renor-engine 0.0.0-stage → 1.0.0

package/dist/evidence/keyPool.js

@@ -0,0 +1,85 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.OLLAMA_KEY_ENV_NAMES = void 0;
+exports.splitKeyList = splitKeyList;
+exports.collectOllamaKeys = collectOllamaKeys;
+exports.isOllamaCloudEndpoint = isOllamaCloudEndpoint;
+exports.ollamaKeysForEndpoint = ollamaKeysForEndpoint;
+const ollamaChat_1 = require("./ollamaChat");
+/**
+ * ONE source of truth for the Ollama Cloud key pool.
+ *
+ * WHY THIS FILE EXISTS
+ *   Two modules read the same env namespace and they disagreed. The write-path
+ *   extractor (`extraction/extractionClient.ts`) resolved SIX names; the
+ *   evidence second pass (`evidence/options.ts`) resolved THREE, and the three
+ *   it named were the first three of the other list. On 2026-09-30 that drift
+ *   cost a 500-case product run: `OLLAMA_CLOUD_KEY_1..3` had all hit their
+ *   MONTHLY ceiling (429) while `OLLAMA_CLOUD_KEY_4`, `OLLAMA_MAX_KEY` and
+ *   `OLLAMA_API_KEY` were healthy, so the evidence extractor exhausted its pool
+ *   and — because `attachSearchEvidence` is deliberately fail-open — the last 77
+ *   of 500 cases were answered with the evidence layer silently absent. The run
+ *   manifest reported full coverage and zero `evid*` keys: a run that lost its
+ *   evidence layer for 15% of cases was byte-indistinguishable from one where it
+ *   held. See issue #222.
+ *
+ * The defect was not a missing key. It was two hand-maintained copies of one
+ * list. Keys are read by env-var NAME; values are never logged here.
+ */
+exports.OLLAMA_KEY_ENV_NAMES = [
+    'OLLAMA_CLOUD_KEY_1',
+    'OLLAMA_CLOUD_KEY_2',
+    'OLLAMA_CLOUD_KEY_3',
+    'OLLAMA_CLOUD_KEY_4',
+    'OLLAMA_MAX_KEY',
+    'OLLAMA_API_KEY',
+];
+/** Comma-separated env value -> trimmed, non-empty keys. */
+function splitKeyList(value) {
+    return (value ?? '').split(',').map(key => key.trim()).filter(Boolean);
+}
+/**
+ * Collect every configured Ollama key, in the fixed name order above, together
+ * with the names that supplied them. `names` is safe to report; `keys` is not.
+ */
+function collectOllamaKeys(env = process.env) {
+    const keys = [];
+    const names = [];
+    for (const name of exports.OLLAMA_KEY_ENV_NAMES) {
+        const found = splitKeyList(env[name]);
+        if (found.length > 0) {
+            keys.push(...found);
+            names.push(name);
+        }
+    }
+    return { keys, names };
+}
+/**
+ * Whether `baseUrl` is Ollama Cloud, the only issuer these keys belong to:
+ * https on ollama.com or a subdomain of it. Blank means the transport default,
+ * which is Ollama Cloud. A look-alike host, plain http or an unparseable URL is
+ * not.
+ */
+function isOllamaCloudEndpoint(baseUrl) {
+    let url;
+    try {
+        url = new URL(baseUrl?.trim() || ollamaChat_1.DEFAULT_CHAT_BASE_URL);
+    }
+    catch {
+        return false;
+    }
+    const host = url.hostname.toLowerCase();
+    return url.protocol === 'https:' && (host === 'ollama.com' || host.endsWith('.ollama.com'));
+}
+/**
+ * The Ollama pool for a client that will call `baseUrl`: every key when that
+ * is Ollama Cloud, none otherwise.
+ *
+ * The evidence client used to append this pool to whatever endpoint
+ * RENOR_EVIDENCE_BASE_URL named, so pointing the extractor at another provider
+ * sent every leftover OLLAMA_* key there too: a credential leak, and a 401 on
+ * each search whose turn in the rotation fell on an Ollama key.
+ */
+function ollamaKeysForEndpoint(baseUrl, env = process.env) {
+    return isOllamaCloudEndpoint(baseUrl) ? collectOllamaKeys(env) : { keys: [], names: [] };
+}

package/dist/evidence/ollamaChat.js

@@ -0,0 +1,84 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DEFAULT_CHAT_BASE_URL = void 0;
+exports.createOllamaChat = createOllamaChat;
+/** The endpoint called when no base URL is given: Ollama Cloud. */
+exports.DEFAULT_CHAT_BASE_URL = 'https://ollama.com/v1';
+function createOllamaChat(opts) {
+    const baseUrl = (opts.baseUrl ?? exports.DEFAULT_CHAT_BASE_URL).replace(/\/+$/, '');
+    const keys = opts.keys.filter(k => k && k.trim());
+    if (keys.length === 0)
+        throw new Error('createOllamaChat requires at least one API key');
+    const timeoutMs = opts.timeoutMs ?? 180_000;
+    const maxRetries = opts.maxRetries ?? 3;
+    const backoffMs = opts.backoffMs ?? 1000;
+    let counter = 0;
+    return async (request) => {
+        const body = JSON.stringify({
+            model: request.model,
+            messages: request.messages,
+            temperature: request.temperature,
+            // Only when the caller asked for JSON mode. Evidence calls omit it.
+            ...(request.response_format ? { response_format: request.response_format } : {}),
+            // Only when the caller set a bound, so an unbounded request is the same bytes: the session router always sets
+            // a ceiling, the evidence pass only when the operator set one (RENOR_EVIDENCE_MAX_TOKENS /
+            // RENOR_EVIDENCE_REASONING_EFFORT), the extractors never.
+            ...(request.max_tokens !== undefined ? { max_tokens: request.max_tokens } : {}),
+            ...(request.reasoning_effort !== undefined ? { reasoning_effort: request.reasoning_effort } : {}),
+        });
+        let lastError;
+        for (let attempt = 0; attempt <= maxRetries; attempt++) {
+            opts.beforeAttempt?.();
+            let retryable = true;
+            const key = keys[counter++ % keys.length];
+            const started = Date.now();
+            const controller = new AbortController();
+            const timer = setTimeout(() => controller.abort(), timeoutMs);
+            try {
+                const resp = await fetch(`${baseUrl}/chat/completions`, {
+                    method: 'POST',
+                    headers: { Authorization: `Bearer ${key}`, 'Content-Type': 'application/json' },
+                    body,
+                    signal: controller.signal,
+                });
+                if (resp.status === 429 || resp.status >= 500) {
+                    lastError = new Error(`extractor provider returned ${resp.status}`);
+                    await resp.text().catch(() => '');
+                    throw lastError;
+                }
+                if (!resp.ok) {
+                    // 4xx other than 429 is the provider rejecting this request.
+                    // Retrying it only spends the key pool and the backoff.
+                    retryable = false;
+                    lastError = new Error(`extractor provider returned ${resp.status}: ${(await resp.text().catch(() => '')).slice(0, 200)}`);
+                    throw lastError;
+                }
+                const data = await resp.json();
+                const content = data.choices?.[0]?.message?.content;
+                const finishReason = data.choices?.[0]?.finish_reason;
+                if (typeof content !== 'string') {
+                    // `length` here is a reasoning model that spent its whole budget thinking.
+                    throw new Error(`extractor provider response missing choices[0].message.content${typeof finishReason === 'string' ? ` (finish_reason=${finishReason})` : ''}`);
+                }
+                return {
+                    content,
+                    promptTokens: data.usage?.prompt_tokens,
+                    completionTokens: data.usage?.completion_tokens,
+                    totalTokens: data.usage?.total_tokens,
+                    latencyMs: Date.now() - started,
+                    ...(typeof finishReason === 'string' ? { finishReason } : {}),
+                };
+            }
+            catch (err) {
+                lastError = err instanceof Error ? err : new Error(String(err));
+                if (!retryable || attempt >= maxRetries)
+                    break;
+                await new Promise(resolve => setTimeout(resolve, 2 ** attempt * backoffMs));
+            }
+            finally {
+                clearTimeout(timer);
+            }
+        }
+        throw lastError ?? new Error('extractor call failed');
+    };
+}

package/dist/evidence/optin.js

@@ -0,0 +1,165 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.EvidenceDailyBudget = exports.EvidenceCapError = exports.EVIDENCE_DAILY_CAP_MAX = exports.EVIDENCE_DAILY_CAP_DEFAULT = exports.EVIDENCE_OPTIN_VALUE = void 0;
+exports.resolveEvidenceOptin = resolveEvidenceOptin;
+exports.readOptinKey = readOptinKey;
+exports.optinEndpointAllowed = optinEndpointAllowed;
+exports.utcDay = utcDay;
+exports.dailyBudgetGate = dailyBudgetGate;
+const node_fs_1 = __importDefault(require("node:fs"));
+const client_1 = require("../db/client");
+const keyPool_1 = require("./keyPool");
+/**
+ * The evidence extractor as a per-workspace opt-in (owner decision, 13 Oct 2026).
+ *
+ * A workspace runs the extractor on Ollama Cloud only when its own env file says so:
+ *
+ *   RENOR_EVIDENCE_OPTIN=ollama        the switch; unset or blank is off, and then nothing here applies
+ *   RENOR_EVIDENCE_KEY_FILE=<path>     the fleet key, by its path (a file, so the env file never holds the secret)
+ *   RENOR_EVIDENCE_DAILY_CAP=<n>       HTTP requests to the model per UTC day for this workspace (default 50)
+ *
+ * With the switch on, the key comes from the key file and nowhere else (no OLLAMA_* name, no
+ * RENOR_EVIDENCE_API_KEY), the endpoint is Ollama Cloud and the model is gemma4:31b; a base URL naming another
+ * issuer is refused rather than sent the Ollama key. The operator turns it on and off with
+ * scripts/alpha/set-tenant-evidence.sh. Values are never logged: only the key file's path and the reason a
+ * setting was refused.
+ */
+exports.EVIDENCE_OPTIN_VALUE = 'ollama';
+/**
+ * HTTP requests to the model a workspace may make per UTC day (a retry of a 429 or 5xx is one more). Sized for the shared account, not for the user: gemma4:31b
+ * reads about 9,300 tokens and writes about 190 per call (provider-terms report, 2026-10-03), so 50 calls are
+ * about 0.47M tokens, about 0.07 USD at list price, and 350 calls a week. Ollama publishes its limits as
+ * usage, not as calls, and does not state the weekly figure, so this stays well under any plausible share and
+ * is a setting (RENOR_EVIDENCE_DAILY_CAP, set per workspace by the ops command). A search answered from the
+ * cache costs none of it.
+ */
+exports.EVIDENCE_DAILY_CAP_DEFAULT = 50;
+exports.EVIDENCE_DAILY_CAP_MAX = 10_000;
+/** null when the workspace has not opted in. A value that does not parse throws, like an invalid RENOR_EVIDENCE_MODE. */
+function resolveEvidenceOptin(env = process.env) {
+    const raw = (env.RENOR_EVIDENCE_OPTIN ?? '').trim().toLowerCase();
+    if (raw === '')
+        return null;
+    if (raw !== exports.EVIDENCE_OPTIN_VALUE) {
+        throw new Error(`Invalid RENOR_EVIDENCE_OPTIN "${raw}": must be ${exports.EVIDENCE_OPTIN_VALUE} (or unset)`);
+    }
+    const keyFile = (env.RENOR_EVIDENCE_KEY_FILE ?? '').trim();
+    const capText = (env.RENOR_EVIDENCE_DAILY_CAP ?? '').trim();
+    let dailyCap = exports.EVIDENCE_DAILY_CAP_DEFAULT;
+    if (capText !== '') {
+        const value = Number(capText);
+        if (!/^[0-9]+$/.test(capText) || !Number.isSafeInteger(value) || value > exports.EVIDENCE_DAILY_CAP_MAX) {
+            throw new Error(`Invalid RENOR_EVIDENCE_DAILY_CAP "${capText}": must be a whole number from 0 to ${exports.EVIDENCE_DAILY_CAP_MAX}`);
+        }
+        dailyCap = value;
+    }
+    return { keyFile, dailyCap };
+}
+/**
+ * The key in the key file: one line, trimmed. Null (with one stderr line naming the path, never the content) when
+ * the setting names no file, the file is not a regular file, or it holds nothing usable.
+ */
+function readOptinKey(keyFile) {
+    if (!keyFile.startsWith('/')) {
+        process.stderr.write('[evidence] opt-in is on but RENOR_EVIDENCE_KEY_FILE is not an absolute path: the extractor stays off\n');
+        return null;
+    }
+    try {
+        if (!node_fs_1.default.statSync(keyFile).isFile())
+            throw new Error('not a regular file');
+        const key = node_fs_1.default.readFileSync(keyFile, 'utf8').trim();
+        if (key === '' || /\s/.test(key))
+            throw new Error('empty or not a single token');
+        return key;
+    }
+    catch (err) {
+        process.stderr.write(`[evidence] opt-in is on but the key file ${keyFile} cannot be used (${err instanceof Error ? err.message.replace(keyFile, 'it') : 'unreadable'}): the extractor stays off\n`);
+        return null;
+    }
+}
+/** Opt-in sends the Ollama key, so it only ever goes to Ollama Cloud. */
+function optinEndpointAllowed(baseUrl) {
+    if ((0, keyPool_1.isOllamaCloudEndpoint)(baseUrl))
+        return true;
+    process.stderr.write('[evidence] opt-in is on but RENOR_EVIDENCE_BASE_URL is not Ollama Cloud: the extractor stays off\n');
+    return false;
+}
+/** The workspace used its allowance for today (or its allowance could not be read, which is treated the same). */
+class EvidenceCapError extends Error {
+    constructor(message = 'the daily allowance of evidence-model calls is used') {
+        super(message);
+        this.name = 'EvidenceCapError';
+    }
+}
+exports.EvidenceCapError = EvidenceCapError;
+const DAY_MS = 24 * 60 * 60 * 1000;
+const KEEP_DAYS = 14;
+function utcDay(now) {
+    return new Date(now).toISOString().slice(0, 10);
+}
+/**
+ * Model calls counted per UTC day in the workspace's own evidence-cache file, so a restart does not hand back
+ * the day's allowance. `take` reserves one call before each HTTP attempt and is atomic across processes (one write
+ * transaction), so a concurrent search can never overshoot by more than a call already in flight and refused.
+ */
+class EvidenceDailyBudget {
+    limit;
+    now;
+    db;
+    takeStmt;
+    usedStmt;
+    sweepStmt;
+    constructor(dbPath, limit, now = Date.now) {
+        this.limit = limit;
+        this.now = now;
+        this.db = (0, client_1.openDb)(dbPath);
+        this.db.pragma('journal_mode = WAL');
+        this.db.pragma('busy_timeout = 10000');
+        this.db.exec('CREATE TABLE IF NOT EXISTS evidence_daily_calls (day TEXT PRIMARY KEY, calls INTEGER NOT NULL)');
+        this.takeStmt = this.db.prepare(`INSERT INTO evidence_daily_calls (day, calls) VALUES (?, 1)
+       ON CONFLICT(day) DO UPDATE SET calls = calls + 1 WHERE calls < ?`);
+        this.usedStmt = this.db.prepare('SELECT calls FROM evidence_daily_calls WHERE day = ?');
+        this.sweepStmt = this.db.prepare('DELETE FROM evidence_daily_calls WHERE day < ?');
+    }
+    /** Reserve one call for today; false when the day's allowance is spent. */
+    take() {
+        const now = this.now();
+        const day = utcDay(now);
+        if (this.limit <= 0)
+            return false;
+        return this.db.transaction(() => {
+            this.sweepStmt.run(utcDay(now - KEEP_DAYS * DAY_MS));
+            return this.takeStmt.run(day, this.limit).changes > 0;
+        }).immediate();
+    }
+    used() {
+        return this.usedStmt.get(utcDay(this.now()))?.calls ?? 0;
+    }
+}
+exports.EvidenceDailyBudget = EvidenceDailyBudget;
+/**
+ * A `beforeAttempt` for createOllamaChat that reserves one call per HTTP attempt, retries included, and throws
+ * EvidenceCapError when none is left. A budget that cannot be opened refuses every attempt: a shared provider
+ * limit is not worth risking on a counter that is not there.
+ */
+function dailyBudgetGate(open) {
+    let budget;
+    return () => {
+        if (budget === undefined) {
+            try {
+                budget = open();
+            }
+            catch (err) {
+                process.stderr.write(`[evidence] the daily call counter cannot be opened (${err instanceof Error ? err.message : String(err)}): the extractor stays off\n`);
+                budget = null;
+            }
+        }
+        if (!budget)
+            throw new EvidenceCapError('the daily call counter is unavailable');
+        if (!budget.take())
+            throw new EvidenceCapError();
+    };
+}

package/dist/evidence/options.js

@@ -0,0 +1,130 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.resolveEvidenceBounds = resolveEvidenceBounds;
+exports.resolveEvidenceProvider = resolveEvidenceProvider;
+exports.resolveEvidenceToolOptions = resolveEvidenceToolOptions;
+exports.createEvidenceExtractor = createEvidenceExtractor;
+const node_path_1 = __importDefault(require("node:path"));
+const ollamaChat_1 = require("./ollamaChat");
+const keyPool_1 = require("./keyPool");
+const evidenceCache_1 = require("./evidenceCache");
+const optin_1 = require("./optin");
+const gate_1 = require("./gate");
+const secondPass_1 = require("./secondPass");
+/**
+ * RENOR_EVIDENCE_MAX_TOKENS (a positive integer) and
+ * RENOR_EVIDENCE_REASONING_EFFORT (none | minimal | low | medium | high).
+ * Unset or blank means no bound, which is the shipped request. A value that
+ * does not parse throws, like an invalid RENOR_EVIDENCE_MODE: an operator who
+ * set a bound must not get an unbounded extractor because of a typo.
+ */
+function resolveEvidenceBounds(env = process.env) {
+    const bounds = {};
+    const maxTokens = (env.RENOR_EVIDENCE_MAX_TOKENS ?? '').trim();
+    if (maxTokens !== '') {
+        const value = Number(maxTokens);
+        if (!/^[1-9][0-9]*$/.test(maxTokens) || !Number.isSafeInteger(value)) {
+            throw new Error(`Invalid RENOR_EVIDENCE_MAX_TOKENS "${maxTokens}": must be a positive integer`);
+        }
+        bounds.maxTokens = value;
+    }
+    const effort = (env.RENOR_EVIDENCE_REASONING_EFFORT ?? '').trim().toLowerCase();
+    if (effort !== '') {
+        if (!secondPass_1.EVIDENCE_REASONING_EFFORTS.includes(effort)) {
+            throw new Error(`Invalid RENOR_EVIDENCE_REASONING_EFFORT "${effort}": must be ${secondPass_1.EVIDENCE_REASONING_EFFORTS.join(' | ')}`);
+        }
+        bounds.reasoningEffort = effort;
+    }
+    return bounds;
+}
+/**
+ * The OpenAI-compatible provider the query-time model passes call: RENOR_EVIDENCE_BASE_URL (unset or blank: the
+ * transport's Ollama Cloud default) and the key pool. Shared by the evidence pass and the session router
+ * (src/router/sessionRouter.ts), so the two can never disagree about which keys exist, and the URL returned is the
+ * one the Ollama keys were judged against. Values are never logged.
+ */
+function resolveEvidenceProvider(env = process.env) {
+    // Blank is the default endpoint (Ollama Cloud), like an unset variable.
+    const baseUrl = env.RENOR_EVIDENCE_BASE_URL?.trim() || undefined;
+    const keys = [
+        ...(env.RENOR_EVIDENCE_API_KEYS ?? '').split(','),
+        env.RENOR_EVIDENCE_API_KEY ?? '',
+        // The Ollama pool is collected by the shared helper, never re-listed here:
+        // this module used to name `OLLAMA_CLOUD_KEY_1..3` while the write-path
+        // extractor named six, so with the first three keys at their monthly
+        // ceiling the evidence layer vanished for 77 of 500 cases with no signal in
+        // the manifest (issue #222). One list, two readers. And only for an Ollama
+        // Cloud endpoint: another provider never receives an Ollama key.
+        ...(0, keyPool_1.ollamaKeysForEndpoint)(baseUrl, env).keys,
+    ].map(k => k.trim()).filter(Boolean);
+    return { baseUrl, keys };
+}
+function resolveEvidenceToolOptions(config, env = process.env) {
+    const mode = (0, gate_1.resolveEvidenceMode)(env);
+    const model = env.RENOR_EVIDENCE_MODEL?.trim() || secondPass_1.EVIDENCE_MODEL_DEFAULT;
+    const cachePath = env.RENOR_EVIDENCE_CACHE?.trim()
+        || node_path_1.default.join(node_path_1.default.dirname(config.dbPath), 'evidence-cache.db');
+    const bounds = resolveEvidenceBounds(env);
+    // A workspace that opted in (RENOR_EVIDENCE_OPTIN, see optin.ts) reaches Ollama Cloud with the key file's key
+    // alone, on gemma4:31b, and spends a daily allowance of calls. Unset, this is the resolver it always was.
+    const optin = (0, optin_1.resolveEvidenceOptin)(env);
+    const { baseUrl, keys } = resolveEvidenceProvider(env);
+    // Coverage knob (RENOR_EVIDENCE_SESSIONS). Default 20 matches the
+    // promotion-grade full-500 arm. One model call per uncached search,
+    // regardless of session count; explicit values remain bounded.
+    // A value that floors below 1 is treated as UNSET, not as "0 sessions". A
+    // fractional setting is finite and positive, so a bare `> 0` test let it
+    // through and `Math.floor` turned it into 0 — and 0 is not a silent no-op:
+    // `loadEvidenceSessionsFromVault` rejects it (`maxSessions must be > 0`),
+    // which the `evidence` MCP tool surfaces as a thrown error and the search path
+    // swallows as `extractor-error`. Floor first, then require >= 1.
+    const requested = Number(env.RENOR_EVIDENCE_SESSIONS ?? '');
+    const requestedSessions = Number.isFinite(requested) ? Math.floor(requested) : Number.NaN;
+    const maxSessions = Number.isFinite(requestedSessions) && requestedSessions >= 1
+        ? Math.min(requestedSessions, 50)
+        : secondPass_1.MAX_EVIDENCE_SESSIONS;
+    let chat;
+    if (optin) {
+        const optinKey = (0, optin_1.optinEndpointAllowed)(baseUrl) ? (0, optin_1.readOptinKey)(optin.keyFile) : null;
+        if (optinKey) {
+            const dailyCap = optin.dailyCap;
+            // The allowance is spent per HTTP attempt (a retried 429 or 5xx is another request to the provider), so it
+            // sits inside the transport rather than around it.
+            chat = (0, ollamaChat_1.createOllamaChat)({
+                keys: [optinKey],
+                beforeAttempt: (0, optin_1.dailyBudgetGate)(() => new optin_1.EvidenceDailyBudget(cachePath, dailyCap)),
+            });
+        }
+    }
+    else if (keys.length > 0) {
+        chat = (0, ollamaChat_1.createOllamaChat)({ baseUrl, keys });
+    }
+    return {
+        mode,
+        // The opt-in is the gemma4:31b decision: a stray RENOR_EVIDENCE_MODEL does not change what the privacy page names.
+        model: optin ? secondPass_1.EVIDENCE_MODEL_DEFAULT : model,
+        maxSessions,
+        charCap: secondPass_1.EVIDENCE_SESSION_CHAR_CAP,
+        cachePath,
+        ...(chat ? { chat } : {}),
+        ...(optin ? { dailyCap: optin.dailyCap } : {}),
+        ...(bounds.maxTokens !== undefined || bounds.reasoningEffort !== undefined ? { bounds } : {}),
+    };
+}
+function createEvidenceExtractor(evidence) {
+    if (!evidence.chat)
+        return null;
+    let cache = null;
+    if (evidence.cachePath) {
+        try {
+            cache = new evidenceCache_1.EvidenceCache(evidence.cachePath);
+        }
+        catch (err) {
+            process.stderr.write(`[evidence] cache unavailable: ${err instanceof Error ? err.message : String(err)}\n`);
+        }
+    }
+    return new secondPass_1.EvidenceExtractor({ chat: evidence.chat, cache, model: evidence.model, bounds: evidence.bounds });
+}