open-multi-agent-kit 0.79.3 → 0.80.0

package/dist/runtime/provider-sovereignty.js

@@ -0,0 +1,285 @@
+/**
+ * Provider sovereignty scoring for Freedomd.
+ *
+ * Translates provider jurisdiction, retention, cutoff/portability, and locality
+ * properties into a normalized score that feeds runtime routing. The score is
+ * intentionally conservative: unknowns are treated as risk.
+ */
+import { runtimeProviderId, runtimeModeOf } from "./authority-matrix.js";
+const EXPORT_POLICY_RISK = {
+    open: 0.0,
+    restricted: 0.4,
+    controlled: 0.8,
+    unknown: 0.6,
+};
+function clamp01(value) {
+    return Math.max(0, Math.min(1, value));
+}
+export function assessJurisdictionRisk(options) {
+    let risk = EXPORT_POLICY_RISK[options.exportPolicy] ?? 0.6;
+    if (options.userCountry && options.providerCountry !== options.userCountry) {
+        risk = Math.max(risk, 0.3);
+    }
+    if (options.taskRisk === "shell" || options.taskRisk === "merge") {
+        risk = Math.min(1, risk * 1.3 + 0.1);
+    }
+    const incident = (options.incidents ?? []).find((i) => i.kind === "export-control" || i.kind === "jurisdiction" || i.kind === "policy");
+    if (incident) {
+        const severityMultiplier = incident.severity === "block" ? 1.0 : incident.severity === "warn" ? 0.5 : 0.2;
+        risk = Math.min(1, risk + severityMultiplier * 0.3);
+    }
+    return clamp01(risk);
+}
+export function assessRetentionRisk(options) {
+    if (options.zeroDataRetention)
+        return 0.0;
+    if (!Number.isFinite(options.retentionDays) || options.retentionDays <= 0)
+        return 0.5;
+    let risk = clamp01(options.retentionDays / 365);
+    if (options.trainingUse) {
+        risk = Math.min(1, risk + 0.3);
+    }
+    if (options.maxRetentionDays !== undefined && options.maxRetentionDays >= 0) {
+        if (options.retentionDays > options.maxRetentionDays) {
+            risk = Math.min(1, risk + 0.4);
+        }
+    }
+    return risk;
+}
+export function assessCutoffRisk(options) {
+    let risk = 0;
+    risk += clamp01(options.policyInstabilityScore) * 0.35;
+    risk += clamp01(options.exportControlExposure) * 0.35;
+    risk += clamp01(options.accountDependency) * 0.30;
+    if (options.health?.available === false) {
+        risk = Math.min(1, risk + 0.5);
+    }
+    const incident = (options.incidents ?? []).find((i) => i.kind === "availability" || i.kind === "export-control" || i.kind === "policy");
+    if (incident) {
+        const bump = incident.severity === "block" ? 0.6 : incident.severity === "warn" ? 0.3 : 0.1;
+        risk = Math.min(1, risk + bump);
+    }
+    return clamp01(risk);
+}
+export function assessPortability(options) {
+    let score = 0.4;
+    if (options.supportsOpenApiCompat)
+        score += 0.25;
+    if (options.supportsToolContract)
+        score += 0.15;
+    if (options.supportsEvidenceReturn)
+        score += 0.20;
+    return clamp01(score);
+}
+export function computeProviderSovereigntyScore(runtime, task, options) {
+    const profile = options.profile;
+    const providerId = runtimeProviderId(runtime);
+    const runtimeMode = runtimeModeOf(runtime);
+    const incidents = (options.incidents ?? []).filter((i) => i.providerId === providerId &&
+        (!i.runtimeMode || i.runtimeMode === runtimeMode));
+    const jurisdictionRisk = assessJurisdictionRisk({
+        providerCountry: profile.providerCountry,
+        userCountry: options.userCountry,
+        taskRisk: options.taskRisk ?? task.safety?.risk,
+        exportPolicy: profile.exportPolicy,
+        incidents,
+    });
+    const retentionRisk = assessRetentionRisk({
+        retentionDays: profile.retentionDays,
+        zeroDataRetention: profile.zeroDataRetention,
+        trainingUse: profile.trainingUse,
+    });
+    const cutoffRisk = assessCutoffRisk({
+        policyInstabilityScore: profile.policyInstabilityScore,
+        exportControlExposure: profile.exportControlExposure,
+        accountDependency: profile.accountDependency,
+        incidents,
+    });
+    const localityScore = options.localAvailable
+        ? 1.0
+        : profile.supportsSelfHosted
+            ? 0.8
+            : 0.4;
+    const portabilityScore = assessPortability({
+        supportsOpenApiCompat: profile.openApiCompatible,
+        supportsToolContract: runtime.capabilities?.toolCalling === true || runtime.capabilities?.supportsToolCalling === true,
+        supportsEvidenceReturn: profile.metadataEvidenceSupport,
+    });
+    const score = 0.25 * (1 - jurisdictionRisk) +
+        0.25 * (1 - retentionRisk) +
+        0.20 * (1 - cutoffRisk) +
+        0.15 * localityScore +
+        0.15 * portabilityScore;
+    const diagnostics = {
+        jurisdictionRisk,
+        retentionRisk,
+        cutoffRisk,
+        localityScore,
+        portabilityScore,
+        incidentSeverity: incidents.length > 0 ? incidents[0].severity : undefined,
+        reason: `jurisdiction=${jurisdictionRisk.toFixed(2)} retention=${retentionRisk.toFixed(2)} cutoff=${cutoffRisk.toFixed(2)} locality=${localityScore.toFixed(2)} portability=${portabilityScore.toFixed(2)}`,
+    };
+    return { score: clamp01(score), diagnostics };
+}
+export function buildProviderSovereigntyProfiles() {
+    const now = new Date().toISOString();
+    const profiles = {
+        "local-llm": {
+            providerId: "local-llm",
+            runtimeMode: "api",
+            providerCountry: "user-device",
+            exportPolicy: "open",
+            retentionDays: 0,
+            zeroDataRetention: true,
+            trainingUse: false,
+            supportsSelfHosted: true,
+            openApiCompatible: true,
+            policyInstabilityScore: 0.05,
+            exportControlExposure: 0.0,
+            accountDependency: 0.0,
+            metadataEvidenceSupport: true,
+        },
+        codex: {
+            providerId: "codex",
+            runtimeMode: "cli",
+            providerCountry: "US",
+            exportPolicy: "restricted",
+            retentionDays: 0,
+            zeroDataRetention: true,
+            trainingUse: false,
+            supportsSelfHosted: false,
+            openApiCompatible: false,
+            policyInstabilityScore: 0.2,
+            exportControlExposure: 0.3,
+            accountDependency: 0.4,
+            metadataEvidenceSupport: true,
+        },
+        kimi: {
+            providerId: "kimi",
+            runtimeMode: "api",
+            providerCountry: "CN",
+            exportPolicy: "restricted",
+            retentionDays: 30,
+            zeroDataRetention: false,
+            trainingUse: false,
+            supportsSelfHosted: false,
+            openApiCompatible: true,
+            policyInstabilityScore: 0.25,
+            exportControlExposure: 0.35,
+            accountDependency: 0.5,
+            metadataEvidenceSupport: true,
+        },
+        mimo: {
+            providerId: "mimo",
+            runtimeMode: "api",
+            providerCountry: "CN",
+            exportPolicy: "restricted",
+            retentionDays: 30,
+            zeroDataRetention: false,
+            trainingUse: false,
+            supportsSelfHosted: false,
+            openApiCompatible: true,
+            policyInstabilityScore: 0.25,
+            exportControlExposure: 0.35,
+            accountDependency: 0.5,
+            metadataEvidenceSupport: true,
+        },
+        deepseek: {
+            providerId: "deepseek",
+            runtimeMode: "api",
+            providerCountry: "CN",
+            exportPolicy: "restricted",
+            retentionDays: 30,
+            zeroDataRetention: false,
+            trainingUse: false,
+            supportsSelfHosted: false,
+            openApiCompatible: true,
+            policyInstabilityScore: 0.3,
+            exportControlExposure: 0.4,
+            accountDependency: 0.5,
+            metadataEvidenceSupport: true,
+        },
+        opencode: {
+            providerId: "opencode",
+            runtimeMode: "cli",
+            providerCountry: "KR",
+            exportPolicy: "open",
+            retentionDays: 0,
+            zeroDataRetention: true,
+            trainingUse: false,
+            supportsSelfHosted: false,
+            openApiCompatible: false,
+            policyInstabilityScore: 0.2,
+            exportControlExposure: 0.1,
+            accountDependency: 0.3,
+            metadataEvidenceSupport: true,
+        },
+        commandcode: {
+            providerId: "commandcode",
+            runtimeMode: "cli",
+            providerCountry: "US",
+            exportPolicy: "open",
+            retentionDays: 0,
+            zeroDataRetention: true,
+            trainingUse: false,
+            supportsSelfHosted: false,
+            openApiCompatible: false,
+            policyInstabilityScore: 0.2,
+            exportControlExposure: 0.1,
+            accountDependency: 0.3,
+            metadataEvidenceSupport: true,
+        },
+        glm: {
+            providerId: "glm",
+            runtimeMode: "api",
+            providerCountry: "CN",
+            exportPolicy: "restricted",
+            retentionDays: 30,
+            zeroDataRetention: false,
+            trainingUse: false,
+            supportsSelfHosted: false,
+            openApiCompatible: true,
+            policyInstabilityScore: 0.3,
+            exportControlExposure: 0.4,
+            accountDependency: 0.5,
+            metadataEvidenceSupport: true,
+        },
+        openrouter: {
+            providerId: "openrouter",
+            runtimeMode: "api",
+            providerCountry: "US",
+            exportPolicy: "restricted",
+            retentionDays: 30,
+            zeroDataRetention: false,
+            trainingUse: false,
+            supportsSelfHosted: false,
+            openApiCompatible: true,
+            policyInstabilityScore: 0.25,
+            exportControlExposure: 0.3,
+            accountDependency: 0.6,
+            metadataEvidenceSupport: true,
+        },
+        qwen: {
+            providerId: "qwen",
+            runtimeMode: "api",
+            providerCountry: "CN",
+            exportPolicy: "restricted",
+            retentionDays: 30,
+            zeroDataRetention: false,
+            trainingUse: false,
+            supportsSelfHosted: false,
+            openApiCompatible: true,
+            policyInstabilityScore: 0.3,
+            exportControlExposure: 0.4,
+            accountDependency: 0.5,
+            metadataEvidenceSupport: true,
+        },
+    };
+    void now;
+    return profiles;
+}
+export function lookupSovereigntyProfile(runtime, profiles) {
+    const map = profiles ?? buildProviderSovereigntyProfiles();
+    const providerId = runtimeProviderId(runtime);
+    return map[providerId] ?? map[runtime.id];
+}

package/dist/runtime/runtime-backed-task-runner.d.ts

@@ -16,5 +16,6 @@ export interface RuntimeBackedTaskRunnerOptions {
     runId?: string;
     goal?: string;
     onOutput?: (text: string) => void;
+    headroomCompactor?: (text: string) => Promise<string | null>;
 }
 export declare function createRuntimeBackedTaskRunner(options: RuntimeBackedTaskRunnerOptions): Promise<TaskRunner>;

package/dist/runtime/runtime-backed-task-runner.js

@@ -6,15 +6,24 @@
  * 2. Route to best AgentRuntime via RuntimeRouter
  * 3. Convert AgentRunResult -> TaskResult
  */
-import { readFileSync } from "node:fs";
+import { appendFileSync, mkdirSync, readFileSync } from "node:fs";
 import { join } from "node:path";
 import { toTaskResult } from "./agent-runtime.js";
+import { checkEvidenceGate, hasDeclaredEvidenceRequirement } from "./contracts/evidence.js";
+function isStrictGuardrailMode() {
+    const raw = process.env.OMK_STRICT_GUARDRAIL ?? "";
+    const normalized = raw.trim().toLowerCase();
+    return normalized === "1" || normalized === "true" || normalized === "on";
+}
 import { capsuleToTask } from "./context-broker-converter.js";
 import { applyTaskRunContextToAgentTask, envFromWorkerManifest } from "./worker-manifest.js";
 import { createRuntimeRegistry } from "./runtime-registry.js";
 import { createRuntimeRouter } from "./runtime-router.js";
+import { createFreedomdRuntimeRouter } from "./freedomd-router.js";
 import { createContextBroker } from "./context-broker.js";
+import { estimateCapsuleTokens } from "./context-capsule.js";
 import { maybeCompactWithHeadroom } from "./headroom-policy.js";
+import { DEFAULT_STRUCTURED_COMPACTION_CONTRACT, buildStructuredCompactionText, buildTypedStructuredCompactionContract, computeCompactionQualityScore, estimateTextTokens, structuredCompactionGuardNote, structuredCompactionInstruction, validateStructuredCompaction, } from "./structured-compaction.js";
 import { DeepSeekRuntime } from "./deepseek-runtime.js";
 import { CodexRuntime } from "./codex-runtime.js";
 import { createOpencodeCliAdapter } from "../adapters/opencode/opencode-cli-adapter.js";
@@ -26,6 +35,7 @@ import { createMimoApiRuntime } from "./mimo-api-runtime.js";
 import { createKimiApiRuntime } from "./kimi-api-runtime.js";
 import { createGlmApiRuntime } from "./glm-api-runtime.js";
 import { getUserHome } from "../util/fs.js";
+import { LocalGraphMemoryStore } from "../memory/local-graph-memory-store.js";
 async function createDefaultRuntimeRegistry(options) {
     const registry = createRuntimeRegistry();
     // ── MiMo API runtime (Xiaomi MiMo — OpenAI-compatible, highest priority) ──
@@ -115,15 +125,182 @@ function readProviderConfig(configDir) {
 function escapeRegExp(value) {
     return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
 }
+function applyCompactedTextToCapsule(capsule, compactedText) {
+    const trimmed = compactedText.trim();
+    const beforeChars = JSON.stringify(capsule).length;
+    const beforeTokens = estimateCapsuleTokens(capsule);
+    const baseDiagnostics = {
+        beforeChars,
+        beforeTokens,
+        compactedTextProduced: trimmed.length > 0,
+    };
+    if (trimmed.length === 0) {
+        return {
+            capsule,
+            diagnostics: {
+                ...baseDiagnostics,
+                afterChars: 0,
+                afterTokens: 0,
+                validated: false,
+                applied: false,
+                missingSections: [],
+                reason: "empty compacted text",
+            },
+        };
+    }
+    const afterChars = trimmed.length;
+    const afterTokens = estimateTextTokens(trimmed);
+    if (afterChars >= beforeChars) {
+        return {
+            capsule,
+            diagnostics: {
+                ...baseDiagnostics,
+                afterChars,
+                afterTokens,
+                validated: false,
+                applied: false,
+                missingSections: [],
+                reason: "compacted text is not smaller than original capsule",
+            },
+        };
+    }
+    // If compaction stripped required structural context, keep original but note the guard.
+    const validation = validateStructuredCompaction(trimmed, capsule);
+    if (!validation.ok) {
+        return {
+            capsule: {
+                ...capsule,
+                system: [
+                    capsule.system,
+                    "",
+                    "[OMK headroom compacted context]",
+                    structuredCompactionGuardNote(validation),
+                ].filter(Boolean).join("\n"),
+                budget: { ...capsule.budget, compression: "summary" },
+            },
+            diagnostics: {
+                ...baseDiagnostics,
+                afterChars,
+                afterTokens,
+                validated: false,
+                applied: false,
+                missingSections: validation.missing,
+                contract: validation.contract.schemaVersion,
+                reason: "structured compaction contract validation failed",
+            },
+        };
+    }
+    return {
+        capsule: {
+            ...capsule,
+            system: [
+                capsule.system,
+                "",
+                "[OMK headroom compacted context]",
+                structuredCompactionInstruction(validation.contract),
+                trimmed,
+            ].filter(Boolean).join("\n"),
+            dependencySummaries: [],
+            relevantFiles: [],
+            graphMemory: [],
+            priorAttempts: [],
+            budget: { ...capsule.budget, compression: "summary" },
+        },
+        diagnostics: {
+            ...baseDiagnostics,
+            afterChars,
+            afterTokens,
+            validated: true,
+            applied: true,
+            missingSections: [],
+            contract: validation.contract.schemaVersion,
+            reason: "compaction applied",
+        },
+    };
+}
+function persistHeadroomDecisionArtifact(input) {
+    const rawRunId = input.runId?.trim() || "runtime-backed-task-runner";
+    const runId = sanitizeArtifactSegment(rawRunId);
+    const nodeId = sanitizeArtifactSegment(input.nodeId || "node");
+    const relativePath = `.omk/runs/${runId}/headroom-decisions.jsonl`;
+    try {
+        const dir = join(input.cwd, ".omk", "runs", runId);
+        mkdirSync(dir, { recursive: true });
+        const record = {
+            schemaVersion: "omk.headroom-decision.v1",
+            runId,
+            nodeId,
+            timestamp: new Date().toISOString(),
+            ...input.metadata,
+            artifactRef: undefined,
+        };
+        appendFileSync(join(input.cwd, relativePath), `${JSON.stringify(record)}\n`, "utf-8");
+        return relativePath;
+    }
+    catch {
+        return undefined;
+    }
+}
+async function materializeHeadroomDecisionGraph(input) {
+    const runId = input.runId?.trim();
+    if (!runId || runId.startsWith("local-"))
+        return;
+    try {
+        const store = await LocalGraphMemoryStore.create({ projectRoot: input.cwd, sessionId: runId, source: "headroom-compaction" });
+        await store?.materializeHeadroomDecision({
+            runId,
+            nodeId: input.nodeId,
+            metadata: input.metadata,
+            artifactRef: input.metadata.artifactRef,
+        });
+    }
+    catch {
+        // Best-effort graph materialization must never block runtime dispatch.
+    }
+}
+function buildAgentContextCompaction(input) {
+    if (!input.metadata?.applied)
+        return undefined;
+    return {
+        schemaVersion: "omk.task-compaction.v1",
+        contract: buildTypedStructuredCompactionContract(input.capsule),
+        diagnostics: {
+            backend: input.metadata.backend,
+            beforeTokens: input.metadata.beforeTokens,
+            afterTokens: input.metadata.afterTokens,
+            validated: input.metadata.validated,
+            applied: input.metadata.applied,
+            qualityScore: input.metadata.qualityScore,
+            compressionRatio: input.metadata.compressionRatio,
+            contract: input.metadata.contract,
+            reason: input.metadata.reason,
+        },
+        artifactRef: input.metadata.artifactRef,
+    };
+}
+function sanitizeArtifactSegment(value) {
+    return value.replace(/[^A-Za-z0-9._-]+/g, "-").replace(/^-+|-+$/g, "").slice(0, 128) || "unknown";
+}
 export async function createRuntimeBackedTaskRunner(options) {
     const registry = await createDefaultRuntimeRegistry(options);
     const runtimes = registry.list();
-    const runtimeRouter = createRuntimeRouter({
-        runtimes,
-        fallbackChain: options.fallbackChain,
-    });
+    const freedomdEnabled = (process.env.OMK_FREEDOMD_MODE ?? "off").trim().toLowerCase() !== "off";
+    const runtimeRouter = freedomdEnabled
+        ? await createFreedomdRuntimeRouter({
+            runtimes,
+            fallbackChain: options.fallbackChain,
+            projectRoot: options.cwd,
+            autoLoadIncidents: true,
+            isTty: process.stdin.isTTY,
+        })
+        : createRuntimeRouter({
+            runtimes,
+            fallbackChain: options.fallbackChain,
+        });
     registry.onChange((nextRuntimes) => {
-        runtimeRouter.setRuntimes(nextRuntimes);
+        if ("setRuntimes" in runtimeRouter) {
+            runtimeRouter.setRuntimes?.(nextRuntimes);
+        }
     });
     const contextBroker = createContextBroker({
         projectRoot: options.cwd,
@@ -140,14 +317,67 @@ export async function createRuntimeBackedTaskRunner(options) {
                 }
                 : undefined;
             const { capsule, headroomDecision } = await contextBroker.buildCapsule(node, runState);
+            let effectiveCapsule = capsule;
+            let headroomCompaction;
             // CTX guard: compact via headroom before the context window crosses the threshold (~90%).
             if (headroomDecision?.shouldCompact) {
-                await maybeCompactWithHeadroom({
+                const compactResult = await maybeCompactWithHeadroom({
                     decision: headroomDecision,
                     text: JSON.stringify(capsule),
+                    runHeadroom: options.headroomCompactor,
+                    fallbackText: () => buildStructuredCompactionText(capsule),
                 }).catch(() => undefined);
+                if (compactResult) {
+                    let applyDiagnostics;
+                    if (compactResult.compactedText) {
+                        const applied = applyCompactedTextToCapsule(capsule, compactResult.compactedText);
+                        effectiveCapsule = applied.capsule;
+                        applyDiagnostics = applied.diagnostics;
+                    }
+                    const quality = computeCompactionQualityScore({
+                        applied: applyDiagnostics?.applied ?? false,
+                        validated: applyDiagnostics?.validated ?? false,
+                        beforeTokens: applyDiagnostics?.beforeTokens,
+                        afterTokens: applyDiagnostics?.afterTokens,
+                        missingSections: applyDiagnostics?.missingSections ?? [],
+                    });
+                    headroomCompaction = {
+                        attempted: compactResult.attempted,
+                        compacted: compactResult.compacted,
+                        via: compactResult.via,
+                        backend: compactResult.backend,
+                        compactedTextProduced: compactResult.compactedTextProduced,
+                        validated: applyDiagnostics?.validated ?? false,
+                        applied: applyDiagnostics?.applied ?? false,
+                        beforeChars: applyDiagnostics?.beforeChars,
+                        afterChars: applyDiagnostics?.afterChars,
+                        beforeTokens: applyDiagnostics?.beforeTokens,
+                        afterTokens: applyDiagnostics?.afterTokens,
+                        threshold: headroomDecision.threshold,
+                        utilization: headroomDecision.utilization,
+                        contract: applyDiagnostics?.contract ?? DEFAULT_STRUCTURED_COMPACTION_CONTRACT.schemaVersion,
+                        missingSections: applyDiagnostics?.missingSections ?? [],
+                        reason: applyDiagnostics?.reason ?? compactResult.reason,
+                        ...quality,
+                    };
+                    const materializedRunId = options.runId ?? capsule.runId;
+                    const artifactRef = persistHeadroomDecisionArtifact({
+                        cwd: options.cwd,
+                        runId: materializedRunId,
+                        nodeId: capsule.nodeId,
+                        metadata: headroomCompaction,
+                    });
+                    if (artifactRef)
+                        headroomCompaction = { ...headroomCompaction, artifactRef };
+                    await materializeHeadroomDecisionGraph({
+                        cwd: options.cwd,
+                        runId: materializedRunId,
+                        nodeId: capsule.nodeId,
+                        metadata: headroomCompaction,
+                    });
+                }
             }
-            const routing = capsule.node.routing;
+            const routing = effectiveCapsule.node.routing;
             const providerFallbackChain = options.fallbackChain
                 ?? (routing?.fallbackProvider ? [routing.fallbackProvider] : []);
             const abortSignal = signal ?? new AbortController().signal;
@@ -156,22 +386,61 @@ export async function createRuntimeBackedTaskRunner(options) {
                 ...(env ?? {}),
                 ...(runContext ? envFromWorkerManifest(runContext.worker) : {}),
             };
-            const baseTask = applyTaskRunContextToAgentTask(await capsuleToTask(capsule, {
+            const rawTask = applyTaskRunContextToAgentTask(await capsuleToTask(effectiveCapsule, {
                 signal: abortSignal,
                 cwd: options.cwd,
                 env: taskEnv,
                 fallbackChain: providerFallbackChain,
             }), runContext);
+            const compactionContext = buildAgentContextCompaction({ capsule, metadata: headroomCompaction });
+            const baseTask = compactionContext
+                ? { ...rawTask, context: { ...rawTask.context, compaction: compactionContext } }
+                : rawTask;
             const task = options.onOutput
                 ? { ...baseTask, context: { ...baseTask.context, onOutput: options.onOutput } }
                 : baseTask;
-            const agentResult = await runtimeRouter.executeTask(task, capsule, abortSignal);
+            const strictGuardrailMode = isStrictGuardrailMode();
+            const evidenceRequired = strictGuardrailMode && (task.safety.evidenceRequired || effectiveCapsule.node.routing?.evidenceRequired === true || isHighRiskTask(task));
+            const declaredEvidenceOk = !evidenceRequired || hasDeclaredEvidenceRequirement(effectiveCapsule.node.outputs);
+            if (evidenceRequired && !declaredEvidenceOk) {
+                return {
+                    success: false,
+                    exitCode: 78,
+                    stdout: "",
+                    stderr: "[omk] Evidence gate required but missing: high-risk task declares no required evidence output gate",
+                    metadata: {
+                        evidenceRequired,
+                        evidenceDeclarationMissing: true,
+                        fallbackChain: task.providerPolicy.fallbackChain,
+                    },
+                };
+            }
+            const agentResult = await runtimeRouter.executeTask(task, effectiveCapsule, abortSignal);
             const taskResult = toTaskResult(agentResult);
+            // Post-execution evidence check for tasks that produced no metadata gate
+            if (evidenceRequired && agentResult.success && strictGuardrailMode) {
+                const postCheck = checkEvidenceGate(true, effectiveCapsule.node.outputs, taskResult.metadata ?? null, taskResult.stdout);
+                if (!postCheck.satisfied) {
+                    return {
+                        success: false,
+                        exitCode: 78,
+                        stdout: taskResult.stdout,
+                        stderr: `[omk] Evidence gate required but task produced no replayable evidence: ${postCheck.reason}`,
+                        metadata: {
+                            ...taskResult.metadata,
+                            evidenceRequired,
+                            evidenceCheck: postCheck,
+                        },
+                    };
+                }
+            }
             // Ensure routing metadata is present even if the router failed to attach it
             taskResult.metadata = {
                 ...(taskResult.metadata ?? {}),
                 fallbackChain: task.providerPolicy.fallbackChain,
+                ...(headroomCompaction && { headroomCompaction }),
                 ...(runContext && { workerOwner: runContext.worker.owner }),
+                ...(evidenceRequired && { evidenceRequired }),
             };
             return taskResult;
         },
@@ -182,3 +451,6 @@ export async function createRuntimeBackedTaskRunner(options) {
     runner._registry = registry;
     return runner;
 }
+function isHighRiskTask(task) {
+    return task.capabilities.write === true || task.capabilities.patch === true || task.capabilities.shell === true || task.capabilities.merge === true;
+}

package/dist/runtime/runtime-bootstrap.d.ts

@@ -19,3 +19,15 @@ export declare function resolveRuntimeBootstrap(options: {
     cwd?: string;
     env?: Record<string, string | undefined>;
 }): Promise<RuntimeBootstrap>;
+export type ResolvedProviderPolicy = {
+    ok: true;
+    provider: string;
+    runtimeId?: string;
+    reason?: string;
+} | {
+    ok: false;
+    provider: string;
+    reason: string;
+    remediation: string[];
+};
+export declare function resolveProviderPolicy(providerPolicy: string, env: Record<string, string | undefined>): Promise<ResolvedProviderPolicy>;