pi-mega-compact 0.20.47 → 0.20.49

package/dist/src/vector-cortex/encoder/qualify.js

@@ -0,0 +1,50 @@
+/**
+ * vector-cortex/encoder/qualify.ts — ENC-0f pure qualification function.
+ *
+ * Constructs a {@link QualificationV1} record from a {@link BenchResultV1} by
+ * asserting four independent gates (latency, marginal-RSS, determinism, opset)
+ * plus the bench's own conjunctive `gates.all`. A gated-off bench can NEVER be
+ * swept into mode A by a sub-threshold p95 alone — `bench_gates_not_green`
+ * forces `"failed"` regardless of the sub-threshold values.
+ *
+ * Pure (TRIAD_RESILIENCE §pure): no `any` (PREVENT-011), no casts, no clock, no
+ * storage, no network (PREVENT-PI-004). Thresholds are sourced from
+ * {@link ENCODER_LATENCY_P95_MS} / {@link ENCODER_RSS_BUDGET_BYTES} /
+ * {@link ENCODER_OPSET} — never magic numbers.
+ */
+import { ENCODER_LATENCY_P95_MS, ENCODER_RSS_BUDGET_BYTES, ENCODER_OPSET, } from "./types.js";
+/**
+ * Qualify a bench result against the four independent gates + the bench's own
+ * conjunctive gate. Returns a QualificationV1 with `verdict:"qualified"` only
+ * when ALL gates pass and `bench.gates.all` is true.
+ */
+export function qualifyEncodedAsset(bench, platform) {
+    const reasons = [];
+    if (bench.p95Ms !== null && bench.p95Ms > ENCODER_LATENCY_P95_MS) {
+        reasons.push("latency");
+    }
+    if (bench.rssMarginalMib !== null &&
+        bench.rssMarginalMib * 1024 * 1024 > ENCODER_RSS_BUDGET_BYTES) {
+        reasons.push("rss");
+    }
+    if (!bench.deterministic) {
+        reasons.push("determinism");
+    }
+    if (bench.opset !== null && bench.opset !== ENCODER_OPSET) {
+        reasons.push("opset");
+    }
+    if (!bench.gates.all && !reasons.includes("bench_gates_not_green")) {
+        reasons.push("bench_gates_not_green");
+    }
+    const verdict = reasons.length === 0 && bench.gates.all ? "qualified" : "failed";
+    return {
+        schema: "qualification-v1",
+        verdict,
+        reasons,
+        platform,
+        p95Ms: bench.p95Ms ?? 0,
+        rssMib: bench.rssMarginalMib ?? 0,
+        opset: bench.opset ?? 0,
+        digest: bench.digest ?? "",
+    };
+}

package/dist/src/vector-cortex/setup-cortex-blockers-compute.js

@@ -0,0 +1,160 @@
+/**
+ * src/vector-cortex/setup-cortex-blockers-compute.ts — canonical blocker
+ * manifest + pure computed blocker derivation for the Setup Cortex status
+ * read path (VC9A/ENC-0g).
+ *
+ * The hard-gate items enumerated in docs/vector-cortex/vc2-model-prep.md §6
+ * (per the 2026-08-05 research update: the opset-14→17 re-export blocker is
+ * REMOVED because onnx-community exports are now opset 21). This module is the
+ * SINGLE canonical source of those blockers — the route file
+ * (routes-setup-cortex.ts) carries NO string literals for them; it reads this
+ * manifest so the UI rows and the spec stay in one place.
+ *
+ * ENC-0g: `SETUP_CORTEX_BLOCKERS` remains the canonical BASE data (authored
+ * all-open, byte-identical to ENC-0f-era for flag-off). `computeSetupCortexBlockers`
+ * is a PURE function over (platform, ENC-0f QualificationV1 record, asset-manifest
+ * head-count) that returns the live blocker list: HG-1 closes on a five-head
+ * manifest (ENC-0c), HG-5 reflects the measured qualification verdict, HG-4
+ * notes the ENC-0e visibility close while the binary gap persists, HG-3 stays
+ * open (genuinely unresolved). `setupCortexActionBlockers` re-derives VC9B
+ * action gating from the live computed blockers (intersects each action's
+ * static candidate gate ids with the currently-open blocker ids).
+ *
+ * Reader-only, pure computation: zero network, no writes (PREVENT-PI-004), no
+ * `any` (PREVENT-011). Thresholds come from src/vector-cortex/encoder/types.js
+ * (ENCODER_HEAD_ORDER / ENCODER_LATENCY_P95_MS / ENCODER_RSS_BUDGET_BYTES) —
+ * never magic numbers in the computed path.
+ */
+import { ENCODER_HEAD_ORDER, ENCODER_LATENCY_P95_MS, ENCODER_RSS_BUDGET_BYTES, } from "./encoder/types.js";
+const MIB = 1024 * 1024;
+/**
+ * Marker threshold-failure emitted by the status route when NO QualificationV1
+ * record exists on the device (or it is missing / unreadable / corrupt) — the
+ * route falls back to the verify-only verdict and includes this marker, never a
+ * fabricated pass and never a bare silent fallback. SINGLE source: the status
+ * route references this const, never a re-literal (no-scattered-literal scan).
+ */
+export const QUALIFICATION_RECORD_UNAVAILABLE = "qualification_record_unavailable";
+/**
+ * The four blockers VC9A reports. Enumerates the vc2-model-prep §6 items that
+ * remain per the 2026-08-05 research. The opset re-export blocker (formerly
+ * §6 #2) is NOT listed: onnx-community exports are opset 21, so it is removed.
+ * This is the canonical BASE (all `status:"open"`); `computeSetupCortexBlockers`
+ * derives the live list from it. Flag-off consumes this array verbatim.
+ */
+export const SETUP_CORTEX_BLOCKERS = [
+    {
+        id: "HG-1",
+        title: "Five projection heads do not exist",
+        severity: "blocker",
+        status: "open",
+        resolution: "Supervision transfer onto a frozen bge-small-en-v1.5 trunk (contradiction distilled from cross-encoder/nli-deberta-v3-small; dependency NLI-assisted; cache-stability deterministic; payload-routing small MLP) — VC2B training + export.",
+    },
+    {
+        id: "HG-3",
+        title: "onnxruntime-node install exceeds the 80 MiB asset budget",
+        severity: "blocker",
+        status: "open",
+        resolution: "onnxruntime-node bundles ~258 MiB across all platforms. Candidate: transformers.js v4.2.0 (9.5 MiB shell, pure-Node via onnxruntime-web WASM) measured against budget + p95 gate before committing.",
+    },
+    {
+        id: "HG-4",
+        title: "No darwin-x64 binary in onnxruntime-node",
+        severity: "high",
+        status: "open",
+        resolution: "Intel-Mac mode-A users demote to the WASM path (if HG-3 resolves that way) or mode B. " +
+            "darwin-x64: no native binary upstream (arm64-only); mode-B WASM per HG-4.",
+    },
+    {
+        id: "HG-5",
+        title: "RSS margin at 512 tokens is ~0.5%",
+        severity: "medium",
+        status: "open",
+        resolution: "149.2 MiB vs 150 MiB cap with run-to-run variance 119-149 MiB; considers capping mode A at 384 tokens or using the marginal-footprint accounting runtime.ts already implements.",
+    },
+];
+/** Look up one blocker by id; undefined when unknown (defensive). */
+export function setupCortexBlocker(id) {
+    return SETUP_CORTEX_BLOCKERS.find((b) => b.id === id);
+}
+/**
+ * The live blockers computed from (platform, ENC-0f QualificationV1 record,
+ * asset-manifest head-count). Pure + deterministic — no IO, no clock, no flag
+ * dependence. Rules:
+ *  - HG-1 → `"closed"` when the asset manifest declares all five projection
+ *    heads (`headCount === ENCODER_HEAD_ORDER.length`); otherwise stays open.
+ *  - HG-3 → unchanged (genuinely open — onnxruntime-node budget unresolved).
+ *  - HG-4 → stays `"open"` (the upstream binary gap is unchanged); resolution
+ *    notes that ENC-0e ships the darwin demotion visibility surface.
+ *  - HG-5 → derived from the qualification record: an empty record is
+ *    `"superseded"` (no measurement on this device); a `failed` verdict closes
+ *    it with the measured p95/RSS wording; a `qualified` verdict closes it with
+ *    "measured" wording. Severity stays `"medium"` from the base row.
+ * `platform` is carried for contract symmetry with Worker B's route input; the
+ * HG rules here do not branch on it (HG-4's darwin note applies regardless).
+ */
+export function computeSetupCortexBlockers(input) {
+    const { qualification, headCount } = input;
+    return SETUP_CORTEX_BLOCKERS.map((base) => {
+        switch (base.id) {
+            case "HG-1":
+                return headCount === ENCODER_HEAD_ORDER.length
+                    ? { ...base, status: "closed" }
+                    : base;
+            case "HG-4":
+                return {
+                    ...base,
+                    resolution: `${base.resolution} ENC-0e shipped the darwin demotion visibility surface.`,
+                };
+            case "HG-5":
+                if (qualification === null) {
+                    return {
+                        ...base,
+                        status: "superseded",
+                        resolution: "No QualificationV1 record on this device — run the gate (scripts/encoder/gate-qualify.mjs) to measure.",
+                    };
+                }
+                if (qualification.verdict === "failed") {
+                    return {
+                        ...base,
+                        title: "Real-asset qualification: failed (latency + marginal-RSS over budget)",
+                        status: "closed",
+                        resolution: `p95 ${qualification.p95Ms} ms vs ${ENCODER_LATENCY_P95_MS} ms gate, marginal RSS ${qualification.rssMib} MiB vs ${ENCODER_RSS_BUDGET_BYTES / MIB} MiB cap — mode A requires the native onnxruntime-node selection`,
+                    };
+                }
+                return {
+                    ...base,
+                    title: "Real-asset qualification: measured",
+                    status: "closed",
+                };
+            default:
+                return base;
+        }
+    });
+}
+/**
+ * The static PER-ACTION CANDIDATE gate ids — this is POLICY, NOT the derived
+ * gating. fetch-model and bench ARE candidates for HG-1 (five-head training)
+ * and HG-3 (install budget); verify-asset is a pure re-read of committed assets
+ * and is NEVER gated (empty candidate list). The derived gating (below)
+ * intersects these candidates with the currently-OPEN blockers from the live
+ * computed list, so a candidate only blocks when its blocker is actually open.
+ */
+const ACTION_GATE_CANDIDATES = {
+    "fetch-model": ["HG-1", "HG-3"],
+    bench: ["HG-1", "HG-3"],
+    "verify-asset": [],
+};
+/**
+ * Re-derived VC9B action gating from the LIVE computed blockers. An action is
+ * gated by exactly the candidate ids that are `status:"open"` AND
+ * `severity:"blocker"` in the supplied blockers. `blockers` defaults to the
+ * base `SETUP_CORTEX_BLOCKERS` (authored all-open) for backward compatibility
+ * with single-arg callers — with HG-1 closed by a computed list, fetch-model
+ * and bench surface `["HG-3"]`; verify-asset always `[]`.
+ */
+export function setupCortexActionBlockers(action, blockers) {
+    const live = blockers ?? SETUP_CORTEX_BLOCKERS;
+    const openBlockerIds = new Set(live.filter((b) => b.status === "open" && b.severity === "blocker").map((b) => b.id));
+    return ACTION_GATE_CANDIDATES[action].filter((id) => openBlockerIds.has(id));
+}

package/dist/vector-cortex/encoder/qualify.js

@@ -0,0 +1,50 @@
+/**
+ * vector-cortex/encoder/qualify.ts — ENC-0f pure qualification function.
+ *
+ * Constructs a {@link QualificationV1} record from a {@link BenchResultV1} by
+ * asserting four independent gates (latency, marginal-RSS, determinism, opset)
+ * plus the bench's own conjunctive `gates.all`. A gated-off bench can NEVER be
+ * swept into mode A by a sub-threshold p95 alone — `bench_gates_not_green`
+ * forces `"failed"` regardless of the sub-threshold values.
+ *
+ * Pure (TRIAD_RESILIENCE §pure): no `any` (PREVENT-011), no casts, no clock, no
+ * storage, no network (PREVENT-PI-004). Thresholds are sourced from
+ * {@link ENCODER_LATENCY_P95_MS} / {@link ENCODER_RSS_BUDGET_BYTES} /
+ * {@link ENCODER_OPSET} — never magic numbers.
+ */
+import { ENCODER_LATENCY_P95_MS, ENCODER_RSS_BUDGET_BYTES, ENCODER_OPSET, } from "./types.js";
+/**
+ * Qualify a bench result against the four independent gates + the bench's own
+ * conjunctive gate. Returns a QualificationV1 with `verdict:"qualified"` only
+ * when ALL gates pass and `bench.gates.all` is true.
+ */
+export function qualifyEncodedAsset(bench, platform) {
+    const reasons = [];
+    if (bench.p95Ms !== null && bench.p95Ms > ENCODER_LATENCY_P95_MS) {
+        reasons.push("latency");
+    }
+    if (bench.rssMarginalMib !== null &&
+        bench.rssMarginalMib * 1024 * 1024 > ENCODER_RSS_BUDGET_BYTES) {
+        reasons.push("rss");
+    }
+    if (!bench.deterministic) {
+        reasons.push("determinism");
+    }
+    if (bench.opset !== null && bench.opset !== ENCODER_OPSET) {
+        reasons.push("opset");
+    }
+    if (!bench.gates.all && !reasons.includes("bench_gates_not_green")) {
+        reasons.push("bench_gates_not_green");
+    }
+    const verdict = reasons.length === 0 && bench.gates.all ? "qualified" : "failed";
+    return {
+        schema: "qualification-v1",
+        verdict,
+        reasons,
+        platform,
+        p95Ms: bench.p95Ms ?? 0,
+        rssMib: bench.rssMarginalMib ?? 0,
+        opset: bench.opset ?? 0,
+        digest: bench.digest ?? "",
+    };
+}

package/dist/vector-cortex/setup-cortex-blockers-compute.js

@@ -0,0 +1,160 @@
+/**
+ * src/vector-cortex/setup-cortex-blockers-compute.ts — canonical blocker
+ * manifest + pure computed blocker derivation for the Setup Cortex status
+ * read path (VC9A/ENC-0g).
+ *
+ * The hard-gate items enumerated in docs/vector-cortex/vc2-model-prep.md §6
+ * (per the 2026-08-05 research update: the opset-14→17 re-export blocker is
+ * REMOVED because onnx-community exports are now opset 21). This module is the
+ * SINGLE canonical source of those blockers — the route file
+ * (routes-setup-cortex.ts) carries NO string literals for them; it reads this
+ * manifest so the UI rows and the spec stay in one place.
+ *
+ * ENC-0g: `SETUP_CORTEX_BLOCKERS` remains the canonical BASE data (authored
+ * all-open, byte-identical to ENC-0f-era for flag-off). `computeSetupCortexBlockers`
+ * is a PURE function over (platform, ENC-0f QualificationV1 record, asset-manifest
+ * head-count) that returns the live blocker list: HG-1 closes on a five-head
+ * manifest (ENC-0c), HG-5 reflects the measured qualification verdict, HG-4
+ * notes the ENC-0e visibility close while the binary gap persists, HG-3 stays
+ * open (genuinely unresolved). `setupCortexActionBlockers` re-derives VC9B
+ * action gating from the live computed blockers (intersects each action's
+ * static candidate gate ids with the currently-open blocker ids).
+ *
+ * Reader-only, pure computation: zero network, no writes (PREVENT-PI-004), no
+ * `any` (PREVENT-011). Thresholds come from src/vector-cortex/encoder/types.js
+ * (ENCODER_HEAD_ORDER / ENCODER_LATENCY_P95_MS / ENCODER_RSS_BUDGET_BYTES) —
+ * never magic numbers in the computed path.
+ */
+import { ENCODER_HEAD_ORDER, ENCODER_LATENCY_P95_MS, ENCODER_RSS_BUDGET_BYTES, } from "./encoder/types.js";
+const MIB = 1024 * 1024;
+/**
+ * Marker threshold-failure emitted by the status route when NO QualificationV1
+ * record exists on the device (or it is missing / unreadable / corrupt) — the
+ * route falls back to the verify-only verdict and includes this marker, never a
+ * fabricated pass and never a bare silent fallback. SINGLE source: the status
+ * route references this const, never a re-literal (no-scattered-literal scan).
+ */
+export const QUALIFICATION_RECORD_UNAVAILABLE = "qualification_record_unavailable";
+/**
+ * The four blockers VC9A reports. Enumerates the vc2-model-prep §6 items that
+ * remain per the 2026-08-05 research. The opset re-export blocker (formerly
+ * §6 #2) is NOT listed: onnx-community exports are opset 21, so it is removed.
+ * This is the canonical BASE (all `status:"open"`); `computeSetupCortexBlockers`
+ * derives the live list from it. Flag-off consumes this array verbatim.
+ */
+export const SETUP_CORTEX_BLOCKERS = [
+    {
+        id: "HG-1",
+        title: "Five projection heads do not exist",
+        severity: "blocker",
+        status: "open",
+        resolution: "Supervision transfer onto a frozen bge-small-en-v1.5 trunk (contradiction distilled from cross-encoder/nli-deberta-v3-small; dependency NLI-assisted; cache-stability deterministic; payload-routing small MLP) — VC2B training + export.",
+    },
+    {
+        id: "HG-3",
+        title: "onnxruntime-node install exceeds the 80 MiB asset budget",
+        severity: "blocker",
+        status: "open",
+        resolution: "onnxruntime-node bundles ~258 MiB across all platforms. Candidate: transformers.js v4.2.0 (9.5 MiB shell, pure-Node via onnxruntime-web WASM) measured against budget + p95 gate before committing.",
+    },
+    {
+        id: "HG-4",
+        title: "No darwin-x64 binary in onnxruntime-node",
+        severity: "high",
+        status: "open",
+        resolution: "Intel-Mac mode-A users demote to the WASM path (if HG-3 resolves that way) or mode B. " +
+            "darwin-x64: no native binary upstream (arm64-only); mode-B WASM per HG-4.",
+    },
+    {
+        id: "HG-5",
+        title: "RSS margin at 512 tokens is ~0.5%",
+        severity: "medium",
+        status: "open",
+        resolution: "149.2 MiB vs 150 MiB cap with run-to-run variance 119-149 MiB; considers capping mode A at 384 tokens or using the marginal-footprint accounting runtime.ts already implements.",
+    },
+];
+/** Look up one blocker by id; undefined when unknown (defensive). */
+export function setupCortexBlocker(id) {
+    return SETUP_CORTEX_BLOCKERS.find((b) => b.id === id);
+}
+/**
+ * The live blockers computed from (platform, ENC-0f QualificationV1 record,
+ * asset-manifest head-count). Pure + deterministic — no IO, no clock, no flag
+ * dependence. Rules:
+ *  - HG-1 → `"closed"` when the asset manifest declares all five projection
+ *    heads (`headCount === ENCODER_HEAD_ORDER.length`); otherwise stays open.
+ *  - HG-3 → unchanged (genuinely open — onnxruntime-node budget unresolved).
+ *  - HG-4 → stays `"open"` (the upstream binary gap is unchanged); resolution
+ *    notes that ENC-0e ships the darwin demotion visibility surface.
+ *  - HG-5 → derived from the qualification record: an empty record is
+ *    `"superseded"` (no measurement on this device); a `failed` verdict closes
+ *    it with the measured p95/RSS wording; a `qualified` verdict closes it with
+ *    "measured" wording. Severity stays `"medium"` from the base row.
+ * `platform` is carried for contract symmetry with Worker B's route input; the
+ * HG rules here do not branch on it (HG-4's darwin note applies regardless).
+ */
+export function computeSetupCortexBlockers(input) {
+    const { qualification, headCount } = input;
+    return SETUP_CORTEX_BLOCKERS.map((base) => {
+        switch (base.id) {
+            case "HG-1":
+                return headCount === ENCODER_HEAD_ORDER.length
+                    ? { ...base, status: "closed" }
+                    : base;
+            case "HG-4":
+                return {
+                    ...base,
+                    resolution: `${base.resolution} ENC-0e shipped the darwin demotion visibility surface.`,
+                };
+            case "HG-5":
+                if (qualification === null) {
+                    return {
+                        ...base,
+                        status: "superseded",
+                        resolution: "No QualificationV1 record on this device — run the gate (scripts/encoder/gate-qualify.mjs) to measure.",
+                    };
+                }
+                if (qualification.verdict === "failed") {
+                    return {
+                        ...base,
+                        title: "Real-asset qualification: failed (latency + marginal-RSS over budget)",
+                        status: "closed",
+                        resolution: `p95 ${qualification.p95Ms} ms vs ${ENCODER_LATENCY_P95_MS} ms gate, marginal RSS ${qualification.rssMib} MiB vs ${ENCODER_RSS_BUDGET_BYTES / MIB} MiB cap — mode A requires the native onnxruntime-node selection`,
+                    };
+                }
+                return {
+                    ...base,
+                    title: "Real-asset qualification: measured",
+                    status: "closed",
+                };
+            default:
+                return base;
+        }
+    });
+}
+/**
+ * The static PER-ACTION CANDIDATE gate ids — this is POLICY, NOT the derived
+ * gating. fetch-model and bench ARE candidates for HG-1 (five-head training)
+ * and HG-3 (install budget); verify-asset is a pure re-read of committed assets
+ * and is NEVER gated (empty candidate list). The derived gating (below)
+ * intersects these candidates with the currently-OPEN blockers from the live
+ * computed list, so a candidate only blocks when its blocker is actually open.
+ */
+const ACTION_GATE_CANDIDATES = {
+    "fetch-model": ["HG-1", "HG-3"],
+    bench: ["HG-1", "HG-3"],
+    "verify-asset": [],
+};
+/**
+ * Re-derived VC9B action gating from the LIVE computed blockers. An action is
+ * gated by exactly the candidate ids that are `status:"open"` AND
+ * `severity:"blocker"` in the supplied blockers. `blockers` defaults to the
+ * base `SETUP_CORTEX_BLOCKERS` (authored all-open) for backward compatibility
+ * with single-arg callers — with HG-1 closed by a computed list, fetch-model
+ * and bench surface `["HG-3"]`; verify-asset always `[]`.
+ */
+export function setupCortexActionBlockers(action, blockers) {
+    const live = blockers ?? SETUP_CORTEX_BLOCKERS;
+    const openBlockerIds = new Set(live.filter((b) => b.status === "open" && b.severity === "blocker").map((b) => b.id));
+    return ACTION_GATE_CANDIDATES[action].filter((id) => openBlockerIds.has(id));
+}

package/extensions/dashboard-server/api-contracts/setup-cortex.ts

@@ -21,8 +21,12 @@ export interface BlockerV1 {
   readonly title: string;
   /** Severity: blocker | high | medium. */
   readonly severity: "blocker" | "high" | "medium";
-  /** Lifecycle state — always "open" (hard gates not closed in-workstream). */
-  readonly status: "open";
+  /**
+   * Lifecycle state. "open" (hard gate unresolved), "closed" (re-derived by
+   * the ENC-0g computed blocker list, e.g. HG-1 once five heads exist), or
+   * "superseded" (an open question with no live measurement on this device).
+   */
+  readonly status: "open" | "closed" | "superseded";
   /** Optional candidate resolution surfaced for the user / controller. */
   readonly resolution?: string;
 }

package/extensions/dashboard-server/qualification-record.ts

@@ -0,0 +1,70 @@
+/**
+ * dashboard-server/qualification-record.ts — ENC-0g QualificationV1 reader.
+ *
+ * Read-only reader for the ENC-0f qualification record at
+ * <stateDir>/encoder-qualification.json. The computed-blocker + action-gating
+ * functions live in setup-cortex-blockers.ts (Worker A's canonical module).
+ *
+ * Reader-only: local filesystem read only (PREVENT-PI-004), no `any`
+ * (PREVENT-011), never payloads/prompts/ledger (EVAL-REDACT-002).
+ */
+
+import { homedir } from "node:os";
+import { readFileSync } from "node:fs";
+import { join } from "node:path";
+import type { QualificationV1 } from "../../src/vector-cortex/encoder/qualify.js";
+import { QUALIFICATION_RECORD_UNAVAILABLE } from "../../src/vector-cortex/setup-cortex-blockers-compute.js";
+
+/** Sentinel appended to thresholdFailures when no valid record is readable (canonical def in setup-cortex-blockers-compute). */
+export { QUALIFICATION_RECORD_UNAVAILABLE };
+
+/**
+ * Resolve the encoder state dir (the record's home) — same precedence as
+ * scripts/encoder/gate-qualify.mjs: MEGACOMPACT_STATE_DIR first, else
+ * ~/.pi/mega-compact-encoder.
+ */
+export function encoderStateDir(): string {
+  const env = process.env.MEGACOMPACT_STATE_DIR;
+  return env !== undefined && env.length > 0
+    ? env
+    : join(homedir(), ".pi", "mega-compact-encoder");
+}
+
+/**
+ * Read + minimally validate the QualificationV1 record. Returns null on a
+ * missing/unreadable file, a JSON parse failure, or a shape mismatch (the
+ * route degrades to verify-only — never crashes). Read-only (PREVENT-PI-004).
+ */
+export function readQualificationRecord(stateDir: string): QualificationV1 | null {
+  let raw: string;
+  try {
+    // guardrails-allow PREVENT-PI-004: local qualification-record filesystem read (loopback)
+    raw = readFileSync(join(stateDir, "encoder-qualification.json"), "utf8");
+  } catch {
+    return null;
+  }
+  let parsed: unknown;
+  try {
+    parsed = JSON.parse(raw) as unknown;
+  } catch {
+    return null;
+  }
+  const rec = parsed as Record<string, unknown> | null;
+  if (rec === null || typeof rec !== "object") return null;
+  if (rec["schema"] !== "qualification-v1") return null;
+  if (typeof rec["verdict"] !== "string") return null;
+  if (!Array.isArray(rec["reasons"])) return null;
+  if (typeof rec["platform"] !== "string") return null;
+  const reasons = rec["reasons"].map((r) => String(r));
+  return {
+    schema: "qualification-v1",
+    verdict: rec["verdict"] === "qualified" ? "qualified" : "failed",
+    reasons,
+    platform: rec["platform"],
+    p95Ms: typeof rec["p95Ms"] === "number" ? rec["p95Ms"] : 0,
+    rssMib: typeof rec["rssMib"] === "number" ? rec["rssMib"] : 0,
+    opset: typeof rec["opset"] === "number" ? rec["opset"] : 0,
+    digest: typeof rec["digest"] === "string" ? rec["digest"] : "",
+  };
+}
+

package/extensions/dashboard-server/routes-rag-settings-vector-cortex.ts

@@ -282,5 +282,17 @@ export const VECTOR_CORTEX_SETTINGS: SettingGroup = {
 			"ENC-0e darwin-x64 explicit demotion: on an Intel Mac the runtime demotes to WASM (no native binary upstream); this surfaces a deterministic reason on the runtime-selection event and the Setup Cortex blockers card so an operator sees why mode A is unreachable. OFF = no demotion reason on the event and no Setup card row (the ML5-C WASM demotion itself remains the default, byte-identical predecessor).",
 			true,
 		),
+		boolDirect(
+			"MEGACOMPACT_ENC_0F",
+			"ENC-0f p95 + marginal-RSS Qualification Gate",
+			"ENC-0f p95 + marginal-RSS qualification gate (real trained asset → mode A): runs the ENC-0d-promoted trained asset through the bench under --expose-gc, asserts p95 ≤ 40 ms @ 512/4 threads, marginal RSS ≤ 150 MiB (baseline-subtracted), determinism, and opset-21; on pass emits QualificationV1 + flips runtime to qualified mode A, on failure asset stays demoted to mode B. OFF = no qualification gate runs, no QualificationV1 written, runtime keeps serving the ENC-0d survivor (byte-identical predecessor).",
+			true,
+		),
+		boolDirect(
+			"MEGACOMPACT_ENC_0G",
+			"ENC-0g Setup Cortex honest state (verdict override + live blockers)",
+			"ENC-0g makes the Setup Cortex status route honest: reads the ENC-0f QualificationV1 record (when ENC_0F is ON and a record exists) and lets its verdict override the structural verify for the qualification field; computes the blocker list from (platform, record, manifest head-count) with corrected HG statuses/wording; re-derives VC9B action gating from live blockers. OFF = verdict from verifyEncoderAsset alone, static SETUP_CORTEX_BLOCKERS, static action gating (byte-identical ENC-0f predecessor).",
+			true,
+		),
 	],
 };

package/extensions/dashboard-server/routes-setup-cortex-actions.ts

@@ -19,10 +19,18 @@
  */
 
 import type { IncomingMessage, ServerResponse } from "node:http";
+import { existsSync } from "node:fs";
+import { join, dirname } from "node:path";
+import { fileURLToPath } from "node:url";
 import type { RouteContext } from "./routes-core.js";
 import { sendJson, readJsonBody } from "./routes-vector-cortex-shared.js";
-import { VC9B_ENABLED } from "../../src/config.js";
-import { setupCortexActionBlockers } from "./setup-cortex-blockers.js";
+import { VC9B_ENABLED, ENC_0G_ENABLED, ENC_0F_ENABLED } from "../../src/config.js";
+import { setupCortexActionBlockers, computeSetupCortexBlockers } from "./setup-cortex-blockers.js";
+import { readEncoderManifest, detectPlatform } from "../../src/vector-cortex/encoder/asset.js";
+import {
+  readQualificationRecord,
+  encoderStateDir,
+} from "./qualification-record.js";
 import {
   runSetupCortexAction,
   readActionLogTail,
@@ -39,6 +47,42 @@ function isActionKind(v: unknown): v is SetupCortexActionKind {
   return typeof v === "string" && ACTION_KINDS.has(v as SetupCortexActionKind);
 }
 
+/** The encoder asset dir used by the action gate (mirrors routes-setup-cortex.ts). */
+function encoderAssetDir(): string | null {
+  let dir = dirname(fileURLToPath(import.meta.url));
+  const rel = join("assets", "vector-cortex", "encoder-v1");
+  for (let i = 0; i < 8; i++) {
+    const candidate = join(dir, rel);
+    if (existsSync(join(candidate, "manifest.json"))) return candidate;
+    const next = dirname(dir);
+    if (next === dir) break;
+    dir = next;
+  }
+  return null;
+}
+
+/**
+ * ENC-0g: the live computed blockers for the action gate. When both gates are
+ * ON, read the QualificationV1 record + verified manifest head-count and derive
+ * the live list (so a closed HG-1 no longer gates fetch-model/bench). Otherwise
+ * return null and let setupCortexActionBlockers fall back to the static base.
+ */
+function liveActionBlockers(): ReturnType<typeof computeSetupCortexBlockers> | null {
+  if (!ENC_0G_ENABLED() || !ENC_0F_ENABLED()) return null;
+  const record = readQualificationRecord(encoderStateDir());
+  let headCount: number | null = null;
+  const dir = encoderAssetDir();
+  if (dir !== null) {
+    const manifest = readEncoderManifest(dir);
+    if (manifest !== null) headCount = Object.keys(manifest.heads).length;
+  }
+  return computeSetupCortexBlockers({
+    platform: detectPlatform(),
+    qualification: record,
+    headCount,
+  });
+}
+
 /** Flag-off response, byte-identical regardless of request (VC9B absent). */
 function sendDisabled(res: ServerResponse): void {
   sendJson(res, 404, { error: "disabled" });
@@ -79,7 +123,10 @@ export function handleSetupCortexAction(
     }
     // Hard-gate check: when an OPEN hard-gate item gates this action, do NOT
     // spawn — surface the blocker ids so the client highlights the matching rows.
-    const blockers = setupCortexActionBlockers(action);
+    // ENC-0g: re-derive against the LIVE computed blockers (a closed HG-1 no
+    // longer blocks), falling back to the static base when the gates are off.
+    const live = liveActionBlockers();
+    const blockers = live !== null ? setupCortexActionBlockers(action, live) : setupCortexActionBlockers(action);
     if (blockers.length > 0) {
       sendJson(res, 423, {
         error: "action_blocked_by_open_item",