@principles/core 1.287.1 → 1.287.2

package/dist/runtime-v2/activation/index.d.ts

@@ -19,8 +19,8 @@ export { collectOpenClawPromotionChecks } from './openclaw-promotion-checks.js';
 export type { HostLivenessContract } from './openclaw-promotion-checks.js';
 export { summarizeRuleCodeShadowEvents } from './rulecode-shadow-summary.js';
 export type { RuleCodeShadowSummary } from './rulecode-shadow-summary.js';
-export { buildPromotionEvidenceSnapshot, computeArtifactDigest, normalizeOwnerIdentity } from './promotion-evidence-snapshot.js';
-export type { BuildPromotionEvidenceSnapshotInput, PromotionEvidenceOwnerIdentity } from './promotion-evidence-snapshot.js';
+export { buildPromotionEvidenceSnapshot, computeArtifactDigest, normalizeOwnerIdentity, verifyPiArtifactRowDigest } from './promotion-evidence-snapshot.js';
+export type { BuildPromotionEvidenceSnapshotInput, PromotionEvidenceOwnerIdentity, ArtifactDigestCheck } from './promotion-evidence-snapshot.js';
 export { ApprovalQueue, decideAutoPromotion } from './approval-queue.js';
 export { MemoryApprovalQueueStore } from './memory-approval-store.js';
 export { SqliteApprovalQueueStore } from './sqlite-approval-store.js';

package/dist/runtime-v2/activation/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/runtime-v2/activation/index.ts"],"names":[],"mappings":"AAAA,YAAY,EACV,mBAAmB,EACnB,eAAe,EACf,yBAAyB,EACzB,aAAa,EACb,kBAAkB,EAClB,kBAAkB,EAClB,2BAA2B,EAC3B,sBAAsB,EACtB,wBAAwB,EACxB,WAAW,EACX,YAAY,EACZ,iBAAiB,EACjB,aAAa,EACb,sBAAsB,EACtB,cAAc,EACd,0BAA0B,EAC1B,cAAc,EACd,cAAc,EACd,oBAAoB,EACpB,cAAc,EACd,sBAAsB,EACtB,kBAAkB,EAClB,eAAe,EACf,mBAAmB,EACnB,kBAAkB,EAClB,uBAAuB,EACvB,aAAa,EACb,kBAAkB,GACnB,MAAM,uBAAuB,CAAC;AAE/B,OAAO,EACL,oBAAoB,EACpB,iBAAiB,EACjB,qBAAqB,EACrB,kBAAkB,EAClB,gBAAgB,EAChB,mBAAmB,EACnB,mCAAmC,EACnC,wBAAwB,EACxB,oBAAoB,GACrB,MAAM,uBAAuB,CAAC;AAE/B,OAAO,EAAE,oBAAoB,EAAE,MAAM,4BAA4B,CAAC;AAClE,YAAY,EAAE,gBAAgB,EAAE,MAAM,4BAA4B,CAAC;AAEnE,OAAO,EACL,YAAY,EACZ,kBAAkB,EAClB,kBAAkB,GACnB,MAAM,uBAAuB,CAAC;AAE/B,OAAO,EACL,0BAA0B,EAC1B,uBAAuB,GACxB,MAAM,oCAAoC,CAAC;AAE5C,OAAO,EAAE,0BAA0B,EAAE,MAAM,oCAAoC,CAAC;AAChF,OAAO,EAAE,2BAA2B,EAAE,MAAM,qCAAqC,CAAC;AAClF,YAAY,EAAE,wBAAwB,EAAE,yBAAyB,EAAE,sBAAsB,EAAE,sBAAsB,EAAE,mBAAmB,EAAE,MAAM,+BAA+B,CAAC;AAC9K,OAAO,EAAE,4BAA4B,EAAE,MAAM,sCAAsC,CAAC;AACpF,YAAY,EACV,yBAAyB,EAAE,oBAAoB,EAAE,wBAAwB,EACzE,mBAAmB,EAAE,qBAAqB,EAAE,oBAAoB,EAAE,oBAAoB,EACtF,gCAAgC,GACjC,MAAM,sCAAsC,CAAC;AAC9C,OAAO,EAAE,4BAA4B,EAAE,kCAAkC,EAAE,MAAM,oCAAoC,CAAC;AACtH,YAAY,EAAE,gBAAgB,EAAE,uBAAuB,EAAE,iCAAiC,EAAE,MAAM,oCAAoC,CAAC;AACvI,OAAO,EAAE,wBAAwB,EAAE,MAAM,iCAAiC,CAAC;AAC3E,YAAY,EAAE,4BAA4B,EAAE,MAAM,iCAAiC,CAAC;AACpF,OAAO,EAAE,6BAA6B,EAAE,iCAAiC,EAAE,MAAM,sCAAsC,CAAC;AACxH,YAAY,EAAE,oBAAoB,EAAE,0BAA0B,EAAE,wBAAwB,EAAE,MAAM,sCAAsC,CAAC;AACvI,OAAO,EAAE,8BAA8B,EAAE,MAAM,gCAAgC,CAAC;AAChF,YAAY,EAAE,oBAAoB,EAAE,MAAM,gCAAgC,CAAC;AAC3E,OAAO,EAAE,6BAA6B,EAAE,MAAM,8BAA8B,CAAC;AAC7E,YAAY,EAAE,qBAAqB,EAAE,MAAM,8BAA8B,CAAC;AAC1E,OAAO,EAAE,8BAA8B,EAAE,qBAAqB,EAAE,sBAAsB,EAAE,MAAM,kCAAkC,CAAC;AACjI,YAAY,EAAE,mCAAmC,EAAE,8BAA8B,EAAE,MAAM,kCAAkC,CAAC;AAE5H,OAAO,EAAE,aAAa,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAEzE,OAAO,EAAE,wBAAwB,EAAE,MAAM,4BAA4B,CAAC;AAEtE,OAAO,EAAE,wBAAwB,EAAE,MAAM,4BAA4B,CAAC;AAEtE,OAAO,EAAE,cAAc,EAAE,mBAAmB,EAAE,MAAM,+BAA+B,CAAC;AACpF,YAAY,EAAE,oBAAoB,EAAE,MAAM,+BAA+B,CAAC;AAK1E,OAAO,EAAE,wBAAwB,EAAE,4BAA4B,EAAE,MAAM,2BAA2B,CAAC;AAInG,OAAO,EAAE,yBAAyB,EAAE,MAAM,kCAAkC,CAAC;AAC7E,YAAY,EAAE,uBAAuB,EAAE,wBAAwB,EAAE,MAAM,kCAAkC,CAAC;AAE1G,OAAO,EACL,2BAA2B,EAC3B,QAAQ,IAAI,gBAAgB,EAC5B,uBAAuB,EACvB,4BAA4B,EAC5B,YAAY,EACZ,4BAA4B,GAC7B,MAAM,wCAAwC,CAAC;AAEhD,YAAY,EACV,kBAAkB,EAClB,4BAA4B,GAC7B,MAAM,wCAAwC,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/runtime-v2/activation/index.ts"],"names":[],"mappings":"AAAA,YAAY,EACV,mBAAmB,EACnB,eAAe,EACf,yBAAyB,EACzB,aAAa,EACb,kBAAkB,EAClB,kBAAkB,EAClB,2BAA2B,EAC3B,sBAAsB,EACtB,wBAAwB,EACxB,WAAW,EACX,YAAY,EACZ,iBAAiB,EACjB,aAAa,EACb,sBAAsB,EACtB,cAAc,EACd,0BAA0B,EAC1B,cAAc,EACd,cAAc,EACd,oBAAoB,EACpB,cAAc,EACd,sBAAsB,EACtB,kBAAkB,EAClB,eAAe,EACf,mBAAmB,EACnB,kBAAkB,EAClB,uBAAuB,EACvB,aAAa,EACb,kBAAkB,GACnB,MAAM,uBAAuB,CAAC;AAE/B,OAAO,EACL,oBAAoB,EACpB,iBAAiB,EACjB,qBAAqB,EACrB,kBAAkB,EAClB,gBAAgB,EAChB,mBAAmB,EACnB,mCAAmC,EACnC,wBAAwB,EACxB,oBAAoB,GACrB,MAAM,uBAAuB,CAAC;AAE/B,OAAO,EAAE,oBAAoB,EAAE,MAAM,4BAA4B,CAAC;AAClE,YAAY,EAAE,gBAAgB,EAAE,MAAM,4BAA4B,CAAC;AAEnE,OAAO,EACL,YAAY,EACZ,kBAAkB,EAClB,kBAAkB,GACnB,MAAM,uBAAuB,CAAC;AAE/B,OAAO,EACL,0BAA0B,EAC1B,uBAAuB,GACxB,MAAM,oCAAoC,CAAC;AAE5C,OAAO,EAAE,0BAA0B,EAAE,MAAM,oCAAoC,CAAC;AAChF,OAAO,EAAE,2BAA2B,EAAE,MAAM,qCAAqC,CAAC;AAClF,YAAY,EAAE,wBAAwB,EAAE,yBAAyB,EAAE,sBAAsB,EAAE,sBAAsB,EAAE,mBAAmB,EAAE,MAAM,+BAA+B,CAAC;AAC9K,OAAO,EAAE,4BAA4B,EAAE,MAAM,sCAAsC,CAAC;AACpF,YAAY,EACV,yBAAyB,EAAE,oBAAoB,EAAE,wBAAwB,EACzE,mBAAmB,EAAE,qBAAqB,EAAE,oBAAoB,EAAE,oBAAoB,EACtF,gCAAgC,GACjC,MAAM,sCAAsC,CAAC;AAC9C,OAAO,EAAE,4BAA4B,EAAE,kCAAkC,EAAE,MAAM,oCAAoC,CAAC;AACtH,YAAY,EAAE,gBAAgB,EAAE,uBAAuB,EAAE,iCAAiC,EAAE,MAAM,oCAAoC,CAAC;AACvI,OAAO,EAAE,wBAAwB,EAAE,MAAM,iCAAiC,CAAC;AAC3E,YAAY,EAAE,4BAA4B,EAAE,MAAM,iCAAiC,CAAC;AACpF,OAAO,EAAE,6BAA6B,EAAE,iCAAiC,EAAE,MAAM,sCAAsC,CAAC;AACxH,YAAY,EAAE,oBAAoB,EAAE,0BAA0B,EAAE,wBAAwB,EAAE,MAAM,sCAAsC,CAAC;AACvI,OAAO,EAAE,8BAA8B,EAAE,MAAM,gCAAgC,CAAC;AAChF,YAAY,EAAE,oBAAoB,EAAE,MAAM,gCAAgC,CAAC;AAC3E,OAAO,EAAE,6BAA6B,EAAE,MAAM,8BAA8B,CAAC;AAC7E,YAAY,EAAE,qBAAqB,EAAE,MAAM,8BAA8B,CAAC;AAC1E,OAAO,EAAE,8BAA8B,EAAE,qBAAqB,EAAE,sBAAsB,EAAE,yBAAyB,EAAE,MAAM,kCAAkC,CAAC;AAC5J,YAAY,EAAE,mCAAmC,EAAE,8BAA8B,EAAE,mBAAmB,EAAE,MAAM,kCAAkC,CAAC;AAEjJ,OAAO,EAAE,aAAa,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAEzE,OAAO,EAAE,wBAAwB,EAAE,MAAM,4BAA4B,CAAC;AAEtE,OAAO,EAAE,wBAAwB,EAAE,MAAM,4BAA4B,CAAC;AAEtE,OAAO,EAAE,cAAc,EAAE,mBAAmB,EAAE,MAAM,+BAA+B,CAAC;AACpF,YAAY,EAAE,oBAAoB,EAAE,MAAM,+BAA+B,CAAC;AAK1E,OAAO,EAAE,wBAAwB,EAAE,4BAA4B,EAAE,MAAM,2BAA2B,CAAC;AAInG,OAAO,EAAE,yBAAyB,EAAE,MAAM,kCAAkC,CAAC;AAC7E,YAAY,EAAE,uBAAuB,EAAE,wBAAwB,EAAE,MAAM,kCAAkC,CAAC;AAE1G,OAAO,EACL,2BAA2B,EAC3B,QAAQ,IAAI,gBAAgB,EAC5B,uBAAuB,EACvB,4BAA4B,EAC5B,YAAY,EACZ,4BAA4B,GAC7B,MAAM,wCAAwC,CAAC;AAEhD,YAAY,EACV,kBAAkB,EAClB,4BAA4B,GAC7B,MAAM,wCAAwC,CAAC"}

package/dist/runtime-v2/activation/index.js

@@ -10,7 +10,7 @@ export { PromotionReadinessReader } from './promotion-readiness-reader.js';
 export { evaluateRuleCodeSafetyCircuit, initialRuleCodeSafetyCircuitState } from './rulecode-safety-circuit-breaker.js';
 export { collectOpenClawPromotionChecks } from './openclaw-promotion-checks.js';
 export { summarizeRuleCodeShadowEvents } from './rulecode-shadow-summary.js';
-export { buildPromotionEvidenceSnapshot, computeArtifactDigest, normalizeOwnerIdentity } from './promotion-evidence-snapshot.js';
+export { buildPromotionEvidenceSnapshot, computeArtifactDigest, normalizeOwnerIdentity, verifyPiArtifactRowDigest } from './promotion-evidence-snapshot.js';
 export { ApprovalQueue, decideAutoPromotion } from './approval-queue.js';
 export { MemoryApprovalQueueStore } from './memory-approval-store.js';
 export { SqliteApprovalQueueStore } from './sqlite-approval-store.js';

package/dist/runtime-v2/activation/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/runtime-v2/activation/index.ts"],"names":[],"mappings":"AA+BA,OAAO,EACL,oBAAoB,EACpB,iBAAiB,EACjB,qBAAqB,EACrB,kBAAkB,EAClB,gBAAgB,EAChB,mBAAmB,EACnB,mCAAmC,EACnC,wBAAwB,EACxB,oBAAoB,GACrB,MAAM,uBAAuB,CAAC;AAE/B,OAAO,EAAE,oBAAoB,EAAE,MAAM,4BAA4B,CAAC;AAGlE,OAAO,EACL,YAAY,EACZ,kBAAkB,EAClB,kBAAkB,GACnB,MAAM,uBAAuB,CAAC;AAE/B,OAAO,EACL,0BAA0B,EAC1B,uBAAuB,GACxB,MAAM,oCAAoC,CAAC;AAE5C,OAAO,EAAE,0BAA0B,EAAE,MAAM,oCAAoC,CAAC;AAChF,OAAO,EAAE,2BAA2B,EAAE,MAAM,qCAAqC,CAAC;AAElF,OAAO,EAAE,4BAA4B,EAAE,MAAM,sCAAsC,CAAC;AAMpF,OAAO,EAAE,4BAA4B,EAAE,kCAAkC,EAAE,MAAM,oCAAoC,CAAC;AAEtH,OAAO,EAAE,wBAAwB,EAAE,MAAM,iCAAiC,CAAC;AAE3E,OAAO,EAAE,6BAA6B,EAAE,iCAAiC,EAAE,MAAM,sCAAsC,CAAC;AAExH,OAAO,EAAE,8BAA8B,EAAE,MAAM,gCAAgC,CAAC;AAEhF,OAAO,EAAE,6BAA6B,EAAE,MAAM,8BAA8B,CAAC;AAE7E,OAAO,EAAE,8BAA8B,EAAE,qBAAqB,EAAE,sBAAsB,EAAE,MAAM,kCAAkC,CAAC;AAGjI,OAAO,EAAE,aAAa,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAEzE,OAAO,EAAE,wBAAwB,EAAE,MAAM,4BAA4B,CAAC;AAEtE,OAAO,EAAE,wBAAwB,EAAE,MAAM,4BAA4B,CAAC;AAEtE,OAAO,EAAE,cAAc,EAAE,mBAAmB,EAAE,MAAM,+BAA+B,CAAC;AAGpF,4EAA4E;AAC5E,0EAA0E;AAC1E,2DAA2D;AAC3D,OAAO,EAAE,wBAAwB,EAAE,4BAA4B,EAAE,MAAM,2BAA2B,CAAC;AAEnG,oEAAoE;AACpE,4EAA4E;AAC5E,OAAO,EAAE,yBAAyB,EAAE,MAAM,kCAAkC,CAAC;AAG7E,OAAO,EACL,2BAA2B,EAC3B,QAAQ,IAAI,gBAAgB,EAC5B,uBAAuB,EACvB,4BAA4B,EAC5B,YAAY,EACZ,4BAA4B,GAC7B,MAAM,wCAAwC,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/runtime-v2/activation/index.ts"],"names":[],"mappings":"AA+BA,OAAO,EACL,oBAAoB,EACpB,iBAAiB,EACjB,qBAAqB,EACrB,kBAAkB,EAClB,gBAAgB,EAChB,mBAAmB,EACnB,mCAAmC,EACnC,wBAAwB,EACxB,oBAAoB,GACrB,MAAM,uBAAuB,CAAC;AAE/B,OAAO,EAAE,oBAAoB,EAAE,MAAM,4BAA4B,CAAC;AAGlE,OAAO,EACL,YAAY,EACZ,kBAAkB,EAClB,kBAAkB,GACnB,MAAM,uBAAuB,CAAC;AAE/B,OAAO,EACL,0BAA0B,EAC1B,uBAAuB,GACxB,MAAM,oCAAoC,CAAC;AAE5C,OAAO,EAAE,0BAA0B,EAAE,MAAM,oCAAoC,CAAC;AAChF,OAAO,EAAE,2BAA2B,EAAE,MAAM,qCAAqC,CAAC;AAElF,OAAO,EAAE,4BAA4B,EAAE,MAAM,sCAAsC,CAAC;AAMpF,OAAO,EAAE,4BAA4B,EAAE,kCAAkC,EAAE,MAAM,oCAAoC,CAAC;AAEtH,OAAO,EAAE,wBAAwB,EAAE,MAAM,iCAAiC,CAAC;AAE3E,OAAO,EAAE,6BAA6B,EAAE,iCAAiC,EAAE,MAAM,sCAAsC,CAAC;AAExH,OAAO,EAAE,8BAA8B,EAAE,MAAM,gCAAgC,CAAC;AAEhF,OAAO,EAAE,6BAA6B,EAAE,MAAM,8BAA8B,CAAC;AAE7E,OAAO,EAAE,8BAA8B,EAAE,qBAAqB,EAAE,sBAAsB,EAAE,yBAAyB,EAAE,MAAM,kCAAkC,CAAC;AAG5J,OAAO,EAAE,aAAa,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAEzE,OAAO,EAAE,wBAAwB,EAAE,MAAM,4BAA4B,CAAC;AAEtE,OAAO,EAAE,wBAAwB,EAAE,MAAM,4BAA4B,CAAC;AAEtE,OAAO,EAAE,cAAc,EAAE,mBAAmB,EAAE,MAAM,+BAA+B,CAAC;AAGpF,4EAA4E;AAC5E,0EAA0E;AAC1E,2DAA2D;AAC3D,OAAO,EAAE,wBAAwB,EAAE,4BAA4B,EAAE,MAAM,2BAA2B,CAAC;AAEnG,oEAAoE;AACpE,4EAA4E;AAC5E,OAAO,EAAE,yBAAyB,EAAE,MAAM,kCAAkC,CAAC;AAG7E,OAAO,EACL,2BAA2B,EAC3B,QAAQ,IAAI,gBAAgB,EAC5B,uBAAuB,EACvB,4BAA4B,EAC5B,YAAY,EACZ,4BAA4B,GAC7B,MAAM,wCAAwC,CAAC"}

package/dist/runtime-v2/activation/production-gate-deps.d.ts

@@ -38,11 +38,15 @@ import type { ToolSemanticRegistry } from '../internalization/tool-semantic-regi
  * - OUTBOUND: the result crosses back as a vm-realm object and is consumed
  *   only through the canonical validateRuleHostResult (field reads + JSON
  *   preview) — the host never invokes functions on it.
- * - TIMEOUT: only compilation is hard-bounded (runInContext timeout). The
- *   evaluate call is a host-frame invocation with no hard timeout — same as
- *   before this change and as documented in refiner-sandbox-wrapper.ts,
- *   whose soft-timeout classification remains the core-side contract; hard
- *   cancellation stays a plugin/child-process responsibility.
+ * - TIMEOUT: compilation is hard-bounded (runInContext timeout), and since the
+ *   security-audit run-1 fix each evaluate call is ALSO hard-bounded — the
+ *   call runs through a precompiled vm script with
+ *   REPLAY_EVALUATE_HARD_TIMEOUT_MS, so a non-terminating candidate is
+ *   interrupted (and its replay case fails) instead of hanging the replaying
+ *   process. The soft elapsed-time classification in
+ *   refiner-sandbox-wrapper.ts remains layered on top as the core-side
+ *   contract; hard cancellation for the LIVE path stays a plugin/child-process
+ *   responsibility.
  * - LOCKSTEP: the helper contract here (five getters over the JSON input)
  *   mirrors the live plugin executor's EVALUATION_PROCESS_SOURCE in
  *   openclaw-plugin/src/core/rule-implementation-runtime.ts. The two copies

package/dist/runtime-v2/activation/production-gate-deps.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"production-gate-deps.d.ts","sourceRoot":"","sources":["../../../src/runtime-v2/activation/production-gate-deps.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAKH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,qCAAqC,CAAC;AAE5E,OAAO,KAAK,EACV,uBAAuB,EACxB,MAAM,6CAA6C,CAAC;AAErD,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,8CAA8C,CAAC;AAkEzF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,wBAAgB,4BAA4B,CAAC,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,gBAAgB,CAmDhG;AAED,MAAM,WAAW,yBAAyB;IACxC;;;;;OAKG;IACH,aAAa,CAAC,EAAE,oBAAoB,CAAC;IACrC;;;;;OAKG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED;;;;;;;GAOG;AACH,wBAAgB,wBAAwB,CAAC,OAAO,GAAE,yBAA8B,GAAG,uBAAuB,CAwFzG"}
+{"version":3,"file":"production-gate-deps.d.ts","sourceRoot":"","sources":["../../../src/runtime-v2/activation/production-gate-deps.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAKH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,qCAAqC,CAAC;AAE5E,OAAO,KAAK,EACV,uBAAuB,EACxB,MAAM,6CAA6C,CAAC;AAErD,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,8CAA8C,CAAC;AA4EzF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,wBAAgB,4BAA4B,CAAC,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,gBAAgB,CA8EhG;AAED,MAAM,WAAW,yBAAyB;IACxC;;;;;OAKG;IACH,aAAa,CAAC,EAAE,oBAAoB,CAAC;IACrC;;;;;OAKG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED;;;;;;;GAOG;AACH,wBAAgB,wBAAwB,CAAC,OAAO,GAAE,yBAA8B,GAAG,uBAAuB,CAwFzG"}

package/dist/runtime-v2/activation/production-gate-deps.js

@@ -24,6 +24,15 @@ import { evaluateInRefinerSandbox } from '../internalization/refiner-sandbox-wra
 import { checkForbiddenPatterns, checkReturnStatementsMissingFields, checkMatchedFalseDecisions } from '../internalization/rule-code-validator.js';
 import { validateRuleHostResult } from '../internalization/rule-host-validator.js';
 import { safeStringifyPreview } from '../feedback/safe-stringify.js';
+/**
+ * Security audit run-1 (rulecode.replay.in-process-evaluate-no-hard-timeout):
+ * hard wall-clock cap for each replay evaluate call. Mirrors the 1000ms vm
+ * compile budget above; the plugin's live child-process path keeps its own
+ * larger budget (EVALUATE_PROCESS_TIMEOUT_MS). A vm timeout throw surfaces as
+ * a rejected replay case (fail closed for the candidate) instead of hanging
+ * the replaying console server / evaluator worker / CLI process.
+ */
+const REPLAY_EVALUATE_HARD_TIMEOUT_MS = 2_000;
 /**
  * PRI-634 PR-A (Slice A): type-narrowing adapter over the canonical
  * validateRuleHostResult — the ONE RuleHostResult semantic authority, shared
@@ -91,11 +100,15 @@ function isCompiledModuleExports(value) {
  * - OUTBOUND: the result crosses back as a vm-realm object and is consumed
  *   only through the canonical validateRuleHostResult (field reads + JSON
  *   preview) — the host never invokes functions on it.
- * - TIMEOUT: only compilation is hard-bounded (runInContext timeout). The
- *   evaluate call is a host-frame invocation with no hard timeout — same as
- *   before this change and as documented in refiner-sandbox-wrapper.ts,
- *   whose soft-timeout classification remains the core-side contract; hard
- *   cancellation stays a plugin/child-process responsibility.
+ * - TIMEOUT: compilation is hard-bounded (runInContext timeout), and since the
+ *   security-audit run-1 fix each evaluate call is ALSO hard-bounded — the
+ *   call runs through a precompiled vm script with
+ *   REPLAY_EVALUATE_HARD_TIMEOUT_MS, so a non-terminating candidate is
+ *   interrupted (and its replay case fails) instead of hanging the replaying
+ *   process. The soft elapsed-time classification in
+ *   refiner-sandbox-wrapper.ts remains layered on top as the core-side
+ *   contract; hard cancellation for the LIVE path stays a plugin/child-process
+ *   responsibility.
  * - LOCKSTEP: the helper contract here (five getters over the JSON input)
  *   mirrors the live plugin executor's EVALUATION_PROCESS_SOURCE in
  *   openclaw-plugin/src/core/rule-implementation-runtime.ts. The two copies
@@ -109,19 +122,36 @@ export function compileHardenedRuleEvaluator(code, sourceLabel) {
     if (typeof code !== 'string' || code.trim().length === 0) {
         throw new Error(`[${sourceLabel}] rule code is empty or not a string`);
     }
-    const context = vm.createContext(Object.create(null));
+    // microtaskMode: 'afterEvaluate' drains the context's microtask queue INSIDE
+    // each runInContext call, so it is covered by the SAME hard timeout as
+    // synchronous code. Without it, a candidate that schedules a looping Promise
+    // microtask returns cleanly and the loop then hangs the HOST microtask queue
+    // (console server / evaluator worker / CLI) outside any timeout boundary
+    // (security audit run-1 review follow-up, CodeRabbit on PR #1846).
+    const context = vm.createContext(Object.create(null), { microtaskMode: 'afterEvaluate' });
     const script = new vm.Script(normalizeSource(code), { filename: sourceLabel });
     script.runInContext(context, { timeout: 1000, displayErrors: true });
     // Treat sandbox output as untrusted — use Reflect.get + type guard, not `as`.
     const moduleExportsUnknown = Reflect.get(context, '__pdRuleModule');
-    Reflect.deleteProperty(context, '__pdRuleModule');
     if (!isCompiledModuleExports(moduleExportsUnknown)) {
         throw new Error(`[${sourceLabel}] compiled module export shape is invalid`);
     }
-    const evaluateFn = moduleExportsUnknown.evaluate;
-    if (typeof evaluateFn !== 'function') {
+    if (typeof moduleExportsUnknown.evaluate !== 'function') {
         throw new Error(`[${sourceLabel}] compiled module has no evaluate function`);
     }
+    // Security audit run-1 (rulecode.replay.in-process-evaluate-no-hard-timeout):
+    // the evaluate call must be HARD-bounded. The module stays on the realm
+    // global and each replay runs through a precompiled vm script whose
+    // runInContext timeout interrupts even a synchronous `while (true)` inside
+    // the rule — previously the call was a bare host-frame function invocation
+    // that an LLM-authored looping candidate could hang forever (the console
+    // server, evaluator worker, or CLI process). The module object is a
+    // realm-internal value (created inside this context); it never crosses to
+    // the host except through the field-reading result validator below, so the
+    // PRI-809 inbound DATA-only crossing is unchanged.
+    const evaluateCallScript = new vm.Script('__pdRuleModule.evaluate(__pdCallJson)', {
+        filename: `${sourceLabel}#evaluate`,
+    });
     return (input, _helpers) => {
         // Trust-boundary crossing: serialize host-built input to a JSON string
         // primitive. The vm-realm bridge parses it with the realm's own
@@ -134,7 +164,17 @@ export function compileHardenedRuleEvaluator(code, sourceLabel) {
         catch (err) {
             throw new Error(`[${sourceLabel}] replay input is not JSON-serializable (trust-boundary crossing requires plain data): ${err instanceof Error ? err.message : String(err)}`, { cause: err });
         }
-        const result = evaluateFn(inputJson);
+        context.__pdCallJson = inputJson;
+        let result;
+        try {
+            result = evaluateCallScript.runInContext(context, {
+                timeout: REPLAY_EVALUATE_HARD_TIMEOUT_MS,
+                displayErrors: true,
+            });
+        }
+        finally {
+            Reflect.deleteProperty(context, '__pdCallJson');
+        }
         // PRI-634 PR-A (Slice A): canonical RuleHostResult authority. The failure
         // message carries the canonical validator's specific errors so the
         // write-test-fix loop receives actionable evidence (P-03).

package/dist/runtime-v2/activation/production-gate-deps.js.map

@@ -1 +1 @@
-{"version":3,"file":"production-gate-deps.js","sourceRoot":"","sources":["../../../src/runtime-v2/activation/production-gate-deps.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAU9B,OAAO,EAAE,wBAAwB,EAAE,MAAM,+CAA+C,CAAC;AACzF,OAAO,EAAE,sBAAsB,EAAE,kCAAkC,EAAE,0BAA0B,EAAE,MAAM,2CAA2C,CAAC;AACnJ,OAAO,EAAE,sBAAsB,EAAE,MAAM,2CAA2C,CAAC;AACnF,OAAO,EAAE,oBAAoB,EAAE,MAAM,+BAA+B,CAAC;AAErE;;;;;;;GAOG;AACH,SAAS,qBAAqB,CAAC,KAAc;IAC3C,OAAO,sBAAsB,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC;AAC7C,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,SAAS,eAAe,CAAC,UAAkB;IACzC,MAAM,cAAc,GAAG,UAAU;SAC9B,OAAO,CAAC,2BAA2B,EAAE,cAAc,CAAC;SACpD,OAAO,CAAC,mCAAmC,EAAE,oBAAoB,CAAC,CAAC;IAEtE,OAAO,GAAG,cAAc;;;;;;;;;;;;;;GAcvB,CAAC;AACJ,CAAC;AAOD;;;GAGG;AACH,SAAS,uBAAuB,CAAC,KAAc;IAC7C,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,CAAC;AACrD,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,MAAM,UAAU,4BAA4B,CAAC,IAAY,EAAE,WAAmB;IAC5E,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzD,MAAM,IAAI,KAAK,CAAC,IAAI,WAAW,sCAAsC,CAAC,CAAC;IACzE,CAAC;IAED,MAAM,OAAO,GAAG,EAAE,CAAC,aAAa,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;IACtD,MAAM,MAAM,GAAG,IAAI,EAAE,CAAC,MAAM,CAAC,eAAe,CAAC,IAAI,CAAC,EAAE,EAAE,QAAQ,EAAE,WAAW,EAAE,CAAC,CAAC;IAE/E,MAAM,CAAC,YAAY,CAAC,OAAO,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;IAErE,8EAA8E;IAC9E,MAAM,oBAAoB,GAAG,OAAO,CAAC,GAAG,CAAC,OAAO,EAAE,gBAAgB,CAAC,CAAC;IACpE,OAAO,CAAC,cAAc,CAAC,OAAO,EAAE,gBAAgB,CAAC,CAAC;IAElD,IAAI,CAAC,uBAAuB,CAAC,oBAAoB,CAAC,EAAE,CAAC;QACnD,MAAM,IAAI,KAAK,CAAC,IAAI,WAAW,2CAA2C,CAAC,CAAC;IAC9E,CAAC;IAED,MAAM,UAAU,GAAG,oBAAoB,CAAC,QAAQ,CAAC;IACjD,IAAI,OAAO,UAAU,KAAK,UAAU,EAAE,CAAC;QACrC,MAAM,IAAI,KAAK,CACb,IAAI,WAAW,4CAA4C,CAC5D,CAAC;IACJ,CAAC;IAED,OAAO,CAAC,KAAoB,EAAE,QAAyB,EAAkB,EAAE;QACzE,uEAAuE;QACvE,gEAAgE;QAChE,sEAAsE;QACtE,wEAAwE;QACxE,IAAI,SAAiB,CAAC;QACtB,IAAI,CAAC;YACH,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;QACpC,CAAC;QAAC,OAAO,GAAY,EAAE,CAAC;YACtB,MAAM,IAAI,KAAK,CACb,IAAI,WAAW,0FAA0F,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,EAC3J,EAAE,KAAK,EAAE,GAAG,EAAE,CACf,CAAC;QACJ,CAAC;QACD,MAAM,MAAM,GAAa,UAAwC,CAAC,SAAS,CAAC,CAAC;QAC7E,0EAA0E;QAC1E,mEAAmE;QACnE,2DAA2D;QAC3D,IAAI,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE,CAAC;YACnC,MAAM,EAAE,MAAM,EAAE,GAAG,sBAAsB,CAAC,MAAM,CAAC,CAAC;YAClD,MAAM,IAAI,KAAK,CACb,IAAI,WAAW,gDAAgD,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,oBAAoB,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAC3L,CAAC;QACJ,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC,CAAC;AACJ,CAAC;AAmBD;;;;;;;GAOG;AACH,MAAM,UAAU,wBAAwB,CAAC,OAAO,GAA8B,EAAE;IAC9E,OAAO;QACL,iBAAiB,EAAE,CACjB,IAAY,EACZ,WAAwB,EACxB,IAA4B,EACN,EAAE;YACxB,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YAE7B,oEAAoE;YACpE,4EAA4E;YAC5E,0EAA0E;YAC1E,uEAAuE;YACvE,oEAAoE;YACpE,2BAA2B;YAC3B,MAAM,mBAAmB,GAAG,sBAAsB,CAAC,IAAI,CAAC,CAAC;YACzD,IAAI,mBAAmB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACnC,OAAO;oBACL,OAAO,EAAE,KAAK;oBACd,WAAW,EAAE,EAAE;oBACf,eAAe,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;oBACvC,0BAA0B,EAAE,mBAAmB;iBAChD,CAAC;YACJ,CAAC;YAED,wEAAwE;YACxE,uEAAuE;YACvE,qEAAqE;YACrE,oEAAoE;YACpE,MAAM,qBAAqB,GAAG,kCAAkC,CAAC,IAAI,CAAC,CAAC;YACvE,IAAI,qBAAqB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACrC,OAAO;oBACL,OAAO,EAAE,KAAK;oBACd,WAAW,EAAE,qBAAqB,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;wBAC/C,MAAM,EAAE,kBAAkB;wBAC1B,SAAS,EAAE,mBAA4B;wBACvC,OAAO,EAAE,GAAG;qBACb,CAAC,CAAC;oBACH,eAAe,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;oBACvC,0BAA0B,EAAE,EAAE;iBAC/B,CAAC;YACJ,CAAC;YAED,gEAAgE;YAChE,qEAAqE;YACrE,sEAAsE;YACtE,mDAAmD;YACnD,MAAM,sBAAsB,GAAG,0BAA0B,CAAC,IAAI,CAAC,CAAC;YAChE,IAAI,sBAAsB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACtC,OAAO;oBACL,OAAO,EAAE,KAAK;oBACd,WAAW,EAAE,sBAAsB,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;wBAChD,MAAM,EAAE,4BAA4B;wBACpC,SAAS,EAAE,mBAA4B;wBACvC,OAAO,EAAE,GAAG;qBACb,CAAC,CAAC;oBACH,eAAe,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;oBACvC,0BAA0B,EAAE,EAAE;iBAC/B,CAAC;YACJ,CAAC;YAED,IAAI,YAA8B,CAAC;YACnC,IAAI,CAAC;gBACH,YAAY,GAAG,4BAA4B,CAAC,IAAI,EAAE,sBAAsB,CAAC,CAAC;YAC5E,CAAC;YAAC,OAAO,GAAY,EAAE,CAAC;gBACtB,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;gBACjE,OAAO;oBACL,OAAO,EAAE,KAAK;oBACd,WAAW,EAAE,CAAC;4BACZ,MAAM,EAAE,aAAa;4BACrB,SAAS,EAAE,cAAc;4BACzB,OAAO;yBACR,CAAC;oBACF,eAAe,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;oBACvC,0BAA0B,EAAE,EAAE;iBAC/B,CAAC;YACJ,CAAC;YAED,OAAO,wBAAwB,CAAC,IAAI,EAAE,WAAW,EAAE;gBACjD,YAAY;gBACZ,GAAG,IAAI;gBACP,uEAAuE;gBACvE,6EAA6E;gBAC7E,aAAa,EAAE,IAAI,EAAE,aAAa,IAAI,OAAO,CAAC,aAAa;gBAC3D,UAAU,EAAE,IAAI,EAAE,UAAU,IAAI,OAAO,CAAC,UAAU;aACnD,CAAC,CAAC;QACL,CAAC;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"production-gate-deps.js","sourceRoot":"","sources":["../../../src/runtime-v2/activation/production-gate-deps.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAU9B,OAAO,EAAE,wBAAwB,EAAE,MAAM,+CAA+C,CAAC;AACzF,OAAO,EAAE,sBAAsB,EAAE,kCAAkC,EAAE,0BAA0B,EAAE,MAAM,2CAA2C,CAAC;AACnJ,OAAO,EAAE,sBAAsB,EAAE,MAAM,2CAA2C,CAAC;AACnF,OAAO,EAAE,oBAAoB,EAAE,MAAM,+BAA+B,CAAC;AAErE;;;;;;;GAOG;AACH,MAAM,+BAA+B,GAAG,KAAK,CAAC;AAE9C;;;;;;;GAOG;AACH,SAAS,qBAAqB,CAAC,KAAc;IAC3C,OAAO,sBAAsB,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC;AAC7C,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,SAAS,eAAe,CAAC,UAAkB;IACzC,MAAM,cAAc,GAAG,UAAU;SAC9B,OAAO,CAAC,2BAA2B,EAAE,cAAc,CAAC;SACpD,OAAO,CAAC,mCAAmC,EAAE,oBAAoB,CAAC,CAAC;IAEtE,OAAO,GAAG,cAAc;;;;;;;;;;;;;;GAcvB,CAAC;AACJ,CAAC;AAOD;;;GAGG;AACH,SAAS,uBAAuB,CAAC,KAAc;IAC7C,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,CAAC;AACrD,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,MAAM,UAAU,4BAA4B,CAAC,IAAY,EAAE,WAAmB;IAC5E,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzD,MAAM,IAAI,KAAK,CAAC,IAAI,WAAW,sCAAsC,CAAC,CAAC;IACzE,CAAC;IAED,6EAA6E;IAC7E,uEAAuE;IACvE,6EAA6E;IAC7E,6EAA6E;IAC7E,yEAAyE;IACzE,mEAAmE;IACnE,MAAM,OAAO,GAAG,EAAE,CAAC,aAAa,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,EAAE,aAAa,EAAE,eAAe,EAAE,CAAC,CAAC;IAC1F,MAAM,MAAM,GAAG,IAAI,EAAE,CAAC,MAAM,CAAC,eAAe,CAAC,IAAI,CAAC,EAAE,EAAE,QAAQ,EAAE,WAAW,EAAE,CAAC,CAAC;IAE/E,MAAM,CAAC,YAAY,CAAC,OAAO,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;IAErE,8EAA8E;IAC9E,MAAM,oBAAoB,GAAG,OAAO,CAAC,GAAG,CAAC,OAAO,EAAE,gBAAgB,CAAC,CAAC;IAEpE,IAAI,CAAC,uBAAuB,CAAC,oBAAoB,CAAC,EAAE,CAAC;QACnD,MAAM,IAAI,KAAK,CAAC,IAAI,WAAW,2CAA2C,CAAC,CAAC;IAC9E,CAAC;IAED,IAAI,OAAO,oBAAoB,CAAC,QAAQ,KAAK,UAAU,EAAE,CAAC;QACxD,MAAM,IAAI,KAAK,CACb,IAAI,WAAW,4CAA4C,CAC5D,CAAC;IACJ,CAAC;IAED,8EAA8E;IAC9E,wEAAwE;IACxE,oEAAoE;IACpE,2EAA2E;IAC3E,2EAA2E;IAC3E,yEAAyE;IACzE,oEAAoE;IACpE,0EAA0E;IAC1E,2EAA2E;IAC3E,mDAAmD;IACnD,MAAM,kBAAkB,GAAG,IAAI,EAAE,CAAC,MAAM,CAAC,uCAAuC,EAAE;QAChF,QAAQ,EAAE,GAAG,WAAW,WAAW;KACpC,CAAC,CAAC;IAEH,OAAO,CAAC,KAAoB,EAAE,QAAyB,EAAkB,EAAE;QACzE,uEAAuE;QACvE,gEAAgE;QAChE,sEAAsE;QACtE,wEAAwE;QACxE,IAAI,SAAiB,CAAC;QACtB,IAAI,CAAC;YACH,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;QACpC,CAAC;QAAC,OAAO,GAAY,EAAE,CAAC;YACtB,MAAM,IAAI,KAAK,CACb,IAAI,WAAW,0FAA0F,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,EAC3J,EAAE,KAAK,EAAE,GAAG,EAAE,CACf,CAAC;QACJ,CAAC;QACD,OAAO,CAAC,YAAY,GAAG,SAAS,CAAC;QACjC,IAAI,MAAe,CAAC;QACpB,IAAI,CAAC;YACH,MAAM,GAAG,kBAAkB,CAAC,YAAY,CAAC,OAAO,EAAE;gBAChD,OAAO,EAAE,+BAA+B;gBACxC,aAAa,EAAE,IAAI;aACpB,CAAC,CAAC;QACL,CAAC;gBAAS,CAAC;YACT,OAAO,CAAC,cAAc,CAAC,OAAO,EAAE,cAAc,CAAC,CAAC;QAClD,CAAC;QACD,0EAA0E;QAC1E,mEAAmE;QACnE,2DAA2D;QAC3D,IAAI,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE,CAAC;YACnC,MAAM,EAAE,MAAM,EAAE,GAAG,sBAAsB,CAAC,MAAM,CAAC,CAAC;YAClD,MAAM,IAAI,KAAK,CACb,IAAI,WAAW,gDAAgD,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,oBAAoB,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAC3L,CAAC;QACJ,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC,CAAC;AACJ,CAAC;AAmBD;;;;;;;GAOG;AACH,MAAM,UAAU,wBAAwB,CAAC,OAAO,GAA8B,EAAE;IAC9E,OAAO;QACL,iBAAiB,EAAE,CACjB,IAAY,EACZ,WAAwB,EACxB,IAA4B,EACN,EAAE;YACxB,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YAE7B,oEAAoE;YACpE,4EAA4E;YAC5E,0EAA0E;YAC1E,uEAAuE;YACvE,oEAAoE;YACpE,2BAA2B;YAC3B,MAAM,mBAAmB,GAAG,sBAAsB,CAAC,IAAI,CAAC,CAAC;YACzD,IAAI,mBAAmB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACnC,OAAO;oBACL,OAAO,EAAE,KAAK;oBACd,WAAW,EAAE,EAAE;oBACf,eAAe,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;oBACvC,0BAA0B,EAAE,mBAAmB;iBAChD,CAAC;YACJ,CAAC;YAED,wEAAwE;YACxE,uEAAuE;YACvE,qEAAqE;YACrE,oEAAoE;YACpE,MAAM,qBAAqB,GAAG,kCAAkC,CAAC,IAAI,CAAC,CAAC;YACvE,IAAI,qBAAqB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACrC,OAAO;oBACL,OAAO,EAAE,KAAK;oBACd,WAAW,EAAE,qBAAqB,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;wBAC/C,MAAM,EAAE,kBAAkB;wBAC1B,SAAS,EAAE,mBAA4B;wBACvC,OAAO,EAAE,GAAG;qBACb,CAAC,CAAC;oBACH,eAAe,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;oBACvC,0BAA0B,EAAE,EAAE;iBAC/B,CAAC;YACJ,CAAC;YAED,gEAAgE;YAChE,qEAAqE;YACrE,sEAAsE;YACtE,mDAAmD;YACnD,MAAM,sBAAsB,GAAG,0BAA0B,CAAC,IAAI,CAAC,CAAC;YAChE,IAAI,sBAAsB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACtC,OAAO;oBACL,OAAO,EAAE,KAAK;oBACd,WAAW,EAAE,sBAAsB,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;wBAChD,MAAM,EAAE,4BAA4B;wBACpC,SAAS,EAAE,mBAA4B;wBACvC,OAAO,EAAE,GAAG;qBACb,CAAC,CAAC;oBACH,eAAe,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;oBACvC,0BAA0B,EAAE,EAAE;iBAC/B,CAAC;YACJ,CAAC;YAED,IAAI,YAA8B,CAAC;YACnC,IAAI,CAAC;gBACH,YAAY,GAAG,4BAA4B,CAAC,IAAI,EAAE,sBAAsB,CAAC,CAAC;YAC5E,CAAC;YAAC,OAAO,GAAY,EAAE,CAAC;gBACtB,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;gBACjE,OAAO;oBACL,OAAO,EAAE,KAAK;oBACd,WAAW,EAAE,CAAC;4BACZ,MAAM,EAAE,aAAa;4BACrB,SAAS,EAAE,cAAc;4BACzB,OAAO;yBACR,CAAC;oBACF,eAAe,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;oBACvC,0BAA0B,EAAE,EAAE;iBAC/B,CAAC;YACJ,CAAC;YAED,OAAO,wBAAwB,CAAC,IAAI,EAAE,WAAW,EAAE;gBACjD,YAAY;gBACZ,GAAG,IAAI;gBACP,uEAAuE;gBACvE,6EAA6E;gBAC7E,aAAa,EAAE,IAAI,EAAE,aAAa,IAAI,OAAO,CAAC,aAAa;gBAC3D,UAAU,EAAE,IAAI,EAAE,UAAU,IAAI,OAAO,CAAC,UAAU;aACnD,CAAC,CAAC;QACL,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/runtime-v2/activation/promotion-evidence-snapshot.d.ts

@@ -25,6 +25,40 @@ export interface BuildPromotionEvidenceSnapshotInput {
     newSnapshotId?: () => string;
 }
 export declare function computeArtifactDigest(artifact: PIArtifactSnapshot): string;
+/**
+ * Outcome of enforcement-time digest re-verification (security audit run-1,
+ * rulecode-approval-content-unbound).
+ *
+ * - `verified` — the row's recomputed digest matches the approved digest.
+ * - `tampered` — the row recomputed cleanly but diverges from the approved
+ *   digest: an integrity failure. Callers must skip the activation (and
+ *   surface a structured warning); they must NOT evaluate the content.
+ * - `unverifiable` — the row is malformed (or the approved digest is not a
+ *   string) so no comparison was possible. Callers apply their own policy.
+ * - `no_binding` — no activation-scoped decision exists for this activation
+ *   (pre-owner-decision legacy row): nothing to verify against; callers keep
+ *   their prior behavior.
+ */
+export type ArtifactDigestCheck = {
+    outcome: 'verified';
+} | {
+    outcome: 'tampered';
+    actualDigest: string;
+} | {
+    outcome: 'unverifiable';
+    error: string;
+} | {
+    outcome: 'no_binding';
+};
+/**
+ * Re-verify a pi_artifacts row (as freshly read from state.db, fields treated
+ * as unknown per rc-1) against the digest the Owner decision recorded at
+ * promotion time. THE single implementation of this check — the host-runtime
+ * production gate and the OpenClaw plugin RuleHost both call this; do not
+ * hand-roll a second copy (the mapping/ordering inside mapPiArtifactRow is
+ * what makes the recomputed digest byte-identical to the promotion-time one).
+ */
+export declare function verifyPiArtifactRowDigest(row: Record<string, unknown>, contentJson: string, approvedDigest: string | null): ArtifactDigestCheck;
 export declare function normalizeOwnerIdentity(actor?: PromotionEvidenceOwnerIdentity | OwnerPromotionActor | null): PromotionEvidenceOwnerIdentity | null;
 export declare function buildPromotionEvidenceSnapshot(input: BuildPromotionEvidenceSnapshotInput): PromotionEvidenceSnapshot;
 //# sourceMappingURL=promotion-evidence-snapshot.d.ts.map

package/dist/runtime-v2/activation/promotion-evidence-snapshot.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"promotion-evidence-snapshot.d.ts","sourceRoot":"","sources":["../../../src/runtime-v2/activation/promotion-evidence-snapshot.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAChE,OAAO,KAAK,EAAE,yBAAyB,EAAE,mBAAmB,EAAE,MAAM,sCAAsC,CAAC;AAG3G,MAAM,WAAW,8BAA8B;IAC7C,aAAa,EAAE,MAAM,CAAC;IACtB,OAAO,EAAE,MAAM,CAAC;IAChB,oBAAoB,EAAE,MAAM,CAAC;IAC7B,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC9B;AAED,MAAM,WAAW,mCAAmC;IAClD,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,MAAM,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,QAAQ,GAAG,QAAQ,CAAC;QAAC,UAAU,CAAC,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;IAChF,QAAQ,CAAC,EAAE,kBAAkB,CAAC;IAC9B,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC,aAAa,CAAC,EAAE,8BAA8B,GAAG,mBAAmB,GAAG,IAAI,CAAC;IAC5E,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,aAAa,CAAC,EAAE,yBAAyB,CAAC,eAAe,CAAC,CAAC;IAC3D,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IACnB,aAAa,CAAC,EAAE,MAAM,MAAM,CAAC;CAC9B;AAED,wBAAgB,qBAAqB,CAAC,QAAQ,EAAE,kBAAkB,GAAG,MAAM,CAE1E;AAED,wBAAgB,sBAAsB,CACpC,KAAK,CAAC,EAAE,8BAA8B,GAAG,mBAAmB,GAAG,IAAI,GAClE,8BAA8B,GAAG,IAAI,CAyBvC;AAED,wBAAgB,8BAA8B,CAC5C,KAAK,EAAE,mCAAmC,GACzC,yBAAyB,CA4D3B"}
+{"version":3,"file":"promotion-evidence-snapshot.d.ts","sourceRoot":"","sources":["../../../src/runtime-v2/activation/promotion-evidence-snapshot.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAChE,OAAO,KAAK,EAAE,yBAAyB,EAAE,mBAAmB,EAAE,MAAM,sCAAsC,CAAC;AAI3G,MAAM,WAAW,8BAA8B;IAC7C,aAAa,EAAE,MAAM,CAAC;IACtB,OAAO,EAAE,MAAM,CAAC;IAChB,oBAAoB,EAAE,MAAM,CAAC;IAC7B,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC9B;AAED,MAAM,WAAW,mCAAmC;IAClD,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,MAAM,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,QAAQ,GAAG,QAAQ,CAAC;QAAC,UAAU,CAAC,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;IAChF,QAAQ,CAAC,EAAE,kBAAkB,CAAC;IAC9B,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC,aAAa,CAAC,EAAE,8BAA8B,GAAG,mBAAmB,GAAG,IAAI,CAAC;IAC5E,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,aAAa,CAAC,EAAE,yBAAyB,CAAC,eAAe,CAAC,CAAC;IAC3D,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IACnB,aAAa,CAAC,EAAE,MAAM,MAAM,CAAC;CAC9B;AAED,wBAAgB,qBAAqB,CAAC,QAAQ,EAAE,kBAAkB,GAAG,MAAM,CAE1E;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,MAAM,mBAAmB,GAC3B;IAAE,OAAO,EAAE,UAAU,CAAA;CAAE,GACvB;IAAE,OAAO,EAAE,UAAU,CAAC;IAAC,YAAY,EAAE,MAAM,CAAA;CAAE,GAC7C;IAAE,OAAO,EAAE,cAAc,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GAC1C;IAAE,OAAO,EAAE,YAAY,CAAA;CAAE,CAAC;AAE9B;;;;;;;GAOG;AACH,wBAAgB,yBAAyB,CACvC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC5B,WAAW,EAAE,MAAM,EACnB,cAAc,EAAE,MAAM,GAAG,IAAI,GAC5B,mBAAmB,CA+CrB;AAED,wBAAgB,sBAAsB,CACpC,KAAK,CAAC,EAAE,8BAA8B,GAAG,mBAAmB,GAAG,IAAI,GAClE,8BAA8B,GAAG,IAAI,CAyBvC;AAED,wBAAgB,8BAA8B,CAC5C,KAAK,EAAE,mCAAmC,GACzC,yBAAyB,CA4D3B"}

package/dist/runtime-v2/activation/promotion-evidence-snapshot.js

@@ -1,7 +1,64 @@
+import { mapPiArtifactRow } from '../store/artifact/sqlite-pi-artifact-store.js';
 import { createHash, randomUUID } from 'node:crypto';
 export function computeArtifactDigest(artifact) {
     return `sha256:${createHash('sha256').update(JSON.stringify(artifact), 'utf8').digest('hex')}`;
 }
+/**
+ * Re-verify a pi_artifacts row (as freshly read from state.db, fields treated
+ * as unknown per rc-1) against the digest the Owner decision recorded at
+ * promotion time. THE single implementation of this check — the host-runtime
+ * production gate and the OpenClaw plugin RuleHost both call this; do not
+ * hand-roll a second copy (the mapping/ordering inside mapPiArtifactRow is
+ * what makes the recomputed digest byte-identical to the promotion-time one).
+ */
+export function verifyPiArtifactRowDigest(row, contentJson, approvedDigest) {
+    if (typeof approvedDigest !== 'string' || approvedDigest.length === 0) {
+        return { outcome: 'no_binding' };
+    }
+    const artifactId = row.artifact_id;
+    const artifactKind = row.artifact_kind;
+    const sourceTaskId = row.source_task_id;
+    const sourcePrincipleId = row.source_principle_id;
+    const sourceRuleId = row.source_rule_id;
+    const lineageArtifactIds = row.lineage_artifact_ids;
+    const validationStatus = row.validation_status;
+    const createdAt = row.created_at;
+    const updatedAt = row.updated_at;
+    const rowReady = typeof artifactId === 'string' && artifactId.length > 0
+        && typeof artifactKind === 'string'
+        && typeof sourceTaskId === 'string'
+        && (typeof sourcePrincipleId === 'string' || sourcePrincipleId === null)
+        && (typeof sourceRuleId === 'string' || sourceRuleId === null)
+        && typeof lineageArtifactIds === 'string'
+        && typeof validationStatus === 'string'
+        && typeof createdAt === 'string'
+        && typeof updatedAt === 'string';
+    if (!rowReady) {
+        return { outcome: 'unverifiable', error: 'artifact row integrity does not allow digest re-verification' };
+    }
+    let actualDigest;
+    try {
+        actualDigest = computeArtifactDigest(mapPiArtifactRow({
+            artifact_id: artifactId,
+            artifact_kind: artifactKind,
+            source_task_id: sourceTaskId,
+            source_principle_id: sourcePrincipleId,
+            source_rule_id: sourceRuleId,
+            lineage_artifact_ids: lineageArtifactIds,
+            validation_status: validationStatus,
+            content_json: contentJson,
+            created_at: createdAt,
+            updated_at: updatedAt,
+        }));
+    }
+    catch (error) {
+        return { outcome: 'unverifiable', error: error instanceof Error ? error.message : String(error) };
+    }
+    if (actualDigest !== approvedDigest) {
+        return { outcome: 'tampered', actualDigest };
+    }
+    return { outcome: 'verified' };
+}
 export function normalizeOwnerIdentity(actor) {
     if (!actor)
         return null;

package/dist/runtime-v2/activation/promotion-evidence-snapshot.js.map

@@ -1 +1 @@
-{"version":3,"file":"promotion-evidence-snapshot.js","sourceRoot":"","sources":["../../../src/runtime-v2/activation/promotion-evidence-snapshot.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAwBrD,MAAM,UAAU,qBAAqB,CAAC,QAA4B;IAChE,OAAO,UAAU,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;AACjG,CAAC;AAED,MAAM,UAAU,sBAAsB,CACpC,KAAmE;IAEnE,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IACxB,IAAI,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,WAAW,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,gBAAgB,CAAC,EAAE,CAAC;QAChF,MAAM,KAAK,GAAG,KAA4B,CAAC;QAC3C,MAAM,aAAa,GAAG,KAAK,CAAC,SAAS,CAAC,IAAI,CAAC;QAC3C,MAAM,OAAO,GACX,KAAK,CAAC,SAAS,CAAC,IAAI,KAAK,kBAAkB;YACzC,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,OAAO;YACzB,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI,KAAK,eAAe;gBACxC,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,aAAa;gBAC/B,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC;QAC/B,MAAM,oBAAoB,GAAG,KAAK,CAAC,cAAc,CAAC,MAAM,CAAC;QACzD,MAAM,YAAY,GAChB,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,cAAc,EAAE,cAAc,CAAC;YACjD,CAAC,CAAE,KAAK,CAAC,cAAmD,CAAC,YAAY,IAAI,IAAI;YACjF,CAAC,CAAC,IAAI,CAAC;QACX,OAAO,EAAE,aAAa,EAAE,OAAO,EAAE,oBAAoB,EAAE,YAAY,EAAE,CAAC;IACxE,CAAC;IACD,MAAM,IAAI,GAAG,KAAuC,CAAC;IACrD,OAAO;QACL,aAAa,EAAE,IAAI,CAAC,aAAa;QACjC,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,oBAAoB,EAAE,IAAI,CAAC,oBAAoB;QAC/C,YAAY,EAAE,IAAI,CAAC,YAAY,IAAI,IAAI;KACxC,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,8BAA8B,CAC5C,KAA0C;IAE1C,MAAM,SAAS,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACrE,MAAM,cAAc,GAAG,KAAK,CAAC,QAAQ;QACnC,CAAC,CAAC,qBAAqB,CAAC,KAAK,CAAC,QAAQ,CAAC;QACvC,CAAC,CAAC,CAAC,KAAK,CAAC,sBAAsB,IAAI,EAAE,CAAC,CAAC;IACzC,MAAM,kBAAkB,GAAG,KAAK,CAAC,kBAAkB,IAAI,mBAAmB,CAAC;IAC3E,MAAM,WAAW,GACf,KAAK,CAAC,WAAW;QACjB,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,YAAY,EAAE,GAAG,KAAK,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAC9F,MAAM,aAAa,GAAG,KAAK,CAAC,aAAa,IAAI;QAC3C,QAAQ,EAAE,IAAI;QACd,OAAO,EAAE,IAAI;QACb,UAAU,EAAE,IAAI;QAChB,UAAU,EAAE,IAAI;QAChB,eAAe,EAAE,IAAI;QACrB,WAAW,EAAE,IAAI;QACjB,MAAM,EAAE,IAAI;QACZ,cAAc,EAAE,IAAI;QACpB,eAAe,EAAE,IAAI;QACrB,cAAc,EAAE,IAAI;KACrB,CAAC;IACF,MAAM,oBAAoB,GAAG,KAAK,CAAC,oBAAoB,IAAI,mBAAmB,CAAC;IAC/E,MAAM,SAAS,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,mBAAmB,EAAE,KAAK,EAAW,CAAC;IACzE,MAAM,aAAa,GAAG,sBAAsB,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;IAElE,8EAA8E;IAC9E,qEAAqE;IACrE,2EAA2E;IAC3E,8DAA8D;IAC9D,wEAAwE;IACxE,oDAAoD;IACpD,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,CAAC;QAChC,YAAY,EAAE,KAAK,CAAC,YAAY,IAAI,IAAI;QACxC,YAAY,EAAE,KAAK,CAAC,YAAY,IAAI,IAAI;QACxC,cAAc;QACd,WAAW;QACX,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,aAAa;QACb,kBAAkB;QAClB,aAAa;QACb,oBAAoB;QACpB,SAAS;QACT,SAAS;KACV,CAAC,CAAC;IAEH,MAAM,cAAc,GAAG,UAAU,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;IACjG,MAAM,UAAU,GAAG,KAAK,CAAC,aAAa,CAAC,CAAC,CAAC,KAAK,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,YAAY,UAAU,EAAE,EAAE,CAAC;IAE5F,OAAO;QACL,UAAU;QACV,cAAc;QACd,cAAc;QACd,WAAW;QACX,kBAAkB;QAClB,iBAAiB,EAAE,KAAK,CAAC,MAAM;QAC/B,aAAa;QACb,oBAAoB;QACpB,SAAS;QACT,SAAS;KACV,CAAC;AACJ,CAAC"}
+{"version":3,"file":"promotion-evidence-snapshot.js","sourceRoot":"","sources":["../../../src/runtime-v2/activation/promotion-evidence-snapshot.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,gBAAgB,EAAE,MAAM,+CAA+C,CAAC;AACjF,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAwBrD,MAAM,UAAU,qBAAqB,CAAC,QAA4B;IAChE,OAAO,UAAU,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;AACjG,CAAC;AAsBD;;;;;;;GAOG;AACH,MAAM,UAAU,yBAAyB,CACvC,GAA4B,EAC5B,WAAmB,EACnB,cAA6B;IAE7B,IAAI,OAAO,cAAc,KAAK,QAAQ,IAAI,cAAc,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtE,OAAO,EAAE,OAAO,EAAE,YAAY,EAAE,CAAC;IACnC,CAAC;IACD,MAAM,UAAU,GAAG,GAAG,CAAC,WAAW,CAAC;IACnC,MAAM,YAAY,GAAG,GAAG,CAAC,aAAa,CAAC;IACvC,MAAM,YAAY,GAAG,GAAG,CAAC,cAAc,CAAC;IACxC,MAAM,iBAAiB,GAAG,GAAG,CAAC,mBAAmB,CAAC;IAClD,MAAM,YAAY,GAAG,GAAG,CAAC,cAAc,CAAC;IACxC,MAAM,kBAAkB,GAAG,GAAG,CAAC,oBAAoB,CAAC;IACpD,MAAM,gBAAgB,GAAG,GAAG,CAAC,iBAAiB,CAAC;IAC/C,MAAM,SAAS,GAAG,GAAG,CAAC,UAAU,CAAC;IACjC,MAAM,SAAS,GAAG,GAAG,CAAC,UAAU,CAAC;IACjC,MAAM,QAAQ,GACZ,OAAO,UAAU,KAAK,QAAQ,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC;WACpD,OAAO,YAAY,KAAK,QAAQ;WAChC,OAAO,YAAY,KAAK,QAAQ;WAChC,CAAC,OAAO,iBAAiB,KAAK,QAAQ,IAAI,iBAAiB,KAAK,IAAI,CAAC;WACrE,CAAC,OAAO,YAAY,KAAK,QAAQ,IAAI,YAAY,KAAK,IAAI,CAAC;WAC3D,OAAO,kBAAkB,KAAK,QAAQ;WACtC,OAAO,gBAAgB,KAAK,QAAQ;WACpC,OAAO,SAAS,KAAK,QAAQ;WAC7B,OAAO,SAAS,KAAK,QAAQ,CAAC;IACnC,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,OAAO,EAAE,OAAO,EAAE,cAAc,EAAE,KAAK,EAAE,8DAA8D,EAAE,CAAC;IAC5G,CAAC;IACD,IAAI,YAAoB,CAAC;IACzB,IAAI,CAAC;QACH,YAAY,GAAG,qBAAqB,CAAC,gBAAgB,CAAC;YACpD,WAAW,EAAE,UAAU;YACvB,aAAa,EAAE,YAAY;YAC3B,cAAc,EAAE,YAAY;YAC5B,mBAAmB,EAAE,iBAAiB;YACtC,cAAc,EAAE,YAAY;YAC5B,oBAAoB,EAAE,kBAAkB;YACxC,iBAAiB,EAAE,gBAAgB;YACnC,YAAY,EAAE,WAAW;YACzB,UAAU,EAAE,SAAS;YACrB,UAAU,EAAE,SAAS;SACtB,CAAC,CAAC,CAAC;IACN,CAAC;IAAC,OAAO,KAAc,EAAE,CAAC;QACxB,OAAO,EAAE,OAAO,EAAE,cAAc,EAAE,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;IACpG,CAAC;IACD,IAAI,YAAY,KAAK,cAAc,EAAE,CAAC;QACpC,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,CAAC;IAC/C,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,CAAC;AACjC,CAAC;AAED,MAAM,UAAU,sBAAsB,CACpC,KAAmE;IAEnE,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IACxB,IAAI,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,WAAW,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,gBAAgB,CAAC,EAAE,CAAC;QAChF,MAAM,KAAK,GAAG,KAA4B,CAAC;QAC3C,MAAM,aAAa,GAAG,KAAK,CAAC,SAAS,CAAC,IAAI,CAAC;QAC3C,MAAM,OAAO,GACX,KAAK,CAAC,SAAS,CAAC,IAAI,KAAK,kBAAkB;YACzC,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,OAAO;YACzB,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI,KAAK,eAAe;gBACxC,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,aAAa;gBAC/B,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC;QAC/B,MAAM,oBAAoB,GAAG,KAAK,CAAC,cAAc,CAAC,MAAM,CAAC;QACzD,MAAM,YAAY,GAChB,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,cAAc,EAAE,cAAc,CAAC;YACjD,CAAC,CAAE,KAAK,CAAC,cAAmD,CAAC,YAAY,IAAI,IAAI;YACjF,CAAC,CAAC,IAAI,CAAC;QACX,OAAO,EAAE,aAAa,EAAE,OAAO,EAAE,oBAAoB,EAAE,YAAY,EAAE,CAAC;IACxE,CAAC;IACD,MAAM,IAAI,GAAG,KAAuC,CAAC;IACrD,OAAO;QACL,aAAa,EAAE,IAAI,CAAC,aAAa;QACjC,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,oBAAoB,EAAE,IAAI,CAAC,oBAAoB;QAC/C,YAAY,EAAE,IAAI,CAAC,YAAY,IAAI,IAAI;KACxC,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,8BAA8B,CAC5C,KAA0C;IAE1C,MAAM,SAAS,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACrE,MAAM,cAAc,GAAG,KAAK,CAAC,QAAQ;QACnC,CAAC,CAAC,qBAAqB,CAAC,KAAK,CAAC,QAAQ,CAAC;QACvC,CAAC,CAAC,CAAC,KAAK,CAAC,sBAAsB,IAAI,EAAE,CAAC,CAAC;IACzC,MAAM,kBAAkB,GAAG,KAAK,CAAC,kBAAkB,IAAI,mBAAmB,CAAC;IAC3E,MAAM,WAAW,GACf,KAAK,CAAC,WAAW;QACjB,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,YAAY,EAAE,GAAG,KAAK,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAC9F,MAAM,aAAa,GAAG,KAAK,CAAC,aAAa,IAAI;QAC3C,QAAQ,EAAE,IAAI;QACd,OAAO,EAAE,IAAI;QACb,UAAU,EAAE,IAAI;QAChB,UAAU,EAAE,IAAI;QAChB,eAAe,EAAE,IAAI;QACrB,WAAW,EAAE,IAAI;QACjB,MAAM,EAAE,IAAI;QACZ,cAAc,EAAE,IAAI;QACpB,eAAe,EAAE,IAAI;QACrB,cAAc,EAAE,IAAI;KACrB,CAAC;IACF,MAAM,oBAAoB,GAAG,KAAK,CAAC,oBAAoB,IAAI,mBAAmB,CAAC;IAC/E,MAAM,SAAS,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,mBAAmB,EAAE,KAAK,EAAW,CAAC;IACzE,MAAM,aAAa,GAAG,sBAAsB,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;IAElE,8EAA8E;IAC9E,qEAAqE;IACrE,2EAA2E;IAC3E,8DAA8D;IAC9D,wEAAwE;IACxE,oDAAoD;IACpD,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,CAAC;QAChC,YAAY,EAAE,KAAK,CAAC,YAAY,IAAI,IAAI;QACxC,YAAY,EAAE,KAAK,CAAC,YAAY,IAAI,IAAI;QACxC,cAAc;QACd,WAAW;QACX,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,aAAa;QACb,kBAAkB;QAClB,aAAa;QACb,oBAAoB;QACpB,SAAS;QACT,SAAS;KACV,CAAC,CAAC;IAEH,MAAM,cAAc,GAAG,UAAU,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;IACjG,MAAM,UAAU,GAAG,KAAK,CAAC,aAAa,CAAC,CAAC,CAAC,KAAK,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,YAAY,UAAU,EAAE,EAAE,CAAC;IAE5F,OAAO;QACL,UAAU;QACV,cAAc;QACd,cAAc;QACd,WAAW;QACX,kBAAkB;QAClB,iBAAiB,EAAE,KAAK,CAAC,MAAM;QAC/B,aAAa;QACb,oBAAoB;QACpB,SAAS;QACT,SAAS;KACV,CAAC;AACJ,CAAC"}

package/dist/runtime-v2/{internalization/__tests__/__fixtures__/split-pipeline-mock-outputs.d.ts → adapter/split-pipeline-fixtures.d.ts}

@@ -9,10 +9,14 @@
  * DO NOT edit these by hand. To regenerate, run:
  *   npx tsx spike/split-e2e-lmstudio.ts --core-grounding
  * Then re-export from spike/split-e2e-results.json
+ *
+ * Not under __tests__ on purpose: test-double-runtime-adapter.ts (production)
+ * imports this same copy, so the file is a shared data authority, not test
+ * scaffolding. Do not move it back into a test directory (PRI-902).
  */
-import type { DiagRootCauseOutputV1 } from '../../../diagnostician/diag-rootcause-output.js';
-import type { DiagDistillerOutputV1 } from '../../../diagnostician/diag-distiller-output.js';
-import type { DiagnosticianOutputV1 } from '../../../diagnostician-output.js';
+import type { DiagRootCauseOutputV1 } from '../diagnostician/diag-rootcause-output.js';
+import type { DiagDistillerOutputV1 } from '../diagnostician/diag-distiller-output.js';
+import type { DiagnosticianOutputV1 } from '../diagnostician-output.js';
 export declare const MOCK_ROOT_CAUSE_OUTPUTS: {
     R6: DiagRootCauseOutputV1;
 };
@@ -22,4 +26,4 @@ export declare const MOCK_DISTILLER_OUTPUTS: {
 export declare const MOCK_ROUTER_OUTPUTS: {
     R6: DiagnosticianOutputV1;
 };
-//# sourceMappingURL=split-pipeline-mock-outputs.d.ts.map
+//# sourceMappingURL=split-pipeline-fixtures.d.ts.map

package/dist/runtime-v2/adapter/split-pipeline-fixtures.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"split-pipeline-fixtures.d.ts","sourceRoot":"","sources":["../../../src/runtime-v2/adapter/split-pipeline-fixtures.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,2CAA2C,CAAC;AACvF,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,2CAA2C,CAAC;AACvF,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AAKxE,eAAO,MAAM,uBAAuB,EAAE;IAAE,EAAE,EAAE,qBAAqB,CAAA;CA+ChE,CAAC;AAEF,eAAO,MAAM,sBAAsB,EAAE;IAAE,EAAE,EAAE,qBAAqB,CAAA;CAW/D,CAAC;AAEF,eAAO,MAAM,mBAAmB,EAAE;IAAE,EAAE,EAAE,qBAAqB,CAAA;CA+C5D,CAAC"}

package/dist/runtime-v2/{internalization/__tests__/__fixtures__/split-pipeline-mock-outputs.js → adapter/split-pipeline-fixtures.js}

@@ -9,6 +9,10 @@
  * DO NOT edit these by hand. To regenerate, run:
  *   npx tsx spike/split-e2e-lmstudio.ts --core-grounding
  * Then re-export from spike/split-e2e-results.json
+ *
+ * Not under __tests__ on purpose: test-double-runtime-adapter.ts (production)
+ * imports this same copy, so the file is a shared data authority, not test
+ * scaffolding. Do not move it back into a test directory (PRI-902).
  */
 // ── R6: refactor_regression, T-01/T-03 ──────────────────────────────────────
 // PRI-363 refactor behavior regression (stage enum change broke tests)
@@ -120,4 +124,4 @@ export const MOCK_ROUTER_OUTPUTS = {
         ],
     },
 };
-//# sourceMappingURL=split-pipeline-mock-outputs.js.map
+//# sourceMappingURL=split-pipeline-fixtures.js.map

package/dist/runtime-v2/adapter/split-pipeline-fixtures.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"split-pipeline-fixtures.js","sourceRoot":"","sources":["../../../src/runtime-v2/adapter/split-pipeline-fixtures.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAMH,+EAA+E;AAC/E,uEAAuE;AAEvE,MAAM,CAAC,MAAM,uBAAuB,GAAkC;IACpE,EAAE,EAAE;QACF,KAAK,EAAE,IAAI;QACX,WAAW,EAAE,2BAA2B;QACxC,MAAM,EAAE,2BAA2B;QACnC,OAAO,EAAE,yEAAyE;QAClF,WAAW,EAAE;YACX;gBACE,GAAG,EAAE,CAAC;gBACN,SAAS,EAAE,0FAA0F;gBACrG,YAAY,EAAE,CAAC,oBAAoB,CAAC;aACrC;YACD;gBACE,GAAG,EAAE,CAAC;gBACN,SAAS,EAAE,oGAAoG;gBAC/G,YAAY,EAAE,CAAC,oBAAoB,CAAC;aACrC;YACD;gBACE,GAAG,EAAE,CAAC;gBACN,SAAS,EAAE,2CAA2C;gBACtD,YAAY,EAAE,CAAC,oBAAoB,CAAC;aACrC;YACD;gBACE,GAAG,EAAE,CAAC;gBACN,SAAS,EAAE,oDAAoD;gBAC/D,YAAY,EAAE,CAAC,oBAAoB,CAAC;aACrC;YACD;gBACE,GAAG,EAAE,CAAC;gBACN,SAAS,EAAE,6CAA6C;gBACxD,YAAY,EAAE,CAAC,oBAAoB,CAAC;aACrC;SACF;QACD,SAAS,EAAE,sDAAsD;QACjE,iBAAiB,EAAE,QAAQ;QAC3B,QAAQ,EAAE;YACR;gBACE,SAAS,EAAE,oBAAoB;gBAC/B,IAAI,EAAE,2LAA2L;aAClM;SACF;QACD,UAAU,EAAE,IAAI;QAChB,cAAc,EAAE;YACd,oFAAoF;YACpF,wCAAwC;SACzC;KACF;CACF,CAAC;AAEF,MAAM,CAAC,MAAM,sBAAsB,GAAkC;IACnE,EAAE,EAAE;QACF,KAAK,EAAE,IAAI;QACX,MAAM,EAAE,2BAA2B;QACnC,yBAAyB,EAAE,kCAAkC;QAC7D,mBAAmB,EAAE,iDAAiD;QACtE,SAAS,EAAE,2FAA2F;QACtG,0BAA0B,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC;QAC5C,KAAK,EAAE,SAAS;QAChB,UAAU,EAAE,IAAI;KACjB;CACF,CAAC;AAEF,MAAM,CAAC,MAAM,mBAAmB,GAAkC;IAChE,EAAE,EAAE;QACF,KAAK,EAAE,IAAI;QACX,WAAW,EAAE,2BAA2B;QACxC,OAAO,EAAE,uEAAuE;QAChF,SAAS,EAAE,sDAAsD;QACjE,kBAAkB,EAAE;YAClB;gBACE,WAAW,EAAE,MAAM;gBACnB,KAAK,EAAE,UAAU;gBACjB,SAAS,EAAE,+CAA+C;aAC3D;YACD;gBACE,WAAW,EAAE,MAAM;gBACnB,KAAK,EAAE,QAAQ;gBACf,SAAS,EAAE,qDAAqD;aACjE;SACF;QACD,QAAQ,EAAE;YACR;gBACE,SAAS,EAAE,oBAAoB;gBAC/B,IAAI,EAAE,2LAA2L;aAClM;SACF;QACD,eAAe,EAAE;YACf;gBACE,IAAI,EAAE,WAAW;gBACjB,WAAW,EAAE,iDAAiD;gBAC9D,mBAAmB,EAAE,iDAAiD;aACvE;YACD;gBACE,IAAI,EAAE,MAAM;gBACZ,WAAW,EAAE,8CAA8C;gBAC3D,cAAc,EAAE,qEAAqE;gBACrF,MAAM,EAAE,mCAAmC;aAC5C;YACD;gBACE,IAAI,EAAE,gBAAgB;gBACtB,WAAW,EAAE,8CAA8C;aAC5D;SACF;QACD,UAAU,EAAE,IAAI;QAChB,cAAc,EAAE;YACd,oFAAoF;YACpF,wCAAwC;SACzC;KACF;CACF,CAAC"}

package/dist/runtime-v2/adapter/test-double-runtime-adapter.d.ts

@@ -7,7 +7,7 @@
  *
  * BUG-008: Default fetchOutput dispatches stage-aware mock outputs based on
  * taskId prefix (diag_rootcause/diag_distiller/diag_router), reusing fixtures
- * from split-pipeline-mock-outputs.ts. Non-split taskIds fall back to the
+ * from split-pipeline-fixtures.ts. Non-split taskIds fall back to the
  * original monolithic DiagnosticianOutputV1 shape (backward-compatible).
  */
 import type { PDRuntimeAdapter, RuntimeKind, RuntimeCapabilities, RuntimeHealth, RunHandle, RunStatus, StartRunInput, StructuredRunOutput, RuntimeArtifactRef, ContextItem } from '../runtime-protocol.js';

package/dist/runtime-v2/adapter/test-double-runtime-adapter.js

@@ -1,4 +1,4 @@
-import { MOCK_ROOT_CAUSE_OUTPUTS, MOCK_DISTILLER_OUTPUTS, MOCK_ROUTER_OUTPUTS } from '../internalization/__tests__/__fixtures__/split-pipeline-mock-outputs.js';
+import { MOCK_ROOT_CAUSE_OUTPUTS, MOCK_DISTILLER_OUTPUTS, MOCK_ROUTER_OUTPUTS } from './split-pipeline-fixtures.js';
 export class TestDoubleRuntimeAdapter {
     overrides;
     defaultTaskId;
@@ -74,7 +74,7 @@ export class TestDoubleRuntimeAdapter {
             return this.overrides.onFetchOutput(runId);
         }
         // BUG-008: Dispatch stage-aware mock outputs based on taskId prefix.
-        // Reuse fixtures from split-pipeline-mock-outputs.ts (R6).
+        // Reuse fixtures from split-pipeline-fixtures.ts (R6).
         const taskId = this.runIdToTaskId.get(runId) ?? this.defaultTaskId;
         if (taskId.includes('diag_rootcause')) {
             return {

package/dist/runtime-v2/adapter/test-double-runtime-adapter.js.map

@@ -1 +1 @@
-{"version":3,"file":"test-double-runtime-adapter.js","sourceRoot":"","sources":["../../../src/runtime-v2/adapter/test-double-runtime-adapter.ts"],"names":[],"mappings":"AAwBA,OAAO,EAAE,uBAAuB,EAAE,sBAAsB,EAAE,mBAAmB,EAAE,MAAM,0EAA0E,CAAC;AAchK,MAAM,OAAO,wBAAwB;IAClB,SAAS,CAA8B;IACvC,aAAa,CAAS;IAC/B,UAAU,GAAG,CAAC,CAAC;IACvB,+EAA+E;IAC9D,aAAa,GAAG,IAAI,GAAG,EAAkB,CAAC;IAE3D,YAAY,SAAuC,EAAE,aAAsB;QACzE,IAAI,CAAC,SAAS,GAAG,SAAS,IAAI,EAAE,CAAC;QACjC,IAAI,CAAC,aAAa,GAAG,aAAa,IAAI,iBAAiB,CAAC;IAC1D,CAAC;IAED,qEAAqE;IACrE,IAAI;QACF,OAAO,aAAa,CAAC;IACvB,CAAC;IAED,KAAK,CAAC,eAAe;QACnB,IAAI,IAAI,CAAC,SAAS,CAAC,iBAAiB,EAAE,CAAC;YACrC,OAAO,IAAI,CAAC,SAAS,CAAC,iBAAiB,EAAE,CAAC;QAC5C,CAAC;QACD,OAAO;YACL,4BAA4B,EAAE,IAAI;YAClC,eAAe,EAAE,KAAK;YACtB,wBAAwB,EAAE,KAAK;YAC/B,sBAAsB,EAAE,KAAK;YAC7B,2BAA2B,EAAE,KAAK;YAClC,oBAAoB,EAAE,IAAI;YAC1B,yBAAyB,EAAE,KAAK;YAChC,sBAAsB,EAAE,KAAK;YAC7B,iBAAiB,EAAE,KAAK;SACzB,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,WAAW;QACf,IAAI,IAAI,CAAC,SAAS,CAAC,aAAa,EAAE,CAAC;YACjC,OAAO,IAAI,CAAC,SAAS,CAAC,aAAa,EAAE,CAAC;QACxC,CAAC;QACD,OAAO;YACL,OAAO,EAAE,IAAI;YACb,QAAQ,EAAE,KAAK;YACf,QAAQ,EAAE,EAAE;YACZ,aAAa,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;SACxC,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,KAAoB;QACjC,IAAI,IAAI,CAAC,SAAS,CAAC,UAAU,EAAE,CAAC;YAC9B,OAAO,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;QAC1C,CAAC;QACD,IAAI,CAAC,UAAU,IAAI,CAAC,CAAC;QACrB,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,UAAU,EAAE,CAAC;QACtC,iFAAiF;QACjF,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,EAAE,MAAM,CAAC;QACrC,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;YAC/B,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QACxC,CAAC;QACD,OAAO;YACL,KAAK;YACL,WAAW,EAAE,aAAa;YAC1B,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;SACpC,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,KAAa;QACzB,IAAI,IAAI,CAAC,SAAS,CAAC,SAAS,EAAE,CAAC;YAC7B,OAAO,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;QACzC,CAAC;QACD,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QACrC,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,SAAS,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC;IACtE,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,KAAa;QAC3B,IAAI,IAAI,CAAC,SAAS,CAAC,WAAW,EAAE,CAAC;YAC/B,OAAO,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;QAC3C,CAAC;IACH,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,KAAa;QAC7B,IAAI,IAAI,CAAC,SAAS,CAAC,aAAa,EAAE,CAAC;YACjC,OAAO,IAAI,CAAC,SAAS,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC;QAC7C,CAAC;QAED,qEAAqE;QACrE,2DAA2D;QAC3D,MAAM,MAAM,GAAG,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,aAAa,CAAC;QAEnE,IAAI,MAAM,CAAC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,CAAC;YACtC,OAAO;gBACL,KAAK;gBACL,OAAO,EAAE;oBACP,GAAG,uBAAuB,CAAC,EAAE;oBAC7B,MAAM;iBACP;aACF,CAAC;QACJ,CAAC;QAED,IAAI,MAAM,CAAC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,CAAC;YACtC,OAAO;gBACL,KAAK;gBACL,OAAO,EAAE;oBACP,GAAG,sBAAsB,CAAC,EAAE;oBAC5B,MAAM;iBACP;aACF,CAAC;QACJ,CAAC;QAED,IAAI,MAAM,CAAC,QAAQ,CAAC,aAAa,CAAC,EAAE,CAAC;YACnC,OAAO;gBACL,KAAK;gBACL,OAAO,EAAE;oBACP,GAAG,mBAAmB,CAAC,EAAE;iBAC1B;aACF,CAAC;QACJ,CAAC;QAED,8EAA8E;QAC9E,OAAO;YACL,KAAK;YACL,OAAO,EAAE;gBACP,KAAK,EAAE,IAAI;gBACX,WAAW,EAAE,iBAAiB;gBAC9B,MAAM,EAAE,IAAI,CAAC,aAAa;gBAC1B,OAAO,EAAE,4BAA4B;gBACrC,SAAS,EAAE,+BAA+B;gBAC1C,kBAAkB,EAAE,EAAE;gBACtB,QAAQ,EAAE,EAAE;gBACZ,eAAe,EAAE,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,WAAW,EAAE,kDAAkD,EAAE,CAAC;gBACrG,UAAU,EAAE,GAAG;aAChB;SACF,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,KAAa;QAChC,IAAI,IAAI,CAAC,SAAS,CAAC,gBAAgB,EAAE,CAAC;YACpC,OAAO,IAAI,CAAC,SAAS,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC;QAChD,CAAC;QACD,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,KAAa,EAAE,KAAoB;QACrD,IAAI,IAAI,CAAC,SAAS,CAAC,eAAe,EAAE,CAAC;YACnC,OAAO,IAAI,CAAC,SAAS,CAAC,eAAe,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QACtD,CAAC;IACH,CAAC;CACF"}
+{"version":3,"file":"test-double-runtime-adapter.js","sourceRoot":"","sources":["../../../src/runtime-v2/adapter/test-double-runtime-adapter.ts"],"names":[],"mappings":"AAwBA,OAAO,EAAE,uBAAuB,EAAE,sBAAsB,EAAE,mBAAmB,EAAE,MAAM,8BAA8B,CAAC;AAcpH,MAAM,OAAO,wBAAwB;IAClB,SAAS,CAA8B;IACvC,aAAa,CAAS;IAC/B,UAAU,GAAG,CAAC,CAAC;IACvB,+EAA+E;IAC9D,aAAa,GAAG,IAAI,GAAG,EAAkB,CAAC;IAE3D,YAAY,SAAuC,EAAE,aAAsB;QACzE,IAAI,CAAC,SAAS,GAAG,SAAS,IAAI,EAAE,CAAC;QACjC,IAAI,CAAC,aAAa,GAAG,aAAa,IAAI,iBAAiB,CAAC;IAC1D,CAAC;IAED,qEAAqE;IACrE,IAAI;QACF,OAAO,aAAa,CAAC;IACvB,CAAC;IAED,KAAK,CAAC,eAAe;QACnB,IAAI,IAAI,CAAC,SAAS,CAAC,iBAAiB,EAAE,CAAC;YACrC,OAAO,IAAI,CAAC,SAAS,CAAC,iBAAiB,EAAE,CAAC;QAC5C,CAAC;QACD,OAAO;YACL,4BAA4B,EAAE,IAAI;YAClC,eAAe,EAAE,KAAK;YACtB,wBAAwB,EAAE,KAAK;YAC/B,sBAAsB,EAAE,KAAK;YAC7B,2BAA2B,EAAE,KAAK;YAClC,oBAAoB,EAAE,IAAI;YAC1B,yBAAyB,EAAE,KAAK;YAChC,sBAAsB,EAAE,KAAK;YAC7B,iBAAiB,EAAE,KAAK;SACzB,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,WAAW;QACf,IAAI,IAAI,CAAC,SAAS,CAAC,aAAa,EAAE,CAAC;YACjC,OAAO,IAAI,CAAC,SAAS,CAAC,aAAa,EAAE,CAAC;QACxC,CAAC;QACD,OAAO;YACL,OAAO,EAAE,IAAI;YACb,QAAQ,EAAE,KAAK;YACf,QAAQ,EAAE,EAAE;YACZ,aAAa,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;SACxC,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,KAAoB;QACjC,IAAI,IAAI,CAAC,SAAS,CAAC,UAAU,EAAE,CAAC;YAC9B,OAAO,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;QAC1C,CAAC;QACD,IAAI,CAAC,UAAU,IAAI,CAAC,CAAC;QACrB,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,UAAU,EAAE,CAAC;QACtC,iFAAiF;QACjF,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,EAAE,MAAM,CAAC;QACrC,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;YAC/B,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QACxC,CAAC;QACD,OAAO;YACL,KAAK;YACL,WAAW,EAAE,aAAa;YAC1B,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;SACpC,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,KAAa;QACzB,IAAI,IAAI,CAAC,SAAS,CAAC,SAAS,EAAE,CAAC;YAC7B,OAAO,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;QACzC,CAAC;QACD,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QACrC,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,SAAS,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC;IACtE,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,KAAa;QAC3B,IAAI,IAAI,CAAC,SAAS,CAAC,WAAW,EAAE,CAAC;YAC/B,OAAO,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;QAC3C,CAAC;IACH,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,KAAa;QAC7B,IAAI,IAAI,CAAC,SAAS,CAAC,aAAa,EAAE,CAAC;YACjC,OAAO,IAAI,CAAC,SAAS,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC;QAC7C,CAAC;QAED,qEAAqE;QACrE,uDAAuD;QACvD,MAAM,MAAM,GAAG,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,aAAa,CAAC;QAEnE,IAAI,MAAM,CAAC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,CAAC;YACtC,OAAO;gBACL,KAAK;gBACL,OAAO,EAAE;oBACP,GAAG,uBAAuB,CAAC,EAAE;oBAC7B,MAAM;iBACP;aACF,CAAC;QACJ,CAAC;QAED,IAAI,MAAM,CAAC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,CAAC;YACtC,OAAO;gBACL,KAAK;gBACL,OAAO,EAAE;oBACP,GAAG,sBAAsB,CAAC,EAAE;oBAC5B,MAAM;iBACP;aACF,CAAC;QACJ,CAAC;QAED,IAAI,MAAM,CAAC,QAAQ,CAAC,aAAa,CAAC,EAAE,CAAC;YACnC,OAAO;gBACL,KAAK;gBACL,OAAO,EAAE;oBACP,GAAG,mBAAmB,CAAC,EAAE;iBAC1B;aACF,CAAC;QACJ,CAAC;QAED,8EAA8E;QAC9E,OAAO;YACL,KAAK;YACL,OAAO,EAAE;gBACP,KAAK,EAAE,IAAI;gBACX,WAAW,EAAE,iBAAiB;gBAC9B,MAAM,EAAE,IAAI,CAAC,aAAa;gBAC1B,OAAO,EAAE,4BAA4B;gBACrC,SAAS,EAAE,+BAA+B;gBAC1C,kBAAkB,EAAE,EAAE;gBACtB,QAAQ,EAAE,EAAE;gBACZ,eAAe,EAAE,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,WAAW,EAAE,kDAAkD,EAAE,CAAC;gBACrG,UAAU,EAAE,GAAG;aAChB;SACF,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,KAAa;QAChC,IAAI,IAAI,CAAC,SAAS,CAAC,gBAAgB,EAAE,CAAC;YACpC,OAAO,IAAI,CAAC,SAAS,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC;QAChD,CAAC;QACD,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,KAAa,EAAE,KAAoB;QACrD,IAAI,IAAI,CAAC,SAAS,CAAC,eAAe,EAAE,CAAC;YACnC,OAAO,IAAI,CAAC,SAAS,CAAC,eAAe,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QACtD,CAAC;IACH,CAAC;CACF"}

package/dist/runtime-v2/index.d.ts

@@ -289,7 +289,8 @@ export { RolloutReviewerPromptBuilder, ROLLOUT_REVIEWER_PROTOCOL_INSTRUCTION, RO
 export type { RolloutReviewerPromptBuilderInput, RolloutReviewerPromptInput, RolloutReviewerPromptBuildResult, } from './internalization/rollout-reviewer-prompt-builder.js';
 export type { PIArtifactRecord, PIArtifactStore } from './internalization/pi-artifact.js';
 export { MemoryPIArtifactStore } from './internalization/pi-artifact-store.js';
-export { SqlitePIArtifactStore } from './store/artifact/sqlite-pi-artifact-store.js';
+export { SqlitePIArtifactStore, mapPiArtifactRow } from './store/artifact/sqlite-pi-artifact-store.js';
+export type { PiArtifactRow } from './store/artifact/sqlite-pi-artifact-store.js';
 export { L2AgentLoopAdapter } from './adapter/l2-agent-loop-adapter.js';
 export type { L2AgentLoopAdapterConfig, L2AgentLoopAdapterDeps } from './adapter/l2-agent-loop-adapter.js';
 export { buildDreamerL2Tools, DREAMER_L2_TOOL_WHITELIST, } from './tools/agent-tool-contract.js';
@@ -323,8 +324,8 @@ export type { ReopenRevisionOptions, RolloutRevisionTarget } from './internaliza
 export { createRuntimeStateHandle } from './runtime-state-handle.js';
 export type { RuntimeStateHandle } from './runtime-state-handle.js';
 export type { ActivationRiskLevel, ActivationActor, RolloutActivationDecision, DispatchInput, ActivationDecision, PIArtifactSnapshot, ActivationArtifactReadModel, ActivationStatusRecord, ActivationStateReadModel, ActivationDecisionRecord, ActivationDecisionSubject, ActivationDecisionKind, ActivationControlState, GlobalRuleCodePause, PromotionEvidenceSnapshot, PromotionFailedCheck, PromotionReadinessResult, OwnerPromotionActor, OwnerPromotionRequest, PromotionCommitInput, OwnerPromotionResult, RuleCodeOwnerDecisionServiceDeps, PromotionCheckId, PromotionReadinessCheck, PromotionReadinessEvaluationInput, PromotionReadinessReaderDeps, RuleCodeSafetySample, RuleCodeSafetyCircuitState, RuleCodeSafetyTripReason, HostLivenessContract, WriterInput, WriterResult, CanActivateResult, ChannelWriter, ApprovalStatus, ApprovalRecord, ApprovalEnqueueInput, ApprovalFilter, ApprovalDecisionResult, ApprovalQueueStore, ApprovalListFilter, ApprovalStats, ApprovalListResult, ArtifactLineageIdentity, ApprovalWithContext, ConfidenceLabel, BuildPromotionEvidenceSnapshotInput, PromotionEvidenceOwnerIdentity, } from './activation/index.js';
-export { LOW_RISK_CHANNELS, isArtifactRevisionOf, HIGH_RISK_CHANNEL_MAP, makeIdempotencyKey, isLowRiskChannel, getChannelRiskLevel, ActivationDispatcher, PromptWriter, DeferArchiveWriter, RuleHostWriter, extractEvidenceRefs, extractPrincipleId, MemoryActivationStateStore, MemoryArtifactReadModel, SqliteActivationStateStore, SqliteActivationSafetyStore, RuleCodeOwnerDecisionService, REQUIRED_PROMOTION_CHECK_IDS, evaluateRuleCodePromotionReadiness, PromotionReadinessReader, evaluateRuleCodeSafetyCircuit, initialRuleCodeSafetyCircuitState, collectOpenClawPromotionChecks, summarizeRuleCodeShadowEvents, AUTO_PROMOTION_CONFIDENCE_THRESHOLD, AUTO_PROMOTABLE_CHANNELS, ApprovalQueue, decideAutoPromotion, MemoryApprovalQueueStore, SqliteApprovalQueueStore, mapConfidenceToLabel, RUNTIME_V2_PRINCIPLE_BUDGET, isArtifactRecord, filterPromptActivations, resolvePrincipleFromArtifact, trimToBudget, renderPrinciplesToDirectives, createProductionGateDeps, compileHardenedRuleEvaluator, ApprovalCompletionService, buildPromotionEvidenceSnapshot, computeArtifactDigest, normalizeOwnerIdentity, } from './activation/index.js';
-export type { ActivatedPrinciple, PromptActivationReaderResult, ApprovalCompletionInput, ApprovalCompletionResult, } from './activation/index.js';
+export { LOW_RISK_CHANNELS, isArtifactRevisionOf, HIGH_RISK_CHANNEL_MAP, makeIdempotencyKey, isLowRiskChannel, getChannelRiskLevel, ActivationDispatcher, PromptWriter, DeferArchiveWriter, RuleHostWriter, extractEvidenceRefs, extractPrincipleId, MemoryActivationStateStore, MemoryArtifactReadModel, SqliteActivationStateStore, SqliteActivationSafetyStore, RuleCodeOwnerDecisionService, REQUIRED_PROMOTION_CHECK_IDS, evaluateRuleCodePromotionReadiness, PromotionReadinessReader, evaluateRuleCodeSafetyCircuit, initialRuleCodeSafetyCircuitState, collectOpenClawPromotionChecks, summarizeRuleCodeShadowEvents, AUTO_PROMOTION_CONFIDENCE_THRESHOLD, AUTO_PROMOTABLE_CHANNELS, ApprovalQueue, decideAutoPromotion, MemoryApprovalQueueStore, SqliteApprovalQueueStore, mapConfidenceToLabel, RUNTIME_V2_PRINCIPLE_BUDGET, isArtifactRecord, filterPromptActivations, resolvePrincipleFromArtifact, trimToBudget, renderPrinciplesToDirectives, createProductionGateDeps, compileHardenedRuleEvaluator, ApprovalCompletionService, buildPromotionEvidenceSnapshot, computeArtifactDigest, normalizeOwnerIdentity, verifyPiArtifactRowDigest, } from './activation/index.js';
+export type { ActivatedPrinciple, PromptActivationReaderResult, ApprovalCompletionInput, ApprovalCompletionResult, ArtifactDigestCheck, } from './activation/index.js';
 export { DEFAULT_GFI_POLICY, applyFriction, applyDecay, applyRelief, classifyGfiStage, createGfiSnapshot, } from './gfi/index.js';
 export type { GfiState, GfiEvent, GfiPolicy, GfiStage, GfiSource, GfiSnapshot, } from './gfi/index.js';
 export { buildGfiWorkspaceSnapshot, classifyGfiWorkspaceHealth } from './gfi/index.js';