pi-mega-compact 0.20.48 → 0.20.50

package/dist/config/vector-cortex-enc0g.js

@@ -0,0 +1,37 @@
+/**
+ * config/vector-cortex-enc0g.ts — ENC-0g Setup Cortex status route honest state.
+ *
+ * Extracted from vector-cortex.ts so that file stays under the 300-line soft
+ * limit (soft-as-hard gate), exactly as vector-cortex-enc0a.ts .. enc0f.ts and
+ * the VC8C/VC9A-D/ML5A-E/DEDUP_ATTR siblings were. vector-cortex.ts re-exports
+ * the flag below and root src/config.ts re-exports it, so no consumer import
+ * path changes.
+ *
+ * ENC-0g makes the Setup Cortex status route honest: the status route reads the
+ * latest ENC-0f `QualificationV1` record (when ENC_0F is ON and a record
+ * exists) and lets its verdict override the structural verifyEncoderAsset
+ * result for the `qualification` field; the blocker list becomes a pure
+ * computed function over (platform, qualification record, manifest head-count)
+ * with corrected HG statuses/wording; and VC9B action gating is re-derived from
+ * the live computed blockers instead of the stale static manifest.
+ *
+ * `MEGACOMPACT_ENC_0G=0` disables: the status route derives its `qualification`
+ * verdict from `verifyEncoderAsset(...).ok` alone, the blocker list is the
+ * static `SETUP_CORTEX_BLOCKERS` array exactly as ENC-0f-era, and action gating
+ * reads the static table as today — byte-identical to the predecessor. The flag
+ * MUST also be a dashboard SETTINGS toggle (visible in config UI, never in
+ * EXCLUDED_SETTINGS).
+ *
+ * Pi-agnostic, dependency-free (PREVENT-PI-004 / PREVENT-011).
+ */
+import { sprintFlag } from "./vector-cortex-flag.js";
+/**
+ * ENC-0g — Setup Cortex status route honest state (verdict override + live
+ * blockers + re-derived gating). Default ON. `MEGACOMPACT_ENC_0G=0` disables
+ * and is byte-identical to the predecessor (ENC-0f): verdict from
+ * `verifyEncoderAsset` alone, static `SETUP_CORTEX_BLOCKERS`, static
+ * `setupCortexActionBlockers`. This flag MUST also be a dashboard SETTINGS
+ * toggle (visible in config UI, never in EXCLUDED_SETTINGS), mirroring
+ * ENC_0A/ENC_0B/ENC_0C/ENC_0D/ENC_0E/ENC_0F.
+ */
+export const ENC_0G_ENABLED = () => sprintFlag("MEGACOMPACT_ENC_0G");

package/dist/config/vector-cortex-enc1a.js

@@ -0,0 +1,39 @@
+/**
+ * config/vector-cortex-enc1a.ts — ENC-1a external embedder API key + endpoint
+ * Settings fields.
+ *
+ * Extracted from vector-cortex.ts so that file stays under the 300-line soft
+ * limit (soft-as-hard gate), exactly as the ENC-0a..ENC-0g siblings were.
+ * vector-cortex.ts re-exports the flag below and root src/config.ts re-exports
+ * it, so no consumer import path changes.
+ *
+ * ENC-1a adds a Settings-visible field pair for the external embedder endpoint
+ * URL + optional Bearer API key. The runtime already reads
+ * `MEGACOMPACT_EMBEDDING_URL` and `MEGACOMPACT_EMBEDDING_KEY` from the process
+ * env (src/httpEmbedder.ts:embeddingConfigFromEnv) and the Setup tab's
+ * CustomEndpointSection already accepts a custom URL — but there is no
+ * dashboard-visible API-key field and no server route persists the pair to the
+ * per-repo `.mega-compact.env` so the session survives a restart. ENC-1a adds
+ * two additive contract fields on GET /api/setup-status (`embeddingEndpointUrl`
+ * echoed + `embeddingApiKeySet` boolean only — the raw key is NEVER returned),
+ * an additive writer branch on POST /api/setup-configure accepting
+ * `embeddingEndpointUrl` / `embeddingApiKey`, and two additive Setup text rows.
+ *
+ * `MEGACOMPACT_ENC_1A=0` disables: the Settings panel renders no ENC-1a text
+ * fields (only the existing boolDirect toggles remain), the GET body omits the
+ * two new fields, and the POST handler does not recognize the new keys —
+ * byte-identical to the ENC-0g predecessor. The flag MUST also be a dashboard
+ * SETTINGS toggle (visible in config UI, never in EXCLUDED_SETTINGS).
+ *
+ * Pi-agnostic, dependency-free (PREVENT-PI-004 / PREVENT-011).
+ */
+import { sprintFlag } from "./vector-cortex-flag.js";
+/**
+ * ENC-1a — external embedder API key + endpoint Settings fields. Default ON.
+ * `MEGACOMPACT_ENC_1A=0` disables and is byte-identical to the predecessor
+ * (ENC-0g): no new GET fields, no writer branch, no new Setup text rows (only
+ * the existing boolDirect toggles remain). This flag MUST also be a dashboard
+ * SETTINGS toggle (visible in config UI, never in EXCLUDED_SETTINGS), mirroring
+ * ENC_0A..ENC_0G.
+ */
+export const ENC_1A_ENABLED = () => sprintFlag("MEGACOMPACT_ENC_1A");

package/dist/config/vector-cortex.js

@@ -31,5 +31,7 @@ export { ENC_0C_ENABLED } from "./vector-cortex-enc0c.js";
 export { ENC_0D_ENABLED } from "./vector-cortex-enc0d.js";
 export { ENC_0E_ENABLED } from "./vector-cortex-enc0e.js";
 export { ENC_0F_ENABLED } from "./vector-cortex-enc0f.js";
+export { ENC_0G_ENABLED } from "./vector-cortex-enc0g.js";
+export { ENC_1A_ENABLED } from "./vector-cortex-enc1a.js";
 // Breaker constants (TRIAD_RESILIENCE.md §breaker) extracted to vector-cortex-breakers.ts.
 export { BREAKER_WINDOW_MS, BREAKER_MIN_ATTEMPTS, BREAKER_PERF_FAILURES, BREAKER_PERF_FAILURE_RATE, BREAKER_CORRECTNESS_FAILURES, BREAKER_COOLDOWN_MS, BREAKER_PROBE_COUNT, BREAKER_RETRY_BASE_MS, BREAKER_RETRY_CAP_MS, BREAKER_RETRY_JITTER, BREAKER_HYSTERESIS_FAILURE_RATE, BREAKER_HYSTERESIS_BUDGET_P95_MS, BREAKER_MIN_HEALTHY_RESIDENCE_MS, } from "./vector-cortex-breakers.js";

package/dist/config.js

@@ -114,4 +114,4 @@ export const NEW_UI = () => ragEnabled("MEGACOMPACT_NEW_UI");
 // default ON, `=0`/`_DISABLED` off. Re-exported from src/config/vector-cortex.ts
 // so root consumers share one source of truth.
 // ---------------------------------------------------------------------------
-export { VC0A_ENABLED, VC0B_ENABLED, VC1A_ENABLED, VC0C_ENABLED, VC1B_ENABLED, VC1C_ENABLED, VC2A_ENABLED, VC2B_ENABLED, VC2C_ENABLED, VC3A_ENABLED, VC3B_ENABLED, VC3C_ENABLED, VC4A_ENABLED, VC4B_ENABLED, VC4C_ENABLED, VC5A_ENABLED, VC5B_ENABLED, VC5C_ENABLED, VC6A_ENABLED, VC6B_ENABLED, VC6C_ENABLED, VC7A_ENABLED, VC7B_ENABLED, VC7C_ENABLED, VC8A_ENABLED, VC8B_ENABLED, VC8C_ENABLED, VC9A_ENABLED, VC9B_ENABLED, VC9C_ENABLED, VC9D_ENABLED, PCC_ENABLED, ML5A_ENABLED, ML5B_ENABLED, ML5C_ENABLED, ML5D_ENABLED, ML5E_ENABLED, DEDUP_ATTR_ENABLED, ENC_0A_ENABLED, ENC_0B_ENABLED, ENC_0C_ENABLED, ENC_0D_ENABLED, ENC_0E_ENABLED, ENC_0F_ENABLED, BREAKER_WINDOW_MS, BREAKER_MIN_ATTEMPTS, BREAKER_PERF_FAILURES, BREAKER_PERF_FAILURE_RATE, BREAKER_CORRECTNESS_FAILURES, BREAKER_COOLDOWN_MS, BREAKER_PROBE_COUNT, BREAKER_RETRY_BASE_MS, BREAKER_RETRY_CAP_MS, BREAKER_RETRY_JITTER, BREAKER_HYSTERESIS_FAILURE_RATE, BREAKER_HYSTERESIS_BUDGET_P95_MS, BREAKER_MIN_HEALTHY_RESIDENCE_MS, } from "./config/vector-cortex.js";
+export { VC0A_ENABLED, VC0B_ENABLED, VC1A_ENABLED, VC0C_ENABLED, VC1B_ENABLED, VC1C_ENABLED, VC2A_ENABLED, VC2B_ENABLED, VC2C_ENABLED, VC3A_ENABLED, VC3B_ENABLED, VC3C_ENABLED, VC4A_ENABLED, VC4B_ENABLED, VC4C_ENABLED, VC5A_ENABLED, VC5B_ENABLED, VC5C_ENABLED, VC6A_ENABLED, VC6B_ENABLED, VC6C_ENABLED, VC7A_ENABLED, VC7B_ENABLED, VC7C_ENABLED, VC8A_ENABLED, VC8B_ENABLED, VC8C_ENABLED, VC9A_ENABLED, VC9B_ENABLED, VC9C_ENABLED, VC9D_ENABLED, PCC_ENABLED, ML5A_ENABLED, ML5B_ENABLED, ML5C_ENABLED, ML5D_ENABLED, ML5E_ENABLED, DEDUP_ATTR_ENABLED, ENC_0A_ENABLED, ENC_0B_ENABLED, ENC_0C_ENABLED, ENC_0D_ENABLED, ENC_0E_ENABLED, ENC_0F_ENABLED, ENC_0G_ENABLED, ENC_1A_ENABLED, BREAKER_WINDOW_MS, BREAKER_MIN_ATTEMPTS, BREAKER_PERF_FAILURES, BREAKER_PERF_FAILURE_RATE, BREAKER_CORRECTNESS_FAILURES, BREAKER_COOLDOWN_MS, BREAKER_PROBE_COUNT, BREAKER_RETRY_BASE_MS, BREAKER_RETRY_CAP_MS, BREAKER_RETRY_JITTER, BREAKER_HYSTERESIS_FAILURE_RATE, BREAKER_HYSTERESIS_BUDGET_P95_MS, BREAKER_MIN_HEALTHY_RESIDENCE_MS, } from "./config/vector-cortex.js";

package/dist/extensions/dashboard-server/qualification-record.js

@@ -0,0 +1,71 @@
+/**
+ * dashboard-server/qualification-record.ts — ENC-0g QualificationV1 reader.
+ *
+ * Read-only reader for the ENC-0f qualification record at
+ * <stateDir>/encoder-qualification.json. The computed-blocker + action-gating
+ * functions live in setup-cortex-blockers.ts (Worker A's canonical module).
+ *
+ * Reader-only: local filesystem read only (PREVENT-PI-004), no `any`
+ * (PREVENT-011), never payloads/prompts/ledger (EVAL-REDACT-002).
+ */
+import { homedir } from "node:os";
+import { readFileSync } from "node:fs";
+import { join } from "node:path";
+import { QUALIFICATION_RECORD_UNAVAILABLE } from "../../src/vector-cortex/setup-cortex-blockers-compute.js";
+/** Sentinel appended to thresholdFailures when no valid record is readable (canonical def in setup-cortex-blockers-compute). */
+export { QUALIFICATION_RECORD_UNAVAILABLE };
+/**
+ * Resolve the encoder state dir (the record's home) — same precedence as
+ * scripts/encoder/gate-qualify.mjs: MEGACOMPACT_STATE_DIR first, else
+ * ~/.pi/mega-compact-encoder.
+ */
+export function encoderStateDir() {
+    const env = process.env.MEGACOMPACT_STATE_DIR;
+    return env !== undefined && env.length > 0
+        ? env
+        : join(homedir(), ".pi", "mega-compact-encoder");
+}
+/**
+ * Read + minimally validate the QualificationV1 record. Returns null on a
+ * missing/unreadable file, a JSON parse failure, or a shape mismatch (the
+ * route degrades to verify-only — never crashes). Read-only (PREVENT-PI-004).
+ */
+export function readQualificationRecord(stateDir) {
+    let raw;
+    try {
+        // guardrails-allow PREVENT-PI-004: local qualification-record filesystem read (loopback)
+        raw = readFileSync(join(stateDir, "encoder-qualification.json"), "utf8");
+    }
+    catch {
+        return null;
+    }
+    let parsed;
+    try {
+        parsed = JSON.parse(raw);
+    }
+    catch {
+        return null;
+    }
+    const rec = parsed;
+    if (rec === null || typeof rec !== "object")
+        return null;
+    if (rec["schema"] !== "qualification-v1")
+        return null;
+    if (typeof rec["verdict"] !== "string")
+        return null;
+    if (!Array.isArray(rec["reasons"]))
+        return null;
+    if (typeof rec["platform"] !== "string")
+        return null;
+    const reasons = rec["reasons"].map((r) => String(r));
+    return {
+        schema: "qualification-v1",
+        verdict: rec["verdict"] === "qualified" ? "qualified" : "failed",
+        reasons,
+        platform: rec["platform"],
+        p95Ms: typeof rec["p95Ms"] === "number" ? rec["p95Ms"] : 0,
+        rssMib: typeof rec["rssMib"] === "number" ? rec["rssMib"] : 0,
+        opset: typeof rec["opset"] === "number" ? rec["opset"] : 0,
+        digest: typeof rec["digest"] === "string" ? rec["digest"] : "",
+    };
+}

package/dist/extensions/dashboard-server/routes-rag-settings-vector-cortex.js

@@ -64,5 +64,7 @@ export const VECTOR_CORTEX_SETTINGS = {
         boolDirect("MEGACOMPACT_ENC_0D", "ENC-0d Real-Asset Promotion Gate", "ENC-0d promotion gate over real trained assets: accepts a {color} real candidate manifest (the ENC-0c trained head weights + the ENC-0b trunk), digest-verifies every staged byte, and atomically swaps the shipped manifest to a green candidate with rollback-to-previous on qualification failure. OFF = accepts no candidate, swaps nothing, emits nothing, shipped manifest stays at the ENC-0c survivor.", true),
         boolDirect("MEGACOMPACT_ENC_0E", "ENC-0e darwin-x64 Demotion Reason", "ENC-0e darwin-x64 explicit demotion: on an Intel Mac the runtime demotes to WASM (no native binary upstream); this surfaces a deterministic reason on the runtime-selection event and the Setup Cortex blockers card so an operator sees why mode A is unreachable. OFF = no demotion reason on the event and no Setup card row (the ML5-C WASM demotion itself remains the default, byte-identical predecessor).", true),
         boolDirect("MEGACOMPACT_ENC_0F", "ENC-0f p95 + marginal-RSS Qualification Gate", "ENC-0f p95 + marginal-RSS qualification gate (real trained asset → mode A): runs the ENC-0d-promoted trained asset through the bench under --expose-gc, asserts p95 ≤ 40 ms @ 512/4 threads, marginal RSS ≤ 150 MiB (baseline-subtracted), determinism, and opset-21; on pass emits QualificationV1 + flips runtime to qualified mode A, on failure asset stays demoted to mode B. OFF = no qualification gate runs, no QualificationV1 written, runtime keeps serving the ENC-0d survivor (byte-identical predecessor).", true),
+        boolDirect("MEGACOMPACT_ENC_0G", "ENC-0g Setup Cortex honest state (verdict override + live blockers)", "ENC-0g makes the Setup Cortex status route honest: reads the ENC-0f QualificationV1 record (when ENC_0F is ON and a record exists) and lets its verdict override the structural verify for the qualification field; computes the blocker list from (platform, record, manifest head-count) with corrected HG statuses/wording; re-derives VC9B action gating from live blockers. OFF = verdict from verifyEncoderAsset alone, static SETUP_CORTEX_BLOCKERS, static action gating (byte-identical ENC-0f predecessor).", true),
+        boolDirect("MEGACOMPACT_ENC_1A", "ENC-1a external embedder API key + endpoint Settings fields", "ENC-1a adds a Settings-visible field pair for the external embedder endpoint URL + optional Bearer API key, persisted by the setup-configure writer branch to the per-repo .mega-compact.env (MEGACOMPACT_EMBEDDING_URL / MEGACOMPACT_EMBEDDING_KEY). The GET status route echoes the endpoint URL and reports embeddingApiKeySet as a boolean ONLY — the raw key is never returned. OFF = no new GET fields, no writer branch, no new Settings text rows (byte-identical ENC-0g predecessor).", true),
     ],
 };

package/dist/extensions/dashboard-server/routes-setup-cortex-actions.js

@@ -17,9 +17,14 @@
  * readJsonBody), no string literals for scripts/blockers (delegated to
  * setup-cortex-actions.ts + setup-cortex-blockers.ts).
  */
+import { existsSync } from "node:fs";
+import { join, dirname } from "node:path";
+import { fileURLToPath } from "node:url";
 import { sendJson, readJsonBody } from "./routes-vector-cortex-shared.js";
-import { VC9B_ENABLED } from "../../src/config.js";
-import { setupCortexActionBlockers } from "./setup-cortex-blockers.js";
+import { VC9B_ENABLED, ENC_0G_ENABLED, ENC_0F_ENABLED } from "../../src/config.js";
+import { setupCortexActionBlockers, computeSetupCortexBlockers } from "./setup-cortex-blockers.js";
+import { readEncoderManifest, detectPlatform } from "../../src/vector-cortex/encoder/asset.js";
+import { readQualificationRecord, encoderStateDir, } from "./qualification-record.js";
 import { runSetupCortexAction, readActionLogTail, } from "./setup-cortex-actions.js";
 const ACTION_KINDS = new Set([
     "fetch-model",
@@ -29,6 +34,44 @@ const ACTION_KINDS = new Set([
 function isActionKind(v) {
     return typeof v === "string" && ACTION_KINDS.has(v);
 }
+/** The encoder asset dir used by the action gate (mirrors routes-setup-cortex.ts). */
+function encoderAssetDir() {
+    let dir = dirname(fileURLToPath(import.meta.url));
+    const rel = join("assets", "vector-cortex", "encoder-v1");
+    for (let i = 0; i < 8; i++) {
+        const candidate = join(dir, rel);
+        if (existsSync(join(candidate, "manifest.json")))
+            return candidate;
+        const next = dirname(dir);
+        if (next === dir)
+            break;
+        dir = next;
+    }
+    return null;
+}
+/**
+ * ENC-0g: the live computed blockers for the action gate. When both gates are
+ * ON, read the QualificationV1 record + verified manifest head-count and derive
+ * the live list (so a closed HG-1 no longer gates fetch-model/bench). Otherwise
+ * return null and let setupCortexActionBlockers fall back to the static base.
+ */
+function liveActionBlockers() {
+    if (!ENC_0G_ENABLED() || !ENC_0F_ENABLED())
+        return null;
+    const record = readQualificationRecord(encoderStateDir());
+    let headCount = null;
+    const dir = encoderAssetDir();
+    if (dir !== null) {
+        const manifest = readEncoderManifest(dir);
+        if (manifest !== null)
+            headCount = Object.keys(manifest.heads).length;
+    }
+    return computeSetupCortexBlockers({
+        platform: detectPlatform(),
+        qualification: record,
+        headCount,
+    });
+}
 /** Flag-off response, byte-identical regardless of request (VC9B absent). */
 function sendDisabled(res) {
     sendJson(res, 404, { error: "disabled" });
@@ -65,7 +108,10 @@ export function handleSetupCortexAction(req, res, ctx) {
         }
         // Hard-gate check: when an OPEN hard-gate item gates this action, do NOT
         // spawn — surface the blocker ids so the client highlights the matching rows.
-        const blockers = setupCortexActionBlockers(action);
+        // ENC-0g: re-derive against the LIVE computed blockers (a closed HG-1 no
+        // longer blocks), falling back to the static base when the gates are off.
+        const live = liveActionBlockers();
+        const blockers = live !== null ? setupCortexActionBlockers(action, live) : setupCortexActionBlockers(action);
         if (blockers.length > 0) {
             sendJson(res, 423, {
                 error: "action_blocked_by_open_item",

package/dist/extensions/dashboard-server/routes-setup-cortex.js

@@ -22,12 +22,13 @@ import { createHash } from "node:crypto";
 import { readFileSync, statSync } from "node:fs";
 import { join, dirname } from "node:path";
 import { fileURLToPath } from "node:url";
-import { VC9A_ENABLED, ENC_0E_ENABLED } from "../../src/config.js";
+import { VC9A_ENABLED, ENC_0E_ENABLED, ENC_0F_ENABLED, ENC_0G_ENABLED } from "../../src/config.js";
 import { readEncoderManifest, verifyEncoderAsset, detectPlatform } from "../../src/vector-cortex/encoder/asset.js";
 import { selectRuntimeBackend } from "../../src/vector-cortex/encoder/runtime-select.js";
 import { sendJson } from "./routes-vector-cortex-shared.js";
 import { deriveVcStatus } from "./vc-status.js";
-import { SETUP_CORTEX_BLOCKERS } from "./setup-cortex-blockers.js";
+import { SETUP_CORTEX_BLOCKERS, computeSetupCortexBlockers } from "./setup-cortex-blockers.js";
+import { readQualificationRecord, encoderStateDir, QUALIFICATION_RECORD_UNAVAILABLE, } from "./qualification-record.js";
 /** Resolve the committed encoder-v1 asset dir by walking up to the repo root. */
 function encoderAssetDir() {
     let dir = dirname(fileURLToPath(import.meta.url));
@@ -51,7 +52,7 @@ function encoderAssetDir() {
 }
 let factCache = null;
 /** Stable cache key: manifest bytes + (size,mtime) of the asset files + platform. */
-function factCacheKey(dir, manifestPath) {
+function factCacheKey(dir, manifestPath, stateDir, record, recordGate) {
     const platform = detectPlatform();
     if (!platform)
         return null;
@@ -67,15 +68,47 @@ function factCacheKey(dir, manifestPath) {
     catch {
         return null;
     }
+    // ENC-0g: fold the qualification-record gate + (mtime, content sha) into the
+    // key so a re-run gate invalidates memoized facts (no stale verdict served).
+    try {
+        const s = statSync(join(stateDir, "encoder-qualification.json"));
+        parts.push(`g:${recordGate ? "on" : "off"}`, `q:${s.size}:${s.mtimeMs}`);
+        parts.push(createHash("sha256").update(JSON.stringify(record)).digest("hex"));
+    }
+    catch {
+        parts.push(`g:${recordGate ? "on" : "off"}`, "q:absent");
+    }
     return parts.join("|");
 }
-function computeSetupCortexFacts(dir) {
+function applyQualificationOverride(base, record, recordGate) {
+    // Flag-off (recordGate false): byte-identical verify-derived facts.
+    if (!recordGate)
+        return base;
+    if (record !== null) {
+        // The ENC-0f QualificationV1 failure maps onto the contract "demoted": a
+        // structurally-valid asset whose real-asset gate measured failure is honest
+        // as demoted, NOT qualified. mode stays verify-derived (A).
+        return {
+            ...base,
+            verdict: record.verdict === "qualified" ? "qualified" : "demoted",
+            thresholdFailures: [...record.reasons],
+        };
+    }
+    // No record + gate on: keep the verify verdict but surface the missing-record
+    // sentinel (never a fabricated pass, never a bare silent fallback).
+    return {
+        ...base,
+        thresholdFailures: [...base.thresholdFailures, QUALIFICATION_RECORD_UNAVAILABLE],
+    };
+}
+function computeSetupCortexFacts(dir, stateDir, record, recordGate) {
     const manifest = readEncoderManifest(dir);
     if (manifest === null) {
-        return { mode: "C", assetDigestPrefix: null, verdict: "unavailable", thresholdFailures: [] };
+        return { mode: "C", assetDigestPrefix: null, verdict: "unavailable", thresholdFailures: [], headCount: null };
     }
+    const headCount = Object.keys(manifest.heads).length;
     const manifestPath = join(dir, "manifest.json");
-    const key = factCacheKey(dir, manifestPath);
+    const key = factCacheKey(dir, manifestPath, stateDir, record, recordGate);
     if (key === null)
         return null;
     if (factCache !== null && factCache.key === key)
@@ -86,25 +119,27 @@ function computeSetupCortexFacts(dir) {
         digest = createHash("sha256").update(readFileSync(manifestPath)).digest("hex");
     }
     catch {
-        const facts = { mode: "B", assetDigestPrefix: null, verdict: "demoted", thresholdFailures: ["ENC_ASSET_UNREADABLE"] };
+        const base = { mode: "B", assetDigestPrefix: null, verdict: "demoted", thresholdFailures: ["ENC_ASSET_UNREADABLE"], headCount };
+        const facts = applyQualificationOverride(base, record, recordGate);
         factCache = { key, facts };
         return facts;
     }
     const verify = verifyEncoderAsset(dir, manifest, detectPlatform());
     const prefix = digest.slice(0, 12);
-    const facts = verify.ok
-        ? { mode: "A", assetDigestPrefix: prefix, verdict: "qualified", thresholdFailures: [] }
-        : { mode: "B", assetDigestPrefix: prefix, verdict: "demoted", thresholdFailures: [verify.code] };
+    const base = verify.ok
+        ? { mode: "A", assetDigestPrefix: prefix, verdict: "qualified", thresholdFailures: [], headCount }
+        : { mode: "B", assetDigestPrefix: prefix, verdict: "demoted", thresholdFailures: [verify.code], headCount };
+    const facts = applyQualificationOverride(base, record, recordGate);
     factCache = { key, facts };
     return facts;
 }
-function setupCortexFacts() {
+function setupCortexFacts(record, recordGate) {
     const dir = encoderAssetDir();
     if (dir === null) {
-        return { mode: "C", assetDigestPrefix: null, verdict: "unavailable", thresholdFailures: [] };
+        return { mode: "C", assetDigestPrefix: null, verdict: "unavailable", thresholdFailures: [], headCount: null };
     }
-    const facts = computeSetupCortexFacts(dir);
-    return facts ?? { mode: "C", assetDigestPrefix: null, verdict: "unavailable", thresholdFailures: [] };
+    const facts = computeSetupCortexFacts(dir, encoderStateDir(), record, recordGate);
+    return facts ?? { mode: "C", assetDigestPrefix: null, verdict: "unavailable", thresholdFailures: [], headCount: null };
 }
 /**
  * Reader-only GET /api/setup-cortex-status (VC9A).
@@ -122,8 +157,22 @@ export function handleSetupCortexStatus(req, res, _ctx) {
         return true;
     }
     const enabled = VC9A_ENABLED();
-    const facts = enabled ? setupCortexFacts() : null;
-    const blocks = enabled ? [...SETUP_CORTEX_BLOCKERS] : [];
+    // ENC-0g: when both gates are ON, read the QualificationV1 record and let its
+    // verdict override the structural verify for the `qualification` field. When
+    // ENC_0G is OFF, nothing below reads the record (byte-identical to ENC-0f-era).
+    const enc0g = enabled && ENC_0G_ENABLED();
+    const recordGate = enc0g && ENC_0F_ENABLED();
+    const record = recordGate ? readQualificationRecord(encoderStateDir()) : null;
+    const facts = enabled ? setupCortexFacts(record, recordGate) : null;
+    const blocks = enabled
+        ? enc0g
+            ? [...computeSetupCortexBlockers({
+                    platform: detectPlatform(),
+                    qualification: record,
+                    headCount: facts ? facts.headCount : null,
+                })]
+            : [...SETUP_CORTEX_BLOCKERS]
+        : [];
     // ENC-0e: surface the darwin-x64 demotion reason additively (reader-only GET,
     // no new route). The platform is read locally; the selection is pure. On a
     // non-darwin-x64 host or flag-off this is null and the field is omitted —

package/dist/extensions/dashboard-server/routes-setup-enc1a.js

@@ -0,0 +1,157 @@
+/**
+ * dashboard-server/routes-setup-enc1a.ts — ENC-1a external-embedder Settings
+ * read/write + the additive writer branch.
+ *
+ * Extracted out of routes-setup.ts (which hovers at the 300-line source soft
+ * cap) so the ENC-1a additive read/write of the per-repo `.mega-compact.env`
+ * keys AND the pure external-embedder configure branch live in a sibling impl
+ * file. The two keys are `MEGACOMPACT_EMBEDDING_URL` and
+ * `MEGACOMPACT_EMBEDDING_KEY` — the exact names `embeddingConfigFromEnv`
+ * (src/httpEmbedder.ts) reads at runtime.
+ *
+ * The write is create-or-append: it upserts the two keys into the existing
+ * per-repo `.mega-compact.env`, preserving every unrelated line and never
+ * deleting other keys. The read reports the endpoint URL (echoed) and an
+ * `apiKeySet` boolean ONLY — the raw API key is never returned, logged, or
+ * emitted (redaction invariant).
+ *
+ * Guardrails: PREVENT-PI-004 (local filesystem writes only, zero network),
+ * PREVENT-001 (null-safe JSON), PREVENT-011 (no `any`).
+ */
+import { writeFileSync, mkdirSync, readFileSync, existsSync } from "node:fs";
+import { join } from "node:path";
+import { ENC_1A_ENABLED } from "../../src/config.js";
+const URL_KEY = "MEGACOMPACT_EMBEDDING_URL";
+const API_KEY = "MEGACOMPACT_EMBEDDING_KEY";
+function envPath(stateDir) {
+    return join(stateDir, ".mega-compact.env");
+}
+/** Extract the value of `export MEGACOMPACT_X="..."` (or unquoted) from a line. */
+function lineValue(line, key) {
+    const m = line.match(new RegExp(`^export\\s+${key}=(.*)$`));
+    if (!m)
+        return null;
+    const rest = m[1].trim();
+    const q = rest.match(/^"([^"]*)"$/);
+    return q ? q[1] : rest;
+}
+/** True when the payload carries the ENC-1a keys (flag-gated). */
+export function wantsEnc1a(body) {
+    return (ENC_1A_ENABLED() &&
+        (typeof body.embeddingEndpointUrl === "string" ||
+            typeof body.embeddingApiKey === "string"));
+}
+/** Additive GET status fields for ENC-1a (both omitted when flag-off): the
+ *  endpoint URL (echoed) + an apiKeySet boolean (true/false) ONLY — never the
+ *  raw key. The boolean is always present when the flag is on so an absent key
+ *  is reported as `embeddingApiKeySet:false` (non-fatal, triad B). */
+export function enc1aStatusFields(stateDir) {
+    if (!ENC_1A_ENABLED())
+        return {};
+    const enc1a = readEnc1aEnv(stateDir);
+    return {
+        ...(enc1a.endpointUrl !== null ? { embeddingEndpointUrl: enc1a.endpointUrl } : {}),
+        embeddingApiKeySet: enc1a.apiKeySet,
+    };
+}
+/** Read the ENC-1a keys from the per-repo `.mega-compact.env` (never the key
+ *  itself to callers — only its presence). */
+export function readEnc1aEnv(stateDir) {
+    try {
+        const p = envPath(stateDir);
+        if (!existsSync(p))
+            return { endpointUrl: null, apiKeySet: false };
+        const content = readFileSync(p, "utf8");
+        const lines = content.split(/\r?\n/);
+        let endpointUrl = null;
+        let apiKeySet = false;
+        for (const line of lines) {
+            const url = lineValue(line, URL_KEY);
+            if (url !== null)
+                endpointUrl = url;
+            const key = lineValue(line, API_KEY);
+            if (key !== null && key.length > 0)
+                apiKeySet = true;
+        }
+        return { endpointUrl, apiKeySet };
+    }
+    catch {
+        return { endpointUrl: null, apiKeySet: false };
+    }
+}
+/** Upsert the ENC-1a keys into the per-repo `.mega-compact.env`. Creates the
+ *  file if absent; preserves every unrelated line; never deletes other keys.
+ *  Passing `null` for a key leaves that line untouched. */
+export function writeEnc1aEnv(stateDir, entries) {
+    const p = envPath(stateDir);
+    const existingLines = existsSync(p)
+        ? readFileSync(p, "utf8").split(/\r?\n/)
+        : [];
+    const out = [];
+    let urlWritten = false;
+    let keyWritten = false;
+    for (const line of existingLines) {
+        if (entries.endpointUrl !== null && lineValue(line, URL_KEY) !== null) {
+            out.push(`export ${URL_KEY}="${entries.endpointUrl ?? ""}"`);
+            urlWritten = true;
+            continue;
+        }
+        if (entries.apiKey !== null && lineValue(line, API_KEY) !== null) {
+            out.push(`export ${API_KEY}="${entries.apiKey ?? ""}"`);
+            keyWritten = true;
+            continue;
+        }
+        out.push(line);
+    }
+    if (entries.endpointUrl !== null && !urlWritten) {
+        out.push(`export ${URL_KEY}="${entries.endpointUrl}"`);
+    }
+    if (entries.apiKey !== null && !keyWritten) {
+        out.push(`export ${API_KEY}="${entries.apiKey ?? ""}"`);
+    }
+    mkdirSync(stateDir, { recursive: true });
+    writeFileSync(p, out.join("\n"), "utf-8");
+    return p;
+}
+/** If the payload is a pure ENC-1a configure (new keys, no valid embedder
+ *  selection), write them additively to the per-repo env and reply. Returns
+ *  true when it fully handled the request. */
+export function tryEnc1aConfigure(body, res, ctx) {
+    if (!wantsEnc1a(body))
+        return false;
+    const embedder = body.embedder;
+    const embedderValid = !!embedder &&
+        (embedder === "ollama" || embedder === "llama" || embedder === "trigram" ||
+            embedder === "custom" || embedder === "onnx");
+    if (embedderValid)
+        return false; // combined payload — integrated after the embedder write
+    try {
+        const envPath = writeEnc1aEnv(ctx.stateDir, {
+            endpointUrl: typeof body.embeddingEndpointUrl === "string" && body.embeddingEndpointUrl
+                ? body.embeddingEndpointUrl
+                : null,
+            apiKey: typeof body.embeddingApiKey === "string" ? body.embeddingApiKey : null,
+        });
+        const currentUrl = process.env["MEGACOMPACT_EMBEDDING_URL"];
+        const alreadyActive = typeof body.embeddingEndpointUrl === "string" &&
+            currentUrl === body.embeddingEndpointUrl;
+        const resp = {
+            embedder: "custom",
+            url: typeof body.embeddingEndpointUrl === "string"
+                ? body.embeddingEndpointUrl
+                : null,
+            envPath,
+            restartRequired: !alreadyActive,
+            alreadyActive,
+        };
+        // guardrails-allow PREVENT-PI-004: loopback dashboard response (local)
+        res.writeHead(200, { "Content-Type": "application/json" });
+        res.end(JSON.stringify(resp));
+        return true;
+    }
+    catch (e) {
+        res.writeHead(500, { "Content-Type": "application/json" });
+        res.end(JSON.stringify({ error: `write_failed: ${e instanceof Error ? e.message : String(e)}` }));
+        return true;
+    }
+}

package/dist/extensions/dashboard-server/routes-setup.js

@@ -11,6 +11,7 @@
 import { writeFileSync, mkdirSync, readFileSync, existsSync } from "node:fs";
 import { join } from "node:path";
 import { VC9D_ENABLED } from "../../src/config.js";
+import { enc1aStatusFields, writeEnc1aEnv, tryEnc1aConfigure, wantsEnc1a } from "./routes-setup-enc1a.js";
 import { detectOllama, detectLlamaCpp, detectOnnx, memoizedDetectOllama, memoizedDetectLlamaCpp, memoizedDetectOnnx, } from "./routes-setup-detect-cache.js";
 // ---------------------------------------------------------------------------
 // handleSetupStatus — "/api/setup-status"
@@ -56,6 +57,9 @@ export function handleSetupStatus(req, res, ctx) {
     }
     const configured = detectConfiguredEmbedder(ctx.stateDir);
     const active = detectCurrentEmbedder();
+    // ENC-1a (flag-gated, additive): echo the persisted endpoint URL and an
+    // embeddingApiKeySet boolean ONLY — the raw API key is never returned. When
+    // the flag is off (or neither is set) both fields are simply omitted.
     const body = {
         currentEmbedder: active,
         configuredEmbedder: configured.embedder,
@@ -64,6 +68,7 @@ export function handleSetupStatus(req, res, ctx) {
         embeddingUrl: process.env["MEGACOMPACT_EMBEDDING_URL"] ?? configured.url,
         embedCache: process.env["MEGACOMPACT_EMBED_CACHE"] ?? null,
         minilm: ["1", "true", "yes"].includes((process.env["MEGACOMPACT_MINILM"] ?? "").trim().toLowerCase()),
+        ...enc1aStatusFields(ctx.stateDir),
     };
     // guardrails-allow PREVENT-PI-004: loopback dashboard response (local)
     res.writeHead(200, { "Content-Type": "application/json" });
@@ -165,6 +170,12 @@ export function handleSetupConfigure(req, res, ctx) {
             return;
         }
         const body = parsed.value;
+        // ENC-1a (flag-gated, additive): a pure external-embedder configure
+        // (new keys, no embedder selection) is handled by the sibling writer.
+        // Flag-off = the keys are simply not recognized, falling through to the
+        // pre-ENC-1a embedder path below (byte-identical predecessor).
+        if (tryEnc1aConfigure(body, res, ctx))
+            return;
         const embedder = body.embedder;
         if (embedder !== "ollama" && embedder !== "llama" && embedder !== "trigram" && embedder !== "custom" && embedder !== "onnx") {
             res.writeHead(400, { "Content-Type": "application/json" });
@@ -225,6 +236,16 @@ export function handleSetupConfigure(req, res, ctx) {
             res.end(JSON.stringify({ error: `write_failed: ${e instanceof Error ? e.message : String(e)}` }));
             return;
         }
+        // ENC-1a: a combined payload (valid embedder + new keys) also upserts
+        // the endpoint/key lines onto the freshly-written env file.
+        if (wantsEnc1a(body)) {
+            writeEnc1aEnv(stateDir, {
+                endpointUrl: typeof body.embeddingEndpointUrl === "string" && body.embeddingEndpointUrl
+                    ? body.embeddingEndpointUrl
+                    : null,
+                apiKey: typeof body.embeddingApiKey === "string" ? body.embeddingApiKey : null,
+            });
+        }
         // Detect if the new config matches what's already active (no restart needed).
         const currentUrl = process.env["MEGACOMPACT_EMBEDDING_URL"];
         const alreadyActive = (resolvedUrl === null && !currentUrl) || (resolvedUrl !== null && currentUrl === resolvedUrl);