pi-mega-compact 0.20.74 → 0.20.75

package/dist/config/vector-cortex-enc2c.js

@@ -9,12 +9,15 @@
  *
  * ENC-2c turns ENC-2a's operator run-script assist into a dashboard action: the
  * Setup Cortex sub-tab gains an "Install Native ORT" button that, when confirmed
- * by the operator, runs the committed `scripts/encoder/install-native-ort.mjs`
- * subprocess locally (npm-delegated, sha256-verified) and then re-qualifies the
- * binding via the ENC-2b retest path. This is a PREVENT-PI-004 opt-in exemption:
- * it is confirm-gated (never automatic), delegated to a local subprocess of a
- * committed repo script, and carries NO URL literals in src/ or extensions/
- * (the registry URL + sha256 live only in the artifacts-module constants).
+ * by the operator, performs the pinned-tarball fetch + sha256 verify + npm
+ * install in-process (a TypeScript port of
+ * `scripts/encoder/install-native-ort.mjs` — the npm package ships
+ * src/dist/extensions but NOT scripts/, so an installed device has no checkout
+ * script to spawn), then re-qualifies the binding via the ENC-2b retest path.
+ * This is a PREVENT-PI-004 opt-in exemption: it is confirm-gated (never
+ * automatic), delegated to the operator's npm as a local subprocess, and carries
+ * NO URL literals in src/ or extensions/ (the registry URL + sha256 live only
+ * in the artifacts-module constants).
  *
  * `MEGACOMPACT_ENC_2C=0` disables: no install action branch, no UI button, no
  * install-related result fields — byte-identical to the ENC-2b predecessor. The

package/dist/extensions/dashboard-server/api-contracts/setup-cortex-native-ort.js

@@ -3,9 +3,11 @@
  * lazy-download INSTALL action contract types.
  *
  * Sibling additive types for the VC9B action driver: POST /api/setup-cortex-action
- * gains the `install-native-ort` action that, when confirmed, runs the committed
- * scripts/encoder/install-native-ort.mjs subprocess locally (npm-delegated,
- * sha256-verified) and then re-qualifies the binding via the ENC-2b retest path.
+ * gains the `install-native-ort` action that, when confirmed, performs the
+ * pinned-tarball fetch + sha256 verify + npm install in-process (a TypeScript
+ * port of scripts/encoder/install-native-ort.mjs — the npm package ships
+ * src/dist/extensions but NOT scripts/, so an installed device has no checkout
+ * script to spawn), then re-qualifies the binding via the ENC-2b retest path.
  *
  * The retest result shape mirrors `RetestResult` from
  * extensions/dashboard-server/api-contracts/setup.ts (and

package/dist/extensions/dashboard-server/routes-rag-settings-vector-cortex.js

@@ -72,7 +72,7 @@ export const VECTOR_CORTEX_SETTINGS = {
         boolDirect("MEGACOMPACT_ENC_2BUDGET", "ENC-2a operator-configurable native install-budget knob", "ENC-2a exposes the runtime operator knob MEGACOMPACT_NATIVE_ORT_BUDGET_MIB (default 300 MiB, clamp 8192) as a dashboard Settings field. The knob gates budgetOk in the encoder runtime decision (decision.ts installBudgetMib + runtime-select.ts selectRuntimeBackend). Persisted to the per-repo .mega-compact.env via the setup-configure writer branch; the GET status route surfaces the persisted value AND the effective integer installBudgetMib() resolves to (so the dashboard shows the runtime's actual operand). OFF = no new GET fields, no writer branch, no new Settings rows (byte-identical ENC-1b predecessor).", true),
         boolDirect("MEGACOMPACT_ENC_2A", "ENC-2a native onnxruntime install GUIDE (detect + copy-paste)", "ENC-2a surfaces the platform-matched native onnxruntime install-guide (three copy-paste steps + script path) on the Setup Cortex sub-tab when the operator opted into the native backend but the effective runtime is still wasm (onnxruntime-node absent). Pure guidance — the extension NEVER executes or fetches (PREVENT-PI-004 unchanged); the committed operator script scripts/encoder/install-native-ort.mjs runs in the USER's shell. OFF = no guide GET fields, no guide-request POST branch, no install card (byte-identical ENC-1b predecessor).", true),
         boolDirect("MEGACOMPACT_ENC_2B", "ENC-2b native ONNX runtime qualification retest (detect + re-qualify)", "ENC-2b re-probes and re-qualifies the installed native onnxruntime binding (onnxruntime-node in ~/.pi/mega-compact/native-ort/, operator-installed via the ENC-2a guide): loads the LOCAL on-disk binding, runs a bounded warmup + p95 probe, measures RSS, and computes a fresh qualification verdict against the ENC-0f p95 budget + the operator install-budget. Never downloads or trains (PREVENT-PI-004 / HG-1 unchanged); surfaces nativeOrtRetestResult + nativeOrtBackendEffective on the GET /api/setup-status. OFF = no retest GET fields, no retest POST branch, no retest card (byte-identical ENC-2a predecessor).", true),
-        boolDirect("MEGACOMPACT_ENC_2C", "ENC-2c native ONNX runtime lazy-download INSTALL action (dashboard-triggered)", "ENC-2c turns ENC-2a's operator run-script assist into a confirm-gated dashboard action: the Setup Cortex sub-tab gains an Install Native ORT button that, when the operator confirms, runs the committed scripts/encoder/install-native-ort.mjs subprocess locally (npm-delegated, sha256-verified) and then re-qualifies the binding via the ENC-2b retest path, exposing nativeOrtRetestResult / nativeOrtBackendEffective on the completion. PREVENT-PI-004 opt-in exemption: confirm-gated, npm-delegated, no URL literals (registry URL + sha256 live only in native-install-artifacts.ts). OFF = no install action POST branch, no UI button, no install result fields (byte-identical ENC-2b predecessor).", true),
+        boolDirect("MEGACOMPACT_ENC_2C", "ENC-2c native ONNX runtime lazy-download INSTALL action (dashboard-triggered)", "ENC-2c turns ENC-2a's operator run-script assist into a confirm-gated dashboard action: the Setup Cortex sub-tab gains an Install Native ORT button that, when the operator confirms, performs the pinned-tarball fetch + sha256 verify + npm install in-process (TypeScript port of scripts/encoder/install-native-ort.mjs — the npm package doesn't ship scripts/, so installed devices have no checkout script to spawn) and then re-qualifies the binding via the ENC-2b retest path, exposing nativeOrtRetestResult / nativeOrtBackendEffective on the completion. PREVENT-PI-004 opt-in exemption: confirm-gated, npm-delegated, no URL literals (registry URL + sha256 live only in native-install-artifacts.ts). OFF = no install action POST branch, no UI button, no install result fields (byte-identical ENC-2b predecessor).", true),
         boolDirect("MEGACOMPACT_COSINE_FP_BENCH", "COS-FP-A Synthetic FP Bench", "Synthetic FP harness + L2 cosine threshold calibration (COS-FP-A): drives the deterministic synthetic-corpus grid sweep (scripts/cosine-fp/bench.mjs) that measures L2 cosine false-positive rates and emits a recommended default, and serves the reader-only GET /api/cosine-fp-report. Synthetic-corpus-only — never reads real session/ledger bytes. OFF = bench inert, endpoint 404s, no report write, L2_COSINE plain MEGACOMPACT_L2_THRESHOLD (byte-identical predecessor).", true),
         boolDirect("MEGACOMPACT_COSINE_FP_REAL", "COS-FP-R Real-Corpus Validation", "Real-corpus L2 cosine FP validation (COS-FP-R): runs the real-corpus grid sweep (scripts/cosine-fp/real-bench.mjs) against donated, consent-approved sessions only (SECURITY_PRIVACY Lifecycle/Consent), scoring FP/FN with Wilson intervals + session-grouped bootstrap, and appends CI-backed per-content-type recommendations to the cosine-threshold report. Runs only when a valid consented corpus exists; absent corpus = no_corpus (normative pre-donation state, nothing written). OFF = script inert, nothing executes, no writes (byte-identical predecessor).", true),
         boolDirect("MEGACOMPACT_REPO_CORPUS", "Cross-Repo Corpus (REPO-A)", "Cross-repo corpus preparation (REPO-A): the governed, consent-gated reader-only path that builds a pseudonymous corpus manifest from per-repo events.log slices and serves GET /api/repo-corpus answering which pseudonymous repos/sessions are in the corpus, what cross-repo overlap exists, and whether consent is active for each — counts + IDs + status only, never payload content. Consent is append-only (consent.mjs, CLI/ops-only); revocation freezes the builder + route. OFF = builder refuses to run, reader route 404s, single-repo recall untouched (byte-identical predecessor).", true),

package/dist/extensions/dashboard-server/setup-cortex-actions-native-ort.js

@@ -5,30 +5,99 @@
  * Sibling of setup-cortex-actions.ts (which stays under the 300-line source soft
  * cap). Implements the mechanics behind the VC9B `install-native-ort` action:
  *
- *   1. locate the committed scripts/encoder/install-native-ort.mjs by walking up
- *      to the repo root (mirroring setup-cortex-actions.ts vc2ScriptDir);
- *   2. spawn `node <script>` locally with a 60s timeout (npm-delegated,
- *      sha256-verified install — the registry URL + sha256 live ONLY in
- *      src/vector-cortex/encoder/native-install-artifacts.ts, never here);
- *   3. capture output to <stateDir>/logs/vc9b/install-native-ort-<ts>.log;
- *   4. REGARDLESS of the install exit code, re-qualify the binding via the ENC-2b
- *      retest path (`runNativeRetest`) and surface the fresh result +
- *      effective backend.
+ *   1. compute the install root (`MEGACOMPACT_NATIVE_ORT_ROOT` override, else
+ *      default ~/.pi/mega-compact/native-ort);
+ *   2. detect the host platform and reject non-installable hosts (ENC-0e);
+ *   3. fetch the pinned onnxruntime-node tarball via the operator's npm and
+ *      verify its sha256 BEFORE install (the tarball never lands in the final
+ *      prefix until the pinned sha matches);
+ *   4. `npm install --prefix <root> <tarball>` from the VERIFIED local tarball;
+ *   5. write a small `.enc2a-marker.json` marker ({platform, version, sha256})
+ *      the ENC-2a version probe reads;
+ *   6. REGARDLESS of install exit code, re-qualify the binding via the ENC-2b
+ *      retest path (`runNativeRetest`) and surface the fresh result + effective
+ *      backend.
  *
  * PREVENT-PI-004 banner: this is an OPT-IN, confirm-gated, npm-delegated local
  * subprocess of a committed repo script. It performs no network I/O in this
  * module and carries NO URL literals (the codebase-wide no-URL-literal scan
  * covers src/ + extensions/).
  *
- * Guardrails: PREVENT-011 (no `any`); the subprocess is a committed local script,
- * never fetched (PREVENT-PI-004, guardrails-allow below).
+ * In-process port of scripts/encoder/install-native-ort.mjs: the npm package
+ * ships src/ + dist/ + extensions/ but NOT scripts/, so the dashboard button on
+ * an installed device has no checkout script to spawn — porting the install
+ * logic here keeps the action working independent of the checkout layout.
+ *
+ * Guardrails: PREVENT-011 (no `any`); PREVENT-PI-004 (npm-delegated local
+ * subprocess; guardrails-allow below).
  */
-import { spawnSync } from "node:child_process"; // guardrails-allow PREVENT-PI-004: opt-in, confirm-gated, npm-delegated install subprocess (local spawn of committed repo script; no URL literals)
-import { mkdirSync, writeFileSync, existsSync } from "node:fs";
+import { spawnSync } from "node:child_process"; // guardrails-allow PREVENT-PI-004: opt-in, confirm-gated, npm-delegated install subprocess (local spawn of committed npm tooling; no URL literals)
+import { createHash } from "node:crypto";
+import { mkdirSync, writeFileSync, existsSync, rmSync, readFileSync } from "node:fs";
 import { join, dirname } from "node:path";
 import { fileURLToPath } from "node:url";
 import { runNativeRetest } from "../../src/vector-cortex/encoder/native-qualify-retest.js";
-/** Locate scripts/encoder/install-native-ort.mjs by walking up to the repo root. */
+import { NATIVE_ORT_PACKAGE, NATIVE_ORT_TARBALL_SHA256, NATIVE_ORT_VERSION, NATIVE_ORT_INSTALLABLE_PLATFORMS, } from "../../src/vector-cortex/encoder/native-install-artifacts.js";
+/** Candidate install roots: `MEGACOMPACT_NATIVE_ORT_ROOT` override first
+ *  (ENC-2a parity + test isolation), else the default `~/.pi/mega-compact/
+ *  native-ort/`. */
+function nativeOrtDir() {
+    const override = process.env.MEGACOMPACT_NATIVE_ORT_ROOT;
+    if (override !== undefined && override.length > 0)
+        return override;
+    return join(process.env.HOME ?? "", ".pi", "mega-compact", "native-ort");
+}
+/** Resolve the host to an installable EncoderPlatform string. darwin-x64 is
+ *  UNSUPPORTED (no native binding upstream — arm64-only since 1.17) and
+ *  unknown platforms also fail → the caller surfaces a clear failure. */
+function hostPlatform() {
+    const plat = process.platform === "win32"
+        ? "win32"
+        : process.platform === "darwin"
+            ? "darwin"
+            : process.platform === "linux"
+                ? "linux"
+                : "";
+    const arch = process.arch === "x64" ? "x64" : process.arch === "arm64" ? "arm64" : "";
+    const candidate = `${plat}-${arch}`;
+    if (candidate === "darwin-x64")
+        return null; // no native binding upstream
+    if (!NATIVE_ORT_INSTALLABLE_PLATFORMS.includes(candidate))
+        return null;
+    return candidate;
+}
+/** sha256 digest of a file on disk. Local FS read (loopback). */
+function sha256File(path) {
+    // guardrails-allow PREVENT-PI-004: local file hash (loopback)
+    return createHash("sha256").update(readFileSync(path)).digest("hex");
+}
+/** Write the small `.enc2a-marker.json` marker the ENC-2a version probe reads. */
+function writeMarker(root, platform) {
+    const marker = {
+        platform,
+        version: NATIVE_ORT_VERSION,
+        installedAt: new Date().toISOString(),
+        sha256: NATIVE_ORT_TARBALL_SHA256,
+    };
+    // guardrails-allow PREVENT-PI-004: local marker write (loopback)
+    writeFileSync(join(root, ".enc2a-marker.json"), JSON.stringify(marker, null, 2) + "\n", "utf8");
+}
+/** Ensure the vc9b log dir exists (mirrors setup-cortex-actions.ts). */
+function ensureLogDir(stateDir) {
+    const dir = join(stateDir, "logs", "vc9b");
+    // guardrails-allow PREVENT-PI-004: local state-dir filesystem write (loopback)
+    mkdirSync(dir, { recursive: true });
+    return dir;
+}
+function writeLog(logPath, body) {
+    // guardrails-allow PREVENT-PI-004: local state-dir filesystem write (loopback)
+    writeFileSync(logPath, body, "utf8");
+}
+/** The original committed-install-script path lookup, kept for the unit test
+ *  that proves the committed scripts/encoder/install-native-ort.mjs lives on
+ *  disk in a checkout. The install action itself no longer spawns that script
+ *  (in-process port), but the suite would otherwise need to lose that
+ *  verification. */
 export function installScriptPath() {
     let dir = dirname(fileURLToPath(import.meta.url));
     const rel = join("scripts", "encoder", "install-native-ort.mjs");
@@ -44,60 +113,118 @@ export function installScriptPath() {
     }
     return null;
 }
-/** Ensure the vc9b log dir exists (mirrors setup-cortex-actions.ts). */
-function ensureLogDir(stateDir) {
-    const dir = join(stateDir, "logs", "vc9b");
-    // guardrails-allow PREVENT-PI-004: local state-dir filesystem write (loopback)
-    mkdirSync(dir, { recursive: true });
-    return dir;
-}
-function writeLog(logPath, body) {
-    // guardrails-allow PREVENT-PI-004: local state-dir filesystem write (loopback)
-    writeFileSync(logPath, body, "utf8");
-}
 /**
- * Run the ENC-2c lazy-download native onnxruntime INSTALL action. Locates and
- * spawns the committed install script (npm-delegated, sha256-verified), logs the
- * captured output, then ALWAYS runs the ENC-2b retest to re-qualify the binding
- * (regardless of install exit code) and surfaces the fresh result.
+ * Run the ENC-2c lazy-download native onnxruntime INSTALL action. Fetches the
+ * pinned tarball via the operator's npm, verifies its sha256, installs into
+ * `nativeOrtDir()`, then ALWAYS runs the ENC-2b retest to re-qualify the
+ * binding and surfacing the fresh result.
  *
- * Never throws: a missing script or non-zero exit is surfaced as ok=false on the
- * result; the retest runs even on install failure so the operator sees the
- * post-install qualification state. Returns a combined SetupCortexActionResult
- * with the ENC-2c additive fields (present only for pendant actions).
+ * Never throws: every failure (host platform, npm failure, hash mismatch)
+ * surfaces as ok=false on the result; the retest runs even on install failure
+ * so the operator sees the post-install qualification state. Returns a
+ * combined SetupCortexActionResult with the ENC-2c additive fields (present
+ * only for pendant actions).
  */
-// guardrails-allow PREVENT-PI-004: opt-in, confirm-gated, npm-delegated install action (subprocess of committed repo script; no URL literals)
+// guardrails-allow PREVENT-PI-004: opt-in, confirm-gated, npm-delegated install action (subprocess of committed npm tooling; no URL literals)
 export async function runInstallNativeOrt(stateDir) {
     const ts = Date.now();
     const logName = `install-native-ort-${ts}.log`;
     const logPath = join(ensureLogDir(stateDir), logName);
-    const scriptPath = installScriptPath();
-    if (scriptPath === null) {
-        writeLog(logPath, "install-native-ort.mjs not found in this checkout\n");
+    const root = nativeOrtDir();
+    const platform = hostPlatform();
+    if (platform === null) {
+        writeLog(logPath, "install-native-ort: host platform has no native binding\n");
         return {
             action: "install-native-ort",
             ok: false,
             exitCode: null,
             logPath,
             logName,
+            spawned: false,
+        };
+    }
+    // Step 1: derive the tarball URL + fetch the tarball via the operator's npm.
+    // (The tarball never lands in the final prefix until the pinned sha matches.)
+    mkdirSync(root, { recursive: true });
+    const packedName = `${NATIVE_ORT_PACKAGE}-${NATIVE_ORT_VERSION}.tgz`;
+    const packedPath = join(root, packedName);
+    let out = "";
+    const run = (argv) => {
+        const res = spawnSync("npm", argv, { encoding: "utf8", timeout: 60_000 });
+        out += [res.stdout, res.stderr].filter(Boolean).join("\n") + "\n";
+        return { code: res.status ?? 1, stdio: out };
+    };
+    // npm pack <pkg>@<ver> --pack-destination <root>
+    // guardrails-allow PREVENT-PI-004: npm-delegated tarball fetch (opt-in
+    // confirm-gated install action; package@version come from the committed
+    // artifacts module, never a literal URL).
+    const pack = run([
+        "pack",
+        `${NATIVE_ORT_PACKAGE}@${NATIVE_ORT_VERSION}`,
+        "--pack-destination",
+        root,
+    ]);
+    if (pack.code !== 0 || !existsSync(packedPath)) {
+        writeLog(logPath, `${out}npm pack failed — could not download tarball\n`);
+        const retest = await runNativeRetest(stateDir);
+        return {
+            action: "install-native-ort",
+            ok: false,
+            exitCode: pack.code,
+            logPath,
+            logName,
+            spawned: true,
+            nativeOrtRetestResult: retest,
+            nativeOrtBackendEffective: retest !== null && retest.verdict === "qualified" ? "native" : "wasm",
+        };
+    }
+    // Step 2: verify sha256 BEFORE install.
+    const actual = sha256File(packedPath);
+    if (actual !== NATIVE_ORT_TARBALL_SHA256) {
+        writeLog(logPath, `${out}sha256 mismatch — expected ${NATIVE_ORT_TARBALL_SHA256}, got ${actual}\n`);
+        // guardrails-allow PREVENT-PI-004: removing a tarball we just wrote (local FS)
+        rmSync(packedPath, { force: true });
+        const retest = await runNativeRetest(stateDir);
+        return {
+            action: "install-native-ort",
+            ok: false,
+            exitCode: 1,
+            logPath,
+            logName,
+            spawned: true,
+            nativeOrtRetestResult: retest,
+            nativeOrtBackendEffective: retest !== null && retest.verdict === "qualified" ? "native" : "wasm",
+        };
+    }
+    // Step 3: install from the VERIFIED local tarball (npm install --prefix).
+    // guardrails-allow PREVENT-PI-004: npm-delegated install from a local tarball
+    // (opt-in confirm-gated install action).
+    const install = run(["install", "--prefix", root, packedPath]);
+    // guardrails-allow PREVENT-PI-004: removing the local tarball after install
+    rmSync(packedPath, { force: true });
+    const installedPkg = join(root, "node_modules", NATIVE_ORT_PACKAGE, "package.json");
+    if (install.code !== 0 || !existsSync(installedPkg)) {
+        writeLog(logPath, `${out}npm install from verified tarball failed\n`);
+        const retest = await runNativeRetest(stateDir);
+        return {
+            action: "install-native-ort",
+            ok: false,
+            exitCode: install.code,
+            logPath,
+            logName,
             spawned: true,
+            nativeOrtRetestResult: retest,
+            nativeOrtBackendEffective: retest !== null && retest.verdict === "qualified" ? "native" : "wasm",
         };
     }
-    // guardrails-allow PREVENT-PI-004: opt-in, confirm-gated, npm-delegated
-    // install subprocess (local spawn of committed repo script; no URL literals)
-    const result = spawnSync(process.execPath, [scriptPath], {
-        encoding: "utf8",
-        timeout: 60_000,
-    });
-    const out = `${result.stdout ?? ""}${result.stderr ?? ""}`;
-    writeLog(logPath, out || "(no output)\n");
-    // Re-qualify AFTER install regardless of exit code (the retest is the source of
-    // truth for whether the binding is actually usable).
+    // Step 4: success — write the marker, log, then retest.
+    writeMarker(root, platform);
+    writeLog(logPath, `${out}installed ${NATIVE_ORT_PACKAGE}@${NATIVE_ORT_VERSION} (${platform}); sha256 verified + marker written.\n`);
     const retest = await runNativeRetest(stateDir);
     return {
         action: "install-native-ort",
-        ok: result.status === 0,
-        exitCode: result.status === null ? null : result.status,
+        ok: true,
+        exitCode: install.code,
         logPath,
         logName,
         spawned: true,

package/dist/src/config/vector-cortex-enc2c.js

@@ -9,12 +9,15 @@
  *
  * ENC-2c turns ENC-2a's operator run-script assist into a dashboard action: the
  * Setup Cortex sub-tab gains an "Install Native ORT" button that, when confirmed
- * by the operator, runs the committed `scripts/encoder/install-native-ort.mjs`
- * subprocess locally (npm-delegated, sha256-verified) and then re-qualifies the
- * binding via the ENC-2b retest path. This is a PREVENT-PI-004 opt-in exemption:
- * it is confirm-gated (never automatic), delegated to a local subprocess of a
- * committed repo script, and carries NO URL literals in src/ or extensions/
- * (the registry URL + sha256 live only in the artifacts-module constants).
+ * by the operator, performs the pinned-tarball fetch + sha256 verify + npm
+ * install in-process (a TypeScript port of
+ * `scripts/encoder/install-native-ort.mjs` — the npm package ships
+ * src/dist/extensions but NOT scripts/, so an installed device has no checkout
+ * script to spawn), then re-qualifies the binding via the ENC-2b retest path.
+ * This is a PREVENT-PI-004 opt-in exemption: it is confirm-gated (never
+ * automatic), delegated to the operator's npm as a local subprocess, and carries
+ * NO URL literals in src/ or extensions/ (the registry URL + sha256 live only
+ * in the artifacts-module constants).
  *
  * `MEGACOMPACT_ENC_2C=0` disables: no install action branch, no UI button, no
  * install-related result fields — byte-identical to the ENC-2b predecessor. The

package/dist/src/vector-cortex/encoder/native-qualify-retest.js

@@ -37,12 +37,16 @@ import { detectPlatform } from "./asset.js";
 import { NATIVE_ORT_PACKAGE } from "./native-install-artifacts.js";
 /** Candidate ONNX runtime native-ort prefixes. The ENC-2a guide installs to
  *  the global `~/.pi/mega-compact/native-ort/`; `stateDir` (per-repo) is a
- *  secondary probe root so the retest resolves either install location. */
+ *  secondary probe root so the retest resolves either install location.
+ *  `MEGACOMPACT_NATIVE_ORT_ROOT` overrides the global root (ENC-2a parity +
+ *  test isolation — honors the same override the enc2a probe and the ENC-2c
+ *  in-process installer honor). */
 function nativeOrtRootCandidates(stateDir) {
-    return [
-        join(process.env.HOME ?? "", ".pi", "mega-compact", "native-ort"),
-        join(stateDir, "native-ort"),
-    ];
+    const override = process.env.MEGACOMPACT_NATIVE_ORT_ROOT;
+    const global = override !== undefined && override.length > 0
+        ? override
+        : join(process.env.HOME ?? "", ".pi", "mega-compact", "native-ort");
+    return [global, join(stateDir, "native-ort")];
 }
 /** A single bounded inference pass on the fixed 512-token synthetic input;
  *  returns latency ms, or null when the session cannot run (caller reports

package/dist/src/vector-cortex/setup-cortex-blockers-compute.js

@@ -200,9 +200,11 @@ const ACTION_GATE_CANDIDATES = {
     // behavior change. HG-7 is training work (no action in this set).
     bench: ["HG-1", "HG-3", "HG-6"],
     "verify-asset": [],
-    // ENC-2c: installing the lazy-download native binding is gated by HG-3 (the
-    // open install-budget hard gate) — a closed HG-3 no longer blocks the install.
-    "install-native-ort": ["HG-3"],
+    // install-native-ort is NEVER gated by HG-3: the action's entire purpose is
+    // to install the binding that closes HG-3. Gating it would deadlock — you
+    // can't install the binding that closes the gate because the gate blocks the
+    // install. HG-3 closes when the install succeeds (the probe detects it).
+    "install-native-ort": [],
 };
 /**
  * Re-derived VC9B action gating from the LIVE computed blockers. An action is

package/dist/vector-cortex/encoder/native-qualify-retest.js

@@ -37,12 +37,16 @@ import { detectPlatform } from "./asset.js";
 import { NATIVE_ORT_PACKAGE } from "./native-install-artifacts.js";
 /** Candidate ONNX runtime native-ort prefixes. The ENC-2a guide installs to
  *  the global `~/.pi/mega-compact/native-ort/`; `stateDir` (per-repo) is a
- *  secondary probe root so the retest resolves either install location. */
+ *  secondary probe root so the retest resolves either install location.
+ *  `MEGACOMPACT_NATIVE_ORT_ROOT` overrides the global root (ENC-2a parity +
+ *  test isolation — honors the same override the enc2a probe and the ENC-2c
+ *  in-process installer honor). */
 function nativeOrtRootCandidates(stateDir) {
-    return [
-        join(process.env.HOME ?? "", ".pi", "mega-compact", "native-ort"),
-        join(stateDir, "native-ort"),
-    ];
+    const override = process.env.MEGACOMPACT_NATIVE_ORT_ROOT;
+    const global = override !== undefined && override.length > 0
+        ? override
+        : join(process.env.HOME ?? "", ".pi", "mega-compact", "native-ort");
+    return [global, join(stateDir, "native-ort")];
 }
 /** A single bounded inference pass on the fixed 512-token synthetic input;
  *  returns latency ms, or null when the session cannot run (caller reports

package/dist/vector-cortex/setup-cortex-blockers-compute.js

@@ -200,9 +200,11 @@ const ACTION_GATE_CANDIDATES = {
     // behavior change. HG-7 is training work (no action in this set).
     bench: ["HG-1", "HG-3", "HG-6"],
     "verify-asset": [],
-    // ENC-2c: installing the lazy-download native binding is gated by HG-3 (the
-    // open install-budget hard gate) — a closed HG-3 no longer blocks the install.
-    "install-native-ort": ["HG-3"],
+    // install-native-ort is NEVER gated by HG-3: the action's entire purpose is
+    // to install the binding that closes HG-3. Gating it would deadlock — you
+    // can't install the binding that closes the gate because the gate blocks the
+    // install. HG-3 closes when the install succeeds (the probe detects it).
+    "install-native-ort": [],
 };
 /**
  * Re-derived VC9B action gating from the LIVE computed blockers. An action is

package/extensions/dashboard-server/api-contracts/setup-cortex-native-ort.ts

@@ -3,9 +3,11 @@
  * lazy-download INSTALL action contract types.
  *
  * Sibling additive types for the VC9B action driver: POST /api/setup-cortex-action
- * gains the `install-native-ort` action that, when confirmed, runs the committed
- * scripts/encoder/install-native-ort.mjs subprocess locally (npm-delegated,
- * sha256-verified) and then re-qualifies the binding via the ENC-2b retest path.
+ * gains the `install-native-ort` action that, when confirmed, performs the
+ * pinned-tarball fetch + sha256 verify + npm install in-process (a TypeScript
+ * port of scripts/encoder/install-native-ort.mjs — the npm package ships
+ * src/dist/extensions but NOT scripts/, so an installed device has no checkout
+ * script to spawn), then re-qualifies the binding via the ENC-2b retest path.
  *
  * The retest result shape mirrors `RetestResult` from
  * extensions/dashboard-server/api-contracts/setup.ts (and

package/extensions/dashboard-server/routes-rag-settings-vector-cortex.ts

@@ -329,7 +329,7 @@ export const VECTOR_CORTEX_SETTINGS: SettingGroup = {
 		boolDirect(
 			"MEGACOMPACT_ENC_2C",
 			"ENC-2c native ONNX runtime lazy-download INSTALL action (dashboard-triggered)",
-			"ENC-2c turns ENC-2a's operator run-script assist into a confirm-gated dashboard action: the Setup Cortex sub-tab gains an Install Native ORT button that, when the operator confirms, runs the committed scripts/encoder/install-native-ort.mjs subprocess locally (npm-delegated, sha256-verified) and then re-qualifies the binding via the ENC-2b retest path, exposing nativeOrtRetestResult / nativeOrtBackendEffective on the completion. PREVENT-PI-004 opt-in exemption: confirm-gated, npm-delegated, no URL literals (registry URL + sha256 live only in native-install-artifacts.ts). OFF = no install action POST branch, no UI button, no install result fields (byte-identical ENC-2b predecessor).",
+			"ENC-2c turns ENC-2a's operator run-script assist into a confirm-gated dashboard action: the Setup Cortex sub-tab gains an Install Native ORT button that, when the operator confirms, performs the pinned-tarball fetch + sha256 verify + npm install in-process (TypeScript port of scripts/encoder/install-native-ort.mjs — the npm package doesn't ship scripts/, so installed devices have no checkout script to spawn) and then re-qualifies the binding via the ENC-2b retest path, exposing nativeOrtRetestResult / nativeOrtBackendEffective on the completion. PREVENT-PI-004 opt-in exemption: confirm-gated, npm-delegated, no URL literals (registry URL + sha256 live only in native-install-artifacts.ts). OFF = no install action POST branch, no UI button, no install result fields (byte-identical ENC-2b predecessor).",
 			true,
 		),
 		boolDirect(

package/extensions/dashboard-server/setup-cortex-actions-native-ort.ts

@@ -5,48 +5,99 @@
  * Sibling of setup-cortex-actions.ts (which stays under the 300-line source soft
  * cap). Implements the mechanics behind the VC9B `install-native-ort` action:
  *
- *   1. locate the committed scripts/encoder/install-native-ort.mjs by walking up
- *      to the repo root (mirroring setup-cortex-actions.ts vc2ScriptDir);
- *   2. spawn `node <script>` locally with a 60s timeout (npm-delegated,
- *      sha256-verified install — the registry URL + sha256 live ONLY in
- *      src/vector-cortex/encoder/native-install-artifacts.ts, never here);
- *   3. capture output to <stateDir>/logs/vc9b/install-native-ort-<ts>.log;
- *   4. REGARDLESS of the install exit code, re-qualify the binding via the ENC-2b
- *      retest path (`runNativeRetest`) and surface the fresh result +
- *      effective backend.
+ *   1. compute the install root (`MEGACOMPACT_NATIVE_ORT_ROOT` override, else
+ *      default ~/.pi/mega-compact/native-ort);
+ *   2. detect the host platform and reject non-installable hosts (ENC-0e);
+ *   3. fetch the pinned onnxruntime-node tarball via the operator's npm and
+ *      verify its sha256 BEFORE install (the tarball never lands in the final
+ *      prefix until the pinned sha matches);
+ *   4. `npm install --prefix <root> <tarball>` from the VERIFIED local tarball;
+ *   5. write a small `.enc2a-marker.json` marker ({platform, version, sha256})
+ *      the ENC-2a version probe reads;
+ *   6. REGARDLESS of install exit code, re-qualify the binding via the ENC-2b
+ *      retest path (`runNativeRetest`) and surface the fresh result + effective
+ *      backend.
  *
  * PREVENT-PI-004 banner: this is an OPT-IN, confirm-gated, npm-delegated local
  * subprocess of a committed repo script. It performs no network I/O in this
  * module and carries NO URL literals (the codebase-wide no-URL-literal scan
  * covers src/ + extensions/).
  *
- * Guardrails: PREVENT-011 (no `any`); the subprocess is a committed local script,
- * never fetched (PREVENT-PI-004, guardrails-allow below).
+ * In-process port of scripts/encoder/install-native-ort.mjs: the npm package
+ * ships src/ + dist/ + extensions/ but NOT scripts/, so the dashboard button on
+ * an installed device has no checkout script to spawn — porting the install
+ * logic here keeps the action working independent of the checkout layout.
+ *
+ * Guardrails: PREVENT-011 (no `any`); PREVENT-PI-004 (npm-delegated local
+ * subprocess; guardrails-allow below).
  */
 
-import { spawnSync } from "node:child_process"; // guardrails-allow PREVENT-PI-004: opt-in, confirm-gated, npm-delegated install subprocess (local spawn of committed repo script; no URL literals)
-import { mkdirSync, writeFileSync, existsSync } from "node:fs";
+import { spawnSync } from "node:child_process"; // guardrails-allow PREVENT-PI-004: opt-in, confirm-gated, npm-delegated install subprocess (local spawn of committed npm tooling; no URL literals)
+import { createHash } from "node:crypto";
+import { mkdirSync, writeFileSync, existsSync, rmSync, readFileSync } from "node:fs";
 import { join, dirname } from "node:path";
 import { fileURLToPath } from "node:url";
 import { runNativeRetest } from "../../src/vector-cortex/encoder/native-qualify-retest.js";
+import {
+  NATIVE_ORT_PACKAGE,
+  NATIVE_ORT_TARBALL_SHA256,
+  NATIVE_ORT_VERSION,
+  NATIVE_ORT_INSTALLABLE_PLATFORMS,
+  type EncoderPlatform,
+} from "../../src/vector-cortex/encoder/native-install-artifacts.js";
 import type {
   SetupCortexActionResultWithNativeOrt,
   NativeOrtRetestResult,
 } from "./api-contracts/setup-cortex-native-ort.js";
 
-/** Locate scripts/encoder/install-native-ort.mjs by walking up to the repo root. */
-export function installScriptPath(): string | null {
-  let dir = dirname(fileURLToPath(import.meta.url));
-  const rel = join("scripts", "encoder", "install-native-ort.mjs");
-  for (let i = 0; i < 8; i++) {
-    const candidate = join(dir, rel);
-    // guardrails-allow PREVENT-PI-004: local repo filesystem read (loopback)
-    if (existsSync(candidate)) return candidate;
-    const next = dirname(dir);
-    if (next === dir) break;
-    dir = next;
-  }
-  return null;
+/** Candidate install roots: `MEGACOMPACT_NATIVE_ORT_ROOT` override first
+ *  (ENC-2a parity + test isolation), else the default `~/.pi/mega-compact/
+ *  native-ort/`. */
+function nativeOrtDir(): string {
+  const override = process.env.MEGACOMPACT_NATIVE_ORT_ROOT;
+  if (override !== undefined && override.length > 0) return override;
+  return join(process.env.HOME ?? "", ".pi", "mega-compact", "native-ort");
+}
+
+/** Resolve the host to an installable EncoderPlatform string. darwin-x64 is
+ *  UNSUPPORTED (no native binding upstream — arm64-only since 1.17) and
+ *  unknown platforms also fail → the caller surfaces a clear failure. */
+function hostPlatform(): EncoderPlatform | null {
+  const plat =
+    process.platform === "win32"
+      ? "win32"
+      : process.platform === "darwin"
+        ? "darwin"
+        : process.platform === "linux"
+          ? "linux"
+          : "";
+  const arch = process.arch === "x64" ? "x64" : process.arch === "arm64" ? "arm64" : "";
+  const candidate = `${plat}-${arch}` as EncoderPlatform;
+  if (candidate === "darwin-x64") return null; // no native binding upstream
+  if (!NATIVE_ORT_INSTALLABLE_PLATFORMS.includes(candidate)) return null;
+  return candidate;
+}
+
+/** sha256 digest of a file on disk. Local FS read (loopback). */
+function sha256File(path: string): string {
+  // guardrails-allow PREVENT-PI-004: local file hash (loopback)
+  return createHash("sha256").update(readFileSync(path)).digest("hex");
+}
+
+/** Write the small `.enc2a-marker.json` marker the ENC-2a version probe reads. */
+function writeMarker(root: string, platform: EncoderPlatform): void {
+  const marker = {
+    platform,
+    version: NATIVE_ORT_VERSION,
+    installedAt: new Date().toISOString(),
+    sha256: NATIVE_ORT_TARBALL_SHA256,
+  };
+  // guardrails-allow PREVENT-PI-004: local marker write (loopback)
+  writeFileSync(
+    join(root, ".enc2a-marker.json"),
+    JSON.stringify(marker, null, 2) + "\n",
+    "utf8",
+  );
 }
 
 /** Ensure the vc9b log dir exists (mirrors setup-cortex-actions.ts). */
@@ -62,18 +113,38 @@ function writeLog(logPath: string, body: string): void {
   writeFileSync(logPath, body, "utf8");
 }
 
+/** The original committed-install-script path lookup, kept for the unit test
+ *  that proves the committed scripts/encoder/install-native-ort.mjs lives on
+ *  disk in a checkout. The install action itself no longer spawns that script
+ *  (in-process port), but the suite would otherwise need to lose that
+ *  verification. */
+export function installScriptPath(): string | null {
+  let dir = dirname(fileURLToPath(import.meta.url));
+  const rel = join("scripts", "encoder", "install-native-ort.mjs");
+  for (let i = 0; i < 8; i++) {
+    const candidate = join(dir, rel);
+    // guardrails-allow PREVENT-PI-004: local repo filesystem read (loopback)
+    if (existsSync(candidate)) return candidate;
+    const next = dirname(dir);
+    if (next === dir) break;
+    dir = next;
+  }
+  return null;
+}
+
 /**
- * Run the ENC-2c lazy-download native onnxruntime INSTALL action. Locates and
- * spawns the committed install script (npm-delegated, sha256-verified), logs the
- * captured output, then ALWAYS runs the ENC-2b retest to re-qualify the binding
- * (regardless of install exit code) and surfaces the fresh result.
+ * Run the ENC-2c lazy-download native onnxruntime INSTALL action. Fetches the
+ * pinned tarball via the operator's npm, verifies its sha256, installs into
+ * `nativeOrtDir()`, then ALWAYS runs the ENC-2b retest to re-qualify the
+ * binding and surfacing the fresh result.
  *
- * Never throws: a missing script or non-zero exit is surfaced as ok=false on the
- * result; the retest runs even on install failure so the operator sees the
- * post-install qualification state. Returns a combined SetupCortexActionResult
- * with the ENC-2c additive fields (present only for pendant actions).
+ * Never throws: every failure (host platform, npm failure, hash mismatch)
+ * surfaces as ok=false on the result; the retest runs even on install failure
+ * so the operator sees the post-install qualification state. Returns a
+ * combined SetupCortexActionResult with the ENC-2c additive fields (present
+ * only for pendant actions).
  */
-// guardrails-allow PREVENT-PI-004: opt-in, confirm-gated, npm-delegated install action (subprocess of committed repo script; no URL literals)
+// guardrails-allow PREVENT-PI-004: opt-in, confirm-gated, npm-delegated install action (subprocess of committed npm tooling; no URL literals)
 export async function runInstallNativeOrt(
   stateDir: string,
 ): Promise<SetupCortexActionResultWithNativeOrt> {
@@ -81,41 +152,122 @@ export async function runInstallNativeOrt(
   const logName = `install-native-ort-${ts}.log`;
   const logPath = join(ensureLogDir(stateDir), logName);
 
-  const scriptPath = installScriptPath();
-  if (scriptPath === null) {
-    writeLog(logPath, "install-native-ort.mjs not found in this checkout\n");
+  const root = nativeOrtDir();
+  const platform = hostPlatform();
+  if (platform === null) {
+    writeLog(logPath, "install-native-ort: host platform has no native binding\n");
     return {
       action: "install-native-ort",
       ok: false,
       exitCode: null,
       logPath,
       logName,
+      spawned: false,
+    };
+  }
+
+  // Step 1: derive the tarball URL + fetch the tarball via the operator's npm.
+  // (The tarball never lands in the final prefix until the pinned sha matches.)
+  mkdirSync(root, { recursive: true });
+  const packedName = `${NATIVE_ORT_PACKAGE}-${NATIVE_ORT_VERSION}.tgz`;
+  const packedPath = join(root, packedName);
+  let out = "";
+  const run = (argv: readonly string[]): { code: number; stdio: string } => {
+    const res = spawnSync("npm", argv, { encoding: "utf8", timeout: 60_000 });
+    out += [res.stdout, res.stderr].filter(Boolean).join("\n") + "\n";
+    return { code: res.status ?? 1, stdio: out };
+  };
+
+  // npm pack <pkg>@<ver> --pack-destination <root>
+  // guardrails-allow PREVENT-PI-004: npm-delegated tarball fetch (opt-in
+  // confirm-gated install action; package@version come from the committed
+  // artifacts module, never a literal URL).
+  const pack = run([
+    "pack",
+    `${NATIVE_ORT_PACKAGE}@${NATIVE_ORT_VERSION}`,
+    "--pack-destination",
+    root,
+  ]);
+  if (pack.code !== 0 || !existsSync(packedPath)) {
+    writeLog(logPath, `${out}npm pack failed — could not download tarball\n`);
+    const retest: NativeOrtRetestResult | null = await runNativeRetest(stateDir);
+    return {
+      action: "install-native-ort",
+      ok: false,
+      exitCode: pack.code,
+      logPath,
+      logName,
       spawned: true,
+      nativeOrtRetestResult: retest,
+      nativeOrtBackendEffective:
+        retest !== null && retest.verdict === "qualified" ? "native" : "wasm",
     };
   }
 
-  // guardrails-allow PREVENT-PI-004: opt-in, confirm-gated, npm-delegated
-  // install subprocess (local spawn of committed repo script; no URL literals)
-  const result = spawnSync(process.execPath, [scriptPath], {
-    encoding: "utf8",
-    timeout: 60_000,
-  });
+  // Step 2: verify sha256 BEFORE install.
+  const actual = sha256File(packedPath);
+  if (actual !== NATIVE_ORT_TARBALL_SHA256) {
+    writeLog(
+      logPath,
+      `${out}sha256 mismatch — expected ${NATIVE_ORT_TARBALL_SHA256}, got ${actual}\n`,
+    );
+    // guardrails-allow PREVENT-PI-004: removing a tarball we just wrote (local FS)
+    rmSync(packedPath, { force: true });
+    const retest: NativeOrtRetestResult | null = await runNativeRetest(stateDir);
+    return {
+      action: "install-native-ort",
+      ok: false,
+      exitCode: 1,
+      logPath,
+      logName,
+      spawned: true,
+      nativeOrtRetestResult: retest,
+      nativeOrtBackendEffective:
+        retest !== null && retest.verdict === "qualified" ? "native" : "wasm",
+    };
+  }
 
-  const out = `${result.stdout ?? ""}${result.stderr ?? ""}`;
-  writeLog(logPath, out || "(no output)\n");
+  // Step 3: install from the VERIFIED local tarball (npm install --prefix).
+  // guardrails-allow PREVENT-PI-004: npm-delegated install from a local tarball
+  // (opt-in confirm-gated install action).
+  const install = run(["install", "--prefix", root, packedPath]);
+  // guardrails-allow PREVENT-PI-004: removing the local tarball after install
+  rmSync(packedPath, { force: true });
 
-  // Re-qualify AFTER install regardless of exit code (the retest is the source of
-  // truth for whether the binding is actually usable).
+  const installedPkg = join(root, "node_modules", NATIVE_ORT_PACKAGE, "package.json");
+  if (install.code !== 0 || !existsSync(installedPkg)) {
+    writeLog(logPath, `${out}npm install from verified tarball failed\n`);
+    const retest: NativeOrtRetestResult | null = await runNativeRetest(stateDir);
+    return {
+      action: "install-native-ort",
+      ok: false,
+      exitCode: install.code,
+      logPath,
+      logName,
+      spawned: true,
+      nativeOrtRetestResult: retest,
+      nativeOrtBackendEffective:
+        retest !== null && retest.verdict === "qualified" ? "native" : "wasm",
+    };
+  }
+
+  // Step 4: success — write the marker, log, then retest.
+  writeMarker(root, platform);
+  writeLog(
+    logPath,
+    `${out}installed ${NATIVE_ORT_PACKAGE}@${NATIVE_ORT_VERSION} (${platform}); sha256 verified + marker written.\n`,
+  );
   const retest: NativeOrtRetestResult | null = await runNativeRetest(stateDir);
 
   return {
     action: "install-native-ort",
-    ok: result.status === 0,
-    exitCode: result.status === null ? null : result.status,
+    ok: true,
+    exitCode: install.code,
     logPath,
     logName,
     spawned: true,
     nativeOrtRetestResult: retest,
-    nativeOrtBackendEffective: retest !== null && retest.verdict === "qualified" ? "native" : "wasm",
+    nativeOrtBackendEffective:
+      retest !== null && retest.verdict === "qualified" ? "native" : "wasm",
   };
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pi-mega-compact",
-  "version": "0.20.74",
+  "version": "0.20.75",
   "description": "Layered, local, vector-backed context compressor for pi — supersede/collapse/cluster compaction with deduped inline recall.",
   "type": "module",
   "license": "BSD-3-Clause",

package/src/config/vector-cortex-enc2c.ts

@@ -9,12 +9,15 @@
  *
  * ENC-2c turns ENC-2a's operator run-script assist into a dashboard action: the
  * Setup Cortex sub-tab gains an "Install Native ORT" button that, when confirmed
- * by the operator, runs the committed `scripts/encoder/install-native-ort.mjs`
- * subprocess locally (npm-delegated, sha256-verified) and then re-qualifies the
- * binding via the ENC-2b retest path. This is a PREVENT-PI-004 opt-in exemption:
- * it is confirm-gated (never automatic), delegated to a local subprocess of a
- * committed repo script, and carries NO URL literals in src/ or extensions/
- * (the registry URL + sha256 live only in the artifacts-module constants).
+ * by the operator, performs the pinned-tarball fetch + sha256 verify + npm
+ * install in-process (a TypeScript port of
+ * `scripts/encoder/install-native-ort.mjs` — the npm package ships
+ * src/dist/extensions but NOT scripts/, so an installed device has no checkout
+ * script to spawn), then re-qualifies the binding via the ENC-2b retest path.
+ * This is a PREVENT-PI-004 opt-in exemption: it is confirm-gated (never
+ * automatic), delegated to the operator's npm as a local subprocess, and carries
+ * NO URL literals in src/ or extensions/ (the registry URL + sha256 live only
+ * in the artifacts-module constants).
  *
  * `MEGACOMPACT_ENC_2C=0` disables: no install action branch, no UI button, no
  * install-related result fields — byte-identical to the ENC-2b predecessor. The

package/src/vector-cortex/encoder/native-qualify-retest.ts

@@ -39,12 +39,16 @@ import { NATIVE_ORT_PACKAGE, type EncoderPlatform } from "./native-install-artif
 
 /** Candidate ONNX runtime native-ort prefixes. The ENC-2a guide installs to
  *  the global `~/.pi/mega-compact/native-ort/`; `stateDir` (per-repo) is a
- *  secondary probe root so the retest resolves either install location. */
+ *  secondary probe root so the retest resolves either install location.
+ *  `MEGACOMPACT_NATIVE_ORT_ROOT` overrides the global root (ENC-2a parity +
+ *  test isolation — honors the same override the enc2a probe and the ENC-2c
+ *  in-process installer honor). */
 function nativeOrtRootCandidates(stateDir: string): string[] {
-  return [
-    join(process.env.HOME ?? "", ".pi", "mega-compact", "native-ort"),
-    join(stateDir, "native-ort"),
-  ];
+  const override = process.env.MEGACOMPACT_NATIVE_ORT_ROOT;
+  const global = override !== undefined && override.length > 0
+    ? override
+    : join(process.env.HOME ?? "", ".pi", "mega-compact", "native-ort");
+  return [global, join(stateDir, "native-ort")];
 }
 
 /** A single bounded inference pass on the fixed 512-token synthetic input;

package/src/vector-cortex/setup-cortex-blockers-compute.ts

@@ -261,9 +261,11 @@ const ACTION_GATE_CANDIDATES: Readonly<Record<SetupCortexActionKind, readonly st
   // behavior change. HG-7 is training work (no action in this set).
   bench: ["HG-1", "HG-3", "HG-6"],
   "verify-asset": [],
-  // ENC-2c: installing the lazy-download native binding is gated by HG-3 (the
-  // open install-budget hard gate) — a closed HG-3 no longer blocks the install.
-  "install-native-ort": ["HG-3"],
+  // install-native-ort is NEVER gated by HG-3: the action's entire purpose is
+  // to install the binding that closes HG-3. Gating it would deadlock — you
+  // can't install the binding that closes the gate because the gate blocks the
+  // install. HG-3 closes when the install succeeds (the probe detects it).
+  "install-native-ort": [],
 };
 
 /**