pi-mega-compact 0.20.76 → 0.20.78

package/dist/config/vector-cortex-vc9b.js

@@ -20,9 +20,10 @@ import { sprintFlag } from "./vector-cortex-flag.js";
  * GET /api/setup-cortex-action-log). Default ON. `MEGACOMPACT_VC9B=0` disables
  * and is byte-identical to the predecessor (VC9A-era): the action POST returns
  * the disabled shape (404/disabled) and flag-off bytes are unchanged. The
- * actions only spawn the existing committed local scripts
- * (scripts/vc2-model-prep/fetch-model.sh / bench-onnx.mjs) or re-read the
- * committed encoder assets — never payload bytes, no network (PREVENT-PI-004).
+ * actions run in-process: fetch-model downloads via HTTPS (opt-in, confirm-gated)
+ * and bench runs ONNX inference directly — no subprocess spawns. verify-asset
+ * re-reads the committed encoder assets; install-native-ort uses the npm-delegated
+ * install (PREVENT-PI-004 opt-in). Never payload bytes.
  * This flag MUST also be a dashboard SETTINGS toggle (visible in config UI,
  * never in EXCLUDED_SETTINGS), mirroring VC9A.
  */

package/dist/extensions/dashboard-server/api-contracts/endpoints/registry-ext.js

@@ -39,7 +39,7 @@ export const EXTRA_ENDPOINTS = {
     setupCortexAction: {
         method: "POST",
         path: "/api/setup-cortex-action",
-        description: "Confirmation-gated driver: fetch-model / bench / verify-asset. Executes only the committed local scripts (scripts/vc2-model-prep/*) or re-reads the committed encoder assets; an OPEN hard-gate item returns action_blocked_by_open_item and does NOT spawn. Never payload bytes; confirm:true required.",
+        description: "Confirmation-gated driver: fetch-model / bench / verify-asset. Runs in-process model fetch (HTTPS) + ONNX bench or re-reads the committed encoder assets; an OPEN hard-gate item returns action_blocked_by_open_item and does NOT execute. Never payload bytes; confirm:true required.",
     },
     /** GET /api/setup-cortex-action-log — bounded, redacted action log tail. */
     setupCortexActionLog: {

package/dist/extensions/dashboard-server/routes-rag-settings-vector-cortex.js

@@ -49,7 +49,7 @@ export const VECTOR_CORTEX_SETTINGS = {
         boolDirect("MEGACOMPACT_VC8B", "VC8B Shadow Adaptive Policy", "Bounded shadow adaptive policy + M7 pressure-v2 migration. Policy actions are from a finite set (admit/dampen/defer/escalate/reject) chosen deterministically by the canonical pressure level; token budgets are clamped into a configured window after the pressure factor. Unknown pressure labels are rejected as POL_PRESSURE_UNKNOWN, never coerced to a neighbour. The shadow engine is structurally incapable of affecting the live path: inputs are deep-copied, the canonical prompt digest is pinned before and after to prove non-mutation, and liveMutations is always zero. M7 migrates legacy pressure labels to the v2 canonical five by copy/validate/switch; an unknown label blocks the switch and keeps the legacy pointer (M7_PRESSURE_UNKNOWN). A shadow decision is mode A, static calibrated policy is mode B (forced by invalid A), and fixed legacy thresholds is mode C (forced by M7 or B failure). OFF = byte-identical predecessor (VC8A); the policy/shadow/migration arithmetic still runs, only the reporter + dashboard seam is suppressed.", true),
         boolDirect("MEGACOMPACT_VC8C", "VC8C Canary Platform + Rust Parity", "Canary selection and external Rust parity. The selector admits a qualified external Rust artifact only when ABI version, URL metadata, commit, Cargo.lock digest, and platform all match evidence; a Cargo.lock digest mismatch rejects the artifact (RUST_CARGO_DIGEST_MISMATCH). The cross-conformance runner exchanges length-framed neutral records over a local stdin/stdout channel — a subprocess, never a URL (PREVENT-PI-004). A parity mismatch selects TS mode B. A qualified external artifact is mode A, TS reference is mode B, legacy path is mode C. OFF = byte-identical predecessor (VC8B); the selector and cross-conformance arithmetic still run, only the reporter + dashboard seam is suppressed.", true),
         boolDirect("MEGACOMPACT_VC9A", "VC9A Setup Cortex Status", "Reader-only Setup Cortex status read path (GET /api/setup-cortex-status): surfaces the vector-cortex encoder gate — mode A/B/C, qualification verdict, open blockers, encoder health — to the dashboard Setup tab without closing the ML gate. OFF = byte-identical predecessor (VC8C-era): returns enabled:false / mode:C / status:off.", true),
-        boolDirect("MEGACOMPACT_VC9B", "VC9B Setup Cortex Actions", "Setup Cortex action drivers (POST /api/setup-cortex-action + GET /api/setup-cortex-action-log): confirmation-gated wrappers that fetch-model / bench / verify-asset by spawning only the committed local scripts (scripts/vc2-model-prep/fetch-model.sh, bench-onnx.mjs) or re-reading the committed encoder assets — never payload bytes, no network. Actions gated by an OPEN hard-gate item (HG-1/HG-3) return action_blocked_by_open_item and do NOT spawn. OFF = byte-identical predecessor (VC9A-era): the action POST returns a disabled/404 shape and flag-off bytes are unchanged.", true),
+        boolDirect("MEGACOMPACT_VC9B", "VC9B Setup Cortex Actions", "Setup Cortex action drivers (POST /api/setup-cortex-action + GET /api/setup-cortex-action-log): confirmation-gated wrappers that fetch-model / bench / verify-asset using in-process model fetch (HTTPS download from HuggingFace) and in-process ONNX bench — never payload bytes. Actions gated by an OPEN hard-gate item (HG-1/HG-3) return action_blocked_by_open_item and do NOT execute. OFF = byte-identical predecessor (VC9A-era): the action POST returns a disabled/404 shape and flag-off bytes are unchanged.", true),
         boolDirect("MEGACOMPACT_VC9C", "VC9C SetupTab Cortex Sub-tab", "SetupTab Cortex sub-tab (client UI): a Cortex sub-tab inside SetupTab that consumes the VC9A status endpoint (GET /api/setup-cortex-status) + the VC9B action endpoints. It surfaces the encoder mode A/B/C, asset digest prefix, qualification verdict + threshold failures, the open hard-gate blockers, and the confirmation-gated fetch/bench/verify actions. OFF = byte-identical predecessor (VC9B-era): the Cortex sub-tab is filtered from SUB_TABS and the Setup tab renders exactly as before.", true),
         boolDirect("MEGACOMPACT_VC9D", "VC9D Embedder Detect Consolidation", "Embedder-detect consolidation + VC9 workstream roll-up: memoizes /api/setup-detect against the mutable input (resolved binary path + mtime) so consecutive requests reuse the result without re-spawning, and unifies the embedder + cortex sub-tabs' 5s poll contract. OFF = byte-identical predecessor (VC9C-era): detect spawns fresh per request and the embedder poll keeps its previous cadence.", true),
         boolDirect("MEGACOMPACT_PC_C", "PC-C Dashboard Cache Visibility", "Dashboard per-turn prompt-cache visibility: surfaces the per-turn stable-prefix ratio trend (GET /api/prefix-stability) in the CacheTab PrefixStabilityCard. Reads aggregate ratios/counts from the local monitoring events log only — no payload bytes. OFF = byte-identical predecessor (PC-B-era): /api/prefix-stability returns 404 and the CacheTab omits the PrefixStabilityCard.", true),

package/dist/extensions/dashboard-server/routes-setup-cortex-actions.js

@@ -5,12 +5,13 @@
  *   GET  /api/setup-cortex-action-log        — bounded, redacted log tail
  *
  * Reader/actor-only: NEVER exposes payload bytes, prompts, or ledger. Actions
- * only spawn the committed local vc2-model-prep scripts, re-read the committed
+ * run in-process (fetch-model via HTTPS, bench via ONNX), re-read the committed
  * encoder assets (verify-asset), or — ENC-2c — run the confirm-gated npm-delegated
- * native onnxruntime install (install-native-ort) + re-qualify — no network in
- * this layer (PREVENT-PI-004). A hard gate (HG-1/HG-3) blocking the requested
- * action yields 423 action_blocked_by_open_item with the blocker ids and NO
- * subprocess is spawned. Missing confirm:true yields 400 confirmation_required.
+ * native onnxruntime install (install-native-ort) + re-qualify — no subprocess
+ * spawn for fetch-model/bench (PREVENT-PI-004 opt-in for fetch-model HTTPS).
+ * A hard gate (HG-1/HG-3) blocking the requested
+ * action yields 423 action_blocked_by_open_item with the blocker ids and the
+ * action does NOT execute. Missing confirm:true yields 400 confirmation_required.
  * Flag-off (MEGACOMPACT_VC9B=0) is byte-identical to the VC9A-era predecessor:
  * the routes are absent, so they return the 404 disabled shape and no action runs.
  *

package/dist/extensions/dashboard-server/setup-cortex-actions-vc2.js

@@ -0,0 +1,334 @@
+/**
+ * dashboard-server/setup-cortex-actions-vc2.ts — VC2 model-prep action driver
+ * (fetch-model + bench), ported in-process.
+ *
+ * Sibling of setup-cortex-actions.ts (the vc9b actor surface). Implements the
+ * mechanics behind the VC9B `fetch-model` and `bench` actions, replacing the
+ * previous spawn-of-scripts approach: the npm package's `files` allowlist does
+ * NOT include scripts/, so scripts/vc2-model-prep/* is absent on installed
+ * devices and the spawn path 500s with "not found in this checkout".
+ *
+ * fetch-model: downloads the candidate encoder (model.onnx + tokenizer.json)
+ * from HuggingFace via node:https and verifies sha256 against pinned digests.
+ * PREVENT-PI-004 opt-in: user-triggered, confirm-gated download of ML model
+ * assets from HuggingFace (same exemption class as install-native-ort).
+ *
+ * bench: loads onnxruntime-node via createRequire, runs warm-up + timed
+ * inference iterations, computes p50/p95/p99 latency, samples RSS, and runs a
+ * determinism check (identical outputs within 1e-6 across repeats).
+ *
+ * Never throws: every failure is returned as { ok: false, ... } with a log.
+ * Guardrails: PREVENT-011 (no `any`); PREVENT-PI-004 (guardrails-allow below).
+ */
+// guardrails-allow PREVENT-PI-004: opt-in, confirm-gated download of ML model
+// assets from HuggingFace (user-triggered from dashboard)
+import { get as httpsGet } from "node:https";
+import { createHash } from "node:crypto";
+import { createRequire } from "node:module";
+import { mkdirSync, writeFileSync, existsSync, statSync, rmSync, } from "node:fs";
+import { join, dirname } from "node:path";
+import { fileURLToPath } from "node:url";
+import { writeLogName, writeLog } from "./setup-cortex-actions.js";
+// ─── fetch-model constants ─────────────────────────────────────────────────
+const HF_BASE = 
+// guardrails-allow PREVENT-PI-004: opt-in, confirm-gated download of ML model
+// assets from HuggingFace (user-triggered from dashboard)
+"https://huggingface.co/sentence-transformers/all-MiniLM-L6-v2/resolve/main";
+const MODEL_URL = `${HF_BASE}/onnx/model_qint8_avx512_vnni.onnx`;
+const TOKENIZER_URL = `${HF_BASE}/tokenizer.json`;
+const MODEL_SHA256 = "4278337fd0ff3c68bfb6291042cad8ab363e1d9fbc43dcb499fe91c871902474";
+const TOKENIZER_SHA256 = "be50c3628f2bf5bb5e3a7f17b1f74611b2561a3a27eeab05e5aa30f411572037";
+// ─── bench constants ───────────────────────────────────────────────────────
+const LATENCY_BUDGET_MS = 40;
+const RSS_BUDGET_MIB = 150;
+const DETERMINISM_EPSILON = 1e-6;
+const BENCH_TOKENS = 512;
+const BENCH_ITERS = 300;
+const BENCH_THREADS = 4;
+const BENCH_REPEATS = 200;
+// ─── shared helpers ────────────────────────────────────────────────────────
+function sha256Hex(buf) {
+    return createHash("sha256").update(buf).digest("hex");
+}
+function mib(bytes) {
+    return +(bytes / 1048576).toFixed(1);
+}
+function percentile(sorted, p) {
+    const i = Math.min(sorted.length - 1, Math.floor(sorted.length * p));
+    return +sorted[i].toFixed(2);
+}
+// ─── fetch helpers ─────────────────────────────────────────────────────────
+/** Download a URL to a Buffer via node:https (follows one redirect). */
+function download(url) {
+    return new Promise((resolve, reject) => {
+        // guardrails-allow PREVENT-PI-004: opt-in, confirm-gated download of ML
+        // model assets from HuggingFace (user-triggered from dashboard)
+        httpsGet(url, (res) => {
+            if (res.statusCode !== undefined &&
+                res.statusCode >= 300 &&
+                res.statusCode < 400 &&
+                res.headers.location) {
+                res.resume();
+                // Follow a single redirect (HuggingFace CDN redirects). The Location
+                // header may be a RELATIVE path (e.g. /api/resolve-cache/...) — resolve
+                // it against the original URL so httpsGet never receives a bare path.
+                const redirected = new URL(res.headers.location, url).toString();
+                download(redirected).then(resolve, reject);
+                return;
+            }
+            if (res.statusCode !== 200) {
+                res.resume();
+                reject(new Error(`HTTP ${res.statusCode} for ${url}`));
+                return;
+            }
+            const chunks = [];
+            res.on("data", (chunk) => chunks.push(chunk));
+            res.on("end", () => resolve(Buffer.concat(chunks)));
+            res.on("error", reject);
+        }).on("error", reject);
+    });
+}
+/** Fetch one asset: download, verify sha256, write to disk. */
+async function fetchAsset(url, outPath, wantSha, logLines) {
+    const label = outPath.split("/").pop() ?? outPath;
+    logLines.push(`fetching ${label}`);
+    let buf;
+    try {
+        buf = await download(url);
+    }
+    catch (err) {
+        const msg = err instanceof Error ? err.message : String(err);
+        logLines.push(`FAIL download ${label}: ${msg}`);
+        return false;
+    }
+    const got = sha256Hex(buf);
+    if (got !== wantSha) {
+        logLines.push(`DIGEST MISMATCH for ${label}`);
+        logLines.push(`  expected: ${wantSha}`);
+        logLines.push(`  actual:   ${got}`);
+        return false;
+    }
+    // guardrails-allow PREVENT-PI-004: local state-dir filesystem write (loopback)
+    writeFileSync(outPath, buf);
+    logLines.push(`  ok  sha256=${got}  bytes=${buf.length}`);
+    return true;
+}
+// ─── fetch-model implementation ────────────────────────────────────────────
+async function runFetchModel(stateDir) {
+    const action = "fetch-model";
+    const { name, logPath } = writeLogName(action, stateDir);
+    const outdir = join(stateDir, "vc2-model-prep");
+    // guardrails-allow PREVENT-PI-004: local state-dir filesystem write (loopback)
+    mkdirSync(outdir, { recursive: true });
+    const logLines = [];
+    let ok = true;
+    // Model
+    const modelPath = join(outdir, "model.onnx");
+    if (!(await fetchAsset(MODEL_URL, modelPath, MODEL_SHA256, logLines))) {
+        ok = false;
+        // Clean up partial download
+        // guardrails-allow PREVENT-PI-004: removing file we just wrote (local FS)
+        rmSync(modelPath, { force: true });
+    }
+    // Tokenizer
+    const tokPath = join(outdir, "tokenizer.json");
+    if (!(await fetchAsset(TOKENIZER_URL, tokPath, TOKENIZER_SHA256, logLines))) {
+        ok = false;
+        // guardrails-allow PREVENT-PI-004: removing file we just wrote (local FS)
+        rmSync(tokPath, { force: true });
+    }
+    logLines.push("");
+    logLines.push(`Staged in ${outdir}.`);
+    logLines.push("NOTE: this export is opset 14, NOT the opset 17 required by MODEL_ASSET.md.");
+    logLines.push("See docs/vector-cortex/vc2-model-prep.md (Opset gap) before committing.");
+    writeLog(logPath, logLines.join("\n") + "\n");
+    return {
+        action,
+        ok,
+        exitCode: ok ? 0 : 1,
+        logPath,
+        logName: name,
+        spawned: false,
+    };
+}
+// ─── bench implementation ──────────────────────────────────────────────────
+/** Locate model.onnx: stateDir first, then walk up from module for dev. */
+function findModelPath(stateDir) {
+    // Check stateDir first (installed-device path).
+    const fromState = join(stateDir, "vc2-model-prep", "model.onnx");
+    // guardrails-allow PREVENT-PI-004: local state-dir filesystem read (loopback)
+    if (existsSync(fromState))
+        return fromState;
+    // Walk up from module for repo-checkout dev mode.
+    let dir = dirname(fileURLToPath(import.meta.url));
+    const rel = join("scripts", "vc2-model-prep", "model.onnx");
+    for (let i = 0; i < 8; i++) {
+        const candidate = join(dir, rel);
+        // guardrails-allow PREVENT-PI-004: local repo filesystem read (loopback)
+        if (existsSync(candidate))
+            return candidate;
+        const next = dirname(dir);
+        if (next === dir)
+            break;
+        dir = next;
+    }
+    return null;
+}
+/** Run the ONNX bench: latency + RSS + determinism gates. */
+async function runBench(stateDir) {
+    const action = "bench";
+    const { name, logPath } = writeLogName(action, stateDir);
+    const logLines = [];
+    const modelPath = findModelPath(stateDir);
+    if (modelPath === null) {
+        logLines.push("bench: model.onnx not found (run fetch-model first)");
+        writeLog(logPath, logLines.join("\n") + "\n");
+        return { action, ok: false, exitCode: 2, logPath, logName: name, spawned: false };
+    }
+    // Load onnxruntime-node via createRequire — the binding may be at the
+    // ENC-2a native-ort root or in the package's node_modules.
+    let ort;
+    try {
+        const req = createRequire(import.meta.url);
+        ort = req("onnxruntime-node");
+    }
+    catch {
+        logLines.push("onnxruntime-node is not installed. See docs/vector-cortex/vc2-model-prep.md.");
+        writeLog(logPath, logLines.join("\n") + "\n");
+        return { action, ok: false, exitCode: 2, logPath, logName: name, spawned: false };
+    }
+    const tokens = BENCH_TOKENS;
+    const iters = BENCH_ITERS;
+    const threads = BENCH_THREADS;
+    const repeats = BENCH_REPEATS;
+    const rssBefore = process.memoryUsage().rss;
+    const loadStart = Date.now();
+    const session = await ort.InferenceSession.create(modelPath, {
+        executionProviders: ["cpu"],
+        intraOpNumThreads: threads,
+        graphOptimizationLevel: "all",
+    });
+    const loadMs = Date.now() - loadStart;
+    const dims = [1, tokens];
+    const ids = BigInt64Array.from({ length: tokens }, (_, i) => BigInt(i === 0 ? 101 : i === tokens - 1 ? 102 : 2000 + (i % 500)));
+    const mask = BigInt64Array.from({ length: tokens }, () => 1n);
+    const types = new BigInt64Array(tokens);
+    const feeds = () => {
+        const f = {};
+        if (session.inputNames.includes("input_ids"))
+            f.input_ids = new ort.Tensor("int64", ids, dims);
+        if (session.inputNames.includes("attention_mask"))
+            f.attention_mask = new ort.Tensor("int64", mask, dims);
+        if (session.inputNames.includes("token_type_ids"))
+            f.token_type_ids = new ort.Tensor("int64", types, dims);
+        return f;
+    };
+    // Warm-up
+    for (let i = 0; i < 5; i++)
+        await session.run(feeds());
+    // Latency measurement — do NOT retain outputs (measures working set, not GC).
+    const lat = [];
+    for (let i = 0; i < iters; i++) {
+        const t = process.hrtime.bigint();
+        await session.run(feeds());
+        lat.push(Number(process.hrtime.bigint() - t) / 1e6);
+    }
+    // GC + steady-state RSS
+    let gcRan = false;
+    if (typeof global.gc === "function") {
+        global.gc();
+        global.gc();
+        await new Promise((r) => setTimeout(r, 200));
+        global.gc();
+        gcRan = true;
+    }
+    else {
+        logLines.push("WARNING: global.gc not available (run under node --expose-gc);" +
+            " RSS figure is unreliable without it.");
+    }
+    const steadyRss = mib(process.memoryUsage().rss - rssBefore);
+    lat.sort((a, b) => a - b);
+    // Determinism: identical inputs must yield bit-stable outputs.
+    let ref = null;
+    let maxDelta = 0;
+    const digests = new Set();
+    for (let i = 0; i < repeats; i++) {
+        const out = (await session.run(feeds()));
+        const d = out[session.outputNames[0]].data;
+        digests.add(createHash("sha256")
+            .update(Buffer.from(d.buffer, d.byteOffset, d.byteLength))
+            .digest("hex"));
+        if (!ref)
+            ref = Float32Array.from(d);
+        else
+            for (let k = 0; k < d.length; k++) {
+                const delta = Math.abs(d[k] - ref[k]);
+                if (delta > maxDelta)
+                    maxDelta = delta;
+            }
+    }
+    const p95 = percentile(lat, 0.95);
+    const report = {
+        model: modelPath,
+        // guardrails-allow PREVENT-PI-004: local file stat (loopback)
+        modelBytes: statSync(modelPath).size,
+        backend: "onnxruntime-node",
+        ortVersion: (() => {
+            try {
+                return createRequire(import.meta.url)("onnxruntime-node/package.json").version;
+            }
+            catch {
+                return "unknown";
+            }
+        })(),
+        platform: `${process.platform}-${process.arch}`,
+        threads,
+        tokens,
+        iters,
+        loadMs,
+        p50: percentile(lat, 0.5),
+        p95,
+        p99: percentile(lat, 0.99),
+        steadyRssMiB: steadyRss,
+        gcRan,
+        determinism: {
+            repeats,
+            distinctDigests: digests.size,
+            maxAbsDelta: maxDelta,
+        },
+        gates: {
+            latency: p95 <= LATENCY_BUDGET_MS,
+            rss: steadyRss <= RSS_BUDGET_MIB,
+            determinism: digests.size === 1 && maxDelta <= DETERMINISM_EPSILON,
+        },
+    };
+    const allPass = report.gates.latency && report.gates.rss && report.gates.determinism;
+    logLines.push(JSON.stringify({ ...report, gates: { ...report.gates, all: allPass } }, null, 2));
+    writeLog(logPath, logLines.join("\n") + "\n");
+    return {
+        action,
+        ok: allPass,
+        exitCode: allPass ? 0 : 1,
+        logPath,
+        logName: name,
+        spawned: false,
+    };
+}
+// ─── public entry point ────────────────────────────────────────────────────
+/**
+ * Run one VC2 model-prep action (fetch-model or bench) in-process.
+ * Never throws — every failure surfaces as { ok: false, ... } with a log.
+ */
+export async function runVc2Action(action, stateDir) {
+    try {
+        if (action === "fetch-model")
+            return await runFetchModel(stateDir);
+        return await runBench(stateDir);
+    }
+    catch (err) {
+        const msg = err instanceof Error ? err.message : String(err);
+        const { name, logPath } = writeLogName(action, stateDir);
+        writeLog(logPath, `${action} failed: ${msg}\n`);
+        return { action, ok: false, exitCode: 1, logPath, logName: name, spawned: false };
+    }
+}

package/dist/extensions/dashboard-server/setup-cortex-actions.js

@@ -2,23 +2,19 @@
  * dashboard-server/setup-cortex-actions.ts — VC9B action driver (actor surface).
  *
  * Implements the actual mechanics behind POST /api/setup-cortex-action and
- * GET /api/setup-cortex-action-log: locating + spawning ONLY the committed local
- * vc2-model-prep scripts (fetch-model.sh, bench-onnx.mjs), capturing their
- * output to <stateDir>/logs/vc9b/<action>-<ts>.log, re-running the committed
- * encoder asset verification seam for verify-asset (NO subprocess), and serving
- * a bounded + redacted log tail. ENC-2c adds the `install-native-ort` action,
- * delegated to the sibling setup-cortex-actions-native-ort.ts (the confirm-gated,
- * npm-delegated local install + ENC-2b re-qualification).
+ * GET /api/setup-cortex-action-log: in-process HTTPS download for fetch-model
+ * and in-process ONNX bench (delegated to setup-cortex-actions-vc2.ts), re-running
+ * the committed encoder asset verification seam for verify-asset (NO subprocess),
+ * and serving a bounded + redacted log tail. ENC-2c adds the `install-native-ort`
+ * action, delegated to the sibling setup-cortex-actions-native-ort.ts (the
+ * confirm-gated, npm-delegated local install + ENC-2b re-qualification).
  *
  * This module is the ONLY place that touches the filesystem for VC9B actions.
  * The route file (routes-setup-cortex-actions.ts) carries NO path/script/blocker
- * string literals — it delegates here. Guardrails: the spawned scripts are the
- * existing committed local developer-tooling scripts (never fetched, no network,
- * PREVENT-PI-004); the log tail is bounded at 8 KiB and redacted (digest
- * prefixes + codes only, never payload bytes — EVAL-REDACT-002); PREVENT-011
- * (no `any`).
+ * string literals — it delegates here. Guardrails: the log tail is bounded at
+ * 8 KiB and redacted (digest prefixes + codes only, never payload bytes —
+ * EVAL-REDACT-002); PREVENT-011 (no `any`).
  */
-import { spawnSync } from "node:child_process"; // guardrails-allow PREVENT-PI-004: local subprocess spawn of committed repo script (loopback)
 import { mkdirSync, readFileSync, writeFileSync, existsSync, readdirSync, } from "node:fs";
 import { join, dirname, basename } from "node:path";
 import { fileURLToPath } from "node:url";
@@ -26,23 +22,9 @@ import { readEncoderManifest, verifyEncoderAsset, detectPlatform, } from "../../
 import { ENC_0G_ENABLED, ENC_0F_ENABLED } from "../../src/config.js";
 import { readQualificationRecord, encoderStateDir, } from "./qualification-record.js";
 import { runInstallNativeOrt } from "./setup-cortex-actions-native-ort.js";
+import { runVc2Action } from "./setup-cortex-actions-vc2.js";
 /** Cap applied to every log tail served by the action-log route. */
 export const ACTION_LOG_TAIL_BYTES = 8192;
-/** Locate the commit's vc2-model-prep directory by walking up to the repo root. */
-function vc2ScriptDir() {
-    let dir = dirname(fileURLToPath(import.meta.url));
-    const rel = join("scripts", "vc2-model-prep");
-    for (let i = 0; i < 8; i++) {
-        const candidate = join(dir, rel);
-        if (existsSync(join(candidate, "fetch-model.sh")))
-            return candidate;
-        const next = dirname(dir);
-        if (next === dir)
-            break;
-        dir = next;
-    }
-    return null;
-}
 /** Absolute dir holding this repo's <stateDir>/logs/vc9b/ action logs. */
 export function vc9bLogDir(stateDir) {
     return join(stateDir, "logs", "vc9b");
@@ -105,40 +87,6 @@ export function readActionLogTail(stateDir, name) {
         complete: raw.length <= ACTION_LOG_TAIL_BYTES,
     };
 }
-/** Run a vc2-model-prep subprocess and capture its output to a vc9b log file. */
-function runSpawnedAction(action, stateDir) {
-    const dir = vc2ScriptDir();
-    const { name, logPath } = writeLogName(action, stateDir);
-    if (dir === null) {
-        writeLog(logPath, "vc2-model-prep scripts not found in this checkout\n");
-        return { action, ok: false, exitCode: null, logPath, logName: name, spawned: true };
-    }
-    let result;
-    if (action === "fetch-model") {
-        // guardrails-allow PREVENT-PI-004: local subprocess spawn of committed repo script (loopback)
-        result = spawnSync("bash", [join(dir, "fetch-model.sh"), join(stateDir, "vc2-model-prep")], {
-            encoding: "utf8",
-            timeout: 60_000,
-        });
-    }
-    else {
-        // guardrails-allow PREVENT-PI-004: local subprocess spawn of committed repo script (loopback)
-        result = spawnSync(process.execPath, [join(dir, "bench-onnx.mjs")], {
-            encoding: "utf8",
-            timeout: 60_000,
-        });
-    }
-    const out = `${result.stdout ?? ""}${result.stderr ?? ""}`;
-    writeLog(logPath, out || "(no output)\n");
-    return {
-        action,
-        ok: result.status === 0,
-        exitCode: result.status === null ? null : result.status,
-        logPath,
-        logName: name,
-        spawned: true,
-    };
-}
 /**
  * Re-run the committed encoder asset verification seam (readEncoderManifest +
  * verifyEncoderAsset + detectPlatform) WITHOUT any subprocess, and log a
@@ -208,7 +156,7 @@ function encoderAssetDir() {
     return null;
 }
 /** Unique <action>-<ts>.log name + absolute path under the vc9b log dir. */
-function writeLogName(action, stateDir) {
+export function writeLogName(action, stateDir) {
     let ts = Date.now();
     const existing = new Set(readdirSync(ensureLogDir(stateDir)));
     while (existing.has(`${action}-${ts}.log`))
@@ -216,22 +164,23 @@ function writeLogName(action, stateDir) {
     const name = `${action}-${ts}.log`;
     return { name, logPath: join(vc9bLogDir(stateDir), name) };
 }
-function writeLog(logPath, body) {
+/** Write a vc9b action log file. Exported for the VC2 sibling. */
+export function writeLog(logPath, body) {
     // guardrails-allow PREVENT-PI-004: local state-dir filesystem write (loopback)
     writeFileSync(logPath, body, "utf8");
 }
 /**
  * Run one Setup Cortex action against the given stateDir. Returns the action
  * result on success; throws nothing — every failure is surfaced as a result with
- * ok=false so the route can shape the HTTP response. Never touches the network;
- * the subprocesses it may spawn are the committed local vc2-model-prep scripts.
- * Async (ENC-2c): install-native-ort runs the npm-delegated local install then
- * re-qualifies via the ENC-2b retest path.
+ * ok=false so the route can shape the HTTP response. fetch-model/bench run
+ * in-process via the VC2 sibling (HTTPS download + ONNX bench); install-native-ort
+ * (ENC-2c) runs the npm-delegated local install then re-qualifies via the ENC-2b
+ * retest path.
  */
 export async function runSetupCortexAction(action, stateDir) {
     if (action === "verify-asset")
         return runVerifyAsset(stateDir);
     if (action === "install-native-ort")
         return runInstallNativeOrt(stateDir);
-    return runSpawnedAction(action, stateDir);
+    return runVc2Action(action, stateDir);
 }

package/dist/src/config/vector-cortex-vc9b.js

@@ -20,9 +20,10 @@ import { sprintFlag } from "./vector-cortex-flag.js";
  * GET /api/setup-cortex-action-log). Default ON. `MEGACOMPACT_VC9B=0` disables
  * and is byte-identical to the predecessor (VC9A-era): the action POST returns
  * the disabled shape (404/disabled) and flag-off bytes are unchanged. The
- * actions only spawn the existing committed local scripts
- * (scripts/vc2-model-prep/fetch-model.sh / bench-onnx.mjs) or re-read the
- * committed encoder assets — never payload bytes, no network (PREVENT-PI-004).
+ * actions run in-process: fetch-model downloads via HTTPS (opt-in, confirm-gated)
+ * and bench runs ONNX inference directly — no subprocess spawns. verify-asset
+ * re-reads the committed encoder assets; install-native-ort uses the npm-delegated
+ * install (PREVENT-PI-004 opt-in). Never payload bytes.
  * This flag MUST also be a dashboard SETTINGS toggle (visible in config UI,
  * never in EXCLUDED_SETTINGS), mirroring VC9A.
  */

package/extensions/dashboard-client/dist/assets/{AdminTab-B8JqsA41.js → AdminTab-BsA8-_bX.js}

@@ -1,2 +1,2 @@
-import{r as s,u as o,e as c,j as e}from"./index-CL6Af_JZ.js";import{T as i}from"./toggle-DHbWo-CW.js";import r from"./MaintenanceTab-CS5HqDkY.js";import{C as l}from"./ConfigTab-CbsdI5yj.js";import"./card-Dvl16_R5.js";import"./button-D-9nb4Bw.js";import"./switch-0MNUTR9I.js";const f="MEGACOMPACT_DASH_0C";function m(n){if(!n)return!1;for(const t of n.categories)for(const a of t.settings)if(a.key===f&&a.type==="boolean")return a.value===!0;return!1}function h(){const[n,t]=s.useState("maintenance"),{data:a}=o(s.useCallback(()=>c(),[]),{pollInterval:0,maxRetries:0});return m(a)?e.jsxs("div",{className:"flex flex-col gap-4",children:[e.jsxs("div",{className:"flex items-center gap-2",role:"tablist","aria-label":"Admin views",children:[e.jsx(i,{pressed:n==="maintenance",onClick:()=>t("maintenance"),children:"Maintenance"}),e.jsx(i,{pressed:n==="config",onClick:()=>t("config"),children:"Config"})]}),n==="maintenance"?e.jsx(r,{}):e.jsx(l,{})]}):e.jsx(r,{})}export{h as default};
-//# sourceMappingURL=AdminTab-B8JqsA41.js.map
+import{r as s,u as o,e as c,j as e}from"./index-iuxgtzEW.js";import{T as i}from"./toggle-z1lWY4UM.js";import r from"./MaintenanceTab-4fJ7M4S4.js";import{C as l}from"./ConfigTab-C016XTNC.js";import"./card-Cfhz9X31.js";import"./button-DhQQAJGm.js";import"./switch-7EHEQMSP.js";const f="MEGACOMPACT_DASH_0C";function m(n){if(!n)return!1;for(const t of n.categories)for(const a of t.settings)if(a.key===f&&a.type==="boolean")return a.value===!0;return!1}function h(){const[n,t]=s.useState("maintenance"),{data:a}=o(s.useCallback(()=>c(),[]),{pollInterval:0,maxRetries:0});return m(a)?e.jsxs("div",{className:"flex flex-col gap-4",children:[e.jsxs("div",{className:"flex items-center gap-2",role:"tablist","aria-label":"Admin views",children:[e.jsx(i,{pressed:n==="maintenance",onClick:()=>t("maintenance"),children:"Maintenance"}),e.jsx(i,{pressed:n==="config",onClick:()=>t("config"),children:"Config"})]}),n==="maintenance"?e.jsx(r,{}):e.jsx(l,{})]}):e.jsx(r,{})}export{h as default};
+//# sourceMappingURL=AdminTab-BsA8-_bX.js.map

package/extensions/dashboard-client/dist/assets/{AdminTab-B8JqsA41.js.map → AdminTab-BsA8-_bX.js.map}

@@ -1 +1 @@
-{"version":3,"file":"AdminTab-B8JqsA41.js","sources":["../../src/tabs/AdminTab.tsx"],"sourcesContent":["/**\n * dashboard-client/src/tabs/AdminTab.tsx — Admin tab (DASH-0c delegate-shell).\n *\n * DASH-0c: the Admin surface combines the maintenance actions with the config\n * editor. A `AdminViews` toggle (\"maintenance\" / \"config\") switches between\n * `MaintenanceTab` (the maintenance shell over MaintenanceTab/*) and `ConfigTab`\n * (the config editor). Both bodies are UNCHANGED — only their hosting changes to\n * this new delegate-shell. `MaintenanceTab.tsx` and `ConfigTab.tsx` stay importable\n * from their original hosts (`ConfigTab` also stays wired into SetupTab per the\n * dual-host note). Flag-ON renders the toggle + both views; flag-OFF renders only\n * the maintenance view (the predecessor's `admin → MaintenanceTab` mapping),\n * and App.tsx keeps its current TabId routing this sprint (DASH-0d rewires).\n *\n * Flag: `MEGACOMPACT_DASH_0C` default ON. The dashboard client is a browser\n * bundle with NO `process` global, so the positive sprint flag cannot be read\n * server-side-style (`process.env`) inside the client. Instead the flag is read\n * from the server-authoritative `/api/rag-settings` state: the server resolves\n * `process.env[\"MEGACOMPACT_DASH_0C\"] ?? default` into the `SettingState.value`\n * boolean.\n */\n\nimport type React from \"react\";\nimport { useCallback, useState } from \"react\";\nimport type { SettingsResponse } from \"@contracts\";\nimport { useApi } from \"../hooks/useApi\";\nimport { fetchSettings } from \"../api/client\";\nimport { Toggle } from \"../components/ui/toggle\";\nimport MaintenanceTab from \"./MaintenanceTab\";\nimport ConfigTab from \"./ConfigTab\";\n\nconst DASH_0C_KEY = \"MEGACOMPACT_DASH_0C\";\n\n/** Resolve the DASH-0c consolidation flag from the server settings state.\n *  Absent/not-yet-loaded => false (flag-off posture), so flag-off users never\n *  see the toggle flash; the toggle appears only once settings confirm it is ON. */\nfunction dash0cEnabled(settings: SettingsResponse | null): boolean {\n\tif (!settings) return false;\n\tfor (const cat of settings.categories) {\n\t\tfor (const s of cat.settings) {\n\t\t\tif (s.key === DASH_0C_KEY && s.type === \"boolean\") return s.value === true;\n\t\t}\n\t}\n\treturn false;\n}\n\ntype AdminViews = \"maintenance\" | \"config\";\n\nexport default function AdminTab(): React.ReactElement {\n\tconst [view, setView] = useState<AdminViews>(\"maintenance\");\n\n\tconst { data: settingsData } = useApi<SettingsResponse>(\n\t\tuseCallback(() => fetchSettings(), []),\n\t\t{ pollInterval: 0, maxRetries: 0 },\n\t);\n\tconst dash0cOn = dash0cEnabled(settingsData);\n\n\tif (!dash0cOn) {\n\t\treturn <MaintenanceTab />;\n\t}\n\n\treturn (\n\t\t<div className=\"flex flex-col gap-4\">\n\t\t\t<div\n\t\t\t\tclassName=\"flex items-center gap-2\"\n\t\t\t\trole=\"tablist\"\n\t\t\t\taria-label=\"Admin views\"\n\t\t\t>\n\t\t\t\t<Toggle\n\t\t\t\t\tpressed={view === \"maintenance\"}\n\t\t\t\t\tonClick={() => setView(\"maintenance\")}\n\t\t\t\t>\n\t\t\t\t\tMaintenance\n\t\t\t\t</Toggle>\n\t\t\t\t<Toggle pressed={view === \"config\"} onClick={() => setView(\"config\")}>\n\t\t\t\t\tConfig\n\t\t\t\t</Toggle>\n\t\t\t</div>\n\t\t\t{view === \"maintenance\" ? <MaintenanceTab /> : <ConfigTab />}\n\t\t</div>\n\t);\n}\n"],"names":["DASH_0C_KEY","dash0cEnabled","settings","cat","s","AdminTab","view","setView","useState","settingsData","useApi","useCallback","fetchSettings","jsxs","jsx","Toggle","MaintenanceTab","ConfigTab"],"mappings":"mRA8BA,MAAMA,EAAc,sBAKpB,SAASC,EAAcC,EAA4C,CAClE,GAAI,CAACA,EAAU,MAAO,GACtB,UAAWC,KAAOD,EAAS,WAC1B,UAAWE,KAAKD,EAAI,SACnB,GAAIC,EAAE,MAAQJ,GAAeI,EAAE,OAAS,UAAW,OAAOA,EAAE,QAAU,GAGxE,MAAO,EACR,CAIA,SAAwBC,GAA+B,CACtD,KAAM,CAACC,EAAMC,CAAO,EAAIC,EAAAA,SAAqB,aAAa,EAEpD,CAAE,KAAMC,CAAA,EAAiBC,EAC9BC,cAAY,IAAMC,EAAA,EAAiB,EAAE,EACrC,CAAE,aAAc,EAAG,WAAY,CAAA,CAAE,EAIlC,OAFiBX,EAAcQ,CAAY,EAO1CI,EAAAA,KAAC,MAAA,CAAI,UAAU,sBACd,SAAA,CAAAA,EAAAA,KAAC,MAAA,CACA,UAAU,0BACV,KAAK,UACL,aAAW,cAEX,SAAA,CAAAC,EAAAA,IAACC,EAAA,CACA,QAAST,IAAS,cAClB,QAAS,IAAMC,EAAQ,aAAa,EACpC,SAAA,aAAA,CAAA,EAGDO,EAAAA,IAACC,EAAA,CAAO,QAAST,IAAS,SAAU,QAAS,IAAMC,EAAQ,QAAQ,EAAG,SAAA,QAAA,CAEtE,CAAA,CAAA,CAAA,EAEAD,IAAS,cAAgBQ,MAACE,EAAA,CAAA,CAAe,QAAMC,EAAA,CAAA,CAAU,CAAA,EAC3D,QArBQD,EAAA,EAAe,CAuBzB"}
+{"version":3,"file":"AdminTab-BsA8-_bX.js","sources":["../../src/tabs/AdminTab.tsx"],"sourcesContent":["/**\n * dashboard-client/src/tabs/AdminTab.tsx — Admin tab (DASH-0c delegate-shell).\n *\n * DASH-0c: the Admin surface combines the maintenance actions with the config\n * editor. A `AdminViews` toggle (\"maintenance\" / \"config\") switches between\n * `MaintenanceTab` (the maintenance shell over MaintenanceTab/*) and `ConfigTab`\n * (the config editor). Both bodies are UNCHANGED — only their hosting changes to\n * this new delegate-shell. `MaintenanceTab.tsx` and `ConfigTab.tsx` stay importable\n * from their original hosts (`ConfigTab` also stays wired into SetupTab per the\n * dual-host note). Flag-ON renders the toggle + both views; flag-OFF renders only\n * the maintenance view (the predecessor's `admin → MaintenanceTab` mapping),\n * and App.tsx keeps its current TabId routing this sprint (DASH-0d rewires).\n *\n * Flag: `MEGACOMPACT_DASH_0C` default ON. The dashboard client is a browser\n * bundle with NO `process` global, so the positive sprint flag cannot be read\n * server-side-style (`process.env`) inside the client. Instead the flag is read\n * from the server-authoritative `/api/rag-settings` state: the server resolves\n * `process.env[\"MEGACOMPACT_DASH_0C\"] ?? default` into the `SettingState.value`\n * boolean.\n */\n\nimport type React from \"react\";\nimport { useCallback, useState } from \"react\";\nimport type { SettingsResponse } from \"@contracts\";\nimport { useApi } from \"../hooks/useApi\";\nimport { fetchSettings } from \"../api/client\";\nimport { Toggle } from \"../components/ui/toggle\";\nimport MaintenanceTab from \"./MaintenanceTab\";\nimport ConfigTab from \"./ConfigTab\";\n\nconst DASH_0C_KEY = \"MEGACOMPACT_DASH_0C\";\n\n/** Resolve the DASH-0c consolidation flag from the server settings state.\n *  Absent/not-yet-loaded => false (flag-off posture), so flag-off users never\n *  see the toggle flash; the toggle appears only once settings confirm it is ON. */\nfunction dash0cEnabled(settings: SettingsResponse | null): boolean {\n\tif (!settings) return false;\n\tfor (const cat of settings.categories) {\n\t\tfor (const s of cat.settings) {\n\t\t\tif (s.key === DASH_0C_KEY && s.type === \"boolean\") return s.value === true;\n\t\t}\n\t}\n\treturn false;\n}\n\ntype AdminViews = \"maintenance\" | \"config\";\n\nexport default function AdminTab(): React.ReactElement {\n\tconst [view, setView] = useState<AdminViews>(\"maintenance\");\n\n\tconst { data: settingsData } = useApi<SettingsResponse>(\n\t\tuseCallback(() => fetchSettings(), []),\n\t\t{ pollInterval: 0, maxRetries: 0 },\n\t);\n\tconst dash0cOn = dash0cEnabled(settingsData);\n\n\tif (!dash0cOn) {\n\t\treturn <MaintenanceTab />;\n\t}\n\n\treturn (\n\t\t<div className=\"flex flex-col gap-4\">\n\t\t\t<div\n\t\t\t\tclassName=\"flex items-center gap-2\"\n\t\t\t\trole=\"tablist\"\n\t\t\t\taria-label=\"Admin views\"\n\t\t\t>\n\t\t\t\t<Toggle\n\t\t\t\t\tpressed={view === \"maintenance\"}\n\t\t\t\t\tonClick={() => setView(\"maintenance\")}\n\t\t\t\t>\n\t\t\t\t\tMaintenance\n\t\t\t\t</Toggle>\n\t\t\t\t<Toggle pressed={view === \"config\"} onClick={() => setView(\"config\")}>\n\t\t\t\t\tConfig\n\t\t\t\t</Toggle>\n\t\t\t</div>\n\t\t\t{view === \"maintenance\" ? <MaintenanceTab /> : <ConfigTab />}\n\t\t</div>\n\t);\n}\n"],"names":["DASH_0C_KEY","dash0cEnabled","settings","cat","s","AdminTab","view","setView","useState","settingsData","useApi","useCallback","fetchSettings","jsxs","jsx","Toggle","MaintenanceTab","ConfigTab"],"mappings":"mRA8BA,MAAMA,EAAc,sBAKpB,SAASC,EAAcC,EAA4C,CAClE,GAAI,CAACA,EAAU,MAAO,GACtB,UAAWC,KAAOD,EAAS,WAC1B,UAAWE,KAAKD,EAAI,SACnB,GAAIC,EAAE,MAAQJ,GAAeI,EAAE,OAAS,UAAW,OAAOA,EAAE,QAAU,GAGxE,MAAO,EACR,CAIA,SAAwBC,GAA+B,CACtD,KAAM,CAACC,EAAMC,CAAO,EAAIC,EAAAA,SAAqB,aAAa,EAEpD,CAAE,KAAMC,CAAA,EAAiBC,EAC9BC,cAAY,IAAMC,EAAA,EAAiB,EAAE,EACrC,CAAE,aAAc,EAAG,WAAY,CAAA,CAAE,EAIlC,OAFiBX,EAAcQ,CAAY,EAO1CI,EAAAA,KAAC,MAAA,CAAI,UAAU,sBACd,SAAA,CAAAA,EAAAA,KAAC,MAAA,CACA,UAAU,0BACV,KAAK,UACL,aAAW,cAEX,SAAA,CAAAC,EAAAA,IAACC,EAAA,CACA,QAAST,IAAS,cAClB,QAAS,IAAMC,EAAQ,aAAa,EACpC,SAAA,aAAA,CAAA,EAGDO,EAAAA,IAACC,EAAA,CAAO,QAAST,IAAS,SAAU,QAAS,IAAMC,EAAQ,QAAQ,EAAG,SAAA,QAAA,CAEtE,CAAA,CAAA,CAAA,EAEAD,IAAS,cAAgBQ,MAACE,EAAA,CAAA,CAAe,QAAMC,EAAA,CAAA,CAAU,CAAA,EAC3D,QArBQD,EAAA,EAAe,CAuBzB"}