pi-mega-compact 0.20.50 → 0.20.52

package/extensions/dashboard-server/api-contracts/vector-cortex-ledger.ts

@@ -0,0 +1,39 @@
+/**
+ * api-contracts/vector-cortex-ledger.ts — VC1B occurrence-ledger surface.
+ *
+ * Extracted from `vector-cortex.ts` so the combined api-contracts module stays
+ * under the 400-line `extensions/` soft limit. Owns the reader-only ledger
+ * views (VC1B aggregate + identity rows). PREVENT-PI-004: type definitions
+ * only, no network code. PREVENT-011: no `any` type.
+ */
+
+/** Live-state derivation shared across the VC views (mirrors vector-cortex.ts). */
+type VcStatus = "live" | "awaiting_data" | "deferred" | "structural" | "off";
+
+/**
+ * Reader-only occurrence-ledger identity view for GET /api/vector-cortex/ledger (VC1B).
+ * Built on the LedgerReader capability surface. Exposes occurrence IDENTITY
+ * (seq/eventId/kind/digest/toolCallId) and the per-session high-water/count —
+ * NEVER sourceBytes or prompt text, honoring the reader-only no-ledger-text rule.
+ */
+export interface VectorCortexLedgerView {
+  /** Whether the VC1B occurrence ledger flag is enabled in this process. */
+  readonly enabled: boolean;
+  /** The ledger session whose occurrences are returned. */
+  readonly session: string;
+  /** Durable contiguous high-water (stringified bigint) for the session. */
+  readonly highWater: string;
+  /** Number of accepted occurrences for the session. */
+  readonly count: number;
+  /** Capped identity rows (ascending seq). No source bytes, never payload text. */
+  readonly occurrences: readonly {
+    readonly seq: string;
+    readonly eventId: string;
+    readonly kind: string;
+    readonly digest: string;
+    readonly toolCallId?: string;
+  }[];
+  /** ISO timestamp of the snapshot. */
+  readonly updatedAt: string;
+  readonly status?: VcStatus;
+}

package/extensions/dashboard-server/api-contracts/vector-cortex.ts

@@ -44,6 +44,13 @@ export interface VectorCortexEvaluationSummary {
   };
   /** Evaluator rejections (EVAL_*) observed in this window. */
   readonly rejects: readonly string[];
+  /**
+   * ML5-D dashboard "Improve Cortex" flag state. Additive and omitted when
+   * MEGACOMPACT_ML5_D is off, so the client omits the ModelImprovementCard
+   * (byte-identical to the ML5-C-era tab). Present (true) only when the flag
+   * is enabled. Reader-only aggregate — never job verdicts or training bytes.
+   */
+  readonly ml5dEnabled?: boolean;
   /** ISO timestamp of the summary. */
   readonly updatedAt: string;
   readonly status?: VcStatus;
@@ -365,36 +372,11 @@ export interface VectorCortexRolloutView {
   readonly status?: VcStatus;
 }
 
-/**
- * Reader-only occurrence-ledger identity view for GET /api/vector-cortex/ledger (VC1B).
- * Built on the LedgerReader capability surface. Exposes occurrence IDENTITY
- * (seq/eventId/kind/digest/toolCallId) and the per-session high-water/count —
- * NEVER sourceBytes or prompt text, honoring the reader-only no-ledger-text rule.
- */
-export interface VectorCortexLedgerView {
-  /** Whether the VC1B occurrence ledger flag is enabled in this process. */
-  readonly enabled: boolean;
-  /** The ledger session whose occurrences are returned. */
-  readonly session: string;
-  /** Durable contiguous high-water (stringified bigint) for the session. */
-  readonly highWater: string;
-  /** Number of accepted occurrences for the session. */
-  readonly count: number;
-  /** Capped identity rows (ascending seq). No source bytes, never payload text. */
-  readonly occurrences: readonly {
-    readonly seq: string;
-    readonly eventId: string;
-    readonly kind: string;
-    readonly digest: string;
-    readonly toolCallId?: string;
-  }[];
-  /** ISO timestamp of the snapshot. */
-  readonly updatedAt: string;
-  readonly status?: VcStatus;
-}
-
 export type {
   VectorCortexClosureProofView,
   VectorCortexRestoreView,
   VectorCortexRepairView,
 } from "./vector-cortex-heal.js";
+export type {
+  VectorCortexLedgerView,
+} from "./vector-cortex-ledger.js";

package/extensions/dashboard-server/routes-rag-settings-vector-cortex.ts

@@ -300,5 +300,11 @@ export const VECTOR_CORTEX_SETTINGS: SettingGroup = {
 			"ENC-1a adds a Settings-visible field pair for the external embedder endpoint URL + optional Bearer API key, persisted by the setup-configure writer branch to the per-repo .mega-compact.env (MEGACOMPACT_EMBEDDING_URL / MEGACOMPACT_EMBEDDING_KEY). The GET status route echoes the endpoint URL and reports embeddingApiKeySet as a boolean ONLY — the raw key is never returned. OFF = no new GET fields, no writer branch, no new Settings text rows (byte-identical ENC-0g predecessor).",
 			true,
 		),
+		boolDirect(
+			"MEGACOMPACT_ENC_1B",
+			"ENC-1b ONNX runtime backend + embedder API settings",
+			"ENC-1b completes the embedder API Settings surface (dim / headers / allow-remote persisted to the per-repo .mega-compact.env) and surfaces the ONNX runtime selection knob (MEGACOMPACT_ENCODER_NATIVE) as a toggle plus the current effective backend + demotion reason. OFF = no new GET fields, no writer branch, no new Settings rows or toggle (byte-identical ENC-1a predecessor).",
+			true,
+		),
 	],
 };

package/extensions/dashboard-server/routes-setup-enc1b.ts

@@ -0,0 +1,336 @@
+/**
+ * dashboard-server/routes-setup-enc1b.ts — ENC-1b embedder API completion +
+ * ONNX runtime selection Settings read/write + the additive writer branch.
+ *
+ * Extracted out of routes-setup.ts (which hovers at the 300-line source soft
+ * cap, mirroring the ENC-1a sibling extract) so the ENC-1b additive read/write
+ * of the per-repo `.mega-compact.env` keys AND the runtime-backend computation
+ * live in a sibling impl file. Four keys are managed here:
+ * `MEGACOMPACT_EMBEDDING_DIM`, `MEGACOMPACT_EMBEDDING_HEADERS`,
+ * `MEGACOMPACT_ALLOW_REMOTE_EMBEDDER`, `MEGACOMPACT_ENCODER_NATIVE` — the exact
+ * names `embeddingConfigFromEnv` (src/httpEmbedder.ts) and the runtime selector
+ * read at runtime.
+ *
+ * The write is create-or-append: it upserts the four keys into the existing
+ * per-repo `.mega-compact.env`, preserving every unrelated line and never
+ * deleting another key. The read reports the persisted dim, booleans for
+ * headers-set / allow-remote / native-opt-in, and computes the current
+ * effective backend + demotion reason through the EXISTING `selectRuntimeBackend`
+ * (reader-only — the runtime's own selection, never a reimplemented literal,
+ * never install logic). The raw headers JSON is NEVER returned, logged or
+ * emitted (redaction invariant — it may carry secrets such as an Authorization
+ * header for a TEI/ONNX server).
+ *
+ * Guardrails: PREVENT-PI-004 (local filesystem reads/writes + in-memory
+ * runtime selection only, zero network), PREVENT-001 (null-safe JSON),
+ * PREVENT-011 (no `any`).
+ */
+
+import { writeFileSync, mkdirSync, readFileSync, existsSync } from "node:fs";
+import { join } from "node:path";
+import type { ServerResponse } from "node:http";
+import type { RouteContext } from "./routes-core.js";
+import {
+  ENC_1B_ENABLED,
+  ENC_1B_MAX_EMBEDDING_DIM,
+  ENC_1B_EMBEDDING_DIM_ENV,
+  ENC_1B_EMBEDDING_HEADERS_ENV,
+  ENC_1B_ALLOW_REMOTE_EMBEDDER_ENV,
+  ENC_1B_ENCODER_NATIVE_ENV,
+} from "../../src/config/vector-cortex.js";
+import type { SetupConfigureRequest, SetupConfigureResponse } from "./api-contracts/setup.js";
+import { selectRuntimeBackend } from "../../src/vector-cortex/encoder/runtime-select.js";
+import { detectPlatform } from "../../src/vector-cortex/encoder/asset.js";
+
+function envPath(stateDir: string): string {
+  return join(stateDir, ".mega-compact.env");
+}
+
+/** Extract the value of `export MEGACOMPACT_X="..."` (or unquoted) from a line. */
+function lineValue(line: string, key: string): string | null {
+  const m = line.match(new RegExp(`^export\\s+${key}=(.*)$`));
+  if (!m) return null;
+  const rest = m[1].trim();
+  if (rest.length === 0) return null;
+  const q = rest.match(/^"([^"]*)"$/);
+  return q ? q[1] : rest;
+}
+
+/** True when the payload carries any ENC-1b key (flag-gated). */
+export function wantsEnc1b(body: SetupConfigureRequest): boolean {
+  return (
+    ENC_1B_ENABLED() &&
+    (typeof body.embeddingDim === "string" ||
+      typeof body.embeddingHeaders === "string" ||
+      typeof body.allowRemoteEmbedder === "boolean" ||
+      typeof body.encoderNativeOptIn === "boolean")
+  );
+}
+
+/** Read the ENC-1b keys from the per-repo `.mega-compact.env`. The headers
+ *  value is NEVER surfaced to callers — only its presence boolean. */
+export function readEnc1bEnv(stateDir: string): {
+  dim: string | null;
+  headersSet: boolean;
+  allowRemote: boolean;
+  nativeOptIn: boolean;
+} {
+  try {
+    const p = envPath(stateDir);
+    if (!existsSync(p)) return { dim: null, headersSet: false, allowRemote: false, nativeOptIn: false };
+    const lines = readFileSync(p, "utf8").split(/\r?\n/);
+    let dim: string | null = null;
+    let headersSet = false;
+    let allowRemote = false;
+    let nativeOptIn = false;
+    for (const line of lines) {
+      const d = lineValue(line, ENC_1B_EMBEDDING_DIM_ENV);
+      if (d !== null && d.length > 0) dim = d;
+      const h = lineValue(line, ENC_1B_EMBEDDING_HEADERS_ENV);
+      if (h !== null && h.length > 0) headersSet = true;
+      const a = lineValue(line, ENC_1B_ALLOW_REMOTE_EMBEDDER_ENV);
+      if (a !== null && ["1", "true", "yes"].includes(a.trim().toLowerCase())) allowRemote = true;
+      const n = lineValue(line, ENC_1B_ENCODER_NATIVE_ENV);
+      if (n !== null && ["1", "true", "yes"].includes(n.trim().toLowerCase())) nativeOptIn = true;
+    }
+    return { dim, headersSet, allowRemote, nativeOptIn };
+  } catch {
+    return { dim: null, headersSet: false, allowRemote: false, nativeOptIn: false };
+  }
+}
+
+/**
+ * ENC-1b additive GET status fields. All omitted when flag-off. The Cortex
+ * trio (native opt-in + effective backend + demotion reason) is computed here
+ * (reader-only): the stored opt-in + current platform drive the EXISTING
+ * `selectRuntimeBackend`, whose own demotion reason is surfaced verbatim when
+ * the runtime falls back. `modeB` (flag-off selection) is projected to `wasm`
+ * for display. Returns `{}` when the flag is off (byte-identical predecessor).
+ */
+export function enc1bStatusFields(stateDir: string): {
+  embeddingDim?: string;
+  embeddingHeadersSet?: boolean;
+  allowRemoteEmbedder?: boolean;
+  encoderNativeOptIn?: boolean;
+  encoderBackend?: "wasm" | "native";
+  encoderDemotionReason?: string | null;
+} {
+  if (!ENC_1B_ENABLED()) return {};
+  const env = readEnc1bEnv(stateDir);
+  const platform = detectPlatform();
+  const chosen = selectRuntimeBackend({
+    platform: platform ?? "unsupported",
+    benchRecord: null,
+    nativeOptIn: env.nativeOptIn,
+  });
+  const backend: "wasm" | "native" =
+    chosen.backend === "native" ? "native" : "wasm";
+  return {
+    ...(env.dim !== null ? { embeddingDim: env.dim } : {}),
+    embeddingHeadersSet: env.headersSet,
+    allowRemoteEmbedder: env.allowRemote,
+    encoderNativeOptIn: env.nativeOptIn,
+    encoderBackend: backend,
+    encoderDemotionReason: chosen.demotionReason,
+  };
+}
+
+/** Upsert the ENC-1b keys into the per-repo `.mega-compact.env`. Creates the
+ *  file if absent; preserves every unrelated line; never deletes other keys.
+ *  A `null` entry leaves that key's line untouched. The headers value is
+ *  wrapped in single quotes so the inner JSON double quotes survive the env
+ *  loader's outer-quote strip (shell-sourceable + loader-compatible). */
+export function writeEnc1bEnv(
+  stateDir: string,
+  entries: {
+    dim?: string | null;
+    headers?: string | null;
+    allowRemote?: boolean | null;
+    nativeOptIn?: boolean | null;
+  },
+): string {
+  const p = envPath(stateDir);
+  const existingLines: string[] = existsSync(p) ? readFileSync(p, "utf8").split(/\r?\n/) : [];
+  const out: string[] = [];
+  const keys = new Set<{ key: string; present: () => boolean; push: () => void }>([
+    {
+      key: ENC_1B_EMBEDDING_DIM_ENV,
+      present: () => entries.dim !== null,
+      push: () => out.push(`export ${ENC_1B_EMBEDDING_DIM_ENV}="${entries.dim ?? ""}"`),
+    },
+    {
+      key: ENC_1B_EMBEDDING_HEADERS_ENV,
+      present: () => entries.headers !== null,
+      push: () => out.push(`export ${ENC_1B_EMBEDDING_HEADERS_ENV}='${entries.headers ?? ""}'`),
+    },
+    {
+      key: ENC_1B_ALLOW_REMOTE_EMBEDDER_ENV,
+      present: () => entries.allowRemote !== null,
+      push: () =>
+        out.push(
+          entries.allowRemote
+            ? `export ${ENC_1B_ALLOW_REMOTE_EMBEDDER_ENV}="1"`
+            : `export ${ENC_1B_ALLOW_REMOTE_EMBEDDER_ENV}="0"`,
+        ),
+    },
+    {
+      key: ENC_1B_ENCODER_NATIVE_ENV,
+      present: () => entries.nativeOptIn !== null,
+      push: () =>
+        out.push(
+          entries.nativeOptIn
+            ? `export ${ENC_1B_ENCODER_NATIVE_ENV}="1"`
+            : `export ${ENC_1B_ENCODER_NATIVE_ENV}="0"`,
+        ),
+    },
+  ]);
+  const written = new Set<string>();
+  for (const line of existingLines) {
+    let replaced = false;
+    for (const k of keys) {
+      if (k.present() && lineValue(line, k.key) !== null) {
+        k.push();
+        written.add(k.key);
+        replaced = true;
+        break;
+      }
+    }
+    if (!replaced) out.push(line);
+  }
+  for (const k of keys) {
+    if (k.present() && !written.has(k.key)) k.push();
+  }
+  mkdirSync(stateDir, { recursive: true });
+  writeFileSync(p, out.join("\n"), "utf-8");
+  return p;
+}
+
+/** Validate `embeddingDim` as a positive integer string within the ENC-1b cap.
+ *  Returns `null` when valid, else the error code. Exported so the routes host
+ *  (combined-payload path) and the aggregator share the same rule. */
+export function validateDim(value: unknown): string | null {
+  if (typeof value !== "string" || value.trim().length === 0) return "invalid_embedding_dim";
+  if (!/^\d+$/.test(value)) return "invalid_embedding_dim";
+  const n = Number(value);
+  if (!Number.isSafeInteger(n) || n < 1 || n > ENC_1B_MAX_EMBEDDING_DIM) {
+    return "invalid_embedding_dim";
+  }
+  return null;
+}
+
+/** Validate `embeddingHeaders` as a string that parses to a JSON object.
+ *  Returns `null` when valid, else the error code. Exported so the routes host
+ *  (combined-payload path) and the aggregator share the same rule. */
+export function validateHeaders(value: unknown): string | null {
+  if (typeof value !== "string" || value.trim().length === 0) return "invalid_embedding_headers";
+  let parsed: unknown;
+  try {
+    parsed = JSON.parse(value);
+  } catch {
+    return "invalid_embedding_headers";
+  }
+  if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) {
+    return "invalid_embedding_headers";
+  }
+  return null;
+}
+
+/**
+ * Combined-payload upsert: after the main embedder write has freshly written
+ * the per-repo env, append any ENC-1b keys carried alongside a valid embedder
+ * selection (flag-gated, additive). No-op when flag-off or no ENC-1b key.
+ */
+export function tryEnc1bInto(stateDir: string, body: SetupConfigureRequest): void {
+  if (!wantsEnc1b(body)) return;
+  writeEnc1bEnv(stateDir, {
+    dim: typeof body.embeddingDim === "string" ? body.embeddingDim : null,
+    headers: typeof body.embeddingHeaders === "string" ? body.embeddingHeaders : null,
+    allowRemote: typeof body.allowRemoteEmbedder === "boolean" ? body.allowRemoteEmbedder : null,
+    nativeOptIn:
+      typeof body.encoderNativeOptIn === "boolean" ? body.encoderNativeOptIn : null,
+  });
+}
+
+/**
+ * If the payload is a pure ENC-1b configure (new keys, no embedder selection),
+ * validate + write them additively to the per-repo env and reply. Returns true
+ * when it fully handled the request. On a validation failure it replies 400
+ * with the code and leaves the file byte-unchanged. Flag-off = keys are not
+ * recognized and this returns false (byte-identical ENC-1a predecessor).
+ */
+/**
+ * Combined-path validation: the standalone `tryEnc1bConfigure` handles the
+ * pure-ENC-1b shape; when a payload ALSO carries a valid embedder the sibling
+ * writer returns false and the routes host is responsible for running the same
+ * dim/headers validation before the combined upsert — returned as the error
+ * code string, or `null` if everything passes (or the flag is off).
+ */
+export function enc1bValidateCombined(body: SetupConfigureRequest): string | null {
+	if (!ENC_1B_ENABLED()) return null;
+	if (body.embeddingDim !== undefined) {
+		const e = validateDim(body.embeddingDim);
+		if (e !== null) return e;
+	}
+	if (body.embeddingHeaders !== undefined) {
+		const e = validateHeaders(body.embeddingHeaders);
+		if (e !== null) return e;
+	}
+	return null;
+}
+
+export function tryEnc1bConfigure(
+  body: SetupConfigureRequest,
+  res: ServerResponse,
+  ctx: RouteContext,
+): boolean {
+  if (!wantsEnc1b(body)) return false;
+  const embedder = body.embedder;
+  const embedderValid =
+    !!embedder &&
+    (embedder === "ollama" || embedder === "llama" || embedder === "trigram" ||
+      embedder === "custom" || embedder === "onnx");
+  if (embedderValid) return false; // combined payload — integrated after the embedder write
+  // Each key is optional: only validate the ones actually carried in the
+  // payload (absent keys are left untouched, never rejected).
+  const dimError = body.embeddingDim === undefined ? null : validateDim(body.embeddingDim);
+  if (dimError !== null) {
+    // guardrails-allow PREVENT-PI-004: loopback dashboard response (local)
+    res.writeHead(400, { "Content-Type": "application/json" });
+    res.end(JSON.stringify({ error: dimError }));
+    return true;
+  }
+  const headersError =
+    body.embeddingHeaders === undefined ? null : validateHeaders(body.embeddingHeaders);
+  if (headersError !== null) {
+    // guardrails-allow PREVENT-PI-004: loopback dashboard response (local)
+    res.writeHead(400, { "Content-Type": "application/json" });
+    res.end(JSON.stringify({ error: headersError }));
+    return true;
+  }
+  try {
+    const envPath = writeEnc1bEnv(ctx.stateDir, {
+      dim: typeof body.embeddingDim === "string" ? body.embeddingDim : null,
+      headers: typeof body.embeddingHeaders === "string" ? body.embeddingHeaders : null,
+      allowRemote: typeof body.allowRemoteEmbedder === "boolean" ? body.allowRemoteEmbedder : null,
+      nativeOptIn:
+        typeof body.encoderNativeOptIn === "boolean" ? body.encoderNativeOptIn : null,
+    });
+    const resp: SetupConfigureResponse = {
+      embedder: "custom",
+      url: null,
+      envPath,
+      restartRequired: true,
+      alreadyActive: false,
+    };
+    // guardrails-allow PREVENT-PI-004: loopback dashboard response (local)
+    res.writeHead(200, { "Content-Type": "application/json" });
+    res.end(JSON.stringify(resp));
+    return true;
+  } catch (e) {
+    res.writeHead(500, { "Content-Type": "application/json" });
+    res.end(
+      JSON.stringify({ error: `write_failed: ${e instanceof Error ? e.message : String(e)}` }),
+    );
+    return true;
+  }
+}

package/extensions/dashboard-server/routes-setup-env-upsert.ts

@@ -0,0 +1,93 @@
+/**
+ * routes-setup-env-upsert.ts — upsert-style write of the per-repo
+ * `.mega-compact.env` for the primary embedder selection.
+ *
+ * Extracted from routes-setup.ts so the route stays under the 300-line soft
+ * cap. The writer preserves every unrelated line (ENC-1a's endpoint/key,
+ * ENC-1b's dim/headers, operator comments) and replaces only the three keys
+ * this primary write owns — MEGACOMPACT_EMBEDDING_URL,
+ * MEGACOMPACT_ALLOW_REMOTE_EMBEDDER, MEGACOMPACT_MINILM. URLs already persisted
+ * by enc1a/enc1b helpers are NOT clobbered across a later native-opt-in POST
+ * (the ENC-1b defect class caught in live review).
+ */
+
+import { writeFileSync, mkdirSync, readFileSync, existsSync } from "node:fs";
+import { join } from "node:path";
+
+/** Line-prefix recognizer for an owned key (covers active, commented, and prose forms). */
+function ownsKey(line: string, key: string): boolean {
+	return (
+		line.startsWith(`export ${key}=`) ||
+		line.startsWith(`# export ${key}=`) ||
+		line.startsWith(`# ${key} `)
+	);
+}
+
+const OWNED_PREFIXES = [
+	"MEGACOMPACT_EMBEDDING_URL",
+	"MEGACOMPACT_ALLOW_REMOTE_EMBEDDER",
+	"MEGACOMPACT_MINILM",
+];
+
+const SCAFFOLD_COMMENTS = new Set([
+	"# Mega-Compact Embedder Configuration",
+	"# trigram: built-in embedder, no URL needed",
+	"# unset MEGACOMPACT_EMBEDDING_URL (commented to override any shell-set value)",
+	"# MEGACOMPACT_ALLOW_REMOTE_EMBEDDER not set (loopback-only)",
+]);
+
+function isScaffoldComment(line: string): boolean {
+	return (
+		SCAFFOLD_COMMENTS.has(line) ||
+		line.startsWith("# Configured via dashboard Setup tab at ")
+	);
+}
+
+/**
+ * Write the embedder selection upsert-style into `<stateDir>/.mega-compact.env`.
+ * `resolvedUrl === null` selects the trigram (built-in) path — the emitted
+ * lines carry only the scaffold comments for that case (the URL/remote lines
+ * are intentionally absent, matching the pre-refactor byte shape).
+ */
+export function writeEmbedderEnv(
+	stateDir: string,
+	resolvedUrl: string | null,
+	allowRemote: boolean,
+): string {
+	const envPath = join(stateDir, ".mega-compact.env");
+	const existingLines: string[] = (() => {
+		try {
+			return existsSync(envPath) ? readFileSync(envPath, "utf-8").split("\n") : [];
+		} catch {
+			return [];
+		}
+	})();
+	const preserved: string[] = existingLines.filter(
+		(l) =>
+			l.trim().length > 0 &&
+			!isScaffoldComment(l) &&
+			!OWNED_PREFIXES.some((p) => ownsKey(l, p)),
+	);
+	const next: string[] = [
+		"# Mega-Compact Embedder Configuration",
+		`# Configured via dashboard Setup tab at ${new Date().toISOString()}`,
+		...preserved,
+	];
+	if (resolvedUrl !== null) {
+		next.push(`export MEGACOMPACT_EMBEDDING_URL="${resolvedUrl}"`);
+		if (allowRemote) {
+			next.push(`export MEGACOMPACT_ALLOW_REMOTE_EMBEDDER="1"`);
+		} else {
+			next.push(`# MEGACOMPACT_ALLOW_REMOTE_EMBEDDER not set (loopback-only)`);
+		}
+	} else {
+		next.push("# trigram: built-in embedder, no URL needed");
+		next.push("# unset MEGACOMPACT_EMBEDDING_URL (commented to override any shell-set value)");
+		next.push("# export MEGACOMPACT_EMBEDDING_URL=");
+		next.push("# export MEGACOMPACT_ALLOW_REMOTE_EMBEDDER=");
+	}
+	next.push("");
+	mkdirSync(stateDir, { recursive: true });
+	writeFileSync(envPath, next.join("\n"), "utf-8");
+	return envPath;
+}

package/extensions/dashboard-server/routes-setup.ts

@@ -9,12 +9,14 @@
  * Each decoration line carries a guardrails-allow annotation.
  */
 
-import { writeFileSync, mkdirSync, readFileSync, existsSync } from "node:fs";
+import { readFileSync, existsSync } from "node:fs";
 import { join } from "node:path";
 import type { IncomingMessage, ServerResponse } from "node:http";
 import type { RouteContext } from "./routes-core.js";
 import { VC9D_ENABLED } from "../../src/config.js";
 import { enc1aStatusFields, writeEnc1aEnv, tryEnc1aConfigure, wantsEnc1a } from "./routes-setup-enc1a.js";
+import { enc1bStatusFields, tryEnc1bConfigure, tryEnc1bInto, enc1bValidateCombined } from "./routes-setup-enc1b.js";
+import { writeEmbedderEnv } from "./routes-setup-env-upsert.js";
 import {
 	detectOllama,
 	detectLlamaCpp,
@@ -91,7 +93,7 @@ export function handleSetupStatus(
 		minilm: ["1", "true", "yes"].includes(
 			(process.env["MEGACOMPACT_MINILM"] ?? "").trim().toLowerCase(),
 		),
-		...enc1aStatusFields(ctx.stateDir),
+		...enc1aStatusFields(ctx.stateDir), ...enc1bStatusFields(ctx.stateDir),
 	};
 	// guardrails-allow PREVENT-PI-004: loopback dashboard response (local)
 	res.writeHead(200, { "Content-Type": "application/json" });
@@ -215,6 +217,21 @@ export function handleSetupConfigure(
 		// Flag-off = the keys are simply not recognized, falling through to the
 		// pre-ENC-1a embedder path below (byte-identical predecessor).
 		if (tryEnc1aConfigure(body, res, ctx)) return;
+		if (tryEnc1bConfigure(body, res, ctx)) return; // pure ENC-1b configure (dim/headers/allow-remote/native)
+		// ENC-1b combined-payload validation: when a payload carries a valid
+		// embedder PLUS the ENC-1b keys, tryEnc1bConfigure above returned false
+		// (it handles only the pure-ENC-1b shape) and tryEnc1bInto below would
+		// write WITHOUT validating. Run the same dim/headers validation here so
+		// the combined path is rejected with the same 400 codes. Flag-off:
+		// enc1bValidateCombined returns null (byte-identical predecessor — the
+		// unknown keys fall through untouched).
+		const combinedError = enc1bValidateCombined(body);
+		if (combinedError !== null) {
+			// guardrails-allow PREVENT-PI-004: loopback dashboard response (local)
+			res.writeHead(400, { "Content-Type": "application/json" });
+			res.end(JSON.stringify({ error: combinedError }));
+			return;
+		}
 		const embedder = body.embedder;
 		if (embedder !== "ollama" && embedder !== "llama" && embedder !== "trigram" && embedder !== "custom" && embedder !== "onnx") {
 			res.writeHead(400, { "Content-Type": "application/json" });
@@ -239,30 +256,14 @@ export function handleSetupConfigure(
 			allowRemote = true;
 		} else resolvedUrl = null;
 
-		// Write .mega-compact.env to the state dir (loaded by env-loader at next startup).
+		// Upsert-style write of the per-repo .mega-compact.env (sibling impl):
+		// preserves ENC-1a's endpoint/key + ENC-1b's dim/headers lines and any
+		// operator comments, replacing only the three keys this primary embedder
+		// write owns (URL / ALLOW_REMOTE / MINILM).
 		const stateDir = ctx.stateDir;
-		const envPath = join(stateDir, ".mega-compact.env");
-		const lines: string[] = [
-			"# Mega-Compact Embedder Configuration",
-			`# Configured via dashboard Setup tab at ${new Date().toISOString()}`,
-		];
-		if (resolvedUrl) {
-			lines.push(`export MEGACOMPACT_EMBEDDING_URL="${resolvedUrl}"`);
-			if (allowRemote) {
-				lines.push(`export MEGACOMPACT_ALLOW_REMOTE_EMBEDDER="1"`);
-			} else {
-				lines.push(`# MEGACOMPACT_ALLOW_REMOTE_EMBEDDER not set (loopback-only)`);
-			}
-		} else {
-			lines.push("# trigram: built-in embedder, no URL needed");
-			lines.push("# unset MEGACOMPACT_EMBEDDING_URL (commented to override any shell-set value)");
-			lines.push("# export MEGACOMPACT_EMBEDDING_URL=");
-			lines.push("# export MEGACOMPACT_ALLOW_REMOTE_EMBEDDER=");
-		}
-		lines.push("");
+		let envPath: string;
 		try {
-			mkdirSync(stateDir, { recursive: true });
-			writeFileSync(envPath, lines.join("\n"), "utf-8");
+			envPath = writeEmbedderEnv(stateDir, resolvedUrl, allowRemote);
 		} catch (e) {
 			res.writeHead(500, { "Content-Type": "application/json" });
 			res.end(JSON.stringify({ error: `write_failed: ${e instanceof Error ? e.message : String(e)}` }));
@@ -279,6 +280,7 @@ export function handleSetupConfigure(
 				apiKey: typeof body.embeddingApiKey === "string" ? body.embeddingApiKey : null,
 			});
 		}
+		tryEnc1bInto(stateDir, body); // ENC-1b combined upsert (dim/headers/allow-remote/native)
 		// Detect if the new config matches what's already active (no restart needed).
 		const currentUrl = process.env["MEGACOMPACT_EMBEDDING_URL"];
 		const alreadyActive = (resolvedUrl === null && !currentUrl) || (resolvedUrl !== null && currentUrl === resolvedUrl);

package/extensions/dashboard-server/routes-vector-cortex-eval.ts

@@ -12,7 +12,7 @@
 
 import type { IncomingMessage, ServerResponse } from "node:http";
 import type { RouteContext } from "./routes-core.js";
-import { VC0A_ENABLED } from "../../src/config.js";
+import { VC0A_ENABLED, ML5D_ENABLED } from "../../src/config.js";
 import { readEvalRows } from "../../src/vector-cortex/eval/persist.js";
 import { summarizeEvalRows } from "../../src/vector-cortex/eval/reader.js";
 import { sendJson } from "./routes-vector-cortex-shared.js";
@@ -53,6 +53,9 @@ export function handleVectorCortexEvaluation(
       total: summary.histogram.total,
     },
     rejects: [], // VC0C wires live breaker/reject telemetry here
+    // ML5-D: additive, present only when the flag is enabled → the client can
+    // omit the ModelImprovementCard when off (byte-identical to ML5-C-era tab).
+    ...(ML5D_ENABLED() ? { ml5dEnabled: true } : {}),
     updatedAt: new Date().toISOString(),
     status: deriveVcStatus({ enabled, hasData: summary.samples > 0 }),
   };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pi-mega-compact",
-  "version": "0.20.50",
+  "version": "0.20.52",
   "description": "Layered, local, vector-backed context compressor for pi — supersede/collapse/cluster compaction with deduped inline recall.",
   "type": "module",
   "license": "BSD-3-Clause",