open-multi-agent-kit 0.79.3 → 0.80.2

package/dist/memory/local-graph-memory-store.js

@@ -1,5 +1,6 @@
 import { createHash } from "crypto";
 import { statSync } from "fs";
+import { sha256FileSync } from "../util/hash.js";
 import { mkdir, readFile, rename, rm, writeFile } from "fs/promises";
 import { dirname, resolve } from "path";
 import { loadMemorySettings, summarizeMemorySettings, usesLocalGraphBackend, } from "./memory-config.js";
@@ -21,9 +22,21 @@ export const ONTOLOGY = {
         "Command",
         "File",
         "Evidence",
+        "EvidenceRequirement",
+        "EvidenceObservation",
+        "Artifact",
+        "HeadroomDecision",
         "Provider",
         "ProviderRoute",
         "ProviderFallback",
+        "ProviderFreedomProfile",
+        "ProviderIncident",
+        "RetentionPolicy",
+        "JurisdictionPolicy",
+        "SovereigntyDecision",
+        "DegradedPlan",
+        "LocalFallback",
+        "EvidenceEnvelope",
         "AuditLink",
         "Constraint",
         "Question",
@@ -40,15 +53,25 @@ export const ONTOLOGY = {
         "HAS_TOPIC",
         "HAS_DECISION",
         "HAS_TASK",
+        "HAS_TURN",
         "HAS_RISK",
         "HAS_COMMAND",
         "HAS_FILE",
         "HAS_EVIDENCE",
+        "HAS_HEADROOM_DECISION",
         "USES_PROVIDER",
         "HAS_PROVIDER_ROUTE",
         "ROUTES_TO",
         "FALLS_BACK_TO",
         "HAS_PROVIDER_FALLBACK",
+        "HAS_SOVEREIGNTY_DECISION",
+        "BLOCKED_BY_PROVIDER_POLICY",
+        "DEGRADED_TO",
+        "HAS_LOCAL_FALLBACK",
+        "HAS_RETENTION_POLICY",
+        "HAS_JURISDICTION_POLICY",
+        "AFFECTED_BY_INCIDENT",
+        "EVIDENCE_ENVELOPE_STORED_AT",
         "HAS_AUDIT_LINK",
         "LINKS_TO",
         "HAS_CONSTRAINT",
@@ -60,6 +83,10 @@ export const ONTOLOGY = {
         "DEPENDS_ON",
         "BLOCKED_BY",
         "EVIDENCED_BY",
+        "DECLARES_EVIDENCE_REQUIREMENT",
+        "OBSERVED_EVIDENCE",
+        "SATISFIED_BY",
+        "STORED_AT",
         "TOUCHES_FILE",
     ],
 };
@@ -73,9 +100,21 @@ const GENERATED_TYPES = new Set([
     "Command",
     "File",
     "Evidence",
+    "EvidenceRequirement",
+    "EvidenceObservation",
+    "Artifact",
+    "HeadroomDecision",
     "Provider",
     "ProviderRoute",
     "ProviderFallback",
+    "ProviderFreedomProfile",
+    "ProviderIncident",
+    "RetentionPolicy",
+    "JurisdictionPolicy",
+    "SovereigntyDecision",
+    "DegradedPlan",
+    "LocalFallback",
+    "EvidenceEnvelope",
     "AuditLink",
     "Constraint",
     "Question",
@@ -88,6 +127,10 @@ const CANONICAL_NODE_TYPES = new Set([
     "Decision",
     "Risk",
     "Evidence",
+    "EvidenceRequirement",
+    "EvidenceObservation",
+    "Artifact",
+    "HeadroomDecision",
     "Goal",
     "Run",
     "Task",
@@ -96,6 +139,14 @@ const CANONICAL_NODE_TYPES = new Set([
     "Provider",
     "ProviderRoute",
     "ProviderFallback",
+    "ProviderFreedomProfile",
+    "ProviderIncident",
+    "RetentionPolicy",
+    "JurisdictionPolicy",
+    "SovereigntyDecision",
+    "DegradedPlan",
+    "LocalFallback",
+    "EvidenceEnvelope",
     "AuditLink",
 ]);
 const graphWriteQueues = new Map();
@@ -308,6 +359,516 @@ export class LocalGraphMemoryStore {
         await writeFile(`${mirrorDir}/commands.md`, `# Commands\n\n${renderNodes(byType("Command"))}`, "utf-8");
         await writeFile(`${mirrorDir}/risks.md`, `# Risks\n\n${renderNodes(byType("Risk"))}`, "utf-8");
     }
+    async materializeTurnAudit(input) {
+        await this.mutateState((state, now) => {
+            state.updatedAt = now;
+            state.project = { ...this.settings.project };
+            state.ontology = ONTOLOGY;
+            const runId = this.nodeId("Run", input.runId);
+            const turnId = this.nodeId("Task", `${input.runId}:${input.nodeId}`);
+            const providerName = input.provider ?? input.selectedRuntime?.split("-")[0] ?? "unknown";
+            const routeId = this.nodeId("ProviderRoute", `${input.runId}:${input.nodeId}:${input.selectedRuntime ?? providerName}`);
+            const evidenceId = this.nodeId("Evidence", `${input.runId}:${input.nodeId}:${input.evidenceArtifactPath ?? input.evidenceKind ?? "result"}`);
+            const providerId = this.nodeId("Provider", providerName);
+            const artifactId = input.evidenceArtifactPath
+                ? this.nodeId("Artifact", `${input.runId}:${input.evidenceArtifactPath}`)
+                : undefined;
+            const requirementEntries = (input.evidenceRequirements ?? [])
+                .filter((requirement) => requirement.required !== false)
+                .map((requirement) => ({
+                requirement,
+                id: this.nodeId("EvidenceRequirement", `${input.runId}:${input.nodeId}:${requirement.gate}:${requirement.ref ?? ""}`),
+            }));
+            const observationEntries = (input.evidenceObservations ?? [])
+                .map((observation, index) => ({
+                observation,
+                id: this.nodeId("Evidence", `${input.runId}:${input.nodeId}:observation:${index}:${observation.kind}:${observation.ref ?? observation.artifactPath ?? ""}`),
+            }));
+            const projectId = this.nodeId("Project", this.settings.project.key);
+            this.upsertNode(state, {
+                id: projectId,
+                type: "Project",
+                labels: ["OmkProject", "Project"],
+                label: this.settings.project.name,
+                summary: this.settings.project.root,
+                tags: ["project"],
+                properties: { key: this.settings.project.key, root: this.settings.project.root },
+                createdAt: now,
+                updatedAt: now,
+            });
+            this.upsertNode(state, {
+                id: runId,
+                type: "Run",
+                labels: ["OmkRun", "Run"],
+                label: input.runId,
+                summary: `Run ${input.runId}`,
+                tags: ["run", "audit"],
+                properties: { key: input.runId, runId: input.runId, projectKey: this.settings.project.key },
+                createdAt: now,
+                updatedAt: now,
+            });
+            this.upsertNode(state, {
+                id: turnId,
+                type: "Task",
+                labels: ["OmkTurn", "Task"],
+                label: input.nodeId,
+                summary: `Turn ${input.nodeId}`,
+                tags: ["turn", "audit"],
+                properties: { key: `${input.runId}:${input.nodeId}`, runId: input.runId, nodeId: input.nodeId },
+                createdAt: now,
+                updatedAt: now,
+            });
+            this.upsertNode(state, {
+                id: routeId,
+                type: "ProviderRoute",
+                labels: ["OmkProviderRoute", "ProviderRoute"],
+                label: input.selectedRuntime ?? input.provider ?? "unknown-runtime",
+                summary: `Selected runtime: ${input.selectedRuntime ?? input.provider ?? "unknown"}`,
+                tags: ["provider-route", "audit"],
+                properties: {
+                    key: `${input.runId}:${input.nodeId}:route`,
+                    runId: input.runId,
+                    nodeId: input.nodeId,
+                    provider: providerName,
+                    selectedRuntime: input.selectedRuntime ?? "unknown",
+                    fallbackChain: (input.fallbackChain ?? []).join(","),
+                },
+                createdAt: now,
+                updatedAt: now,
+            });
+            this.upsertNode(state, {
+                id: providerId,
+                type: "Provider",
+                labels: ["OmkProvider", "Provider"],
+                label: providerName,
+                summary: `Provider ${providerName}`,
+                tags: ["provider", "audit"],
+                properties: { key: providerName, provider: providerName },
+                createdAt: now,
+                updatedAt: now,
+            });
+            this.upsertNode(state, {
+                id: evidenceId,
+                type: "Evidence",
+                labels: ["OmkEvidence", "Evidence", "EvidenceObservation"],
+                label: input.evidenceKind ?? "turn-result",
+                summary: input.evidenceArtifactPath ?? "turn result artifact",
+                tags: ["evidence", "audit", "observation"],
+                properties: {
+                    key: `${input.runId}:${input.nodeId}:evidence`,
+                    runId: input.runId,
+                    nodeId: input.nodeId,
+                    kind: input.evidenceKind ?? "turn-result",
+                    artifactRef: input.evidenceArtifactPath ?? "",
+                    sha256: input.evidenceHash ?? "",
+                },
+                createdAt: now,
+                updatedAt: now,
+            });
+            if (artifactId && input.evidenceArtifactPath) {
+                const artifactPath = input.evidenceArtifactPath;
+                this.upsertNode(state, {
+                    id: artifactId,
+                    type: "Artifact",
+                    labels: ["OmkArtifact", "Artifact"],
+                    label: artifactPath,
+                    summary: artifactPath,
+                    tags: ["artifact", "audit"],
+                    properties: {
+                        key: `${input.runId}:${artifactPath}`,
+                        runId: input.runId,
+                        path: artifactPath,
+                        sha256: input.evidenceHash ?? "",
+                    },
+                    createdAt: now,
+                    updatedAt: now,
+                });
+            }
+            for (const { requirement, id } of requirementEntries) {
+                this.upsertNode(state, {
+                    id,
+                    type: "EvidenceRequirement",
+                    labels: ["OmkEvidenceRequirement", "EvidenceRequirement"],
+                    label: requirement.gate,
+                    summary: requirement.ref ?? requirement.gate,
+                    tags: ["evidence", "audit", "requirement"],
+                    properties: {
+                        key: `${input.runId}:${input.nodeId}:requirement:${requirement.gate}:${requirement.ref ?? ""}`,
+                        runId: input.runId,
+                        nodeId: input.nodeId,
+                        gate: requirement.gate,
+                        ref: requirement.ref ?? "",
+                        required: requirement.required !== false,
+                    },
+                    createdAt: now,
+                    updatedAt: now,
+                });
+            }
+            for (const { observation, id } of observationEntries) {
+                this.upsertNode(state, {
+                    id,
+                    type: "Evidence",
+                    labels: ["OmkEvidence", "Evidence", "EvidenceObservation"],
+                    label: observation.kind,
+                    summary: observation.ref ?? observation.artifactPath ?? observation.kind,
+                    tags: ["evidence", "audit", "observation"],
+                    properties: {
+                        key: `${input.runId}:${input.nodeId}:observation:${observation.kind}:${observation.ref ?? observation.artifactPath ?? ""}`,
+                        runId: input.runId,
+                        nodeId: input.nodeId,
+                        kind: observation.kind,
+                        source: observation.source,
+                        ref: observation.ref ?? "",
+                        artifactRef: observation.artifactPath ?? "",
+                        confidence: observation.confidence ?? 0,
+                        replayable: observation.replayable !== false,
+                        redacted: observation.redacted !== false,
+                    },
+                    createdAt: now,
+                    updatedAt: now,
+                });
+            }
+            this.upsertEdge(state, projectId, runId, "HAS_RUN", now);
+            this.upsertEdge(state, runId, turnId, "HAS_TASK", now);
+            this.upsertEdge(state, runId, turnId, "HAS_TURN", now);
+            this.upsertEdge(state, turnId, routeId, "HAS_PROVIDER_ROUTE", now);
+            this.upsertEdge(state, routeId, providerId, "ROUTES_TO", now);
+            this.upsertEdge(state, turnId, evidenceId, "OBSERVED_EVIDENCE", now);
+            this.upsertEdge(state, routeId, evidenceId, "EVIDENCED_BY", now);
+            if (artifactId)
+                this.upsertEdge(state, evidenceId, artifactId, "STORED_AT", now);
+            for (const { id } of requirementEntries) {
+                this.upsertEdge(state, turnId, id, "DECLARES_EVIDENCE_REQUIREMENT", now);
+            }
+            for (const { id, observation } of observationEntries) {
+                this.upsertEdge(state, turnId, id, "OBSERVED_EVIDENCE", now);
+                if (observation.artifactPath && artifactId && observation.artifactPath === input.evidenceArtifactPath) {
+                    this.upsertEdge(state, id, artifactId, "STORED_AT", now);
+                }
+                for (const { id: requirementId, requirement } of requirementEntries) {
+                    if (evidenceObservationSatisfiesRequirement(requirement.gate, observation.kind)) {
+                        this.upsertEdge(state, requirementId, id, "SATISFIED_BY", now);
+                    }
+                }
+            }
+        });
+    }
+    async materializeHeadroomDecision(input) {
+        await this.mutateState((state, now) => {
+            state.updatedAt = now;
+            state.project = { ...this.settings.project };
+            state.ontology = ONTOLOGY;
+            const projectId = this.nodeId("Project", this.settings.project.key);
+            const runId = this.nodeId("Run", input.runId);
+            const taskId = this.nodeId("Task", `${input.runId}:${input.nodeId}`);
+            const decisionId = this.nodeId("HeadroomDecision", `${input.runId}:${input.nodeId}`);
+            const artifactId = input.artifactRef
+                ? this.nodeId("Artifact", `${input.runId}:${input.artifactRef}`)
+                : undefined;
+            const attempted = input.metadata.attempted === true;
+            const applied = input.metadata.applied === true;
+            const reason = input.metadata.reason ?? "headroom decision";
+            this.upsertNode(state, {
+                id: projectId,
+                type: "Project",
+                labels: ["OmkProject", "Project"],
+                label: this.settings.project.name,
+                summary: this.settings.project.root,
+                tags: ["project"],
+                properties: { key: this.settings.project.key, root: this.settings.project.root },
+                createdAt: now,
+                updatedAt: now,
+            });
+            this.upsertNode(state, {
+                id: runId,
+                type: "Run",
+                labels: ["OmkRun", "Run"],
+                label: input.runId,
+                summary: `Run ${input.runId}`,
+                tags: ["run", "audit"],
+                properties: { key: input.runId, runId: input.runId, projectKey: this.settings.project.key },
+                createdAt: now,
+                updatedAt: now,
+            });
+            this.upsertNode(state, {
+                id: taskId,
+                type: "Task",
+                labels: ["OmkTurn", "Task"],
+                label: input.nodeId,
+                summary: `Turn ${input.nodeId}`,
+                tags: ["turn", "audit"],
+                properties: { key: `${input.runId}:${input.nodeId}`, runId: input.runId, nodeId: input.nodeId },
+                createdAt: now,
+                updatedAt: now,
+            });
+            this.upsertNode(state, {
+                id: decisionId,
+                type: "HeadroomDecision",
+                labels: ["OmkHeadroomDecision", "HeadroomDecision"],
+                label: `${input.nodeId}:headroom`,
+                summary: reason,
+                tags: ["headroom", "compaction", "audit"],
+                properties: {
+                    key: `${input.runId}:${input.nodeId}:headroom`,
+                    runId: input.runId,
+                    nodeId: input.nodeId,
+                    attempted,
+                    backend: input.metadata.backend ?? "none",
+                    compacted: input.metadata.compacted === true,
+                    compactedTextProduced: input.metadata.compactedTextProduced === true,
+                    validated: input.metadata.validated === true,
+                    applied,
+                    beforeTokens: input.metadata.beforeTokens ?? 0,
+                    afterTokens: input.metadata.afterTokens ?? 0,
+                    utilization: input.metadata.utilization ?? 0,
+                    threshold: input.metadata.threshold ?? 0,
+                    contract: input.metadata.contract ?? "unknown",
+                    reason,
+                    missingSections: (input.metadata.missingSections ?? []).join(","),
+                    qualityScore: input.metadata.qualityScore ?? 0,
+                    compressionRatio: input.metadata.compressionRatio ?? 0,
+                },
+                createdAt: now,
+                updatedAt: now,
+            });
+            if (artifactId && input.artifactRef) {
+                const artifactPath = resolve(this.settings.project.root, input.artifactRef);
+                let sha256 = null;
+                let sizeBytes = null;
+                let exists = false;
+                try {
+                    const stats = statSync(artifactPath);
+                    sizeBytes = stats.size;
+                    sha256 = sha256FileSync(artifactPath) ?? null;
+                    exists = true;
+                }
+                catch {
+                    sha256 = null;
+                    sizeBytes = null;
+                    exists = false;
+                }
+                this.upsertNode(state, {
+                    id: artifactId,
+                    type: "Artifact",
+                    labels: ["OmkArtifact", "Artifact"],
+                    label: input.artifactRef,
+                    summary: input.artifactRef,
+                    tags: ["artifact", "headroom", "audit"],
+                    properties: {
+                        key: `${input.runId}:${input.artifactRef}`,
+                        runId: input.runId,
+                        path: input.artifactRef,
+                        kind: "headroom-decision",
+                        sha256,
+                        sizeBytes,
+                        exists,
+                    },
+                    createdAt: now,
+                    updatedAt: now,
+                });
+                if (!exists) {
+                    const missingArtifactRiskId = this.nodeId("Risk", `${input.runId}:${input.nodeId}:missing-headroom-artifact`);
+                    this.upsertNode(state, {
+                        id: missingArtifactRiskId,
+                        type: "Risk",
+                        labels: ["OmkRisk", "Risk"],
+                        label: "missing-headroom-artifact",
+                        summary: "headroom decision artifactRef did not resolve",
+                        tags: ["risk", "headroom", "artifact"],
+                        properties: {
+                            key: `${input.runId}:${input.nodeId}:missing-headroom-artifact`,
+                            runId: input.runId,
+                            nodeId: input.nodeId,
+                            kind: "missing-headroom-artifact",
+                            artifactRef: input.artifactRef,
+                        },
+                        createdAt: now,
+                        updatedAt: now,
+                    });
+                    this.upsertEdge(state, decisionId, missingArtifactRiskId, "HAS_RISK", now);
+                }
+            }
+            this.upsertEdge(state, projectId, runId, "HAS_RUN", now);
+            this.upsertEdge(state, runId, taskId, "HAS_TASK", now);
+            this.upsertEdge(state, taskId, decisionId, "HAS_HEADROOM_DECISION", now);
+            if (artifactId)
+                this.upsertEdge(state, decisionId, artifactId, "STORED_AT", now);
+            if (attempted && !applied) {
+                const riskId = this.nodeId("Risk", `${input.runId}:${input.nodeId}:headroom`);
+                this.upsertNode(state, {
+                    id: riskId,
+                    type: "Risk",
+                    labels: ["OmkRisk", "Risk"],
+                    label: "headroom-compaction-not-applied",
+                    summary: reason,
+                    tags: ["risk", "headroom", "compaction"],
+                    properties: {
+                        key: `${input.runId}:${input.nodeId}:headroom-risk`,
+                        runId: input.runId,
+                        nodeId: input.nodeId,
+                        kind: "headroom-compaction-not-applied",
+                        reason,
+                        missingSections: (input.metadata.missingSections ?? []).join(","),
+                    },
+                    createdAt: now,
+                    updatedAt: now,
+                });
+                this.upsertEdge(state, taskId, riskId, "HAS_RISK", now);
+            }
+        });
+    }
+    async materializeFreedomdSovereignty(input) {
+        await this.mutateState((state, now) => {
+            state.updatedAt = now;
+            state.ontology = ONTOLOGY;
+            const runNodeId = this.nodeId("Run", input.runId);
+            const taskId = this.nodeId("Task", `${input.runId}:${input.nodeId}`);
+            const decisionId = this.nodeId("SovereigntyDecision", `${input.runId}:${input.nodeId}`);
+            const providerId = this.nodeId("Provider", `${input.providerId}:${input.runtimeMode}`);
+            this.upsertNode(state, {
+                id: runNodeId,
+                type: "Run",
+                labels: ["OmkRun", "Run"],
+                label: input.runId,
+                summary: `Run ${input.runId}`,
+                tags: ["run", "audit", "freedomd"],
+                properties: { key: input.runId, runId: input.runId },
+                createdAt: now,
+                updatedAt: now,
+            });
+            this.upsertNode(state, {
+                id: taskId,
+                type: "Task",
+                labels: ["OmkTurn", "Task"],
+                label: input.nodeId,
+                summary: `Turn ${input.nodeId}`,
+                tags: ["turn", "audit", "freedomd"],
+                properties: { key: `${input.runId}:${input.nodeId}`, runId: input.runId, nodeId: input.nodeId },
+                createdAt: now,
+                updatedAt: now,
+            });
+            this.upsertNode(state, {
+                id: providerId,
+                type: "Provider",
+                labels: ["OmkProvider", "Provider"],
+                label: `${input.providerId}:${input.runtimeMode}`,
+                summary: `Provider ${input.providerId} (${input.runtimeMode})`,
+                tags: ["provider", "freedomd"],
+                properties: { key: `${input.providerId}:${input.runtimeMode}`, providerId: input.providerId, runtimeMode: input.runtimeMode },
+                createdAt: now,
+                updatedAt: now,
+            });
+            this.upsertNode(state, {
+                id: decisionId,
+                type: "SovereigntyDecision",
+                labels: ["OmkSovereigntyDecision", "SovereigntyDecision"],
+                label: `${input.nodeId}:sovereignty`,
+                summary: input.sovereignty.reason,
+                tags: ["sovereignty", "freedomd", "audit"],
+                properties: {
+                    key: `${input.runId}:${input.nodeId}:sovereignty`,
+                    runId: input.runId,
+                    nodeId: input.nodeId,
+                    mode: input.sovereignty.mode,
+                    dataBoundary: input.sovereignty.dataBoundary,
+                    retentionDecision: input.sovereignty.retentionDecision,
+                    jurisdictionDecision: input.sovereignty.jurisdictionDecision,
+                    providerCutoffRisk: input.sovereignty.providerCutoffRisk,
+                    localFallbackAvailable: input.sovereignty.localFallbackAvailable,
+                    reason: input.sovereignty.reason,
+                },
+                createdAt: now,
+                updatedAt: now,
+            });
+            this.upsertEdge(state, runNodeId, taskId, "HAS_TASK", now);
+            this.upsertEdge(state, taskId, decisionId, "HAS_SOVEREIGNTY_DECISION", now);
+            this.upsertEdge(state, taskId, providerId, "USES_PROVIDER", now);
+            if (input.degradedMode) {
+                const degradedId = this.nodeId("DegradedPlan", `${input.runId}:${input.nodeId}`);
+                this.upsertNode(state, {
+                    id: degradedId,
+                    type: "DegradedPlan",
+                    labels: ["OmkDegradedPlan", "DegradedPlan"],
+                    label: input.degradedMode,
+                    summary: `Degraded to ${input.degradedMode}`,
+                    tags: ["degraded", "freedomd"],
+                    properties: { key: `${input.runId}:${input.nodeId}:degraded`, runId: input.runId, nodeId: input.nodeId, mode: input.degradedMode },
+                    createdAt: now,
+                    updatedAt: now,
+                });
+                this.upsertEdge(state, taskId, degradedId, "DEGRADED_TO", now);
+            }
+            if (input.incident) {
+                const incidentId = this.nodeId("ProviderIncident", `${input.runId}:${input.nodeId}:${input.providerId}`);
+                this.upsertNode(state, {
+                    id: incidentId,
+                    type: "ProviderIncident",
+                    labels: ["OmkProviderIncident", "ProviderIncident"],
+                    label: input.incident.kind,
+                    summary: input.incident.reason,
+                    tags: ["incident", "freedomd", input.incident.severity],
+                    properties: {
+                        key: `${input.runId}:${input.nodeId}:${input.providerId}:incident`,
+                        runId: input.runId,
+                        nodeId: input.nodeId,
+                        providerId: input.providerId,
+                        kind: input.incident.kind,
+                        severity: input.incident.severity,
+                        reason: input.incident.reason,
+                    },
+                    createdAt: now,
+                    updatedAt: now,
+                });
+                this.upsertEdge(state, decisionId, incidentId, "AFFECTED_BY_INCIDENT", now);
+            }
+        });
+    }
+    async materializeFreedomdEvidenceEnvelope(input) {
+        await this.mutateState((state, now) => {
+            state.updatedAt = now;
+            state.ontology = ONTOLOGY;
+            const taskId = this.nodeId("Task", `${input.runId}:${input.nodeId}`);
+            const envelopeId = this.nodeId("EvidenceEnvelope", `${input.runId}:${input.nodeId}`);
+            const artifactId = this.nodeId("Artifact", `${input.runId}:${input.envelopePath}`);
+            this.upsertNode(state, {
+                id: envelopeId,
+                type: "EvidenceEnvelope",
+                labels: ["OmkEvidenceEnvelope", "EvidenceEnvelope"],
+                label: `${input.nodeId}:evidence-envelope`,
+                summary: "Freedomd local-first evidence envelope",
+                tags: ["evidence", "freedomd", "audit"],
+                properties: {
+                    key: `${input.runId}:${input.nodeId}:evidence-envelope`,
+                    runId: input.runId,
+                    nodeId: input.nodeId,
+                    path: input.envelopePath,
+                },
+                createdAt: now,
+                updatedAt: now,
+            });
+            this.upsertNode(state, {
+                id: artifactId,
+                type: "Artifact",
+                labels: ["OmkArtifact", "Artifact"],
+                label: input.envelopePath,
+                summary: input.envelopePath,
+                tags: ["artifact", "evidence", "freedomd"],
+                properties: {
+                    key: `${input.runId}:${input.envelopePath}`,
+                    runId: input.runId,
+                    path: input.envelopePath,
+                    kind: "freedomd-evidence-envelope",
+                    sha256: input.sha256 ?? null,
+                    sizeBytes: input.sizeBytes ?? null,
+                    exists: input.exists ?? false,
+                },
+                createdAt: now,
+                updatedAt: now,
+            });
+            this.upsertEdge(state, taskId, envelopeId, "HAS_EVIDENCE", now);
+            this.upsertEdge(state, envelopeId, artifactId, "EVIDENCE_ENVELOPE_STORED_AT", now);
+        });
+    }
     async append(path, content) {
         await this.mutateState((state, now) => {
             const existing = this.readFromState(state, path);
@@ -1300,6 +1861,15 @@ function readNumberArg(query, name) {
     const match = query.match(new RegExp(`${name}\\s*:\\s*(\\d+)`, "i"));
     return match ? Number.parseInt(match[1], 10) : undefined;
 }
+function evidenceObservationSatisfiesRequirement(requirementGate, observationKind) {
+    if (observationKind === requirementGate)
+        return true;
+    if (requirementGate === "test-pass" && observationKind === "command-pass")
+        return true;
+    if (requirementGate === "file-exists" && observationKind === "artifact")
+        return true;
+    return false;
+}
 function hash(value) {
     return createHash("sha256").update(value).digest("hex");
 }

package/dist/orchestration/dag.d.ts

@@ -1,7 +1,7 @@
 import type { DeepSeekModelTier, DeepSeekParticipation, ProviderId } from "../providers/types.js";
 export type TaskStatus = "pending" | "running" | "done" | "failed" | "blocked" | "skipped";
 export type DagContextBudget = "tiny" | "small" | "normal";
-export type DagOutputGate = "file-exists" | "test-pass" | "review-pass" | "command-pass" | "summary" | "none";
+export type DagOutputGate = "file-exists" | "test-pass" | "review-pass" | "command-pass" | "summary" | "artifact" | "diff" | "none";
 export interface DagNodeInput {
     name: string;
     ref: string;
@@ -39,6 +39,9 @@ export interface DagNodeRouting {
     approvalPolicy?: string;
     executionPrompt?: string;
     promptMode?: string;
+    promptHash?: string;
+    promptPayloadRef?: string;
+    promptPayloadPrivate?: boolean;
     runtimeSidecar?: unknown;
     needsIntegration?: boolean;
     /**
@@ -73,6 +76,24 @@ export interface DagNodeRouting {
         };
         reason: string;
     }>;
+    riskTrace?: {
+        risk?: string;
+        confidence?: number;
+        matchedSignal?: string;
+        readOnlyOverride?: boolean;
+        positiveSignals?: readonly string[];
+        negativeScopes?: readonly string[];
+        requestedOps?: readonly string[];
+        excludedOps?: readonly string[];
+    };
+    /** Freedomd sovereignty metadata for provider-independent routing. */
+    freedomd?: {
+        dataBoundary?: "public" | "internal" | "customer" | "secret";
+        preferredProvider?: string;
+        allowProviderExceptions?: boolean;
+        degradedMode?: string;
+        sovereigntyReason?: string;
+    };
     replanHint?: {
         criterionId?: string;
         artifactRef?: string;