pi-mega-compact 0.20.48 → 0.20.49

package/dist/config/vector-cortex-enc0g.js

@@ -0,0 +1,37 @@
+/**
+ * config/vector-cortex-enc0g.ts — ENC-0g Setup Cortex status route honest state.
+ *
+ * Extracted from vector-cortex.ts so that file stays under the 300-line soft
+ * limit (soft-as-hard gate), exactly as vector-cortex-enc0a.ts .. enc0f.ts and
+ * the VC8C/VC9A-D/ML5A-E/DEDUP_ATTR siblings were. vector-cortex.ts re-exports
+ * the flag below and root src/config.ts re-exports it, so no consumer import
+ * path changes.
+ *
+ * ENC-0g makes the Setup Cortex status route honest: the status route reads the
+ * latest ENC-0f `QualificationV1` record (when ENC_0F is ON and a record
+ * exists) and lets its verdict override the structural verifyEncoderAsset
+ * result for the `qualification` field; the blocker list becomes a pure
+ * computed function over (platform, qualification record, manifest head-count)
+ * with corrected HG statuses/wording; and VC9B action gating is re-derived from
+ * the live computed blockers instead of the stale static manifest.
+ *
+ * `MEGACOMPACT_ENC_0G=0` disables: the status route derives its `qualification`
+ * verdict from `verifyEncoderAsset(...).ok` alone, the blocker list is the
+ * static `SETUP_CORTEX_BLOCKERS` array exactly as ENC-0f-era, and action gating
+ * reads the static table as today — byte-identical to the predecessor. The flag
+ * MUST also be a dashboard SETTINGS toggle (visible in config UI, never in
+ * EXCLUDED_SETTINGS).
+ *
+ * Pi-agnostic, dependency-free (PREVENT-PI-004 / PREVENT-011).
+ */
+import { sprintFlag } from "./vector-cortex-flag.js";
+/**
+ * ENC-0g — Setup Cortex status route honest state (verdict override + live
+ * blockers + re-derived gating). Default ON. `MEGACOMPACT_ENC_0G=0` disables
+ * and is byte-identical to the predecessor (ENC-0f): verdict from
+ * `verifyEncoderAsset` alone, static `SETUP_CORTEX_BLOCKERS`, static
+ * `setupCortexActionBlockers`. This flag MUST also be a dashboard SETTINGS
+ * toggle (visible in config UI, never in EXCLUDED_SETTINGS), mirroring
+ * ENC_0A/ENC_0B/ENC_0C/ENC_0D/ENC_0E/ENC_0F.
+ */
+export const ENC_0G_ENABLED = () => sprintFlag("MEGACOMPACT_ENC_0G");

package/dist/config/vector-cortex.js

@@ -31,5 +31,6 @@ export { ENC_0C_ENABLED } from "./vector-cortex-enc0c.js";
 export { ENC_0D_ENABLED } from "./vector-cortex-enc0d.js";
 export { ENC_0E_ENABLED } from "./vector-cortex-enc0e.js";
 export { ENC_0F_ENABLED } from "./vector-cortex-enc0f.js";
+export { ENC_0G_ENABLED } from "./vector-cortex-enc0g.js";
 // Breaker constants (TRIAD_RESILIENCE.md §breaker) extracted to vector-cortex-breakers.ts.
 export { BREAKER_WINDOW_MS, BREAKER_MIN_ATTEMPTS, BREAKER_PERF_FAILURES, BREAKER_PERF_FAILURE_RATE, BREAKER_CORRECTNESS_FAILURES, BREAKER_COOLDOWN_MS, BREAKER_PROBE_COUNT, BREAKER_RETRY_BASE_MS, BREAKER_RETRY_CAP_MS, BREAKER_RETRY_JITTER, BREAKER_HYSTERESIS_FAILURE_RATE, BREAKER_HYSTERESIS_BUDGET_P95_MS, BREAKER_MIN_HEALTHY_RESIDENCE_MS, } from "./vector-cortex-breakers.js";

package/dist/config.js

@@ -114,4 +114,4 @@ export const NEW_UI = () => ragEnabled("MEGACOMPACT_NEW_UI");
 // default ON, `=0`/`_DISABLED` off. Re-exported from src/config/vector-cortex.ts
 // so root consumers share one source of truth.
 // ---------------------------------------------------------------------------
-export { VC0A_ENABLED, VC0B_ENABLED, VC1A_ENABLED, VC0C_ENABLED, VC1B_ENABLED, VC1C_ENABLED, VC2A_ENABLED, VC2B_ENABLED, VC2C_ENABLED, VC3A_ENABLED, VC3B_ENABLED, VC3C_ENABLED, VC4A_ENABLED, VC4B_ENABLED, VC4C_ENABLED, VC5A_ENABLED, VC5B_ENABLED, VC5C_ENABLED, VC6A_ENABLED, VC6B_ENABLED, VC6C_ENABLED, VC7A_ENABLED, VC7B_ENABLED, VC7C_ENABLED, VC8A_ENABLED, VC8B_ENABLED, VC8C_ENABLED, VC9A_ENABLED, VC9B_ENABLED, VC9C_ENABLED, VC9D_ENABLED, PCC_ENABLED, ML5A_ENABLED, ML5B_ENABLED, ML5C_ENABLED, ML5D_ENABLED, ML5E_ENABLED, DEDUP_ATTR_ENABLED, ENC_0A_ENABLED, ENC_0B_ENABLED, ENC_0C_ENABLED, ENC_0D_ENABLED, ENC_0E_ENABLED, ENC_0F_ENABLED, BREAKER_WINDOW_MS, BREAKER_MIN_ATTEMPTS, BREAKER_PERF_FAILURES, BREAKER_PERF_FAILURE_RATE, BREAKER_CORRECTNESS_FAILURES, BREAKER_COOLDOWN_MS, BREAKER_PROBE_COUNT, BREAKER_RETRY_BASE_MS, BREAKER_RETRY_CAP_MS, BREAKER_RETRY_JITTER, BREAKER_HYSTERESIS_FAILURE_RATE, BREAKER_HYSTERESIS_BUDGET_P95_MS, BREAKER_MIN_HEALTHY_RESIDENCE_MS, } from "./config/vector-cortex.js";
+export { VC0A_ENABLED, VC0B_ENABLED, VC1A_ENABLED, VC0C_ENABLED, VC1B_ENABLED, VC1C_ENABLED, VC2A_ENABLED, VC2B_ENABLED, VC2C_ENABLED, VC3A_ENABLED, VC3B_ENABLED, VC3C_ENABLED, VC4A_ENABLED, VC4B_ENABLED, VC4C_ENABLED, VC5A_ENABLED, VC5B_ENABLED, VC5C_ENABLED, VC6A_ENABLED, VC6B_ENABLED, VC6C_ENABLED, VC7A_ENABLED, VC7B_ENABLED, VC7C_ENABLED, VC8A_ENABLED, VC8B_ENABLED, VC8C_ENABLED, VC9A_ENABLED, VC9B_ENABLED, VC9C_ENABLED, VC9D_ENABLED, PCC_ENABLED, ML5A_ENABLED, ML5B_ENABLED, ML5C_ENABLED, ML5D_ENABLED, ML5E_ENABLED, DEDUP_ATTR_ENABLED, ENC_0A_ENABLED, ENC_0B_ENABLED, ENC_0C_ENABLED, ENC_0D_ENABLED, ENC_0E_ENABLED, ENC_0F_ENABLED, ENC_0G_ENABLED, BREAKER_WINDOW_MS, BREAKER_MIN_ATTEMPTS, BREAKER_PERF_FAILURES, BREAKER_PERF_FAILURE_RATE, BREAKER_CORRECTNESS_FAILURES, BREAKER_COOLDOWN_MS, BREAKER_PROBE_COUNT, BREAKER_RETRY_BASE_MS, BREAKER_RETRY_CAP_MS, BREAKER_RETRY_JITTER, BREAKER_HYSTERESIS_FAILURE_RATE, BREAKER_HYSTERESIS_BUDGET_P95_MS, BREAKER_MIN_HEALTHY_RESIDENCE_MS, } from "./config/vector-cortex.js";

package/dist/extensions/dashboard-server/qualification-record.js

@@ -0,0 +1,71 @@
+/**
+ * dashboard-server/qualification-record.ts — ENC-0g QualificationV1 reader.
+ *
+ * Read-only reader for the ENC-0f qualification record at
+ * <stateDir>/encoder-qualification.json. The computed-blocker + action-gating
+ * functions live in setup-cortex-blockers.ts (Worker A's canonical module).
+ *
+ * Reader-only: local filesystem read only (PREVENT-PI-004), no `any`
+ * (PREVENT-011), never payloads/prompts/ledger (EVAL-REDACT-002).
+ */
+import { homedir } from "node:os";
+import { readFileSync } from "node:fs";
+import { join } from "node:path";
+import { QUALIFICATION_RECORD_UNAVAILABLE } from "../../src/vector-cortex/setup-cortex-blockers-compute.js";
+/** Sentinel appended to thresholdFailures when no valid record is readable (canonical def in setup-cortex-blockers-compute). */
+export { QUALIFICATION_RECORD_UNAVAILABLE };
+/**
+ * Resolve the encoder state dir (the record's home) — same precedence as
+ * scripts/encoder/gate-qualify.mjs: MEGACOMPACT_STATE_DIR first, else
+ * ~/.pi/mega-compact-encoder.
+ */
+export function encoderStateDir() {
+    const env = process.env.MEGACOMPACT_STATE_DIR;
+    return env !== undefined && env.length > 0
+        ? env
+        : join(homedir(), ".pi", "mega-compact-encoder");
+}
+/**
+ * Read + minimally validate the QualificationV1 record. Returns null on a
+ * missing/unreadable file, a JSON parse failure, or a shape mismatch (the
+ * route degrades to verify-only — never crashes). Read-only (PREVENT-PI-004).
+ */
+export function readQualificationRecord(stateDir) {
+    let raw;
+    try {
+        // guardrails-allow PREVENT-PI-004: local qualification-record filesystem read (loopback)
+        raw = readFileSync(join(stateDir, "encoder-qualification.json"), "utf8");
+    }
+    catch {
+        return null;
+    }
+    let parsed;
+    try {
+        parsed = JSON.parse(raw);
+    }
+    catch {
+        return null;
+    }
+    const rec = parsed;
+    if (rec === null || typeof rec !== "object")
+        return null;
+    if (rec["schema"] !== "qualification-v1")
+        return null;
+    if (typeof rec["verdict"] !== "string")
+        return null;
+    if (!Array.isArray(rec["reasons"]))
+        return null;
+    if (typeof rec["platform"] !== "string")
+        return null;
+    const reasons = rec["reasons"].map((r) => String(r));
+    return {
+        schema: "qualification-v1",
+        verdict: rec["verdict"] === "qualified" ? "qualified" : "failed",
+        reasons,
+        platform: rec["platform"],
+        p95Ms: typeof rec["p95Ms"] === "number" ? rec["p95Ms"] : 0,
+        rssMib: typeof rec["rssMib"] === "number" ? rec["rssMib"] : 0,
+        opset: typeof rec["opset"] === "number" ? rec["opset"] : 0,
+        digest: typeof rec["digest"] === "string" ? rec["digest"] : "",
+    };
+}

package/dist/extensions/dashboard-server/routes-rag-settings-vector-cortex.js

@@ -64,5 +64,6 @@ export const VECTOR_CORTEX_SETTINGS = {
         boolDirect("MEGACOMPACT_ENC_0D", "ENC-0d Real-Asset Promotion Gate", "ENC-0d promotion gate over real trained assets: accepts a {color} real candidate manifest (the ENC-0c trained head weights + the ENC-0b trunk), digest-verifies every staged byte, and atomically swaps the shipped manifest to a green candidate with rollback-to-previous on qualification failure. OFF = accepts no candidate, swaps nothing, emits nothing, shipped manifest stays at the ENC-0c survivor.", true),
         boolDirect("MEGACOMPACT_ENC_0E", "ENC-0e darwin-x64 Demotion Reason", "ENC-0e darwin-x64 explicit demotion: on an Intel Mac the runtime demotes to WASM (no native binary upstream); this surfaces a deterministic reason on the runtime-selection event and the Setup Cortex blockers card so an operator sees why mode A is unreachable. OFF = no demotion reason on the event and no Setup card row (the ML5-C WASM demotion itself remains the default, byte-identical predecessor).", true),
         boolDirect("MEGACOMPACT_ENC_0F", "ENC-0f p95 + marginal-RSS Qualification Gate", "ENC-0f p95 + marginal-RSS qualification gate (real trained asset → mode A): runs the ENC-0d-promoted trained asset through the bench under --expose-gc, asserts p95 ≤ 40 ms @ 512/4 threads, marginal RSS ≤ 150 MiB (baseline-subtracted), determinism, and opset-21; on pass emits QualificationV1 + flips runtime to qualified mode A, on failure asset stays demoted to mode B. OFF = no qualification gate runs, no QualificationV1 written, runtime keeps serving the ENC-0d survivor (byte-identical predecessor).", true),
+        boolDirect("MEGACOMPACT_ENC_0G", "ENC-0g Setup Cortex honest state (verdict override + live blockers)", "ENC-0g makes the Setup Cortex status route honest: reads the ENC-0f QualificationV1 record (when ENC_0F is ON and a record exists) and lets its verdict override the structural verify for the qualification field; computes the blocker list from (platform, record, manifest head-count) with corrected HG statuses/wording; re-derives VC9B action gating from live blockers. OFF = verdict from verifyEncoderAsset alone, static SETUP_CORTEX_BLOCKERS, static action gating (byte-identical ENC-0f predecessor).", true),
     ],
 };

package/dist/extensions/dashboard-server/routes-setup-cortex-actions.js

@@ -17,9 +17,14 @@
  * readJsonBody), no string literals for scripts/blockers (delegated to
  * setup-cortex-actions.ts + setup-cortex-blockers.ts).
  */
+import { existsSync } from "node:fs";
+import { join, dirname } from "node:path";
+import { fileURLToPath } from "node:url";
 import { sendJson, readJsonBody } from "./routes-vector-cortex-shared.js";
-import { VC9B_ENABLED } from "../../src/config.js";
-import { setupCortexActionBlockers } from "./setup-cortex-blockers.js";
+import { VC9B_ENABLED, ENC_0G_ENABLED, ENC_0F_ENABLED } from "../../src/config.js";
+import { setupCortexActionBlockers, computeSetupCortexBlockers } from "./setup-cortex-blockers.js";
+import { readEncoderManifest, detectPlatform } from "../../src/vector-cortex/encoder/asset.js";
+import { readQualificationRecord, encoderStateDir, } from "./qualification-record.js";
 import { runSetupCortexAction, readActionLogTail, } from "./setup-cortex-actions.js";
 const ACTION_KINDS = new Set([
     "fetch-model",
@@ -29,6 +34,44 @@ const ACTION_KINDS = new Set([
 function isActionKind(v) {
     return typeof v === "string" && ACTION_KINDS.has(v);
 }
+/** The encoder asset dir used by the action gate (mirrors routes-setup-cortex.ts). */
+function encoderAssetDir() {
+    let dir = dirname(fileURLToPath(import.meta.url));
+    const rel = join("assets", "vector-cortex", "encoder-v1");
+    for (let i = 0; i < 8; i++) {
+        const candidate = join(dir, rel);
+        if (existsSync(join(candidate, "manifest.json")))
+            return candidate;
+        const next = dirname(dir);
+        if (next === dir)
+            break;
+        dir = next;
+    }
+    return null;
+}
+/**
+ * ENC-0g: the live computed blockers for the action gate. When both gates are
+ * ON, read the QualificationV1 record + verified manifest head-count and derive
+ * the live list (so a closed HG-1 no longer gates fetch-model/bench). Otherwise
+ * return null and let setupCortexActionBlockers fall back to the static base.
+ */
+function liveActionBlockers() {
+    if (!ENC_0G_ENABLED() || !ENC_0F_ENABLED())
+        return null;
+    const record = readQualificationRecord(encoderStateDir());
+    let headCount = null;
+    const dir = encoderAssetDir();
+    if (dir !== null) {
+        const manifest = readEncoderManifest(dir);
+        if (manifest !== null)
+            headCount = Object.keys(manifest.heads).length;
+    }
+    return computeSetupCortexBlockers({
+        platform: detectPlatform(),
+        qualification: record,
+        headCount,
+    });
+}
 /** Flag-off response, byte-identical regardless of request (VC9B absent). */
 function sendDisabled(res) {
     sendJson(res, 404, { error: "disabled" });
@@ -65,7 +108,10 @@ export function handleSetupCortexAction(req, res, ctx) {
         }
         // Hard-gate check: when an OPEN hard-gate item gates this action, do NOT
         // spawn — surface the blocker ids so the client highlights the matching rows.
-        const blockers = setupCortexActionBlockers(action);
+        // ENC-0g: re-derive against the LIVE computed blockers (a closed HG-1 no
+        // longer blocks), falling back to the static base when the gates are off.
+        const live = liveActionBlockers();
+        const blockers = live !== null ? setupCortexActionBlockers(action, live) : setupCortexActionBlockers(action);
         if (blockers.length > 0) {
             sendJson(res, 423, {
                 error: "action_blocked_by_open_item",

package/dist/extensions/dashboard-server/routes-setup-cortex.js

@@ -22,12 +22,13 @@ import { createHash } from "node:crypto";
 import { readFileSync, statSync } from "node:fs";
 import { join, dirname } from "node:path";
 import { fileURLToPath } from "node:url";
-import { VC9A_ENABLED, ENC_0E_ENABLED } from "../../src/config.js";
+import { VC9A_ENABLED, ENC_0E_ENABLED, ENC_0F_ENABLED, ENC_0G_ENABLED } from "../../src/config.js";
 import { readEncoderManifest, verifyEncoderAsset, detectPlatform } from "../../src/vector-cortex/encoder/asset.js";
 import { selectRuntimeBackend } from "../../src/vector-cortex/encoder/runtime-select.js";
 import { sendJson } from "./routes-vector-cortex-shared.js";
 import { deriveVcStatus } from "./vc-status.js";
-import { SETUP_CORTEX_BLOCKERS } from "./setup-cortex-blockers.js";
+import { SETUP_CORTEX_BLOCKERS, computeSetupCortexBlockers } from "./setup-cortex-blockers.js";
+import { readQualificationRecord, encoderStateDir, QUALIFICATION_RECORD_UNAVAILABLE, } from "./qualification-record.js";
 /** Resolve the committed encoder-v1 asset dir by walking up to the repo root. */
 function encoderAssetDir() {
     let dir = dirname(fileURLToPath(import.meta.url));
@@ -51,7 +52,7 @@ function encoderAssetDir() {
 }
 let factCache = null;
 /** Stable cache key: manifest bytes + (size,mtime) of the asset files + platform. */
-function factCacheKey(dir, manifestPath) {
+function factCacheKey(dir, manifestPath, stateDir, record, recordGate) {
     const platform = detectPlatform();
     if (!platform)
         return null;
@@ -67,15 +68,47 @@ function factCacheKey(dir, manifestPath) {
     catch {
         return null;
     }
+    // ENC-0g: fold the qualification-record gate + (mtime, content sha) into the
+    // key so a re-run gate invalidates memoized facts (no stale verdict served).
+    try {
+        const s = statSync(join(stateDir, "encoder-qualification.json"));
+        parts.push(`g:${recordGate ? "on" : "off"}`, `q:${s.size}:${s.mtimeMs}`);
+        parts.push(createHash("sha256").update(JSON.stringify(record)).digest("hex"));
+    }
+    catch {
+        parts.push(`g:${recordGate ? "on" : "off"}`, "q:absent");
+    }
     return parts.join("|");
 }
-function computeSetupCortexFacts(dir) {
+function applyQualificationOverride(base, record, recordGate) {
+    // Flag-off (recordGate false): byte-identical verify-derived facts.
+    if (!recordGate)
+        return base;
+    if (record !== null) {
+        // The ENC-0f QualificationV1 failure maps onto the contract "demoted": a
+        // structurally-valid asset whose real-asset gate measured failure is honest
+        // as demoted, NOT qualified. mode stays verify-derived (A).
+        return {
+            ...base,
+            verdict: record.verdict === "qualified" ? "qualified" : "demoted",
+            thresholdFailures: [...record.reasons],
+        };
+    }
+    // No record + gate on: keep the verify verdict but surface the missing-record
+    // sentinel (never a fabricated pass, never a bare silent fallback).
+    return {
+        ...base,
+        thresholdFailures: [...base.thresholdFailures, QUALIFICATION_RECORD_UNAVAILABLE],
+    };
+}
+function computeSetupCortexFacts(dir, stateDir, record, recordGate) {
     const manifest = readEncoderManifest(dir);
     if (manifest === null) {
-        return { mode: "C", assetDigestPrefix: null, verdict: "unavailable", thresholdFailures: [] };
+        return { mode: "C", assetDigestPrefix: null, verdict: "unavailable", thresholdFailures: [], headCount: null };
     }
+    const headCount = Object.keys(manifest.heads).length;
     const manifestPath = join(dir, "manifest.json");
-    const key = factCacheKey(dir, manifestPath);
+    const key = factCacheKey(dir, manifestPath, stateDir, record, recordGate);
     if (key === null)
         return null;
     if (factCache !== null && factCache.key === key)
@@ -86,25 +119,27 @@ function computeSetupCortexFacts(dir) {
         digest = createHash("sha256").update(readFileSync(manifestPath)).digest("hex");
     }
     catch {
-        const facts = { mode: "B", assetDigestPrefix: null, verdict: "demoted", thresholdFailures: ["ENC_ASSET_UNREADABLE"] };
+        const base = { mode: "B", assetDigestPrefix: null, verdict: "demoted", thresholdFailures: ["ENC_ASSET_UNREADABLE"], headCount };
+        const facts = applyQualificationOverride(base, record, recordGate);
         factCache = { key, facts };
         return facts;
     }
     const verify = verifyEncoderAsset(dir, manifest, detectPlatform());
     const prefix = digest.slice(0, 12);
-    const facts = verify.ok
-        ? { mode: "A", assetDigestPrefix: prefix, verdict: "qualified", thresholdFailures: [] }
-        : { mode: "B", assetDigestPrefix: prefix, verdict: "demoted", thresholdFailures: [verify.code] };
+    const base = verify.ok
+        ? { mode: "A", assetDigestPrefix: prefix, verdict: "qualified", thresholdFailures: [], headCount }
+        : { mode: "B", assetDigestPrefix: prefix, verdict: "demoted", thresholdFailures: [verify.code], headCount };
+    const facts = applyQualificationOverride(base, record, recordGate);
     factCache = { key, facts };
     return facts;
 }
-function setupCortexFacts() {
+function setupCortexFacts(record, recordGate) {
     const dir = encoderAssetDir();
     if (dir === null) {
-        return { mode: "C", assetDigestPrefix: null, verdict: "unavailable", thresholdFailures: [] };
+        return { mode: "C", assetDigestPrefix: null, verdict: "unavailable", thresholdFailures: [], headCount: null };
     }
-    const facts = computeSetupCortexFacts(dir);
-    return facts ?? { mode: "C", assetDigestPrefix: null, verdict: "unavailable", thresholdFailures: [] };
+    const facts = computeSetupCortexFacts(dir, encoderStateDir(), record, recordGate);
+    return facts ?? { mode: "C", assetDigestPrefix: null, verdict: "unavailable", thresholdFailures: [], headCount: null };
 }
 /**
  * Reader-only GET /api/setup-cortex-status (VC9A).
@@ -122,8 +157,22 @@ export function handleSetupCortexStatus(req, res, _ctx) {
         return true;
     }
     const enabled = VC9A_ENABLED();
-    const facts = enabled ? setupCortexFacts() : null;
-    const blocks = enabled ? [...SETUP_CORTEX_BLOCKERS] : [];
+    // ENC-0g: when both gates are ON, read the QualificationV1 record and let its
+    // verdict override the structural verify for the `qualification` field. When
+    // ENC_0G is OFF, nothing below reads the record (byte-identical to ENC-0f-era).
+    const enc0g = enabled && ENC_0G_ENABLED();
+    const recordGate = enc0g && ENC_0F_ENABLED();
+    const record = recordGate ? readQualificationRecord(encoderStateDir()) : null;
+    const facts = enabled ? setupCortexFacts(record, recordGate) : null;
+    const blocks = enabled
+        ? enc0g
+            ? [...computeSetupCortexBlockers({
+                    platform: detectPlatform(),
+                    qualification: record,
+                    headCount: facts ? facts.headCount : null,
+                })]
+            : [...SETUP_CORTEX_BLOCKERS]
+        : [];
     // ENC-0e: surface the darwin-x64 demotion reason additively (reader-only GET,
     // no new route). The platform is read locally; the selection is pure. On a
     // non-darwin-x64 host or flag-off this is null and the field is omitted —

package/dist/extensions/dashboard-server/setup-cortex-actions.js

@@ -21,6 +21,8 @@ import { mkdirSync, readFileSync, writeFileSync, existsSync, readdirSync, } from
 import { join, dirname, basename } from "node:path";
 import { fileURLToPath } from "node:url";
 import { readEncoderManifest, verifyEncoderAsset, detectPlatform, } from "../../src/vector-cortex/encoder/asset.js";
+import { ENC_0G_ENABLED, ENC_0F_ENABLED } from "../../src/config.js";
+import { readQualificationRecord, encoderStateDir, } from "./qualification-record.js";
 /** Cap applied to every log tail served by the action-log route. */
 export const ACTION_LOG_TAIL_BYTES = 8192;
 /** Locate the commit's vc2-model-prep directory by walking up to the repo root. */
@@ -153,23 +155,38 @@ function runVerifyAsset(stateDir) {
         spawned: false,
     };
 }
+/**
+ * The ENC-0g honesty suffix for the verify-asset summary line: when both gates
+ * are ON, surface the QualificationV1 record verdict so the action log is honest
+ * alongside the (possibly demoted) status card. Returns "" byte-identical when
+ * ENC_0G is off. Bounded + redacted (verdict + reasons only).
+ */
+function qualificationRecordSuffix() {
+    if (!ENC_0G_ENABLED() || !ENC_0F_ENABLED())
+        return "";
+    const record = readQualificationRecord(encoderStateDir());
+    if (record === null)
+        return " record_verdict=unavailable";
+    return ` record_verdict=${record.verdict} record_reasons=${record.reasons.join(",")}`;
+}
 /** Compute the redacted verify-asset summary lines (digests + codes only). */
 function buildVerifySummary() {
+    const suffix = qualificationRecordSuffix();
     const dir = encoderAssetDir();
     if (dir === null) {
-        return "mode=C verdict=unavailable reason=asset_missing\n";
+        return `mode=C verdict=unavailable reason=asset_missing${suffix}\n`;
     }
     const manifest = readEncoderManifest(dir);
     if (manifest === null) {
-        return "mode=B verdict=demoted reason=ENC_MANIFEST_INVALID\n";
+        return `mode=B verdict=demoted reason=ENC_MANIFEST_INVALID${suffix}\n`;
     }
     const platform = detectPlatform();
     const verify = verifyEncoderAsset(dir, manifest, platform);
     if (verify.ok) {
         const prefix = verify.onnxDigest.slice(0, 12);
-        return `mode=A verdict=qualified onnx_digest_prefix=${prefix} embedded_bytes=${verify.embeddedBytes}\n`;
+        return `mode=A verdict=qualified onnx_digest_prefix=${prefix} embedded_bytes=${verify.embeddedBytes}${suffix}\n`;
     }
-    return `mode=B verdict=demoted reason=${verify.code}\n`;
+    return `mode=B verdict=demoted reason=${verify.code}${suffix}\n`;
 }
 /** Walk up to the committed encoder-v1 asset dir (mirrors routes-setup-cortex.ts). */
 function encoderAssetDir() {

package/dist/extensions/dashboard-server/setup-cortex-blockers.js

@@ -1,71 +1,5 @@
 /**
- * dashboard-server/setup-cortex-blockers.ts — canonical blocker manifest for the
- * dashboard Setup Cortex status read path (VC9A).
- *
- * The hard-gate items enumerated in docs/vector-cortex/vc2-model-prep.md §6
- * (per the 2026-08-05 research update: the opset-14→17 re-export blocker is
- * REMOVED because onnx-community exports are now opset 21). This module is the
- * SINGLE canonical source of those blockers — the route file
- * (routes-setup-cortex.ts) carries NO string literals for them; it reads this
- * static manifest so the UI rows and the spec stay in one place.
- *
- * Reader-only, static: zero network, no writes (PREVENT-PI-004), no `any`
- * (PREVENT-011).
+ * dashboard-server/setup-cortex-blockers.ts — thin shell re-exporting the
+ * canonical Setup Cortex blocker compute from src (single source of truth).
  */
-/**
- * The four blockers VC9A reports. Enumerates the vc2-model-prep §6 items that
- * remain per the 2026-08-05 research. The opset re-export blocker (formerly
- * §6 #2) is NOT listed: onnx-community exports are opset 21, so it is removed.
- */
-export const SETUP_CORTEX_BLOCKERS = [
-    {
-        id: "HG-1",
-        title: "Five projection heads do not exist",
-        severity: "blocker",
-        status: "open",
-        resolution: "Supervision transfer onto a frozen bge-small-en-v1.5 trunk (contradiction distilled from cross-encoder/nli-deberta-v3-small; dependency NLI-assisted; cache-stability deterministic; payload-routing small MLP) — VC2B training + export.",
-    },
-    {
-        id: "HG-3",
-        title: "onnxruntime-node install exceeds the 80 MiB asset budget",
-        severity: "blocker",
-        status: "open",
-        resolution: "onnxruntime-node bundles ~258 MiB across all platforms. Candidate: transformers.js v4.2.0 (9.5 MiB shell, pure-Node via onnxruntime-web WASM) measured against budget + p95 gate before committing.",
-    },
-    {
-        id: "HG-4",
-        title: "No darwin-x64 binary in onnxruntime-node",
-        severity: "high",
-        status: "open",
-        resolution: "Intel-Mac mode-A users demote to the WASM path (if HG-3 resolves that way) or mode B. " +
-            "darwin-x64: no native binary upstream (arm64-only); mode-B WASM per HG-4.",
-    },
-    {
-        id: "HG-5",
-        title: "RSS margin at 512 tokens is ~0.5%",
-        severity: "medium",
-        status: "open",
-        resolution: "149.2 MiB vs 150 MiB cap with run-to-run variance 119-149 MiB; considers capping mode A at 384 tokens or using the marginal-footprint accounting runtime.ts already implements.",
-    },
-];
-/** Look up one blocker by id; undefined when unknown (defensive). */
-export function setupCortexBlocker(id) {
-    return SETUP_CORTEX_BLOCKERS.find((b) => b.id === id);
-}
-/**
- * The open hard-gate ids that BLOCK a given action. fetch-model and bench are
- * gated by HG-1 (five-head training open) and HG-3 (install budget open) per the
- * VC9 workstream plan; verify-asset is a pure re-read of committed assets and is
- * NOT gated. When a gated action is requested, the route returns
- * action_blocked_by_open_item with these ids and does NOT spawn. The ids are
- * always drawn from SETUP_CORTEX_BLOCKERS (each exists — verified by test).
- */
-export function setupCortexActionBlockers(action) {
-    switch (action) {
-        case "fetch-model":
-        case "bench":
-            return ["HG-1", "HG-3"];
-        case "verify-asset":
-            return [];
-    }
-}
+export * from "../../src/vector-cortex/setup-cortex-blockers-compute.js";

package/dist/src/config/vector-cortex-enc0g.js

@@ -0,0 +1,37 @@
+/**
+ * config/vector-cortex-enc0g.ts — ENC-0g Setup Cortex status route honest state.
+ *
+ * Extracted from vector-cortex.ts so that file stays under the 300-line soft
+ * limit (soft-as-hard gate), exactly as vector-cortex-enc0a.ts .. enc0f.ts and
+ * the VC8C/VC9A-D/ML5A-E/DEDUP_ATTR siblings were. vector-cortex.ts re-exports
+ * the flag below and root src/config.ts re-exports it, so no consumer import
+ * path changes.
+ *
+ * ENC-0g makes the Setup Cortex status route honest: the status route reads the
+ * latest ENC-0f `QualificationV1` record (when ENC_0F is ON and a record
+ * exists) and lets its verdict override the structural verifyEncoderAsset
+ * result for the `qualification` field; the blocker list becomes a pure
+ * computed function over (platform, qualification record, manifest head-count)
+ * with corrected HG statuses/wording; and VC9B action gating is re-derived from
+ * the live computed blockers instead of the stale static manifest.
+ *
+ * `MEGACOMPACT_ENC_0G=0` disables: the status route derives its `qualification`
+ * verdict from `verifyEncoderAsset(...).ok` alone, the blocker list is the
+ * static `SETUP_CORTEX_BLOCKERS` array exactly as ENC-0f-era, and action gating
+ * reads the static table as today — byte-identical to the predecessor. The flag
+ * MUST also be a dashboard SETTINGS toggle (visible in config UI, never in
+ * EXCLUDED_SETTINGS).
+ *
+ * Pi-agnostic, dependency-free (PREVENT-PI-004 / PREVENT-011).
+ */
+import { sprintFlag } from "./vector-cortex-flag.js";
+/**
+ * ENC-0g — Setup Cortex status route honest state (verdict override + live
+ * blockers + re-derived gating). Default ON. `MEGACOMPACT_ENC_0G=0` disables
+ * and is byte-identical to the predecessor (ENC-0f): verdict from
+ * `verifyEncoderAsset` alone, static `SETUP_CORTEX_BLOCKERS`, static
+ * `setupCortexActionBlockers`. This flag MUST also be a dashboard SETTINGS
+ * toggle (visible in config UI, never in EXCLUDED_SETTINGS), mirroring
+ * ENC_0A/ENC_0B/ENC_0C/ENC_0D/ENC_0E/ENC_0F.
+ */
+export const ENC_0G_ENABLED = () => sprintFlag("MEGACOMPACT_ENC_0G");

package/dist/src/config/vector-cortex.js

@@ -31,5 +31,6 @@ export { ENC_0C_ENABLED } from "./vector-cortex-enc0c.js";
 export { ENC_0D_ENABLED } from "./vector-cortex-enc0d.js";
 export { ENC_0E_ENABLED } from "./vector-cortex-enc0e.js";
 export { ENC_0F_ENABLED } from "./vector-cortex-enc0f.js";
+export { ENC_0G_ENABLED } from "./vector-cortex-enc0g.js";
 // Breaker constants (TRIAD_RESILIENCE.md §breaker) extracted to vector-cortex-breakers.ts.
 export { BREAKER_WINDOW_MS, BREAKER_MIN_ATTEMPTS, BREAKER_PERF_FAILURES, BREAKER_PERF_FAILURE_RATE, BREAKER_CORRECTNESS_FAILURES, BREAKER_COOLDOWN_MS, BREAKER_PROBE_COUNT, BREAKER_RETRY_BASE_MS, BREAKER_RETRY_CAP_MS, BREAKER_RETRY_JITTER, BREAKER_HYSTERESIS_FAILURE_RATE, BREAKER_HYSTERESIS_BUDGET_P95_MS, BREAKER_MIN_HEALTHY_RESIDENCE_MS, } from "./vector-cortex-breakers.js";

package/dist/src/config.js

@@ -114,4 +114,4 @@ export const NEW_UI = () => ragEnabled("MEGACOMPACT_NEW_UI");
 // default ON, `=0`/`_DISABLED` off. Re-exported from src/config/vector-cortex.ts
 // so root consumers share one source of truth.
 // ---------------------------------------------------------------------------
-export { VC0A_ENABLED, VC0B_ENABLED, VC1A_ENABLED, VC0C_ENABLED, VC1B_ENABLED, VC1C_ENABLED, VC2A_ENABLED, VC2B_ENABLED, VC2C_ENABLED, VC3A_ENABLED, VC3B_ENABLED, VC3C_ENABLED, VC4A_ENABLED, VC4B_ENABLED, VC4C_ENABLED, VC5A_ENABLED, VC5B_ENABLED, VC5C_ENABLED, VC6A_ENABLED, VC6B_ENABLED, VC6C_ENABLED, VC7A_ENABLED, VC7B_ENABLED, VC7C_ENABLED, VC8A_ENABLED, VC8B_ENABLED, VC8C_ENABLED, VC9A_ENABLED, VC9B_ENABLED, VC9C_ENABLED, VC9D_ENABLED, PCC_ENABLED, ML5A_ENABLED, ML5B_ENABLED, ML5C_ENABLED, ML5D_ENABLED, ML5E_ENABLED, DEDUP_ATTR_ENABLED, ENC_0A_ENABLED, ENC_0B_ENABLED, ENC_0C_ENABLED, ENC_0D_ENABLED, ENC_0E_ENABLED, ENC_0F_ENABLED, BREAKER_WINDOW_MS, BREAKER_MIN_ATTEMPTS, BREAKER_PERF_FAILURES, BREAKER_PERF_FAILURE_RATE, BREAKER_CORRECTNESS_FAILURES, BREAKER_COOLDOWN_MS, BREAKER_PROBE_COUNT, BREAKER_RETRY_BASE_MS, BREAKER_RETRY_CAP_MS, BREAKER_RETRY_JITTER, BREAKER_HYSTERESIS_FAILURE_RATE, BREAKER_HYSTERESIS_BUDGET_P95_MS, BREAKER_MIN_HEALTHY_RESIDENCE_MS, } from "./config/vector-cortex.js";
+export { VC0A_ENABLED, VC0B_ENABLED, VC1A_ENABLED, VC0C_ENABLED, VC1B_ENABLED, VC1C_ENABLED, VC2A_ENABLED, VC2B_ENABLED, VC2C_ENABLED, VC3A_ENABLED, VC3B_ENABLED, VC3C_ENABLED, VC4A_ENABLED, VC4B_ENABLED, VC4C_ENABLED, VC5A_ENABLED, VC5B_ENABLED, VC5C_ENABLED, VC6A_ENABLED, VC6B_ENABLED, VC6C_ENABLED, VC7A_ENABLED, VC7B_ENABLED, VC7C_ENABLED, VC8A_ENABLED, VC8B_ENABLED, VC8C_ENABLED, VC9A_ENABLED, VC9B_ENABLED, VC9C_ENABLED, VC9D_ENABLED, PCC_ENABLED, ML5A_ENABLED, ML5B_ENABLED, ML5C_ENABLED, ML5D_ENABLED, ML5E_ENABLED, DEDUP_ATTR_ENABLED, ENC_0A_ENABLED, ENC_0B_ENABLED, ENC_0C_ENABLED, ENC_0D_ENABLED, ENC_0E_ENABLED, ENC_0F_ENABLED, ENC_0G_ENABLED, BREAKER_WINDOW_MS, BREAKER_MIN_ATTEMPTS, BREAKER_PERF_FAILURES, BREAKER_PERF_FAILURE_RATE, BREAKER_CORRECTNESS_FAILURES, BREAKER_COOLDOWN_MS, BREAKER_PROBE_COUNT, BREAKER_RETRY_BASE_MS, BREAKER_RETRY_CAP_MS, BREAKER_RETRY_JITTER, BREAKER_HYSTERESIS_FAILURE_RATE, BREAKER_HYSTERESIS_BUDGET_P95_MS, BREAKER_MIN_HEALTHY_RESIDENCE_MS, } from "./config/vector-cortex.js";