-server.js

@@ -777,7 +777,7 @@ async function handleTailRunEvents(args) {
         afterSeq: typeof args.afterSeq === "number" ? args.afterSeq : undefined,
         limit: typeof args.limit === "number" ? Math.max(0, Math.min(500, args.limit)) : 200,
     });
-    return { events: redactSecrets(events), source: "events.jsonl" };
+    return { events: redactSecrets(events), source: "events.ndjson" };
 }
 async function handleReadRunState(args) {
     const runId = sanitizeRunId(args.runId);

package/dist/metrics/provenance-ratio.d.ts

@@ -0,0 +1,16 @@
+export interface ProvenanceLayerInput {
+    readonly name: string;
+    readonly addedModifiedLines: number;
+    readonly loc: number;
+    readonly importance: number;
+}
+export interface ProvenanceLayerResult extends ProvenanceLayerInput {
+    readonly originality: number;
+    readonly weightedOriginality: number;
+}
+export interface ProvenanceRatioResult {
+    readonly headlineOriginality: number;
+    readonly layers: readonly ProvenanceLayerResult[];
+    readonly importanceSum: number;
+}
+export declare function computeProvenanceRatio(layers: readonly ProvenanceLayerInput[]): ProvenanceRatioResult;