open-multi-agent-kit 0.79.3 → 0.80.0

package/dist/runtime/deepseek-runtime.js

@@ -6,8 +6,12 @@
  */
 import { capsuleToTask } from "./context-broker-converter.js";
 import { buildProviderToolPayload } from "./provider-tool-contracts.js";
+import { probeOpenAiCompatibleModels } from "./runtime-health-probes.js";
 export class DeepSeekRuntime {
     id = "deepseek-api";
+    providerId = "deepseek";
+    advisory = true;
+    runtimeMode = "api";
     kind = "api";
     priority = 40;
     capabilities = {
@@ -42,14 +46,16 @@ export class DeepSeekRuntime {
             return false;
         return true;
     }
-    async health() {
-        const available = Boolean(this.apiKey);
-        return {
+    async health(input = { probeKind: "static", highRisk: false }) {
+        return probeOpenAiCompatibleModels({
             runtimeId: this.id,
-            available,
-            reason: available ? undefined : "DEEPSEEK_API_KEY is not set",
-            checkedAt: new Date().toISOString(),
-        };
+            baseUrl: this.baseUrl,
+            apiKey: this.apiKey,
+            apiKeyName: "DEEPSEEK_API_KEY",
+            model: this.model,
+            providerName: "DeepSeek",
+            probeKind: input.probeKind,
+        });
     }
     async runNode(capsule, signal) {
         try {

package/dist/runtime/external-cli-adapter.js

@@ -5,14 +5,17 @@
 import { mkdtemp, rm, writeFile } from "node:fs/promises";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
-import { checkCommand, } from "../util/shell.js";
+import { checkCommand, runShell, } from "../util/shell.js";
 import { runtimeMetadataEnv } from "./child-env.js";
 import { runProcessSession } from "./process-session.js";
 import { createRuntimeSandboxProfile } from "./sandbox-profile.js";
+import { staticRuntimeHealth } from "./runtime-health-probes.js";
 export function createExternalCliAdapter(options) {
     let pendingOnOutput;
     return {
         id: options.id,
+        providerId: options.id.split("-")[0],
+        runtimeMode: "cli",
         displayName: options.displayName,
         kind: "cli",
         priority: options.priority,
@@ -20,14 +23,24 @@ export function createExternalCliAdapter(options) {
         supports(capsule) {
             return runtimeCapabilitiesSupportCapsule(options.capabilities, capsule);
         },
-        async health() {
-            const available = await checkCommand(options.bin);
-            return {
+        async health(input = { probeKind: "static", highRisk: false }) {
+            const started = Date.now();
+            const available = input.probeKind === "static"
+                ? await checkCommand(options.bin)
+                : (await runShell(options.bin, ["--version"], { cwd: options.cwd ?? process.cwd(), timeout: 5000 }).catch(() => ({ exitCode: 1 }))).exitCode === 0;
+            return staticRuntimeHealth({
                 runtimeId: options.id,
                 available,
-                reason: available ? undefined : `Command not found: ${options.bin}`,
-                checkedAt: new Date().toISOString(),
-            };
+                reason: available ? undefined : `Command not found or failed --version probe: ${options.bin}`,
+                runtimeOk: available,
+                authOk: available,
+                modelOk: true,
+                quotaOk: true,
+                rateLimitOk: true,
+                latencyMs: input.probeKind === "static" ? undefined : Date.now() - started,
+                probeKind: input.probeKind,
+                ttlMs: input.probeKind === "static" ? 60_000 : 30_000,
+            });
         },
         async execute(task) {
             pendingOnOutput = task.context.onOutput;

package/dist/runtime/freedomd-evidence-envelope.d.ts

@@ -0,0 +1,57 @@
+/**
+ * Local-first evidence envelope for Freedomd.
+ *
+ * Provider responses and evidence observations are persisted outside the
+ * provider runtime so that runs remain replayable and auditable even when a
+ * provider becomes unavailable or changes policy.
+ */
+import type { AgentRuntime, AgentRunResult, AgentTask, AgentTaskSovereignty } from "./agent-runtime.js";
+import type { EvidenceObservation, EvidenceRequirement } from "./contracts/evidence.js";
+import type { LocalGraphMemoryStore } from "../memory/local-graph-memory-store.js";
+export interface EvidenceEnvelopeArtifact {
+    readonly path: string;
+    readonly sha256: string;
+    readonly sizeBytes: number;
+    readonly redacted: boolean;
+    readonly replayable: boolean;
+}
+export interface EvidenceEnvelopeObservation {
+    readonly kind: string;
+    readonly verdict: "pass" | "fail" | "partial" | "pending";
+    readonly artifactRef?: string;
+    readonly sha256?: string;
+    readonly replayable: boolean;
+    readonly redacted: boolean;
+    readonly confidence: number;
+    readonly timestamp: string;
+}
+export interface FreedomdEvidenceEnvelope {
+    schemaVersion: "omk.freedomd.evidence-envelope.v1";
+    runId: string;
+    nodeId: string;
+    taskHash: string;
+    selectedRuntime: string;
+    providerId: string;
+    runtimeMode: string;
+    sovereignty: AgentTaskSovereignty;
+    evidenceRequirements: readonly EvidenceRequirement[];
+    evidenceObservations: readonly EvidenceEnvelopeObservation[];
+    providerResponseRef?: string;
+    localArtifacts: readonly EvidenceEnvelopeArtifact[];
+    createdAt: string;
+}
+export interface BuildEvidenceEnvelopeOptions {
+    readonly task: AgentTask;
+    readonly selectedRuntime: AgentRuntime;
+    readonly runContext: {
+        readonly runId: string;
+        readonly nodeId: string;
+        readonly projectRoot?: string;
+    };
+    readonly evidenceObservations?: readonly EvidenceObservation[];
+    readonly providerResponse?: AgentRunResult;
+    readonly sovereignty: AgentTaskSovereignty;
+}
+export declare function hashTaskPrompt(prompt: string): string;
+export declare function buildLocalFirstEvidenceEnvelope(options: BuildEvidenceEnvelopeOptions): Promise<FreedomdEvidenceEnvelope>;
+export declare function materializeEvidenceEnvelopeInGraph(store: LocalGraphMemoryStore, envelope: FreedomdEvidenceEnvelope): Promise<void>;

package/dist/runtime/freedomd-evidence-envelope.js

@@ -0,0 +1,110 @@
+/**
+ * Local-first evidence envelope for Freedomd.
+ *
+ * Provider responses and evidence observations are persisted outside the
+ * provider runtime so that runs remain replayable and auditable even when a
+ * provider becomes unavailable or changes policy.
+ */
+import { mkdir, writeFile } from "fs/promises";
+import { dirname, join, resolve } from "path";
+import { sha256Hex } from "../util/hash.js";
+function envelopeDir(root, runId) {
+    return join(resolve(root), ".omk", "runs", runId, "freedomd");
+}
+function artifactPath(root, runId, nodeId, kind) {
+    const safeNodeId = nodeId.replace(/[^a-zA-Z0-9_-]/g, "_");
+    return join(envelopeDir(root, runId), `${safeNodeId}-${kind}.json`);
+}
+export function hashTaskPrompt(prompt) {
+    return sha256Hex(prompt);
+}
+async function persistArtifact(root, runId, nodeId, kind, payload) {
+    const path = artifactPath(root, runId, nodeId, kind);
+    await mkdir(dirname(path), { recursive: true });
+    const text = JSON.stringify(payload, null, 2);
+    await writeFile(path, text, "utf-8");
+    return {
+        path,
+        sha256: sha256Hex(text),
+        sizeBytes: Buffer.byteLength(text, "utf-8"),
+        redacted: false,
+        replayable: true,
+    };
+}
+export async function buildLocalFirstEvidenceEnvelope(options) {
+    const { task, selectedRuntime, runContext, evidenceObservations, providerResponse, sovereignty } = options;
+    const root = runContext.projectRoot ?? process.cwd();
+    const now = new Date().toISOString();
+    const localArtifacts = [];
+    const evidenceObservationList = [];
+    for (const observation of evidenceObservations ?? []) {
+        const artifact = await persistArtifact(root, runContext.runId, runContext.nodeId, `observation-${observation.kind}`, observation);
+        localArtifacts.push(artifact);
+        evidenceObservationList.push({
+            kind: observation.kind,
+            verdict: observation.confidence >= 0.8 ? "pass" : observation.confidence >= 0.4 ? "partial" : "fail",
+            artifactRef: artifact.path,
+            sha256: artifact.sha256,
+            replayable: observation.replayable,
+            redacted: observation.redacted,
+            confidence: observation.confidence,
+            timestamp: observation.timestamp,
+        });
+    }
+    if (providerResponse) {
+        const safeResponse = {
+            success: providerResponse.success,
+            exitCode: providerResponse.exitCode,
+            stdout: providerResponse.stdout,
+            stderr: providerResponse.stderr,
+            tokenUsage: providerResponse.tokenUsage,
+            metadata: providerResponse.metadata,
+        };
+        const artifact = await persistArtifact(root, runContext.runId, runContext.nodeId, "provider-response", safeResponse);
+        localArtifacts.push(artifact);
+        const envelope = {
+            schemaVersion: "omk.freedomd.evidence-envelope.v1",
+            runId: runContext.runId,
+            nodeId: runContext.nodeId,
+            taskHash: hashTaskPrompt(task.prompt),
+            selectedRuntime: selectedRuntime.id,
+            providerId: selectedRuntime.providerId ?? selectedRuntime.id.split("-")[0] ?? selectedRuntime.id,
+            runtimeMode: selectedRuntime.runtimeMode,
+            sovereignty,
+            evidenceRequirements: [],
+            evidenceObservations: evidenceObservationList,
+            providerResponseRef: artifact.path,
+            localArtifacts,
+            createdAt: now,
+        };
+        const envelopeArtifact = await persistArtifact(root, runContext.runId, runContext.nodeId, "evidence-envelope", envelope);
+        return {
+            ...envelope,
+            localArtifacts: [...localArtifacts, envelopeArtifact],
+        };
+    }
+    const envelope = {
+        schemaVersion: "omk.freedomd.evidence-envelope.v1",
+        runId: runContext.runId,
+        nodeId: runContext.nodeId,
+        taskHash: hashTaskPrompt(task.prompt),
+        selectedRuntime: selectedRuntime.id,
+        providerId: selectedRuntime.providerId ?? selectedRuntime.id.split("-")[0] ?? selectedRuntime.id,
+        runtimeMode: selectedRuntime.runtimeMode,
+        sovereignty,
+        evidenceRequirements: [],
+        evidenceObservations: evidenceObservationList,
+        localArtifacts,
+        createdAt: now,
+    };
+    const envelopeArtifact = await persistArtifact(root, runContext.runId, runContext.nodeId, "evidence-envelope", envelope);
+    return {
+        ...envelope,
+        localArtifacts: [...localArtifacts, envelopeArtifact],
+    };
+}
+export async function materializeEvidenceEnvelopeInGraph(store, envelope) {
+    const runId = envelope.runId;
+    const nodeId = envelope.nodeId;
+    await store.write(join(".omk", "runs", runId, "freedomd", `${nodeId}-evidence-envelope.json`), JSON.stringify(envelope, null, 2));
+}

package/dist/runtime/freedomd-exception.d.ts

@@ -0,0 +1,32 @@
+/**
+ * Freedomd provider exception approval.
+ *
+ * Interactive approval flow for blocked providers. Records user decisions as
+ * local artifacts and graph nodes so every override is auditable.
+ */
+import type { LocalGraphMemoryStore } from "../memory/local-graph-memory-store.js";
+export type ProviderExceptionScope = "once" | "run" | "deny";
+export interface ProviderExceptionRequest {
+    readonly providerId: string;
+    readonly runtimeMode?: string;
+    readonly blockedReason: string;
+    readonly retentionDays: number;
+    readonly jurisdictionRisk: number;
+    readonly localFallbackAvailable: boolean;
+    readonly taskSensitivity: string;
+}
+export interface ProviderExceptionResult {
+    readonly decision: ProviderExceptionScope;
+    readonly reason: string;
+    readonly artifactPath?: string;
+    readonly policyOverridePath?: string;
+}
+export interface ProviderExceptionApproverOptions {
+    readonly runId: string;
+    readonly nodeId: string;
+    readonly projectRoot?: string;
+    readonly graphStore?: LocalGraphMemoryStore;
+    readonly isTty?: boolean;
+    readonly promptUser?: (message: string) => Promise<string>;
+}
+export declare function requestProviderException(request: ProviderExceptionRequest, options: ProviderExceptionApproverOptions): Promise<ProviderExceptionResult>;

package/dist/runtime/freedomd-exception.js

@@ -0,0 +1,95 @@
+/**
+ * Freedomd provider exception approval.
+ *
+ * Interactive approval flow for blocked providers. Records user decisions as
+ * local artifacts and graph nodes so every override is auditable.
+ */
+import { mkdir, writeFile } from "node:fs/promises";
+import { dirname, join, resolve } from "node:path";
+export async function requestProviderException(request, options) {
+    const root = resolve(options.projectRoot ?? process.cwd());
+    if (options.isTty === false) {
+        return { decision: "deny", reason: "non-interactive provider exception denied" };
+    }
+    const summary = [
+        `Provider: ${request.providerId}${request.runtimeMode ? ` (${request.runtimeMode})` : ""}`,
+        `Blocked reason: ${request.blockedReason}`,
+        `Retention: ${request.retentionDays} days`,
+        `Jurisdiction risk: ${request.jurisdictionRisk.toFixed(2)}`,
+        `Local fallback available: ${request.localFallbackAvailable}`,
+        `Task sensitivity: ${request.taskSensitivity}`,
+    ].join("\n");
+    const choice = await (options.promptUser?.(summary) ?? Promise.resolve("deny"));
+    const normalized = choice.trim().toLowerCase();
+    if (normalized.startsWith("allow once")) {
+        const artifactPath = await writeExceptionArtifact(root, options.runId, options.nodeId, request, "once");
+        await materializeExceptionInGraph(options, request, "once", artifactPath);
+        return { decision: "once", reason: "user approved once", artifactPath };
+    }
+    if (normalized.startsWith("allow for run") || normalized.startsWith("allow run")) {
+        const artifactPath = await writeExceptionArtifact(root, options.runId, options.nodeId, request, "run");
+        const policyOverridePath = await writeRunPolicyOverride(root, options.runId, request);
+        await materializeExceptionInGraph(options, request, "run", artifactPath);
+        return { decision: "run", reason: "user approved for this run", artifactPath, policyOverridePath };
+    }
+    return { decision: "deny", reason: "user denied provider exception" };
+}
+async function writeExceptionArtifact(root, runId, nodeId, request, scope) {
+    const dir = join(root, ".omk", "runs", runId, "freedomd");
+    const path = join(dir, `${nodeId}-provider-exception.json`);
+    await mkdir(dirname(path), { recursive: true });
+    const payload = {
+        schemaVersion: "omk.freedomd.provider-exception.v1",
+        runId,
+        nodeId,
+        providerId: request.providerId,
+        runtimeMode: request.runtimeMode,
+        scope,
+        requestedAt: new Date().toISOString(),
+        request,
+    };
+    await writeFile(path, JSON.stringify(payload, null, 2), "utf-8");
+    return path;
+}
+async function writeRunPolicyOverride(root, runId, request) {
+    const dir = join(root, ".omk", "runs", runId, "freedomd");
+    const path = join(dir, "policy-overrides.json");
+    await mkdir(dirname(path), { recursive: true });
+    const payload = {
+        schemaVersion: "omk.freedomd.policy-overrides.v1",
+        runId,
+        providerOverrides: {
+            [request.providerId]: {
+                enabled: true,
+                reason: request.blockedReason,
+            },
+        },
+        createdAt: new Date().toISOString(),
+    };
+    await writeFile(path, JSON.stringify(payload, null, 2), "utf-8");
+    return path;
+}
+async function materializeExceptionInGraph(options, request, scope, artifactPath) {
+    if (!options.graphStore)
+        return;
+    try {
+        await options.graphStore.materializeFreedomdSovereignty({
+            runId: options.runId,
+            nodeId: options.nodeId,
+            providerId: request.providerId,
+            runtimeMode: request.runtimeMode ?? "api",
+            sovereignty: {
+                mode: "freedomd",
+                dataBoundary: "internal",
+                retentionDecision: "allow",
+                jurisdictionDecision: "allow",
+                providerCutoffRisk: 0,
+                localFallbackAvailable: request.localFallbackAvailable,
+                reason: `provider exception approved: ${scope}`,
+            },
+        });
+    }
+    catch {
+        // Best-effort graph materialization.
+    }
+}

package/dist/runtime/freedomd-incidents.d.ts

@@ -0,0 +1,23 @@
+/**
+ * Freedomd provider incident monitor.
+ *
+ * Reads local incident overrides from `.omk/provider-incidents.json` and
+ * optional per-project policy files. This avoids scraping public web pages by
+ * default while still letting operators react to events like Fable 5 quickly.
+ */
+import type { ProviderIncidentState } from "./provider-sovereignty.js";
+export interface ProviderIncidentFile {
+    readonly schemaVersion?: string;
+    readonly updatedAt?: string;
+    readonly incidents: readonly ProviderIncidentState[];
+}
+export interface LoadIncidentsOptions {
+    readonly projectRoot?: string;
+    readonly env?: NodeJS.ProcessEnv;
+    readonly feedUrls?: readonly string[];
+    readonly fetch?: (url: string) => Promise<{
+        ok: boolean;
+        text: () => Promise<string>;
+    }>;
+}
+export declare function loadProviderIncidents(options?: LoadIncidentsOptions): Promise<ProviderIncidentState[]>;

package/dist/runtime/freedomd-incidents.js

@@ -0,0 +1,103 @@
+/**
+ * Freedomd provider incident monitor.
+ *
+ * Reads local incident overrides from `.omk/provider-incidents.json` and
+ * optional per-project policy files. This avoids scraping public web pages by
+ * default while still letting operators react to events like Fable 5 quickly.
+ */
+import { readFile } from "node:fs/promises";
+import { join, resolve } from "node:path";
+function parseIncidentFile(raw) {
+    try {
+        const parsed = JSON.parse(raw);
+        if (!Array.isArray(parsed.incidents))
+            return [];
+        return parsed.incidents.filter(isValidIncident);
+    }
+    catch {
+        return [];
+    }
+}
+function isValidIncident(value) {
+    if (!value || typeof value !== "object")
+        return false;
+    const incident = value;
+    return (typeof incident.providerId === "string" &&
+        typeof incident.kind === "string" &&
+        typeof incident.severity === "string" &&
+        ["availability", "policy", "export-control", "retention", "jurisdiction"].includes(incident.kind) &&
+        ["info", "warn", "block"].includes(incident.severity));
+}
+function incidentsFromEnv(env) {
+    const raw = env.OMK_PROVIDER_INCIDENTS;
+    if (!raw)
+        return [];
+    try {
+        const parsed = JSON.parse(raw);
+        if (Array.isArray(parsed))
+            return parsed.filter(isValidIncident);
+        if (parsed && typeof parsed === "object" && "incidents" in parsed) {
+            return (parsed.incidents ?? []).filter(isValidIncident);
+        }
+        return [];
+    }
+    catch {
+        return [];
+    }
+}
+export async function loadProviderIncidents(options = {}) {
+    const root = resolve(options.projectRoot ?? process.cwd());
+    const env = options.env ?? process.env;
+    const filePath = join(root, ".omk", "provider-incidents.json");
+    let fileIncidents = [];
+    try {
+        const raw = await readFile(filePath, "utf-8");
+        fileIncidents = parseIncidentFile(raw);
+    }
+    catch {
+        // Missing or unreadable file is fine; fall back to env.
+    }
+    const envIncidents = incidentsFromEnv(env);
+    const feedIncidents = await fetchFeedIncidents(options.feedUrls ?? [], options.fetch);
+    // Merge by providerId+kind, preferring the most recent and most severe.
+    const map = new Map();
+    for (const incident of [...fileIncidents, ...envIncidents, ...feedIncidents]) {
+        const key = `${incident.providerId}:${incident.kind}:${incident.runtimeMode ?? ""}`;
+        const existing = map.get(key);
+        if (!existing || severityRank(incident.severity) > severityRank(existing.severity)) {
+            map.set(key, incident);
+        }
+    }
+    return [...map.values()];
+}
+async function fetchFeedIncidents(urls, fetchImpl) {
+    if (urls.length === 0)
+        return [];
+    const fetcher = fetchImpl ?? defaultFetch;
+    const results = [];
+    for (const url of urls) {
+        try {
+            const response = await fetcher(url);
+            if (!response.ok)
+                continue;
+            const text = await response.text();
+            const parsed = parseIncidentFile(text);
+            results.push(...parsed);
+        }
+        catch {
+            // Best-effort: individual feed failures must not block routing.
+        }
+    }
+    return results;
+}
+async function defaultFetch(url) {
+    const response = await fetch(url, { signal: AbortSignal.timeout(5_000) });
+    return { ok: response.ok, text: () => response.text() };
+}
+function severityRank(severity) {
+    if (severity === "block")
+        return 2;
+    if (severity === "warn")
+        return 1;
+    return 0;
+}

package/dist/runtime/freedomd-policy.d.ts

@@ -0,0 +1,35 @@
+/**
+ * Freedomd policy compiler.
+ *
+ * Translates environment, org defaults, and optional user config into a
+ * normalized policy that drives provider-sovereignty routing, retention gates,
+ * and degraded-mode fallback decisions.
+ */
+export type FreedomdMode = "off" | "balanced" | "strict";
+export interface FreedomdProviderOverride {
+    readonly enabled: boolean;
+    readonly reason?: string;
+    readonly priority?: number;
+}
+export interface FreedomdPolicy {
+    readonly mode: FreedomdMode;
+    readonly preferLocal: boolean;
+    readonly maxRetentionDays: number;
+    readonly allowExportRestrictedProvider: boolean;
+    readonly allowProviderExceptions: boolean;
+    readonly requireLocalEvidenceEnvelope: boolean;
+    readonly providerOverrides: Readonly<Record<string, FreedomdProviderOverride>>;
+    readonly maxJurisdictionRisk: number;
+    readonly maxRetentionRisk: number;
+    readonly maxCutoffRisk: number;
+    /** Optional public/provider incident feed URLs. Best-effort only. */
+    readonly incidentFeedUrls: readonly string[];
+}
+export interface FreedomdPolicyInputs {
+    readonly env?: NodeJS.ProcessEnv;
+    readonly orgDefaults?: Partial<FreedomdPolicy>;
+    readonly taskFlags?: Partial<FreedomdPolicy>;
+}
+export declare function compileFreedomdPolicy(inputs?: FreedomdPolicyInputs): FreedomdPolicy;
+export declare function isFreedomdEnabled(policy: Pick<FreedomdPolicy, "mode">): boolean;
+export declare function explainFreedomdPolicy(policy: FreedomdPolicy): string;

package/dist/runtime/freedomd-policy.js

@@ -0,0 +1,114 @@
+/**
+ * Freedomd policy compiler.
+ *
+ * Translates environment, org defaults, and optional user config into a
+ * normalized policy that drives provider-sovereignty routing, retention gates,
+ * and degraded-mode fallback decisions.
+ */
+const DEFAULT_POLICY = {
+    mode: "off",
+    preferLocal: false,
+    maxRetentionDays: Number.POSITIVE_INFINITY,
+    allowExportRestrictedProvider: true,
+    allowProviderExceptions: true,
+    requireLocalEvidenceEnvelope: false,
+    providerOverrides: {},
+    maxJurisdictionRisk: 1.0,
+    maxRetentionRisk: 1.0,
+    maxCutoffRisk: 1.0,
+    incidentFeedUrls: [],
+};
+function parseMode(raw) {
+    if (!raw)
+        return undefined;
+    const normalized = raw.trim().toLowerCase();
+    if (normalized === "off" || normalized === "0" || normalized === "false")
+        return "off";
+    if (normalized === "balanced" || normalized === "1" || normalized === "true")
+        return "balanced";
+    if (normalized === "strict" || normalized === "2")
+        return "strict";
+    return undefined;
+}
+function parseBoolean(raw) {
+    if (raw === undefined)
+        return undefined;
+    const normalized = raw.trim().toLowerCase();
+    if (normalized === "1" || normalized === "true" || normalized === "on")
+        return true;
+    if (normalized === "0" || normalized === "false" || normalized === "off")
+        return false;
+    return undefined;
+}
+function parseNumber(raw) {
+    if (raw === undefined)
+        return undefined;
+    const value = Number(raw);
+    if (!Number.isFinite(value))
+        return undefined;
+    return value;
+}
+function mergePolicy(base, patch) {
+    return {
+        ...base,
+        ...patch,
+        providerOverrides: {
+            ...base.providerOverrides,
+            ...patch.providerOverrides,
+        },
+    };
+}
+export function compileFreedomdPolicy(inputs = {}) {
+    const env = inputs.env ?? process.env;
+    let policy = mergePolicy(DEFAULT_POLICY, inputs.orgDefaults ?? {});
+    const envMode = parseMode(env.OMK_FREEDOMD_MODE);
+    if (envMode !== undefined) {
+        policy = mergePolicy(policy, { mode: envMode });
+    }
+    const preferLocal = parseBoolean(env.OMK_PREFER_LOCAL);
+    if (preferLocal !== undefined) {
+        policy = mergePolicy(policy, { preferLocal });
+    }
+    const maxRetentionDays = parseNumber(env.OMK_MAX_RETENTION_DAYS);
+    if (maxRetentionDays !== undefined) {
+        policy = mergePolicy(policy, { maxRetentionDays });
+    }
+    const allowExportRestricted = parseBoolean(env.OMK_BLOCK_EXPORT_RESTRICTED);
+    if (allowExportRestricted !== undefined) {
+        policy = mergePolicy(policy, { allowExportRestrictedProvider: !allowExportRestricted });
+    }
+    const allowProviderExceptions = parseBoolean(env.OMK_ALLOW_PROVIDER_EXCEPTIONS);
+    if (allowProviderExceptions !== undefined) {
+        policy = mergePolicy(policy, { allowProviderExceptions });
+    }
+    const incidentFeedUrlsRaw = env.OMK_FREEDOMD_FEED_URLS;
+    if (incidentFeedUrlsRaw) {
+        const urls = incidentFeedUrlsRaw.split(",").map((u) => u.trim()).filter(Boolean);
+        policy = mergePolicy(policy, { incidentFeedUrls: urls });
+    }
+    policy = mergePolicy(policy, inputs.taskFlags ?? {});
+    if (policy.mode === "strict") {
+        policy = mergePolicy(policy, {
+            preferLocal: true,
+            allowExportRestrictedProvider: false,
+            requireLocalEvidenceEnvelope: true,
+        });
+        if (!Number.isFinite(policy.maxRetentionDays) || policy.maxRetentionDays > 0) {
+            policy = mergePolicy(policy, { maxRetentionDays: 0 });
+        }
+    }
+    return policy;
+}
+export function isFreedomdEnabled(policy) {
+    return policy.mode !== "off";
+}
+export function explainFreedomdPolicy(policy) {
+    return [
+        `mode=${policy.mode}`,
+        `preferLocal=${policy.preferLocal}`,
+        `maxRetentionDays=${Number.isFinite(policy.maxRetentionDays) ? policy.maxRetentionDays : "unlimited"}`,
+        `allowExportRestricted=${policy.allowExportRestrictedProvider}`,
+        `allowExceptions=${policy.allowProviderExceptions}`,
+        `localEvidenceEnvelope=${policy.requireLocalEvidenceEnvelope}`,
+    ].join("; ");
+}