@principles/host-runtime 0.10.1 → 0.10.3

package/dist/behavior-history.js

@@ -1,5 +1,5 @@
 /** Shared validated history assembly; host vocabulary is supplied by its owner. */
-import { extractFilePathFromParams, normalizePathPure } from '@principles/core/runtime-v2/internalization/rule-host-input-builder';
+import { buildRuleHostAction } from '@principles/core/runtime-v2/internalization/rule-host-input-builder';
 const VALID_OUTCOMES = new Set(['success', 'failure', 'blocked']);
 function isPlainObject(value) {
     return typeof value === 'object' && value !== null && !Array.isArray(value);
@@ -51,14 +51,9 @@ export function assembleBehaviorHistory(rows, truncated, options) {
         // like 'shell'/'cmd'/'delete_file' previously degraded to 'other' here
         // while the gate classified them as bash/write (vocabulary drift).
         const canonicalKind = toolSemantics.resolve(toolName);
-        // Extract normalized path using the same pure logic as buildRuleHostAction
-        // (avoids production/replay drift, spec §4.4)
-        const rawPath = extractFilePathFromParams(parsedParams, {
-            isBashTool: canonicalKind === 'execute',
-            isWriteTool: canonicalKind === 'write',
-            toolName,
-        });
-        const normalizedPath = normalizePathPure(rawPath, projectDir);
+        // Use the shared action builder so history and live/replay preserve the
+        // same distinction between extracted paths and opaque shell commands.
+        const { normalizedPath } = buildRuleHostAction(toolName, parsedParams, projectDir, { canonicalKind });
         records.push({
             sequenceId: row.id,
             toolName,

package/dist/codex-rule-context-provider.d.ts

@@ -0,0 +1,23 @@
+import { type ToolSemanticRegistry } from '@principles/core/runtime-v2';
+import type { RuleContextProvider } from './production-rulehost-gate.js';
+export interface CodexRuleContextProviderOptions {
+    /** The resolved PD workspace whose trajectory database is authoritative. */
+    workspaceDir: string;
+    /** Native Codex project cwd; history rows must have this exact stored scope. */
+    projectDir: string;
+    /** Existing `rulecode_context_v2` and `codex_conversation_ingestion` gates. */
+    enabled: boolean;
+    /** Timestamp captured immediately after decoding this PreToolUse event. */
+    cutoffAt: Date;
+    /** Host-authoritative current Codex tool_use_id, excluded even on timestamp ties. */
+    currentToolUseId: string;
+    toolSemantics: ToolSemanticRegistry;
+}
+/**
+ * Read a bounded same-session trajectory window for Codex PreToolUse events.
+ * It never reads the Codex transcript itself: only already-ingested tool rows
+ * from the resolved workspace are eligible, and rows at/after the captured
+ * hook epoch or belonging to the current tool_use_id are excluded. Disabled
+ * or unverifiable sources return explicit unknowns.
+ */
+export declare function createCodexRuleContextProvider(options: CodexRuleContextProviderOptions): RuleContextProvider;

package/dist/codex-rule-context-provider.js

@@ -0,0 +1,89 @@
+import path from 'node:path';
+import { computeBehaviorFacts, } from '@principles/core/runtime-v2';
+import { assembleBehaviorHistory } from './behavior-history.js';
+import { readWorkspaceRuleContextRowsBefore } from './workspace-behavior-evidence.js';
+const HISTORY_LIMIT = 100;
+const MAX_REASON_LENGTH = 240;
+function isRecord(value) {
+    return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
+function unavailable(reason) {
+    const history = {
+        status: 'unavailable',
+        unavailableReason: reason.replace(/\s+/g, ' ').slice(0, MAX_REASON_LENGTH),
+        truncated: false,
+        calls: [],
+    };
+    return { version: 2, history, facts: computeBehaviorFacts(history, null, null) };
+}
+/**
+ * Read a bounded same-session trajectory window for Codex PreToolUse events.
+ * It never reads the Codex transcript itself: only already-ingested tool rows
+ * from the resolved workspace are eligible, and rows at/after the captured
+ * hook epoch or belonging to the current tool_use_id are excluded. Disabled
+ * or unverifiable sources return explicit unknowns.
+ */
+export function createCodexRuleContextProvider(options) {
+    const workspaceDir = path.resolve(options.workspaceDir);
+    const projectDir = path.resolve(options.projectDir);
+    return (request) => {
+        if (!options.enabled)
+            return unavailable('codex_rule_context_disabled');
+        if (path.resolve(request.workspaceDir) !== workspaceDir)
+            return unavailable('workspace_scope_mismatch');
+        if (typeof request.sessionId !== 'string' || request.sessionId.trim().length === 0)
+            return unavailable('session_id_invalid');
+        const raw = request.rawPayload;
+        const toolInput = isRecord(raw) && isRecord(raw.toolInput) ? raw.toolInput : null;
+        if (toolInput === null
+            || toolInput.toolName !== request.toolName
+            || !isRecord(toolInput.params)
+            || !path.isAbsolute(projectDir)
+            || options.currentToolUseId.trim().length === 0) {
+            return unavailable('codex_pre_tool_scope_mismatch');
+        }
+        const cutoff = options.cutoffAt;
+        if (!(cutoff instanceof Date) || !Number.isFinite(cutoff.getTime()))
+            return unavailable('history_cutoff_invalid');
+        try {
+            const historyRows = readWorkspaceRuleContextRowsBefore(workspaceDir, {
+                sessionId: request.sessionId,
+                projectDir,
+                beforeCreatedAt: cutoff.toISOString(),
+                excludeToolUseId: options.currentToolUseId,
+                limit: HISTORY_LIMIT,
+            });
+            if (historyRows.unscopedPriorRows)
+                return unavailable('trajectory_project_scope_incomplete');
+            if (historyRows.rows.length === 0)
+                return unavailable('no_prior_session_history');
+            const history = assembleBehaviorHistory(historyRows.rows, historyRows.truncated, {
+                projectDir,
+                toolSemantics: options.toolSemantics,
+            });
+            // Codex exposes shell as execute, and other host tools may be MCP calls
+            // absent from this host's semantic registry. Either may read or mutate
+            // files, so neither target-read absence nor exact action counts can be
+            // asserted from this partial semantic view.
+            const factsIncomplete = history.truncated || history.calls.some((call) => call.canonicalKind === 'execute' || call.canonicalKind === 'other');
+            const computedFacts = computeBehaviorFacts(history, factsIncomplete ? null : request.targetPath, null);
+            const facts = factsIncomplete
+                ? {
+                    priorReadOfTarget: 'unknown',
+                    readCount: null,
+                    writeCount: null,
+                    uniqueWritePathCount: null,
+                    sameActionBlockCount: null,
+                }
+                : computedFacts;
+            return {
+                version: 2,
+                history,
+                facts,
+            };
+        }
+        catch (error) {
+            return unavailable(`trajectory_history_unavailable:${error instanceof Error ? error.message : String(error)}`);
+        }
+    };
+}

package/dist/explicit-owner-statement-prefix.d.ts

@@ -0,0 +1,17 @@
+/** The exact prefix (fullwidth colon) defined by SPEC §6.4. */
+export declare const OWNER_STATEMENT_PREFIX = "PD\u8BB0\u5F55\u75DB\u82E6\uFF1A";
+/** SPEC §6.1: reject instead of truncating the Owner's intent. */
+export declare const MAX_OWNER_STATEMENT_CHARS = 500;
+export type OwnerStatementPrefixParse = {
+    matched: false;
+} | {
+    matched: true;
+    text: string | null;
+    reason?: 'statement_empty' | 'statement_too_long';
+};
+/**
+ * Deterministic prefix parse of the CURRENT user prompt. `text === null` means
+ * the prefix matched but the remainder was empty/blank — an explicit request
+ * with no content is a bounded rejection, never a fabricated statement.
+ */
+export declare function parseOwnerStatementPrefix(prompt: unknown): OwnerStatementPrefixParse;

package/dist/explicit-owner-statement-prefix.js

@@ -0,0 +1,21 @@
+/** The exact prefix (fullwidth colon) defined by SPEC §6.4. */
+export const OWNER_STATEMENT_PREFIX = 'PD记录痛苦：';
+/** SPEC §6.1: reject instead of truncating the Owner's intent. */
+export const MAX_OWNER_STATEMENT_CHARS = 500;
+/**
+ * Deterministic prefix parse of the CURRENT user prompt. `text === null` means
+ * the prefix matched but the remainder was empty/blank — an explicit request
+ * with no content is a bounded rejection, never a fabricated statement.
+ */
+export function parseOwnerStatementPrefix(prompt) {
+    if (typeof prompt !== 'string')
+        return { matched: false };
+    if (!prompt.startsWith(OWNER_STATEMENT_PREFIX))
+        return { matched: false };
+    const remainder = prompt.slice(OWNER_STATEMENT_PREFIX.length).trim();
+    if (remainder.length === 0)
+        return { matched: true, text: null, reason: 'statement_empty' };
+    if (remainder.length > MAX_OWNER_STATEMENT_CHARS)
+        return { matched: true, text: null, reason: 'statement_too_long' };
+    return { matched: true, text: remainder };
+}

package/dist/governance-signal-admission.d.ts

@@ -63,7 +63,7 @@ export declare function evaluateCorrectionSignal(input: {
 export type GovernanceSignalKind = 'user_correction' | 'tool_failure';
 export interface GovernanceCorrectionCandidate {
     readonly kind: 'user_correction';
-    readonly hostKind: 'codex';
+    readonly hostKind: 'codex' | 'workbuddy';
     readonly logicalObservationKey: string;
     readonly rolloutIdentity: string;
     readonly rootSessionId: string;
@@ -72,7 +72,7 @@ export interface GovernanceCorrectionCandidate {
     readonly observedAt: string;
     /**
      * SPEC-CODEX-PAIN-CLOSURE-001 CR-02/CR-07: the text is an EXPLICIT Owner
-     * statement (Codex `PD记录痛苦：` prefix). Explicit submissions bypass the
+     * statement (native current-user `PD记录痛苦：` prefix). Explicit submissions bypass the
      * STRONG+high-precision keyword gate — the Owner's explicit request is the
      * signal; nothing is inferred. Rate limiting and the unique observation-key
      * dedup still apply unchanged.
@@ -98,6 +98,8 @@ export interface GovernanceToolFailureCandidate {
     readonly toolCallId?: string;
     /** Host tool-call id (SPEC-CODEX-PAIN-CLOSURE-001 CR-01) — same id the live PostToolUse path records into tool_calls.tool_use_id for the dedup join. */
     readonly toolUseId?: string;
+    /** Native host cwd, when supplied by a live hook; absent for transcript catch-up. */
+    readonly projectDir?: string;
     readonly toolInput?: unknown;
     readonly toolOutput?: unknown;
     readonly observedAt: string;

package/dist/governance-signal-admission.js

@@ -34,7 +34,7 @@
 import fs from 'node:fs';
 import path from 'node:path';
 import Database from 'better-sqlite3';
-import { collectSync, CORRECTION_SEED_KEYWORDS, buildToolFailureObservation, evaluateTriage, evaluateTriggerController, resolveSourceKind, PainToPrincipleService, PrincipleTreeLedgerAdapter, RuntimeStateManager, createDiagnosticianTaskId, disposePainSignalBridgesForWorkspace, sanitizeString, MAX_EVIDENCE_VALUE_CHARS, } from '@principles/core/runtime-v2';
+import { collectSync, CORRECTION_SEED_KEYWORDS, buildToolFailureObservation, evaluateTriage, evaluateTriggerController, resolveSourceKind, PainToPrincipleService, PrincipleTreeLedgerAdapter, RuntimeStateManager, createDiagnosticianTaskId, disposePainSignalBridgesForWorkspace, sanitizeString, boundCorrectionEvidenceText, MAX_EVIDENCE_VALUE_CHARS, } from '@principles/core/runtime-v2';
 import { deriveProductionCorrectionPainIdentity, deriveProductionToolPainIdentity, hasProductionPainSchema, PRODUCTION_WRITE_TOOLS, } from './production-pain-evidence.js';
 import { promoteGovernanceEvidence, ensureGovernanceSchema } from './governance-observation-store.js';
 import { loadPdConfigForPlugin } from './pd-config.js';
@@ -303,13 +303,23 @@ function ensureGovernanceAdmissionSchema(db) {
         if (hasToolCalls) {
             try {
                 db.exec('ALTER TABLE tool_calls ADD COLUMN tool_use_id TEXT');
-                db.exec('CREATE INDEX IF NOT EXISTS idx_tool_calls_session_tool_use_id ON tool_calls(session_id, tool_use_id)');
             }
             catch (err) {
                 const message = err instanceof Error ? err.message : String(err);
                 if (!message.includes('duplicate column name'))
                     throw err;
             }
+            try {
+                // Additive project scope for live Codex admission rows. Existing rows
+                // deliberately remain NULL because their originating cwd is unknown.
+                db.exec('ALTER TABLE tool_calls ADD COLUMN project_dir TEXT');
+            }
+            catch (err) {
+                const message = err instanceof Error ? err.message : String(err);
+                if (!message.includes('duplicate column name'))
+                    throw err;
+            }
+            db.exec('CREATE INDEX IF NOT EXISTS idx_tool_calls_session_tool_use_id ON tool_calls(session_id, tool_use_id)');
         }
     })();
 }
@@ -385,7 +395,7 @@ function tryConsumeRateLimit({ db, rootSessionId, ruleVersion, now }) {
 }
 function insertCorrectionPain({ db, candidate, workspaceDir, painId, detection, nowIso }) {
     const reason = candidate.explicitOwnerStatement === true
-        ? 'Codex explicit owner statement (PD记录痛苦 prefix)'
+        ? `${candidate.hostKind === 'workbuddy' ? 'WorkBuddy' : 'Codex'} explicit owner statement (PD记录痛苦 prefix)`
         : detection !== undefined && detection.matchedTerms.length > 0
             ? `User correction detected: ${detection.matchedTerms.join(', ')}`
             : 'User correction detected';
@@ -433,13 +443,19 @@ function taskSubmissionPayload(candidate, workspaceDir, reason) {
             reason: reason || 'User correction detected',
             score: GOVERNANCE_STRONG_PAIN_SCORE,
             sessionId: candidate.rootSessionId,
-            hostKind: 'codex',
-            evidence: [{ sourceRef: `governance_observation:${candidate.logicalObservationKey}`, note: sanitizeString(candidate.text, workspaceDir) }],
+            hostKind: candidate.hostKind,
+            // WorkBuddy explicit intake has no transcript observation to promote.
+            // The classified Owner statement is its input basis, not a pseudo-trace.
+            evidence: candidate.hostKind === 'workbuddy' && candidate.explicitOwnerStatement === true
+                ? []
+                : [{ sourceRef: `governance_observation:${candidate.logicalObservationKey}`, note: sanitizeString(candidate.text, workspaceDir) }],
             // SPEC-CODEX-PAIN-CLOSURE-001 CR-02 (merged from main): an explicit
             // Owner statement rides as classified correction evidence — never
             // summarized by an AI, never inside evidence[] pseudo-trace entries.
             ...(candidate.explicitOwnerStatement === true
-                ? { correctionEvidence: { text: sanitizeString(candidate.text, workspaceDir), classification: 'owner_statement', channel: 'codex_explicit_prefix' } }
+                ? { correctionEvidence: candidate.hostKind === 'workbuddy'
+                        ? { text: boundCorrectionEvidenceText({ text: candidate.text, classification: 'owner_statement', channel: 'workbuddy_explicit_prefix' }, workspaceDir).text, classification: 'owner_statement', channel: 'workbuddy_explicit_prefix' }
+                        : { text: sanitizeString(candidate.text, workspaceDir), classification: 'owner_statement', channel: 'codex_explicit_prefix' } }
                 : {}),
         };
         return JSON.stringify(payload);
@@ -602,8 +618,11 @@ function admitToolFailure({ db, candidate, workspaceDir, nowIso }) {
         else {
             db.prepare(`INSERT INTO sessions (session_id, started_at, updated_at) VALUES (?, ?, ?) ON CONFLICT(session_id) DO UPDATE SET updated_at = excluded.updated_at`)
                 .run(candidate.rootSessionId, nowIso, nowIso);
-            db.prepare(`INSERT INTO tool_calls (session_id, tool_name, outcome, duration_ms, exit_code, error_type, error_message, gfi_before, gfi_after, params_json, result_preview, created_at, tool_use_id) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`)
-                .run(candidate.rootSessionId, candidate.toolName, outcome.outcome, outcome.durationMs ?? null, outcome.exitCode, outcome.error ? outcome.error.split(/[\s:]/, 1)[0] : null, outcome.error ?? null, null, null, paramsJson, resultPreview, nowIso, candidate.toolUseId ?? null);
+            const projectDir = typeof candidate.projectDir === 'string' && path.isAbsolute(candidate.projectDir)
+                ? path.resolve(candidate.projectDir)
+                : null;
+            db.prepare(`INSERT INTO tool_calls (session_id, tool_name, outcome, duration_ms, exit_code, error_type, error_message, gfi_before, gfi_after, params_json, result_preview, created_at, tool_use_id, project_dir) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`)
+                .run(candidate.rootSessionId, candidate.toolName, outcome.outcome, outcome.durationMs ?? null, outcome.exitCode, outcome.error ? outcome.error.split(/[\s:]/, 1)[0] : null, outcome.error ?? null, null, null, paramsJson, resultPreview, nowIso, candidate.toolUseId ?? null, projectDir);
             reason = `tool=${candidate.toolName}; error=${outcome.error ?? `exit=${outcome.exitCode}`}; path=${relativePath}`;
             db.prepare(`INSERT INTO pain_events (session_id, source, score, reason, severity, origin, confidence, text, canonical_pain_id, runtime_task_id, host_kind, created_at) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`)
                 .run(candidate.rootSessionId, sourceObservation.failureSource ?? 'tool_failure', painScore, reason, painScore >= 70 ? 'severe' : painScore >= 40 ? 'moderate' : 'mild', 'system_infer', null, null, painId, null, candidate.hostKind, nowIso);
@@ -632,8 +651,8 @@ function admitToolFailure({ db, candidate, workspaceDir, nowIso }) {
     return { disposition: 'admitted', kind: 'tool_failure', logicalObservationKey: candidate.logicalObservationKey, canonicalPainId: painId, duplicate, ruleVersion: null };
 }
 function admitOne({ db, candidate, workspaceDir, now, nowIso, keywordStore, onDegradation }) {
-    if (candidate.hostKind !== 'codex') {
-        return { ok: false, reason: 'unsupported_host_kind', nextAction: 'governance signal admission currently accepts codex observations only' };
+    if (candidate.hostKind !== 'codex' && !(candidate.hostKind === 'workbuddy' && candidate.kind === 'user_correction' && candidate.explicitOwnerStatement === true)) {
+        return { ok: false, reason: 'unsupported_host_kind', nextAction: 'governance signal admission accepts Codex observations or explicit WorkBuddy Owner statements' };
     }
     const marker = db.prepare('SELECT * FROM governance_signal_admissions WHERE logical_observation_key = ?').get(candidate.logicalObservationKey);
     if (isRecord(marker)) {
@@ -710,7 +729,8 @@ function isGovernanceTaskPayload(value) {
     const correctionEvidence = own(value, 'correctionEvidence');
     const hasOwnerStatement = isRecord(correctionEvidence)
         && own(correctionEvidence, 'classification') === 'owner_statement'
-        && own(correctionEvidence, 'channel') === 'codex_explicit_prefix'
+        && (own(correctionEvidence, 'channel') === 'codex_explicit_prefix' && hostKind === 'codex'
+            || own(correctionEvidence, 'channel') === 'workbuddy_explicit_prefix' && hostKind === 'workbuddy')
         && typeof own(correctionEvidence, 'text') === 'string'
         && own(correctionEvidence, 'text').length > 0;
     if (correctionEvidence !== undefined && !hasOwnerStatement)

package/dist/index.d.ts

@@ -87,4 +87,6 @@ export declare function createProductionHostRuntime(options?: Partial<Pick<HostR
 }): HostRuntime;
 export * from './behavior-example-pack-assembler.js';
 export * from './behavior-history.js';
-export * from './workspace-behavior-evidence.js';
+export * from './codex-rule-context-provider.js';
+export { createWorkspaceBehaviorEvidencePort } from './workspace-behavior-evidence.js';
+export * from './explicit-owner-statement-prefix.js';

package/dist/index.js

@@ -181,6 +181,7 @@ export function createHostRuntime(options) {
 }
 export function createProductionHostRuntime(options = {}) {
     const productionGate = createProductionRuleHostGate({
+        ...(options.hostKind ? { hostKind: options.hostKind } : {}),
         ...(options.projectDir ? { projectDir: options.projectDir } : {}),
         ...(options.ruleContextProvider ? { ruleContextProvider: options.ruleContextProvider } : {}),
         ...(options.ruleInputEnrichmentProvider ? { ruleInputEnrichmentProvider: options.ruleInputEnrichmentProvider } : {}),
@@ -192,6 +193,7 @@ export function createProductionHostRuntime(options = {}) {
             ...(options.painEnrichmentProvider ? { painEnrichmentProvider: options.painEnrichmentProvider } : {}),
             ...(options.painDatabaseFactory ? { painDatabaseFactory: options.painDatabaseFactory } : {}),
             ...(options.hostKind ? { hostKind: options.hostKind } : {}),
+            ...(options.projectDir ? { projectDir: options.projectDir } : {}),
             ...(options.events ? { events: options.events } : {}),
         }),
         beforeToolCall: options.beforeToolCall ?? productionGate,
@@ -267,4 +269,6 @@ export function createProductionHostRuntime(options = {}) {
 }
 export * from './behavior-example-pack-assembler.js';
 export * from './behavior-history.js';
-export * from './workspace-behavior-evidence.js';
+export * from './codex-rule-context-provider.js';
+export { createWorkspaceBehaviorEvidencePort } from './workspace-behavior-evidence.js';
+export * from './explicit-owner-statement-prefix.js';

package/dist/internalization-consumer-cycle.js

@@ -693,7 +693,7 @@ export async function runInternalizationConsumerCycle(workspaceDir, ports) {
                 break;
             case 'scribe':
                 runner = new ScribeRunner({
-                    stateManager, runtimeAdapter: adapter, eventEmitter: storeEmitter, artifactStore: stateManager.piArtifactStore, validator: new DefaultScribeValidator(),
+                    stateManager, runtimeAdapter: adapter, eventEmitter: storeEmitter, artifactStore: stateManager.piArtifactStore, validator: new DefaultScribeValidator({ requireRuleCodeContracts: true }),
                     // I2 — CHAIN STAMPING (Owner review of PR #1856, P1): the scribe
                     // stamps the ledger principle UUID (minted at intake, keyed by the
                     // dreamer task seed's candidateId) onto the artifact it writes, so

package/dist/internalization-consumer-governance.js

@@ -170,6 +170,9 @@ export function createEvaluatorRepairDeps(workspaceDir, stateManager, logger) {
                     timeoutMs: params.inheritedTimeoutMs,
                     inputArtifactRefs: [...params.inheritedInputArtifactRefs],
                     outputArtifactRefs: [],
+                    ...(params.ownerEvidenceSelection !== undefined
+                        ? { ownerEvidenceSelection: params.ownerEvidenceSelection }
+                        : {}),
                     repairPayload: params.repairPayload,
                 }),
             });

package/dist/production-pain-evidence.d.ts

@@ -143,6 +143,7 @@ export declare function createProductionPainEvidenceHandler(options?: {
     painEnrichmentProvider?: PainEnrichmentProvider;
     painDatabaseFactory?: PainDatabaseFactory;
     hostKind?: GovernanceHostKind;
+    projectDir?: string;
     events?: HostEventEmitter;
 }): (event: HostEvent) => Promise<HostEventResult>;
 export declare function resetProductionPainCooldownForTest(): void;

package/dist/production-pain-evidence.js

@@ -225,7 +225,7 @@ export function deriveProductionCorrectionPainIdentity(fields) {
 }
 const REQUIRED_COLUMNS = {
     sessions: { session_id: 'TEXT', started_at: 'TEXT', updated_at: 'TEXT' },
-    tool_calls: { session_id: 'TEXT', tool_name: 'TEXT', outcome: 'TEXT', duration_ms: 'INTEGER', exit_code: 'INTEGER', error_type: 'TEXT', error_message: 'TEXT', gfi_before: 'REAL', gfi_after: 'REAL', params_json: 'TEXT', result_preview: 'TEXT', created_at: 'TEXT' },
+    tool_calls: { session_id: 'TEXT', tool_name: 'TEXT', outcome: 'TEXT', duration_ms: 'INTEGER', exit_code: 'INTEGER', error_type: 'TEXT', error_message: 'TEXT', gfi_before: 'REAL', gfi_after: 'REAL', params_json: 'TEXT', result_preview: 'TEXT', created_at: 'TEXT', project_dir: 'TEXT' },
     pain_events: { session_id: 'TEXT', source: 'TEXT', score: 'REAL', reason: 'TEXT', severity: 'TEXT', origin: 'TEXT', confidence: 'REAL', text: 'TEXT', canonical_pain_id: 'TEXT', runtime_task_id: 'TEXT', host_kind: 'TEXT', created_at: 'TEXT' },
 };
 function pragmaField(row, key) {
@@ -277,7 +277,7 @@ function hasCanonicalSchema(db) {
     db.prepare('SELECT 1 FROM tool_calls WHERE session_id = ? AND tool_name = ? AND params_json = ? AND outcome = ? AND exit_code IS ? AND error_message IS ? AND result_preview IS ?');
     db.prepare('SELECT 1 FROM pain_events WHERE canonical_pain_id = ?');
     db.prepare('INSERT INTO sessions (session_id, started_at, updated_at) VALUES (?, ?, ?) ON CONFLICT(session_id) DO UPDATE SET updated_at = excluded.updated_at');
-    db.prepare('INSERT INTO tool_calls (session_id, tool_name, outcome, duration_ms, exit_code, error_type, error_message, gfi_before, gfi_after, params_json, result_preview, created_at, tool_use_id) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)');
+    db.prepare('INSERT INTO tool_calls (session_id, tool_name, outcome, duration_ms, exit_code, error_type, error_message, gfi_before, gfi_after, params_json, result_preview, created_at, tool_use_id, project_dir) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)');
     db.prepare('INSERT INTO pain_events (session_id, source, score, reason, severity, origin, confidence, text, canonical_pain_id, runtime_task_id, host_kind, created_at) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)');
     return true;
 }
@@ -301,6 +301,19 @@ function ensureToolCallsToolUseIdColumn(db) {
         // the prepared-statement readiness check below fails loud if it is truly absent.
     }
 }
+/** Additive migration for verified host cwd binding; legacy rows stay NULL. */
+function ensureToolCallsProjectDirColumn(db) {
+    const columns = db.prepare('PRAGMA table_info(tool_calls)').all();
+    if (columns.some((row) => pragmaField(row, 'name') === 'project_dir'))
+        return;
+    try {
+        db.exec('ALTER TABLE tool_calls ADD COLUMN project_dir TEXT');
+    }
+    catch {
+        // A concurrent writer may have added it between the check and the ALTER;
+        // the prepared-statement readiness check below fails loud if absent.
+    }
+}
 /**
  * SPEC-CODEX-PAIN-CLOSURE-001 CR-01: upgrade the live-hook observation of a
  * tool call with the host-verified final result (exit code) read through the
@@ -412,6 +425,7 @@ export function createProductionPainEvidenceHandler(options = {}) {
             db = options.painDatabaseFactory ? options.painDatabaseFactory(dbPath) : new Database(dbPath);
             db.pragma('busy_timeout = 5000');
             ensureToolCallsToolUseIdColumn(db);
+            ensureToolCallsProjectDirColumn(db);
             if (!hasCanonicalSchema(db)) {
                 db.close();
                 db = undefined;
@@ -518,8 +532,8 @@ export function createProductionPainEvidenceHandler(options = {}) {
                     return;
                 }
                 db.prepare(`INSERT INTO sessions (session_id, started_at, updated_at) VALUES (?, ?, ?) ON CONFLICT(session_id) DO UPDATE SET updated_at = excluded.updated_at`).run(event.context.sessionId, createdAt, createdAt);
-                db.prepare(`INSERT INTO tool_calls (session_id, tool_name, outcome, duration_ms, exit_code, error_type, error_message, gfi_before, gfi_after, params_json, result_preview, created_at, tool_use_id) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`)
-                    .run(event.context.sessionId, toolName, outcome.outcome, outcome.durationMs ?? null, outcome.exitCode, outcome.error ? outcome.error.split(/[\s:]/, 1)[0] : null, outcome.error ?? null, null, null, paramsJson, resultPreview, createdAt, event.context.toolCallId ?? null);
+                db.prepare(`INSERT INTO tool_calls (session_id, tool_name, outcome, duration_ms, exit_code, error_type, error_message, gfi_before, gfi_after, params_json, result_preview, created_at, tool_use_id, project_dir) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`)
+                    .run(event.context.sessionId, toolName, outcome.outcome, outcome.durationMs ?? null, outcome.exitCode, outcome.error ? outcome.error.split(/[\s:]/, 1)[0] : null, outcome.error ?? null, null, null, paramsJson, resultPreview, createdAt, event.context.toolCallId ?? null, path.resolve(options.projectDir ?? event.context.workspaceDir));
                 if (admitted) {
                     // Raw observation only (Pain Diagnosis Persistence SPEC §8): the
                     // pain row must record WHAT happened, not WHY. Attribution

package/dist/production-rulehost-gate.d.ts

@@ -1,4 +1,4 @@
-import { type ToolSemanticRegistry } from '@principles/core/runtime-v2';
+import { type ToolSemanticRegistry, type GovernanceHostKind } from '@principles/core/runtime-v2';
 import type { HostEvent, HostEventResult } from '@principles/core/host';
 import { type RuleImplementationRuntime } from './rule-implementation-runtime.js';
 export interface ProductionRuleContextRequest {
@@ -17,6 +17,7 @@ export interface RuleInputEnrichment {
 export type RuleInputEnrichmentProvider = (request: ProductionRuleContextRequest) => unknown | Promise<unknown>;
 export interface ProductionRuleHostGateOptions {
     projectDir?: string;
+    hostKind?: GovernanceHostKind;
     ruleContextProvider?: RuleContextProvider;
     ruleInputEnrichmentProvider?: RuleInputEnrichmentProvider;
     implementationRuntime?: RuleImplementationRuntime;

package/dist/production-rulehost-gate.js

@@ -1,6 +1,7 @@
 import fs from 'node:fs';
 import path from 'node:path';
 import { buildRuleHostAction, buildToolSemanticRegistry, deriveToolHintsFromCanonicalKind, estimateLineChanges, mergeDecisions, SqliteConnection, UNAVAILABLE_RULE_CONTEXT, validateRuleContextV2, validateRuleHostResult, verifyPiArtifactRowDigest, } from '@principles/core/runtime-v2';
+import { isSensitiveSystemPath } from '@principles/core/runtime-v2/internalization/rule-host-input-builder';
 import { scanRetiredContractSymbols } from './legacy-rule-contract-symbols.js';
 import { recordDegradedEnforcement } from './degraded-enforcement-marker.js';
 import { createNodeRuleImplementationRuntime, MAX_ACTIVE_RULES, RULE_BATCH_SOURCE_BYTES, RULE_SOURCE_BYTES, } from './rule-implementation-runtime.js';
@@ -174,6 +175,8 @@ export function createProductionRuleHostGate(options = {}) {
         SELECT a.activation_id, a.artifact_id, a.target_ref, a.action,
                c.enforcement, c.isolation_decision_id,
                p.source_rule_id, p.source_principle_id,
+               EXISTS (SELECT 1 FROM approvals ap WHERE ap.artifact_id = a.artifact_id
+                 AND ap.channel = 'code_tool_hook' AND ap.status = 'approved') AS owner_approved,
                length(CAST(p.content_json AS BLOB)) AS content_bytes,
                (SELECT d.artifact_digest FROM activation_decisions d
                 WHERE d.subject_kind = 'activation' AND d.activation_id = a.activation_id
@@ -232,8 +235,8 @@ export function createProductionRuleHostGate(options = {}) {
                     // through the SAME budget/content/context validation and
                     // evaluateBatch pipeline as live rows, but their results are
                     // collected as observations only and never join mergeDecisions
-                    // (shadow observes, never enforces). The v2 gate below stays ahead
-                    // of any evaluation, so Codex v2 shadow remains suspended.
+                    // (shadow observes, never enforces). The v2 qualification and context
+                    // checks below remain ahead of evaluation for both activation modes.
                     const activationMode = row.action === 'code_tool_hook_live_activate'
                         ? 'live'
                         : row.action === 'code_tool_hook_shadow_activate' ? 'shadow' : null;
@@ -325,6 +328,42 @@ export function createProductionRuleHostGate(options = {}) {
                                 addWarning(warnings, `unsupported_context_version: ${String(content.requiresContextVersion)}`, 'regenerate the rule artifact for context version 2');
                                 continue;
                             }
+                            // Codex V2 is opt-in per regenerated, Owner-approved artifact.
+                            // This system-stamped contract is emitted only after current
+                            // evaluator replay; merely wiring history must not revive old
+                            // activations. Live execution additionally needs the existing
+                            // promotion decision's binding to this exact artifact snapshot.
+                            if (options.hostKind === 'codex') {
+                                const contract = content.ruleHostInputContract;
+                                const hosts = isRecord(contract) ? contract.hostKinds : undefined;
+                                let contentBindingVerified = digestCheck.outcome === 'verified';
+                                if (activationMode === 'shadow' && row.owner_approved === 1) {
+                                    // Old databases remain readable without writing a migration
+                                    // from this enforcement reader. A legacy approval without a
+                                    // content digest cannot grant Codex V2 execution eligibility.
+                                    const approvalColumns = connection.getDb().prepare('PRAGMA table_info(approvals)').all();
+                                    if (approvalColumns.some((column) => isRecord(column) && column.name === 'artifact_digest')) {
+                                        const approval = connection.getDb().prepare(`
+                      SELECT artifact_digest FROM approvals
+                      WHERE artifact_id = ? AND channel = 'code_tool_hook' AND status = 'approved'
+                      ORDER BY decided_at DESC LIMIT 1
+                    `).get(artifactId);
+                                        const approvalDigest = isRecord(approval) && typeof approval.artifact_digest === 'string'
+                                            ? approval.artifact_digest : null;
+                                        contentBindingVerified = verifyPiArtifactRowDigest(contentRow, contentJson, approvalDigest).outcome === 'verified';
+                                    }
+                                    else {
+                                        contentBindingVerified = false;
+                                    }
+                                }
+                                if (!isRecord(contract) || contract.version !== 1 || contract.contextVersion !== 2
+                                    || !Array.isArray(hosts) || !hosts.every((host) => typeof host === 'string')
+                                    || !hosts.includes('codex') || row.owner_approved !== 1
+                                    || !contentBindingVerified) {
+                                    addWarning(warnings, `codex_rule_context_v2_unqualified: activation=${activationId}`, 'regenerate and replay this artifact for Codex, approve it for shadow observation, and use the existing Owner promotion flow for live execution');
+                                    continue;
+                                }
+                            }
                             // SPEC-RULECODE-QUALITY-001 A3 / §7.1 (Q10): MANDATORY runtime
                             // suspension of context-dependent rules. A v2 rule may only
                             // execute when the provider resolved a schema-valid context
@@ -379,7 +418,7 @@ export function createProductionRuleHostGate(options = {}) {
             }
             const hostInput = {
                 action,
-                workspace: { isRiskPath: false },
+                workspace: { isRiskPath: isSensitiveSystemPath(action.normalizedPath) },
                 session: { sessionId: event.context.sessionId, currentGfi: enrichment.currentGfi },
                 evolution: { epTier: enrichment.epTier },
                 derived: { estimatedLineChanges: estimateLineChanges({ toolName: input.toolName, params: input.params }), bashRisk: enrichment.bashRisk },
@@ -401,7 +440,9 @@ export function createProductionRuleHostGate(options = {}) {
             if (remaining <= 0) {
                 return { decision: 'allow', source: event.source, warnings: [boundedWarning('gate_deadline_exceeded', 'reduce active RuleCode count or source size and retry')], metadata: { evaluatedLiveRules: 0 } };
             }
-            const liveBatch = implementationRuntime.evaluateBatch(liveCandidates.map((candidate) => ({ source: candidate.source, filename: `activation-${candidate.implId}` })), hostInput, remaining);
+            const liveBatch = liveCandidates.length === 0
+                ? { ok: true, results: [] }
+                : implementationRuntime.evaluateBatch(liveCandidates.map((candidate) => ({ source: candidate.source, filename: `activation-${candidate.implId}` })), hostInput, remaining);
             if (!liveBatch.ok || !liveBatch.results) {
                 return { decision: 'allow', source: event.source, warnings: [boundedWarning(`${liveBatch.reason ?? 'rule_batch_failed'}: ${liveBatch.detail ?? 'unknown failure'}`, 'inspect active RuleCode resource use and repair or deactivate the unhealthy rule')], metadata: { evaluatedLiveRules: 0 } };
             }

package/dist/workspace-behavior-evidence.d.ts

@@ -1,3 +1,21 @@
 import type { BehaviorEvidencePort, ToolSemanticRegistry } from '@principles/core/runtime-v2';
+import type { RuleHostContextRow } from '@principles/core/trajectory-types';
 /** Lazy storage access: missing labels need no DB, and a failed open remains observable. */
 export declare function createWorkspaceBehaviorEvidencePort(workspaceDir: string, toolSemantics?: ToolSemanticRegistry): BehaviorEvidencePort;
+/**
+ * Read one bounded, same-session history window from the canonical trajectory
+ * database. The timestamp is the caller's pre-event cutoff; rows at or after
+ * it are excluded so replayed/future calls cannot enter a live RuleContext.
+ * This is read-only and never creates or migrates trajectory state.
+ */
+export declare function readWorkspaceRuleContextRowsBefore(workspaceDir: string, input: {
+    sessionId: string;
+    projectDir: string;
+    beforeCreatedAt: string;
+    excludeToolUseId: string;
+    limit: number;
+}): {
+    rows: readonly RuleHostContextRow[];
+    truncated: boolean;
+    unscopedPriorRows: boolean;
+};

package/dist/workspace-behavior-evidence.js

@@ -72,3 +72,50 @@ export function createWorkspaceBehaviorEvidencePort(workspaceDir, toolSemantics)
         },
     };
 }
+/**
+ * Read one bounded, same-session history window from the canonical trajectory
+ * database. The timestamp is the caller's pre-event cutoff; rows at or after
+ * it are excluded so replayed/future calls cannot enter a live RuleContext.
+ * This is read-only and never creates or migrates trajectory state.
+ */
+export function readWorkspaceRuleContextRowsBefore(workspaceDir, input) {
+    const { sessionId, projectDir, beforeCreatedAt, excludeToolUseId, limit } = input;
+    if (sessionId.trim().length === 0)
+        throw new Error('history_session_id_invalid');
+    if (!path.isAbsolute(projectDir))
+        throw new Error('history_project_dir_invalid');
+    if (excludeToolUseId.trim().length === 0)
+        throw new Error('history_tool_use_id_invalid');
+    if (!Number.isSafeInteger(limit) || limit < 1 || limit > 100)
+        throw new Error('history_limit_invalid');
+    if (!Number.isFinite(Date.parse(beforeCreatedAt)))
+        throw new Error('history_cutoff_invalid');
+    const db = new Database(path.join(workspaceDir, '.state', 'trajectory.db'), { readonly: true, fileMustExist: true });
+    try {
+        db.pragma('busy_timeout = 100');
+        return db.transaction(() => {
+            const rows = db.prepare(`
+        SELECT id, tool_name, outcome, params_json
+        FROM tool_calls
+        WHERE session_id = ? AND project_dir = ? AND created_at < ? AND (tool_use_id IS NULL OR tool_use_id <> ?)
+        ORDER BY created_at DESC, id DESC
+        LIMIT ?
+      `).all(sessionId, projectDir, beforeCreatedAt, excludeToolUseId, limit + 1);
+            const unscoped = db.prepare(`
+        SELECT 1 AS found FROM tool_calls
+        WHERE session_id = ? AND project_dir IS NULL AND created_at < ?
+          AND (tool_use_id IS NULL OR tool_use_id <> ?) LIMIT 1
+      `).get(sessionId, beforeCreatedAt, excludeToolUseId);
+            if (!Array.isArray(rows))
+                throw new Error('history_query_invalid');
+            return {
+                rows: rows.slice(0, limit).reverse().map(contextRow),
+                truncated: rows.length > limit,
+                unscopedPriorRows: unscoped !== undefined,
+            };
+        })();
+    }
+    finally {
+        db.close();
+    }
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@principles/host-runtime",
-  "version": "0.10.1",
+  "version": "0.10.3",
   "description": "Shared host-neutral orchestration for Principles Disciple MVP-Core hook paths.",
   "type": "module",
   "main": "./dist/index.js",
@@ -31,7 +31,7 @@
     "lint": "eslint \"src/**/*.ts\""
   },
   "dependencies": {
-    "@principles/core": "^1.293.2",
+    "@principles/core": "^1.293.5",
     "@principles/install-layout": "^0.4.0",
     "better-sqlite3": "^13.0.3",
     "js-yaml": "^5.4.3"