@principles/core 1.263.0 → 1.264.0

package/dist/runtime-v2/activation/openclaw-promotion-checks.js

@@ -0,0 +1,124 @@
+function isRecord(value) {
+    return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
+function isNonEmptyString(value) {
+    return typeof value === 'string' && value.trim().length > 0;
+}
+function validateHostContract(value) {
+    if (!isRecord(value))
+        return null;
+    const { outOfBandControls } = value;
+    const { protectedCapabilities } = value;
+    const { neutralProbes } = value;
+    if (value.version !== 'openclaw-legacy@1'
+        || value.supportsShadowEvidence !== true
+        || !Array.isArray(outOfBandControls)
+        || !Array.isArray(protectedCapabilities)
+        || !Array.isArray(neutralProbes))
+        return null;
+    const requiredControls = ['activation_deactivate', 'global_rulecode_pause', 'owner_review_console'];
+    if (!requiredControls.every(control => outOfBandControls.includes(control)))
+        return null;
+    const protectedIds = new Set();
+    const protectedCapabilityList = [];
+    for (const capability of protectedCapabilities) {
+        if (!isRecord(capability) || !isNonEmptyString(capability.capabilityId)
+            || !Array.isArray(capability.hostToolAliases)
+            || !capability.hostToolAliases.every(isNonEmptyString))
+            return null;
+        // RUNTIME_CONTRACT: hostToolAliases elements validated individually above.
+        protectedCapabilityList.push({ capabilityId: capability.capabilityId, hostToolAliases: capability.hostToolAliases });
+        protectedIds.add(capability.capabilityId);
+    }
+    const requiredCapabilities = ['pd_status', 'rulecode_deactivate', 'rulecode_global_pause', 'owner_review_access'];
+    if (!requiredCapabilities.every(capability => protectedIds.has(capability)))
+        return null;
+    const neutralProbeList = [];
+    for (const probe of neutralProbes) {
+        if (!isRecord(probe) || !isNonEmptyString(probe.probeId)
+            || !isNonEmptyString(probe.capabilityId) || !protectedIds.has(probe.capabilityId)
+            || !isNonEmptyString(probe.toolName) || !isRecord(probe.params)
+            || probe.expectedDecision !== 'allow')
+            return null;
+        neutralProbeList.push({
+            probeId: probe.probeId,
+            capabilityId: probe.capabilityId,
+            toolName: probe.toolName,
+            params: probe.params,
+            expectedDecision: 'allow',
+        });
+    }
+    if (!requiredCapabilities.every(capability => neutralProbeList.some(probe => probe.capabilityId === capability)))
+        return null;
+    return {
+        version: 'openclaw-legacy@1',
+        supportsShadowEvidence: true,
+        outOfBandControls: requiredControls,
+        protectedCapabilities: protectedCapabilityList,
+        neutralProbes: neutralProbeList,
+    };
+}
+function parseArtifactContent(artifact) {
+    try {
+        const parsed = JSON.parse(artifact.contentJson);
+        return isRecord(parsed) ? parsed : null;
+    }
+    catch {
+        return null;
+    }
+}
+function artifactWithNeutralProbes(artifact, contract) {
+    const content = parseArtifactContent(artifact);
+    if (!content || !isRecord(content.goldenTrace) || !Array.isArray(content.goldenTrace.cases))
+        return null;
+    const cases = contract.neutralProbes.map(probe => ({
+        caseId: `host-liveness:${probe.probeId}`,
+        kind: 'positive',
+        toolName: probe.toolName,
+        params: { ...probe.params },
+        expectedDecision: 'allow',
+    }));
+    const trace = {
+        traceId: `${String(content.goldenTrace.traceId)}:host-liveness`,
+        sourcePainId: String(content.goldenTrace.sourcePainId),
+        cases: [...content.goldenTrace.cases, ...cases],
+        createdAt: String(content.goldenTrace.createdAt),
+        version: 1,
+    };
+    return { ...artifact, contentJson: JSON.stringify({ ...content, goldenTrace: trace }) };
+}
+export async function collectOpenClawPromotionChecks(artifact, input) {
+    const content = parseArtifactContent(artifact);
+    const affectedTools = content && Array.isArray(content.affectedTools)
+        ? content.affectedTools.filter(isNonEmptyString)
+        : [];
+    const bounded = affectedTools.length > 0
+        && affectedTools.every(value => value !== '*' && value.toLowerCase() !== 'all');
+    const protectedCapabilityIds = new Set([
+        'pd_status', 'rulecode_deactivate', 'rulecode_global_pause', 'owner_review_access',
+    ]);
+    const scopeAvoidsProtectedCapabilities = bounded
+        && affectedTools.every(value => !protectedCapabilityIds.has(value));
+    const contract = validateHostContract(input.hostContract);
+    let probesPassed = false;
+    if (contract && scopeAvoidsProtectedCapabilities) {
+        probesPassed = true;
+        for (const candidate of [artifact, ...input.existingLiveArtifacts]) {
+            const withProbes = artifactWithNeutralProbes(candidate, contract);
+            if (!withProbes || !(await input.validateProductionArtifact(withProbes)).ok) {
+                probesPassed = false;
+                break;
+            }
+        }
+    }
+    const emergencyControlsHealthy = contract !== null && input.safetyControlsEnabled;
+    return [
+        { checkId: 'bounded_scope', status: bounded ? 'passed' : 'failed', ...(!bounded ? { reasonCode: 'explicit_affected_tools_required' } : {}) },
+        { checkId: 'runtime_compatibility', status: contract ? 'passed' : 'failed', ...(!contract ? { reasonCode: 'host_liveness_contract_missing_invalid_or_unsupported' } : {}) },
+        { checkId: 'host_liveness_composition', status: probesPassed ? 'passed' : 'failed', ...(!probesPassed ? { reasonCode: 'neutral_probe_or_live_composition_failed' } : {}) },
+        { checkId: 'emergency_controls', status: emergencyControlsHealthy ? 'passed' : 'failed', ...(!emergencyControlsHealthy ? { reasonCode: contract ? 'safety_controls_disabled' : 'out_of_band_controls_unavailable' } : {}) },
+        { checkId: 'runtime_shadow_evidence', status: contract?.supportsShadowEvidence === true ? 'passed' : 'failed', ...(contract?.supportsShadowEvidence === true ? {} : { reasonCode: 'runtime_shadow_evidence_unsupported' }) },
+        { checkId: 'owner_identity_configuration', status: input.ownerIdentityConfigured ? 'passed' : 'failed', ...(!input.ownerIdentityConfigured ? { reasonCode: 'configured_owner_missing' } : {}) },
+    ];
+}
+//# sourceMappingURL=openclaw-promotion-checks.js.map

package/dist/runtime-v2/activation/openclaw-promotion-checks.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"openclaw-promotion-checks.js","sourceRoot":"","sources":["../../../src/runtime-v2/activation/openclaw-promotion-checks.ts"],"names":[],"mappings":"AA4BA,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC9E,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAc;IACtC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC;AAC9D,CAAC;AAED,SAAS,oBAAoB,CAAC,KAAc;IAC1C,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAClC,MAAM,EAAC,iBAAiB,EAAC,GAAG,KAAK,CAAC;IAClC,MAAM,EAAC,qBAAqB,EAAC,GAAG,KAAK,CAAC;IACtC,MAAM,EAAC,aAAa,EAAC,GAAG,KAAK,CAAC;IAC9B,IAAI,KAAK,CAAC,OAAO,KAAK,mBAAmB;WACpC,KAAK,CAAC,sBAAsB,KAAK,IAAI;WACrC,CAAC,KAAK,CAAC,OAAO,CAAC,iBAAiB,CAAC;WACjC,CAAC,KAAK,CAAC,OAAO,CAAC,qBAAqB,CAAC;WACrC,CAAC,KAAK,CAAC,OAAO,CAAC,aAAa,CAAC;QAAE,OAAO,IAAI,CAAC;IAChD,MAAM,gBAAgB,GAAG,CAAC,uBAAuB,EAAE,uBAAuB,EAAE,sBAAsB,CAAU,CAAC;IAC7G,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC,iBAAiB,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACzF,MAAM,YAAY,GAAG,IAAI,GAAG,EAAU,CAAC;IACvC,MAAM,uBAAuB,GAA4D,EAAE,CAAC;IAC5F,KAAK,MAAM,UAAU,IAAI,qBAAqB,EAAE,CAAC;QAC/C,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,gBAAgB,CAAC,UAAU,CAAC,YAAY,CAAC;eAClE,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,eAAe,CAAC;eAC1C,CAAC,UAAU,CAAC,eAAe,CAAC,KAAK,CAAC,gBAAgB,CAAC;YAAE,OAAO,IAAI,CAAC;QACtE,2EAA2E;QAC3E,uBAAuB,CAAC,IAAI,CAAC,EAAE,YAAY,EAAE,UAAU,CAAC,YAAY,EAAE,eAAe,EAAE,UAAU,CAAC,eAAe,EAAE,CAAC,CAAC;QACrH,YAAY,CAAC,GAAG,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC;IAC5C,CAAC;IACD,MAAM,oBAAoB,GAAG,CAAC,WAAW,EAAE,qBAAqB,EAAE,uBAAuB,EAAE,qBAAqB,CAAU,CAAC;IAC3H,IAAI,CAAC,oBAAoB,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,CAAC,YAAY,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACzF,MAAM,gBAAgB,GAAoD,EAAE,CAAC;IAC7E,KAAK,MAAM,KAAK,IAAI,aAAa,EAAE,CAAC;QAClC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC,OAAO,CAAC;eACnD,CAAC,gBAAgB,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,YAAY,CAAC;eAC9E,CAAC,gBAAgB,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC;eAC5D,KAAK,CAAC,gBAAgB,KAAK,OAAO;YAAE,OAAO,IAAI,CAAC;QACrD,gBAAgB,CAAC,IAAI,CAAC;YACpB,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,YAAY,EAAE,KAAK,CAAC,YAAY;YAChC,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,gBAAgB,EAAE,OAAO;SAC1B,CAAC,CAAC;IACL,CAAC;IACD,IAAI,CAAC,oBAAoB,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,CAAC,gBAAgB,CAAC,IAAI,CACjE,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,YAAY,KAAK,UAAU,CAC3C,CAAC;QAAE,OAAO,IAAI,CAAC;IAChB,OAAO;QACL,OAAO,EAAE,mBAAmB;QAC5B,sBAAsB,EAAE,IAAI;QAC5B,iBAAiB,EAAE,gBAAgB;QACnC,qBAAqB,EAAE,uBAAuB;QAC9C,aAAa,EAAE,gBAAgB;KAChC,CAAC;AACJ,CAAC;AAED,SAAS,oBAAoB,CAAC,QAA4B;IACxD,IAAI,CAAC;QACH,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;QACzD,OAAO,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;IAC1C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,yBAAyB,CAChC,QAA4B,EAC5B,QAA8B;IAE9B,MAAM,OAAO,GAAG,oBAAoB,CAAC,QAAQ,CAAC,CAAC;IAC/C,IAAI,CAAC,OAAO,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,WAAW,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACzG,MAAM,KAAK,GAAG,QAAQ,CAAC,aAAa,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QACjD,MAAM,EAAE,iBAAiB,KAAK,CAAC,OAAO,EAAE;QACxC,IAAI,EAAE,UAAU;QAChB,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,MAAM,EAAE,EAAE,GAAG,KAAK,CAAC,MAAM,EAAE;QAC3B,gBAAgB,EAAE,OAAO;KAC1B,CAAC,CAAC,CAAC;IACJ,MAAM,KAAK,GAAG;QACZ,OAAO,EAAE,GAAG,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC,OAAO,CAAC,gBAAgB;QAC/D,YAAY,EAAE,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC,YAAY,CAAC;QACtD,KAAK,EAAE,CAAC,GAAG,OAAO,CAAC,WAAW,CAAC,KAAK,EAAE,GAAG,KAAK,CAAC;QAC/C,SAAS,EAAE,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC,SAAS,CAAC;QAChD,OAAO,EAAE,CAAC;KACX,CAAC;IACF,OAAO,EAAE,GAAG,QAAQ,EAAE,WAAW,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,OAAO,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;AAC1F,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,8BAA8B,CAClD,QAA4B,EAC5B,KAAkC;IAElC,MAAM,OAAO,GAAG,oBAAoB,CAAC,QAAQ,CAAC,CAAC;IAC/C,MAAM,aAAa,GAAG,OAAO,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,aAAa,CAAC;QACnE,CAAC,CAAC,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,gBAAgB,CAAC;QAChD,CAAC,CAAC,EAAE,CAAC;IACP,MAAM,OAAO,GAAG,aAAa,CAAC,MAAM,GAAG,CAAC;WACnC,aAAa,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,KAAK,GAAG,IAAI,KAAK,CAAC,WAAW,EAAE,KAAK,KAAK,CAAC,CAAC;IAClF,MAAM,sBAAsB,GAAG,IAAI,GAAG,CAAC;QACrC,WAAW,EAAE,qBAAqB,EAAE,uBAAuB,EAAE,qBAAqB;KACnF,CAAC,CAAC;IACH,MAAM,gCAAgC,GAAG,OAAO;WAC3C,aAAa,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,sBAAsB,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC;IACtE,MAAM,QAAQ,GAAG,oBAAoB,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;IAE1D,IAAI,YAAY,GAAG,KAAK,CAAC;IACzB,IAAI,QAAQ,IAAI,gCAAgC,EAAE,CAAC;QACjD,YAAY,GAAG,IAAI,CAAC;QACpB,KAAK,MAAM,SAAS,IAAI,CAAC,QAAQ,EAAE,GAAG,KAAK,CAAC,qBAAqB,CAAC,EAAE,CAAC;YACnE,MAAM,UAAU,GAAG,yBAAyB,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;YAClE,IAAI,CAAC,UAAU,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,0BAA0B,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;gBAC5E,YAAY,GAAG,KAAK,CAAC;gBACrB,MAAM;YACR,CAAC;QACH,CAAC;IACH,CAAC;IAED,MAAM,wBAAwB,GAAG,QAAQ,KAAK,IAAI,IAAI,KAAK,CAAC,qBAAqB,CAAC;IAClF,OAAO;QACL,EAAE,OAAO,EAAE,eAAe,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,kCAAkC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE;QAC5I,EAAE,OAAO,EAAE,uBAAuB,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,uDAAuD,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE;QAC3K,EAAE,OAAO,EAAE,2BAA2B,EAAE,MAAM,EAAE,YAAY,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,0CAA0C,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE;QAC1K,EAAE,OAAO,EAAE,oBAAoB,EAAE,MAAM,EAAE,wBAAwB,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC,wBAAwB,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,QAAQ,CAAC,CAAC,CAAC,0BAA0B,CAAC,CAAC,CAAC,kCAAkC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE;QAC3N,EAAE,OAAO,EAAE,yBAAyB,EAAE,MAAM,EAAE,QAAQ,EAAE,sBAAsB,KAAK,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE,sBAAsB,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,qCAAqC,EAAE,CAAC,EAAE;QAC5N,EAAE,OAAO,EAAE,8BAA8B,EAAE,MAAM,EAAE,KAAK,CAAC,uBAAuB,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,uBAAuB,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,0BAA0B,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE;KAChM,CAAC;AACJ,CAAC"}

package/dist/runtime-v2/activation/promotion-readiness-evaluator.d.ts

@@ -0,0 +1,17 @@
+import type { PromotionEvidenceSnapshot, PromotionReadinessResult } from './rulecode-owner-decision-service.js';
+export declare const REQUIRED_PROMOTION_CHECK_IDS: readonly ['activation_eligibility', 'lineage_binding', 'bounded_scope', 'production_compile_load', 'golden_trace', 'runtime_compatibility', 'host_liveness_composition', 'emergency_controls', 'runtime_shadow_evidence', 'owner_identity_configuration'];
+export type PromotionCheckId = typeof REQUIRED_PROMOTION_CHECK_IDS[number];
+export interface PromotionReadinessCheck {
+    checkId: PromotionCheckId;
+    status: 'passed' | 'failed';
+    reasonCode?: string;
+}
+export interface PromotionReadinessEvaluationInput {
+    evaluationId: string;
+    artifactId: string;
+    artifactDigest: string;
+    evidenceSnapshot: PromotionEvidenceSnapshot;
+    checks: readonly PromotionReadinessCheck[];
+}
+export declare function evaluateRuleCodePromotionReadiness(input: PromotionReadinessEvaluationInput): PromotionReadinessResult;
+//# sourceMappingURL=promotion-readiness-evaluator.d.ts.map

package/dist/runtime-v2/activation/promotion-readiness-evaluator.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"promotion-readiness-evaluator.d.ts","sourceRoot":"","sources":["../../../src/runtime-v2/activation/promotion-readiness-evaluator.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,yBAAyB,EAAwB,wBAAwB,EAAE,MAAM,sCAAsC,CAAC;AAEtI,eAAO,MAAM,4BAA4B,YACvC,wBAAwB,EAAE,iBAAiB,EAAE,eAAe,EAAE,yBAAyB,EACvF,cAAc,EAAE,uBAAuB,EAAE,2BAA2B,EAAE,oBAAoB,EAC1F,yBAAyB,EAAE,8BAA8B,CACjD,CAAC;AAEX,MAAM,MAAM,gBAAgB,GAAG,OAAO,4BAA4B,CAAC,MAAM,CAAC,CAAC;AAC3E,MAAM,WAAW,uBAAuB;IACtC,OAAO,EAAE,gBAAgB,CAAC;IAC1B,MAAM,EAAE,QAAQ,GAAG,QAAQ,CAAC;IAC5B,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AACD,MAAM,WAAW,iCAAiC;IAChD,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;IACnB,cAAc,EAAE,MAAM,CAAC;IACvB,gBAAgB,EAAE,yBAAyB,CAAC;IAC5C,MAAM,EAAE,SAAS,uBAAuB,EAAE,CAAC;CAC5C;AAED,wBAAgB,kCAAkC,CAAC,KAAK,EAAE,iCAAiC,GAAG,wBAAwB,CA+CrH"}

package/dist/runtime-v2/activation/promotion-readiness-evaluator.js

@@ -0,0 +1,55 @@
+export const REQUIRED_PROMOTION_CHECK_IDS = [
+    'activation_eligibility', 'lineage_binding', 'bounded_scope', 'production_compile_load',
+    'golden_trace', 'runtime_compatibility', 'host_liveness_composition', 'emergency_controls',
+    'runtime_shadow_evidence', 'owner_identity_configuration',
+];
+export function evaluateRuleCodePromotionReadiness(input) {
+    const byId = new Map();
+    const duplicateIds = new Set();
+    for (const check of input.checks) {
+        if (byId.has(check.checkId))
+            duplicateIds.add(check.checkId);
+        byId.set(check.checkId, check);
+    }
+    const unavailable = [];
+    for (const checkId of REQUIRED_PROMOTION_CHECK_IDS) {
+        if (!byId.has(checkId))
+            unavailable.push({ checkId, reasonCode: 'required_check_missing' });
+        if (duplicateIds.has(checkId))
+            unavailable.push({ checkId, reasonCode: 'duplicate_check_result' });
+    }
+    if (input.evidenceSnapshot.artifactDigest !== input.artifactDigest) {
+        unavailable.push({ checkId: 'evidence_binding', reasonCode: 'artifact_digest_mismatch' });
+    }
+    const { shadowSummary } = input.evidenceSnapshot;
+    const safetyGateResults = REQUIRED_PROMOTION_CHECK_IDS.flatMap(checkId => {
+        const check = byId.get(checkId);
+        if (!check)
+            return [];
+        if (checkId === 'runtime_shadow_evidence' && shadowSummary.errors !== null && shadowSummary.errors > 0) {
+            return [{ checkId, status: 'failed', reasonCode: 'unresolved_shadow_unhealthy_evidence' }];
+        }
+        return [{ ...check }];
+    });
+    const evidenceSnapshot = { ...input.evidenceSnapshot, safetyGateResults };
+    if (unavailable.length > 0) {
+        return { status: 'unavailable', evaluationId: input.evaluationId, artifactId: input.artifactId,
+            artifactDigest: input.artifactDigest, evidenceSnapshot, failedChecks: unavailable };
+    }
+    const failedChecks = safetyGateResults
+        .filter(check => check.status === 'failed')
+        .map(check => ({ checkId: check.checkId, reasonCode: check.reasonCode ?? 'hard_check_failed' }));
+    const summary = evidenceSnapshot.shadowSummary;
+    const shadowAgeMs = summary.firstObservedAt === null
+        ? null
+        : Date.parse(evidenceSnapshot.createdAt) - Date.parse(summary.firstObservedAt);
+    const insufficientEvidence = summary.observed === null || summary.observed < 20
+        || summary.matched === null || summary.matched < 3
+        || summary.neutralControl === null || summary.neutralControl < 1
+        || shadowAgeMs === null || !Number.isFinite(shadowAgeMs) || shadowAgeMs < 24 * 60 * 60 * 1000;
+    return {
+        status: failedChecks.length > 0 ? 'blocked' : insufficientEvidence ? 'evidence_insufficient' : 'ready', evaluationId: input.evaluationId,
+        artifactId: input.artifactId, artifactDigest: input.artifactDigest, evidenceSnapshot, failedChecks,
+    };
+}
+//# sourceMappingURL=promotion-readiness-evaluator.js.map

package/dist/runtime-v2/activation/promotion-readiness-evaluator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"promotion-readiness-evaluator.js","sourceRoot":"","sources":["../../../src/runtime-v2/activation/promotion-readiness-evaluator.ts"],"names":[],"mappings":"AAEA,MAAM,CAAC,MAAM,4BAA4B,GAAG;IAC1C,wBAAwB,EAAE,iBAAiB,EAAE,eAAe,EAAE,yBAAyB;IACvF,cAAc,EAAE,uBAAuB,EAAE,2BAA2B,EAAE,oBAAoB;IAC1F,yBAAyB,EAAE,8BAA8B;CACjD,CAAC;AAgBX,MAAM,UAAU,kCAAkC,CAAC,KAAwC;IACzF,MAAM,IAAI,GAAG,IAAI,GAAG,EAA6C,CAAC;IAClE,MAAM,YAAY,GAAG,IAAI,GAAG,EAAoB,CAAC;IACjD,KAAK,MAAM,KAAK,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;QACjC,IAAI,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC;YAAE,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAC7D,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IACjC,CAAC;IAED,MAAM,WAAW,GAA2B,EAAE,CAAC;IAC/C,KAAK,MAAM,OAAO,IAAI,4BAA4B,EAAE,CAAC;QACnD,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC;YAAE,WAAW,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,UAAU,EAAE,wBAAwB,EAAE,CAAC,CAAC;QAC5F,IAAI,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC;YAAE,WAAW,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,UAAU,EAAE,wBAAwB,EAAE,CAAC,CAAC;IACrG,CAAC;IACD,IAAI,KAAK,CAAC,gBAAgB,CAAC,cAAc,KAAK,KAAK,CAAC,cAAc,EAAE,CAAC;QACnE,WAAW,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,kBAAkB,EAAE,UAAU,EAAE,0BAA0B,EAAE,CAAC,CAAC;IAC5F,CAAC;IAED,MAAM,EAAC,aAAa,EAAC,GAAG,KAAK,CAAC,gBAAgB,CAAC;IAC/C,MAAM,iBAAiB,GAAG,4BAA4B,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE;QACvE,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAChC,IAAI,CAAC,KAAK;YAAE,OAAO,EAAE,CAAC;QACtB,IAAI,OAAO,KAAK,yBAAyB,IAAI,aAAa,CAAC,MAAM,KAAK,IAAI,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACvG,OAAO,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,QAAiB,EAAE,UAAU,EAAE,sCAAsC,EAAE,CAAC,CAAC;QACtG,CAAC;QACD,OAAO,CAAC,EAAE,GAAG,KAAK,EAAE,CAAC,CAAC;IACxB,CAAC,CAAC,CAAC;IACH,MAAM,gBAAgB,GAAG,EAAE,GAAG,KAAK,CAAC,gBAAgB,EAAE,iBAAiB,EAAE,CAAC;IAC1E,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC3B,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,YAAY,EAAE,KAAK,CAAC,YAAY,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU;YAC5F,cAAc,EAAE,KAAK,CAAC,cAAc,EAAE,gBAAgB,EAAE,YAAY,EAAE,WAAW,EAAE,CAAC;IACxF,CAAC;IAED,MAAM,YAAY,GAAG,iBAAiB;SACnC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,MAAM,KAAK,QAAQ,CAAC;SAC1C,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU,IAAI,mBAAmB,EAAE,CAAC,CAAC,CAAC;IACnG,MAAM,OAAO,GAAG,gBAAgB,CAAC,aAAa,CAAC;IAC/C,MAAM,WAAW,GAAG,OAAO,CAAC,eAAe,KAAK,IAAI;QAClD,CAAC,CAAC,IAAI;QACN,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,gBAAgB,CAAC,SAAS,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;IACjF,MAAM,oBAAoB,GAAG,OAAO,CAAC,QAAQ,KAAK,IAAI,IAAI,OAAO,CAAC,QAAQ,GAAG,EAAE;WAC1E,OAAO,CAAC,OAAO,KAAK,IAAI,IAAI,OAAO,CAAC,OAAO,GAAG,CAAC;WAC/C,OAAO,CAAC,cAAc,KAAK,IAAI,IAAI,OAAO,CAAC,cAAc,GAAG,CAAC;WAC7D,WAAW,KAAK,IAAI,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,WAAW,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;IAChG,OAAO;QACL,MAAM,EAAE,YAAY,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,uBAAuB,CAAC,CAAC,CAAC,OAAO,EAAE,YAAY,EAAE,KAAK,CAAC,YAAY;QACxI,UAAU,EAAE,KAAK,CAAC,UAAU,EAAE,cAAc,EAAE,KAAK,CAAC,cAAc,EAAE,gBAAgB,EAAE,YAAY;KACnG,CAAC;AACJ,CAAC"}

package/dist/runtime-v2/activation/promotion-readiness-reader.d.ts

@@ -0,0 +1,21 @@
+import type { ActivationStatusRecord, CanActivateResult, PIArtifactSnapshot } from './activation-types.js';
+import type { OwnerPromotionRequest, PromotionEvidenceSnapshot, PromotionReadinessResult } from './rulecode-owner-decision-service.js';
+import { type PromotionReadinessCheck } from './promotion-readiness-evaluator.js';
+export interface PromotionReadinessReaderDeps {
+    listCodeToolHookActivations(): Promise<ActivationStatusRecord[]>;
+    getArtifactById(artifactId: string): Promise<PIArtifactSnapshot | null>;
+    computeArtifactDigest(artifact: PIArtifactSnapshot): string;
+    validateProductionArtifact(artifact: PIArtifactSnapshot): Promise<CanActivateResult>;
+    collectHostChecks(artifact: PIArtifactSnapshot): Promise<PromotionReadinessCheck[]>;
+    buildEvidenceSnapshot(checks: PromotionReadinessCheck[], artifact?: PIArtifactSnapshot): PromotionEvidenceSnapshot;
+    newEvaluationId(): string;
+}
+type ReadinessRequest = Pick<OwnerPromotionRequest, 'activationId' | 'expectedArtifactId' | 'expectedArtifactDigest'>;
+export declare class PromotionReadinessReader {
+    private readonly deps;
+    constructor(deps: PromotionReadinessReaderDeps);
+    evaluate(request: ReadinessRequest): Promise<PromotionReadinessResult>;
+    private blocked;
+}
+export {};
+//# sourceMappingURL=promotion-readiness-reader.d.ts.map

package/dist/runtime-v2/activation/promotion-readiness-reader.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"promotion-readiness-reader.d.ts","sourceRoot":"","sources":["../../../src/runtime-v2/activation/promotion-readiness-reader.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,sBAAsB,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAC3G,OAAO,KAAK,EAAE,qBAAqB,EAAE,yBAAyB,EAAE,wBAAwB,EAAE,MAAM,sCAAsC,CAAC;AACvI,OAAO,EAAsC,KAAK,uBAAuB,EAAE,MAAM,oCAAoC,CAAC;AAEtH,MAAM,WAAW,4BAA4B;IAC3C,2BAA2B,IAAI,OAAO,CAAC,sBAAsB,EAAE,CAAC,CAAC;IACjE,eAAe,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC,CAAC;IACxE,qBAAqB,CAAC,QAAQ,EAAE,kBAAkB,GAAG,MAAM,CAAC;IAC5D,0BAA0B,CAAC,QAAQ,EAAE,kBAAkB,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAAC;IACrF,iBAAiB,CAAC,QAAQ,EAAE,kBAAkB,GAAG,OAAO,CAAC,uBAAuB,EAAE,CAAC,CAAC;IACpF,qBAAqB,CAAC,MAAM,EAAE,uBAAuB,EAAE,EAAE,QAAQ,CAAC,EAAE,kBAAkB,GAAG,yBAAyB,CAAC;IACnH,eAAe,IAAI,MAAM,CAAC;CAC3B;AAED,KAAK,gBAAgB,GAAG,IAAI,CAAC,qBAAqB,EAAE,cAAc,GAAG,oBAAoB,GAAG,wBAAwB,CAAC,CAAC;AAEtH,qBAAa,wBAAwB;IACvB,OAAO,CAAC,QAAQ,CAAC,IAAI;IAAjC,YAA6B,IAAI,EAAE,4BAA4B,EAAI;IAE7D,QAAQ,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,wBAAwB,CAAC,CAgC3E;IAED,OAAO,CAAC,OAAO;CAQhB"}

package/dist/runtime-v2/activation/promotion-readiness-reader.js

@@ -0,0 +1,44 @@
+import { evaluateRuleCodePromotionReadiness } from './promotion-readiness-evaluator.js';
+export class PromotionReadinessReader {
+    deps;
+    constructor(deps) {
+        this.deps = deps;
+    }
+    async evaluate(request) {
+        const evaluationId = this.deps.newEvaluationId();
+        const matches = (await this.deps.listCodeToolHookActivations()).filter(record => record.activationId === request.activationId);
+        const activation = matches.length === 1 ? matches[0] : undefined;
+        if (!activation || activation.action !== 'code_tool_hook_shadow_activate' || activation.deactivatedAt !== null) {
+            return this.blocked(evaluationId, request, [{ checkId: 'activation_eligibility', status: 'failed', reasonCode: matches.length > 1 ? 'activation_not_unique' : 'active_shadow_activation_required' }]);
+        }
+        if (activation.artifactId !== request.expectedArtifactId) {
+            return this.blocked(evaluationId, request, [{ checkId: 'lineage_binding', status: 'failed', reasonCode: 'activation_artifact_mismatch' }]);
+        }
+        const artifact = await this.deps.getArtifactById(activation.artifactId);
+        if (!artifact) {
+            return this.blocked(evaluationId, request, [{ checkId: 'lineage_binding', status: 'failed', reasonCode: 'artifact_not_found' }]);
+        }
+        const artifactDigest = this.deps.computeArtifactDigest(artifact);
+        if (artifactDigest !== request.expectedArtifactDigest) {
+            return this.blocked(evaluationId, { ...request, expectedArtifactDigest: artifactDigest }, [{ checkId: 'lineage_binding', status: 'failed', reasonCode: 'artifact_digest_mismatch' }]);
+        }
+        const checks = [
+            { checkId: 'activation_eligibility', status: 'passed' },
+            { checkId: 'lineage_binding', status: artifact.sourceTaskId && artifact.lineageArtifactIds.length > 0 ? 'passed' : 'failed',
+                ...(artifact.sourceTaskId && artifact.lineageArtifactIds.length > 0 ? {} : { reasonCode: 'artifact_lineage_missing' }) },
+        ];
+        const gate = await this.deps.validateProductionArtifact(artifact);
+        checks.push({ checkId: 'production_compile_load', status: gate.ok ? 'passed' : 'failed', ...(!gate.ok ? { reasonCode: gate.reason } : {}) }, { checkId: 'golden_trace', status: gate.ok ? 'passed' : 'failed', ...(!gate.ok ? { reasonCode: gate.reason } : {}) }, ...await this.deps.collectHostChecks(artifact));
+        const evidenceSnapshot = this.deps.buildEvidenceSnapshot(checks, artifact);
+        return evaluateRuleCodePromotionReadiness({ evaluationId, artifactId: artifact.artifactId, artifactDigest, evidenceSnapshot, checks });
+    }
+    blocked(evaluationId, request, checks) {
+        const evidenceSnapshot = this.deps.buildEvidenceSnapshot(checks);
+        return {
+            status: 'blocked', evaluationId, artifactId: request.expectedArtifactId,
+            artifactDigest: request.expectedArtifactDigest, evidenceSnapshot,
+            failedChecks: checks.map(check => ({ checkId: check.checkId, reasonCode: check.reasonCode ?? 'hard_check_failed' })),
+        };
+    }
+}
+//# sourceMappingURL=promotion-readiness-reader.js.map

package/dist/runtime-v2/activation/promotion-readiness-reader.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"promotion-readiness-reader.js","sourceRoot":"","sources":["../../../src/runtime-v2/activation/promotion-readiness-reader.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,kCAAkC,EAAgC,MAAM,oCAAoC,CAAC;AActH,MAAM,OAAO,wBAAwB;IACN,IAAI;IAAjC,YAA6B,IAAkC;oBAAlC,IAAI;IAAiC,CAAC;IAEnE,KAAK,CAAC,QAAQ,CAAC,OAAyB;QACtC,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE,CAAC;QACjD,MAAM,OAAO,GAAG,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,2BAA2B,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,YAAY,KAAK,OAAO,CAAC,YAAY,CAAC,CAAC;QAC/H,MAAM,UAAU,GAAG,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACjE,IAAI,CAAC,UAAU,IAAI,UAAU,CAAC,MAAM,KAAK,gCAAgC,IAAI,UAAU,CAAC,aAAa,KAAK,IAAI,EAAE,CAAC;YAC/G,OAAO,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE,OAAO,EAAE,CAAC,EAAE,OAAO,EAAE,wBAAwB,EAAE,MAAM,EAAE,QAAQ,EAAE,UAAU,EAAE,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,uBAAuB,CAAC,CAAC,CAAC,mCAAmC,EAAE,CAAC,CAAC,CAAC;QACxM,CAAC;QACD,IAAI,UAAU,CAAC,UAAU,KAAK,OAAO,CAAC,kBAAkB,EAAE,CAAC;YACzD,OAAO,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE,OAAO,EAAE,CAAC,EAAE,OAAO,EAAE,iBAAiB,EAAE,MAAM,EAAE,QAAQ,EAAE,UAAU,EAAE,8BAA8B,EAAE,CAAC,CAAC,CAAC;QAC7I,CAAC;QACD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC;QACxE,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,OAAO,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE,OAAO,EAAE,CAAC,EAAE,OAAO,EAAE,iBAAiB,EAAE,MAAM,EAAE,QAAQ,EAAE,UAAU,EAAE,oBAAoB,EAAE,CAAC,CAAC,CAAC;QACnI,CAAC;QACD,MAAM,cAAc,GAAG,IAAI,CAAC,IAAI,CAAC,qBAAqB,CAAC,QAAQ,CAAC,CAAC;QACjE,IAAI,cAAc,KAAK,OAAO,CAAC,sBAAsB,EAAE,CAAC;YACtD,OAAO,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE,EAAE,GAAG,OAAO,EAAE,sBAAsB,EAAE,cAAc,EAAE,EAAE,CAAC,EAAE,OAAO,EAAE,iBAAiB,EAAE,MAAM,EAAE,QAAQ,EAAE,UAAU,EAAE,0BAA0B,EAAE,CAAC,CAAC,CAAC;QACxL,CAAC;QAED,MAAM,MAAM,GAA8B;YACxC,EAAE,OAAO,EAAE,wBAAwB,EAAE,MAAM,EAAE,QAAQ,EAAE;YACvD,EAAE,OAAO,EAAE,iBAAiB,EAAE,MAAM,EAAE,QAAQ,CAAC,YAAY,IAAI,QAAQ,CAAC,kBAAkB,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ;gBACzH,GAAG,CAAC,QAAQ,CAAC,YAAY,IAAI,QAAQ,CAAC,kBAAkB,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,0BAA0B,EAAE,CAAC,EAAE;SAC3H,CAAC;QACF,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,0BAA0B,CAAC,QAAQ,CAAC,CAAC;QAClE,MAAM,CAAC,IAAI,CACT,EAAE,OAAO,EAAE,yBAAyB,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAC/H,EAAE,OAAO,EAAE,cAAc,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EACpH,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,iBAAiB,CAAC,QAAQ,CAAC,CAC/C,CAAC;QACF,MAAM,gBAAgB,GAAG,IAAI,CAAC,IAAI,CAAC,qBAAqB,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;QAC3E,OAAO,kCAAkC,CAAC,EAAE,YAAY,EAAE,UAAU,EAAE,QAAQ,CAAC,UAAU,EAAE,cAAc,EAAE,gBAAgB,EAAE,MAAM,EAAE,CAAC,CAAC;IACzI,CAAC;IAEO,OAAO,CAAC,YAAoB,EAAE,OAAyB,EAAE,MAAiC;QAChG,MAAM,gBAAgB,GAAG,IAAI,CAAC,IAAI,CAAC,qBAAqB,CAAC,MAAM,CAAC,CAAC;QACjE,OAAO;YACL,MAAM,EAAE,SAAS,EAAE,YAAY,EAAE,UAAU,EAAE,OAAO,CAAC,kBAAkB;YACvE,cAAc,EAAE,OAAO,CAAC,sBAAsB,EAAE,gBAAgB;YAChE,YAAY,EAAE,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU,IAAI,mBAAmB,EAAE,CAAC,CAAC;SACrH,CAAC;IACJ,CAAC;CACF"}

package/dist/runtime-v2/activation/rulecode-owner-decision-service.d.ts

@@ -0,0 +1,104 @@
+import type { ActivationDecisionRecord } from './activation-control-types.js';
+export interface PromotionEvidenceSnapshot {
+    snapshotId: string;
+    snapshotDigest: string;
+    artifactDigest: string;
+    lineageRefs: string[];
+    hostRuntimeVersion: string;
+    safetyGateResults: {
+        checkId: string;
+        status: 'passed' | 'failed';
+        reasonCode?: string;
+    }[];
+    shadowSummary: {
+        observed: number | null;
+        matched: number | null;
+        wouldBlock: number | null;
+        wouldAllow: number | null;
+        requireApproval: number | null;
+        autoCorrect: number | null;
+        errors: number | null;
+        neutralControl: number | null;
+        firstObservedAt: string | null;
+        lastObservedAt: string | null;
+    };
+    configurationVersion: string;
+    redaction: {
+        version: string;
+        rawParametersStored: false;
+    };
+    createdAt: string;
+}
+export interface PromotionFailedCheck {
+    checkId: string;
+    reasonCode: string;
+}
+export interface PromotionReadinessResult {
+    status: 'ready' | 'evidence_insufficient' | 'blocked' | 'unavailable';
+    evaluationId: string;
+    artifactId: string;
+    artifactDigest: string;
+    evidenceSnapshot: PromotionEvidenceSnapshot;
+    failedChecks: PromotionFailedCheck[];
+}
+export interface OwnerPromotionActor {
+    principal: ActivationDecisionRecord['principal'];
+    authentication: ActivationDecisionRecord['authentication'];
+    operator?: ActivationDecisionRecord['operator'];
+}
+export interface OwnerPromotionRequest {
+    activationId: string;
+    expectedArtifactId: string;
+    expectedArtifactDigest: string;
+    expectedControlVersion: number;
+    idempotencyKey: string;
+    reasonCode: string;
+    note?: string;
+    confirmed: boolean;
+    dryRun?: boolean;
+}
+export interface PromotionCommitInput {
+    decision: ActivationDecisionRecord;
+    evidenceSnapshot: PromotionEvidenceSnapshot;
+    readinessEvaluationId: string;
+    evidenceSnapshotDigest: string;
+    expectedControlVersion: number;
+    idempotencyKey: string;
+}
+export type OwnerPromotionResult = {
+    ok: true;
+    decision: 'promoted';
+    activationId: string;
+    decisionId: string;
+    promotedAt: string;
+} | {
+    ok: true;
+    decision: 'would_promote';
+    activationId: string;
+    readinessEvaluationId: string;
+    evidenceSnapshotDigest: string;
+} | {
+    ok: false;
+    reasonCode: string;
+    summary: string;
+    failedChecks: PromotionFailedCheck[];
+    nextAction: string;
+};
+export interface RuleCodeOwnerDecisionServiceDeps {
+    ownerLiveDecisionEnabled(): boolean;
+    safetyControlsEnabled(): boolean;
+    evaluateReadiness(input: OwnerPromotionRequest): Promise<PromotionReadinessResult>;
+    commitPromotion(input: PromotionCommitInput): Promise<{
+        activationId: string;
+        decisionId: string;
+        promotedAt: string;
+    }>;
+    newDecisionId(): string;
+    now(): string;
+}
+export declare class RuleCodeOwnerDecisionService {
+    private readonly deps;
+    constructor(deps: RuleCodeOwnerDecisionServiceDeps);
+    promote(request: OwnerPromotionRequest, actor: OwnerPromotionActor): Promise<OwnerPromotionResult>;
+}
+//# sourceMappingURL=rulecode-owner-decision-service.d.ts.map

package/dist/runtime-v2/activation/rulecode-owner-decision-service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rulecode-owner-decision-service.d.ts","sourceRoot":"","sources":["../../../src/runtime-v2/activation/rulecode-owner-decision-service.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,+BAA+B,CAAC;AAE9E,MAAM,WAAW,yBAAyB;IACxC,UAAU,EAAE,MAAM,CAAC;IACnB,cAAc,EAAE,MAAM,CAAC;IACvB,cAAc,EAAE,MAAM,CAAC;IACvB,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,kBAAkB,EAAE,MAAM,CAAC;IAC3B,iBAAiB,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,QAAQ,GAAG,QAAQ,CAAC;QAAC,UAAU,CAAC,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;IAC3F,aAAa,EAAE;QACb,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;QACxB,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;QACvB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;QAC1B,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;QAC1B,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;QAC/B,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;QAC3B,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;QACtB,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;QAC9B,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;QAC/B,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;KAC/B,CAAC;IACF,oBAAoB,EAAE,MAAM,CAAC;IAC7B,SAAS,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,mBAAmB,EAAE,KAAK,CAAA;KAAE,CAAC;IAC3D,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,oBAAoB;IACnC,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,wBAAwB;IACvC,MAAM,EAAE,OAAO,GAAG,uBAAuB,GAAG,SAAS,GAAG,aAAa,CAAC;IACtE,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;IACnB,cAAc,EAAE,MAAM,CAAC;IACvB,gBAAgB,EAAE,yBAAyB,CAAC;IAC5C,YAAY,EAAE,oBAAoB,EAAE,CAAC;CACtC;AAED,MAAM,WAAW,mBAAmB;IAClC,SAAS,EAAE,wBAAwB,CAAC,WAAW,CAAC,CAAC;IACjD,cAAc,EAAE,wBAAwB,CAAC,gBAAgB,CAAC,CAAC;IAC3D,QAAQ,CAAC,EAAE,wBAAwB,CAAC,UAAU,CAAC,CAAC;CACjD;AAED,MAAM,WAAW,qBAAqB;IACpC,YAAY,EAAE,MAAM,CAAC;IACrB,kBAAkB,EAAE,MAAM,CAAC;IAC3B,sBAAsB,EAAE,MAAM,CAAC;IAC/B,sBAAsB,EAAE,MAAM,CAAC;IAC/B,cAAc,EAAE,MAAM,CAAC;IACvB,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,OAAO,CAAC;IACnB,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;AAED,MAAM,WAAW,oBAAoB;IACnC,QAAQ,EAAE,wBAAwB,CAAC;IACnC,gBAAgB,EAAE,yBAAyB,CAAC;IAC5C,qBAAqB,EAAE,MAAM,CAAC;IAC9B,sBAAsB,EAAE,MAAM,CAAC;IAC/B,sBAAsB,EAAE,MAAM,CAAC;IAC/B,cAAc,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,MAAM,oBAAoB,GAC5B;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,QAAQ,EAAE,UAAU,CAAC;IAAC,YAAY,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,GAChG;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,QAAQ,EAAE,eAAe,CAAC;IAAC,YAAY,EAAE,MAAM,CAAC;IAAC,qBAAqB,EAAE,MAAM,CAAC;IAAC,sBAAsB,EAAE,MAAM,CAAA;CAAE,GAC5H;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,oBAAoB,EAAE,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,CAAC;AAEjH,MAAM,WAAW,gCAAgC;IAC/C,wBAAwB,IAAI,OAAO,CAAC;IACpC,qBAAqB,IAAI,OAAO,CAAC;IACjC,iBAAiB,CAAC,KAAK,EAAE,qBAAqB,GAAG,OAAO,CAAC,wBAAwB,CAAC,CAAC;IACnF,eAAe,CAAC,KAAK,EAAE,oBAAoB,GAAG,OAAO,CAAC;QAAE,YAAY,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACxH,aAAa,IAAI,MAAM,CAAC;IACxB,GAAG,IAAI,MAAM,CAAC;CACf;AAMD,qBAAa,4BAA4B;IAC3B,OAAO,CAAC,QAAQ,CAAC,IAAI;IAAjC,YAA6B,IAAI,EAAE,gCAAgC,EAAI;IAEjE,OAAO,CAAC,OAAO,EAAE,qBAAqB,EAAE,KAAK,EAAE,mBAAmB,GAAG,OAAO,CAAC,oBAAoB,CAAC,CA6EvG;CACF"}

package/dist/runtime-v2/activation/rulecode-owner-decision-service.js

@@ -0,0 +1,86 @@
+function refused(input) {
+    return { ok: false, ...input, failedChecks: input.failedChecks ?? [] };
+}
+export class RuleCodeOwnerDecisionService {
+    deps;
+    constructor(deps) {
+        this.deps = deps;
+    }
+    async promote(request, actor) {
+        if (!this.deps.ownerLiveDecisionEnabled()) {
+            return refused({ reasonCode: 'feature_not_enabled', summary: 'Owner live decisions are disabled.', nextAction: 'Enable rulecode_owner_live_decision after completing its rollout gate.' });
+        }
+        if (!this.deps.safetyControlsEnabled()) {
+            return refused({ reasonCode: 'safety_controls_unavailable', summary: 'Durable RuleCode safety controls are unavailable.', nextAction: 'Restore rulecode_safety_controls or disable code_tool_hook enforcement.' });
+        }
+        const authenticatedOwner = actor.principal.kind === 'configured_owner'
+            && (actor.authentication.method === 'console_token' || actor.authentication.method === 'cli_owner_credential');
+        if (!authenticatedOwner) {
+            return refused({ reasonCode: 'owner_authentication_required', summary: 'Promotion requires the configured Owner credential.', nextAction: 'Authenticate as the configured Owner; local break-glass authority may only stop enforcement.' });
+        }
+        if (actor.authentication.method === 'cli_owner_credential' && (!request.note || request.note.trim().length === 0)) {
+            return refused({ reasonCode: 'cli_owner_note_required', summary: 'CLI promotion requires an Owner review note.', nextAction: 'Provide a concise --note explaining the live decision.' });
+        }
+        if (!request.confirmed && request.dryRun !== true) {
+            return refused({ reasonCode: 'confirmation_required', summary: 'Live enforcement was not confirmed.', nextAction: 'Refresh the review evidence and explicitly confirm promotion.' });
+        }
+        if (!request.activationId || !request.expectedArtifactId || !request.expectedArtifactDigest || !request.idempotencyKey || !request.reasonCode) {
+            return refused({ reasonCode: 'promotion_request_invalid', summary: 'Required promotion binding fields are missing.', nextAction: 'Refresh the Owner review and submit all optimistic preconditions.' });
+        }
+        const readiness = await this.deps.evaluateReadiness(request);
+        if (readiness.status === 'blocked' || readiness.status === 'unavailable') {
+            return refused({
+                reasonCode: readiness.status === 'blocked' ? 'promotion_safety_gate_blocked' : 'promotion_readiness_unavailable',
+                summary: readiness.status === 'blocked' ? 'One or more hard promotion checks failed.' : 'Promotion readiness could not be established.',
+                nextAction: 'Review the failed checks, repair them, and refresh the Owner review before retrying.',
+                failedChecks: readiness.failedChecks,
+            });
+        }
+        if (readiness.artifactId !== request.expectedArtifactId || readiness.artifactDigest !== request.expectedArtifactDigest
+            || readiness.evidenceSnapshot.artifactDigest !== readiness.artifactDigest) {
+            return refused({ reasonCode: 'promotion_snapshot_stale', summary: 'The activation artifact changed during review.', nextAction: 'Refresh the Owner review and evaluate the current artifact version.' });
+        }
+        if (readiness.status === 'evidence_insufficient') {
+            const allowedOverrideReasons = new Set(['rare_behavior', 'controlled_rollout', 'owner_accepts_limited_evidence']);
+            if (!allowedOverrideReasons.has(request.reasonCode)) {
+                return refused({ reasonCode: 'evidence_override_reason_required', summary: 'Evidence-insufficient promotion requires a predefined Owner reason.', nextAction: 'Choose rare_behavior, controlled_rollout, or owner_accepts_limited_evidence.' });
+            }
+            if (!request.note || request.note.trim().length === 0) {
+                return refused({ reasonCode: 'evidence_override_note_required', summary: 'Evidence-insufficient promotion requires an Owner note.', nextAction: 'Explain why promotion is acceptable despite insufficient evidence.' });
+            }
+        }
+        if (request.dryRun === true) {
+            return {
+                ok: true, decision: 'would_promote', activationId: request.activationId,
+                readinessEvaluationId: readiness.evaluationId,
+                evidenceSnapshotDigest: readiness.evidenceSnapshot.snapshotDigest,
+            };
+        }
+        const decidedAt = this.deps.now();
+        const decision = {
+            decisionId: this.deps.newDecisionId(),
+            subject: {
+                kind: 'activation', activationId: request.activationId,
+                artifactId: readiness.artifactId, artifactDigest: readiness.artifactDigest,
+            },
+            decision: 'promote_live',
+            principal: actor.principal,
+            authentication: actor.authentication,
+            operator: actor.operator,
+            reasonCode: request.reasonCode,
+            note: request.note?.trim() || null,
+            evidenceSnapshotId: readiness.evidenceSnapshot.snapshotId,
+            decidedAt,
+        };
+        const committed = await this.deps.commitPromotion({
+            decision,
+            evidenceSnapshot: readiness.evidenceSnapshot,
+            readinessEvaluationId: readiness.evaluationId,
+            evidenceSnapshotDigest: readiness.evidenceSnapshot.snapshotDigest,
+            expectedControlVersion: request.expectedControlVersion,
+            idempotencyKey: request.idempotencyKey,
+        });
+        return { ok: true, decision: 'promoted', ...committed };
+    }
+}
+//# sourceMappingURL=rulecode-owner-decision-service.js.map

package/dist/runtime-v2/activation/rulecode-owner-decision-service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rulecode-owner-decision-service.js","sourceRoot":"","sources":["../../../src/runtime-v2/activation/rulecode-owner-decision-service.ts"],"names":[],"mappings":"AAiFA,SAAS,OAAO,CAAC,KAAyG;IACxH,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,GAAG,KAAK,EAAE,YAAY,EAAE,KAAK,CAAC,YAAY,IAAI,EAAE,EAAE,CAAC;AACzE,CAAC;AAED,MAAM,OAAO,4BAA4B;IACV,IAAI;IAAjC,YAA6B,IAAsC;oBAAtC,IAAI;IAAqC,CAAC;IAEvE,KAAK,CAAC,OAAO,CAAC,OAA8B,EAAE,KAA0B;QACtE,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,wBAAwB,EAAE,EAAE,CAAC;YAC1C,OAAO,OAAO,CAAC,EAAE,UAAU,EAAE,qBAAqB,EAAE,OAAO,EAAE,oCAAoC,EAAE,UAAU,EAAE,wEAAwE,EAAE,CAAC,CAAC;QAC7L,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,qBAAqB,EAAE,EAAE,CAAC;YACvC,OAAO,OAAO,CAAC,EAAE,UAAU,EAAE,6BAA6B,EAAE,OAAO,EAAE,mDAAmD,EAAE,UAAU,EAAE,yEAAyE,EAAE,CAAC,CAAC;QACrN,CAAC;QACD,MAAM,kBAAkB,GAAG,KAAK,CAAC,SAAS,CAAC,IAAI,KAAK,kBAAkB;eACjE,CAAC,KAAK,CAAC,cAAc,CAAC,MAAM,KAAK,eAAe,IAAI,KAAK,CAAC,cAAc,CAAC,MAAM,KAAK,sBAAsB,CAAC,CAAC;QACjH,IAAI,CAAC,kBAAkB,EAAE,CAAC;YACxB,OAAO,OAAO,CAAC,EAAE,UAAU,EAAE,+BAA+B,EAAE,OAAO,EAAE,qDAAqD,EAAE,UAAU,EAAE,8FAA8F,EAAE,CAAC,CAAC;QAC9O,CAAC;QACD,IAAI,KAAK,CAAC,cAAc,CAAC,MAAM,KAAK,sBAAsB,IAAI,CAAC,CAAC,OAAO,CAAC,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,CAAC,EAAE,CAAC;YAClH,OAAO,OAAO,CAAC,EAAE,UAAU,EAAE,yBAAyB,EAAE,OAAO,EAAE,8CAA8C,EAAE,UAAU,EAAE,wDAAwD,EAAE,CAAC,CAAC;QAC3L,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,SAAS,IAAI,OAAO,CAAC,MAAM,KAAK,IAAI,EAAE,CAAC;YAClD,OAAO,OAAO,CAAC,EAAE,UAAU,EAAE,uBAAuB,EAAE,OAAO,EAAE,qCAAqC,EAAE,UAAU,EAAE,+DAA+D,EAAE,CAAC,CAAC;QACvL,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,YAAY,IAAI,CAAC,OAAO,CAAC,kBAAkB,IAAI,CAAC,OAAO,CAAC,sBAAsB,IAAI,CAAC,OAAO,CAAC,cAAc,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,CAAC;YAC9I,OAAO,OAAO,CAAC,EAAE,UAAU,EAAE,2BAA2B,EAAE,OAAO,EAAE,gDAAgD,EAAE,UAAU,EAAE,mEAAmE,EAAE,CAAC,CAAC;QAC1M,CAAC;QAED,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,iBAAiB,CAAC,OAAO,CAAC,CAAC;QAC7D,IAAI,SAAS,CAAC,MAAM,KAAK,SAAS,IAAI,SAAS,CAAC,MAAM,KAAK,aAAa,EAAE,CAAC;YACzE,OAAO,OAAO,CAAC;gBACb,UAAU,EAAE,SAAS,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,+BAA+B,CAAC,CAAC,CAAC,iCAAiC;gBAChH,OAAO,EAAE,SAAS,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,2CAA2C,CAAC,CAAC,CAAC,+CAA+C;gBACvI,UAAU,EAAE,sFAAsF;gBAClG,YAAY,EAAE,SAAS,CAAC,YAAY;aACrC,CAAC,CAAC;QACL,CAAC;QACD,IAAI,SAAS,CAAC,UAAU,KAAK,OAAO,CAAC,kBAAkB,IAAI,SAAS,CAAC,cAAc,KAAK,OAAO,CAAC,sBAAsB;eACjH,SAAS,CAAC,gBAAgB,CAAC,cAAc,KAAK,SAAS,CAAC,cAAc,EAAE,CAAC;YAC5E,OAAO,OAAO,CAAC,EAAE,UAAU,EAAE,0BAA0B,EAAE,OAAO,EAAE,gDAAgD,EAAE,UAAU,EAAE,qEAAqE,EAAE,CAAC,CAAC;QAC3M,CAAC;QACD,IAAI,SAAS,CAAC,MAAM,KAAK,uBAAuB,EAAE,CAAC;YACjD,MAAM,sBAAsB,GAAG,IAAI,GAAG,CAAC,CAAC,eAAe,EAAE,oBAAoB,EAAE,gCAAgC,CAAC,CAAC,CAAC;YAClH,IAAI,CAAC,sBAAsB,CAAC,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;gBACpD,OAAO,OAAO,CAAC,EAAE,UAAU,EAAE,mCAAmC,EAAE,OAAO,EAAE,qEAAqE,EAAE,UAAU,EAAE,8EAA8E,EAAE,CAAC,CAAC;YAClP,CAAC;YACD,IAAI,CAAC,OAAO,CAAC,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACtD,OAAO,OAAO,CAAC,EAAE,UAAU,EAAE,iCAAiC,EAAE,OAAO,EAAE,yDAAyD,EAAE,UAAU,EAAE,oEAAoE,EAAE,CAAC,CAAC;YAC1N,CAAC;QACH,CAAC;QACD,IAAI,OAAO,CAAC,MAAM,KAAK,IAAI,EAAE,CAAC;YAC5B,OAAO;gBACL,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,eAAe,EAAE,YAAY,EAAE,OAAO,CAAC,YAAY;gBACvE,qBAAqB,EAAE,SAAS,CAAC,YAAY;gBAC7C,sBAAsB,EAAE,SAAS,CAAC,gBAAgB,CAAC,cAAc;aAClE,CAAC;QACJ,CAAC;QAED,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC;QAClC,MAAM,QAAQ,GAA6B;YACzC,UAAU,EAAE,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE;YACrC,OAAO,EAAE;gBACP,IAAI,EAAE,YAAY,EAAE,YAAY,EAAE,OAAO,CAAC,YAAY;gBACtD,UAAU,EAAE,SAAS,CAAC,UAAU,EAAE,cAAc,EAAE,SAAS,CAAC,cAAc;aAC3E;YACD,QAAQ,EAAE,cAAc;YACxB,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,cAAc,EAAE,KAAK,CAAC,cAAc;YACpC,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,UAAU,EAAE,OAAO,CAAC,UAAU;YAC9B,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,IAAI;YAClC,kBAAkB,EAAE,SAAS,CAAC,gBAAgB,CAAC,UAAU;YACzD,SAAS;SACV,CAAC;QACF,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC;YAChD,QAAQ;YACR,gBAAgB,EAAE,SAAS,CAAC,gBAAgB;YAC5C,qBAAqB,EAAE,SAAS,CAAC,YAAY;YAC7C,sBAAsB,EAAE,SAAS,CAAC,gBAAgB,CAAC,cAAc;YACjE,sBAAsB,EAAE,OAAO,CAAC,sBAAsB;YACtD,cAAc,EAAE,OAAO,CAAC,cAAc;SACvC,CAAC,CAAC;QACH,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,UAAU,EAAE,GAAG,SAAS,EAAE,CAAC;IAC1D,CAAC;CACF"}

package/dist/runtime-v2/activation/rulecode-safety-circuit-breaker.d.ts

@@ -0,0 +1,25 @@
+export interface RuleCodeSafetySample {
+    toolName: string;
+    decision: 'allow' | 'block' | 'requireApproval' | 'auto_correct' | 'error';
+    outsideApprovedScope: boolean;
+    protectedCapabilityMatched?: boolean;
+    neutralProbeFailed?: boolean;
+    healthFailure?: 'load' | 'compatibility' | 'context' | 'invalid_result' | 'timeout' | 'exception';
+}
+export interface RuleCodeSafetyCircuitState {
+    consecutiveErrors: number;
+    consecutiveBlocks: {
+        toolName: string;
+    }[];
+    latestEligible: {
+        blocked: boolean;
+        outsideApprovedScope: boolean;
+    }[];
+}
+export type RuleCodeSafetyTripReason = 'protected_capability_matched' | 'host_liveness_probe_failed' | 'runtime_health_failure' | 'three_consecutive_errors' | 'broad_consecutive_blocking' | 'outside_scope_block_ratio';
+export declare function initialRuleCodeSafetyCircuitState(): RuleCodeSafetyCircuitState;
+export declare function evaluateRuleCodeSafetyCircuit(state: RuleCodeSafetyCircuitState, sample: RuleCodeSafetySample): {
+    state: RuleCodeSafetyCircuitState;
+    trip: RuleCodeSafetyTripReason | null;
+};
+//# sourceMappingURL=rulecode-safety-circuit-breaker.d.ts.map

package/dist/runtime-v2/activation/rulecode-safety-circuit-breaker.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rulecode-safety-circuit-breaker.d.ts","sourceRoot":"","sources":["../../../src/runtime-v2/activation/rulecode-safety-circuit-breaker.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,oBAAoB;IACnC,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,OAAO,GAAG,OAAO,GAAG,iBAAiB,GAAG,cAAc,GAAG,OAAO,CAAC;IAC3E,oBAAoB,EAAE,OAAO,CAAC;IAC9B,0BAA0B,CAAC,EAAE,OAAO,CAAC;IACrC,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B,aAAa,CAAC,EAAE,MAAM,GAAG,eAAe,GAAG,SAAS,GAAG,gBAAgB,GAAG,SAAS,GAAG,WAAW,CAAC;CACnG;AAED,MAAM,WAAW,0BAA0B;IACzC,iBAAiB,EAAE,MAAM,CAAC;IAC1B,iBAAiB,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;IAC1C,cAAc,EAAE;QAAE,OAAO,EAAE,OAAO,CAAC;QAAC,oBAAoB,EAAE,OAAO,CAAA;KAAE,EAAE,CAAC;CACvE;AAED,MAAM,MAAM,wBAAwB,GAAG,8BAA8B,GAAG,4BAA4B,GAAG,wBAAwB,GAAG,0BAA0B,GAAG,4BAA4B,GAAG,2BAA2B,CAAC;AAE1N,wBAAgB,iCAAiC,IAAI,0BAA0B,CAE9E;AAED,wBAAgB,6BAA6B,CAAC,KAAK,EAAE,0BAA0B,EAAE,MAAM,EAAE,oBAAoB,GAAG;IAAE,KAAK,EAAE,0BAA0B,CAAC;IAAC,IAAI,EAAE,wBAAwB,GAAG,IAAI,CAAA;CAAE,CAY3L"}

package/dist/runtime-v2/activation/rulecode-safety-circuit-breaker.js

@@ -0,0 +1,23 @@
+export function initialRuleCodeSafetyCircuitState() {
+    return { consecutiveErrors: 0, consecutiveBlocks: [], latestEligible: [] };
+}
+export function evaluateRuleCodeSafetyCircuit(state, sample) {
+    if (sample.protectedCapabilityMatched)
+        return { state, trip: 'protected_capability_matched' };
+    if (sample.neutralProbeFailed)
+        return { state, trip: 'host_liveness_probe_failed' };
+    if (sample.healthFailure)
+        return { state, trip: 'runtime_health_failure' };
+    const consecutiveErrors = sample.decision === 'error' ? state.consecutiveErrors + 1 : 0;
+    const consecutiveBlocks = sample.decision === 'block' ? [...state.consecutiveBlocks, { toolName: sample.toolName }].slice(-5) : [];
+    const latestEligible = [...state.latestEligible, { blocked: sample.decision === 'block', outsideApprovedScope: sample.outsideApprovedScope }].slice(-20);
+    const next = { consecutiveErrors, consecutiveBlocks, latestEligible };
+    if (consecutiveErrors >= 3)
+        return { state: next, trip: 'three_consecutive_errors' };
+    if (consecutiveBlocks.length >= 5 && new Set(consecutiveBlocks.map(value => value.toolName)).size >= 3)
+        return { state: next, trip: 'broad_consecutive_blocking' };
+    if (latestEligible.length === 20 && latestEligible.filter(value => value.blocked && value.outsideApprovedScope).length / 20 > 0.8)
+        return { state: next, trip: 'outside_scope_block_ratio' };
+    return { state: next, trip: null };
+}
+//# sourceMappingURL=rulecode-safety-circuit-breaker.js.map

package/dist/runtime-v2/activation/rulecode-safety-circuit-breaker.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rulecode-safety-circuit-breaker.js","sourceRoot":"","sources":["../../../src/runtime-v2/activation/rulecode-safety-circuit-breaker.ts"],"names":[],"mappings":"AAiBA,MAAM,UAAU,iCAAiC;IAC/C,OAAO,EAAE,iBAAiB,EAAE,CAAC,EAAE,iBAAiB,EAAE,EAAE,EAAE,cAAc,EAAE,EAAE,EAAE,CAAC;AAC7E,CAAC;AAED,MAAM,UAAU,6BAA6B,CAAC,KAAiC,EAAE,MAA4B;IAC3G,IAAI,MAAM,CAAC,0BAA0B;QAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,8BAA8B,EAAE,CAAC;IAC9F,IAAI,MAAM,CAAC,kBAAkB;QAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,4BAA4B,EAAE,CAAC;IACpF,IAAI,MAAM,CAAC,aAAa;QAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,wBAAwB,EAAE,CAAC;IAC3E,MAAM,iBAAiB,GAAG,MAAM,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,iBAAiB,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACxF,MAAM,iBAAiB,GAAG,MAAM,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,iBAAiB,EAAE,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACnI,MAAM,cAAc,GAAG,CAAC,GAAG,KAAK,CAAC,cAAc,EAAE,EAAE,OAAO,EAAE,MAAM,CAAC,QAAQ,KAAK,OAAO,EAAE,oBAAoB,EAAE,MAAM,CAAC,oBAAoB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC;IACzJ,MAAM,IAAI,GAAG,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,cAAc,EAAE,CAAC;IACtE,IAAI,iBAAiB,IAAI,CAAC;QAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,0BAA0B,EAAE,CAAC;IACrF,IAAI,iBAAiB,CAAC,MAAM,IAAI,CAAC,IAAI,IAAI,GAAG,CAAC,iBAAiB,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;QAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,4BAA4B,EAAE,CAAC;IACnK,IAAI,cAAc,CAAC,MAAM,KAAK,EAAE,IAAI,cAAc,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,OAAO,IAAI,KAAK,CAAC,oBAAoB,CAAC,CAAC,MAAM,GAAG,EAAE,GAAG,GAAG;QAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,2BAA2B,EAAE,CAAC;IAC7L,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;AACrC,CAAC"}

package/dist/runtime-v2/activation/rulecode-shadow-summary.d.ts

@@ -0,0 +1,14 @@
+export interface RuleCodeShadowSummary {
+    observed: number;
+    matched: number;
+    wouldBlock: number;
+    wouldAllow: number;
+    requireApproval: number;
+    autoCorrect: number;
+    errors: number;
+    neutralControl: number;
+    firstObservedAt: string | null;
+    lastObservedAt: string | null;
+}
+export declare function summarizeRuleCodeShadowEvents(entries: readonly unknown[], activationId: string): RuleCodeShadowSummary;
+//# sourceMappingURL=rulecode-shadow-summary.d.ts.map

package/dist/runtime-v2/activation/rulecode-shadow-summary.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rulecode-shadow-summary.d.ts","sourceRoot":"","sources":["../../../src/runtime-v2/activation/rulecode-shadow-summary.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,qBAAqB;IACpC,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,eAAe,EAAE,MAAM,CAAC;IACxB,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,MAAM,CAAC;IACf,cAAc,EAAE,MAAM,CAAC;IACvB,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;CAC/B;AAGD,wBAAgB,6BAA6B,CAAC,OAAO,EAAE,SAAS,OAAO,EAAE,EAAE,YAAY,EAAE,MAAM,GAAG,qBAAqB,CA2CtH"}