@principles/host-runtime 0.10.2 → 0.10.4

package/dist/behavior-history.js

@@ -1,5 +1,5 @@
 /** Shared validated history assembly; host vocabulary is supplied by its owner. */
-import { extractFilePathFromParams, normalizePathPure } from '@principles/core/runtime-v2/internalization/rule-host-input-builder';
+import { buildRuleHostAction } from '@principles/core/runtime-v2/internalization/rule-host-input-builder';
 const VALID_OUTCOMES = new Set(['success', 'failure', 'blocked']);
 function isPlainObject(value) {
     return typeof value === 'object' && value !== null && !Array.isArray(value);
@@ -51,14 +51,9 @@ export function assembleBehaviorHistory(rows, truncated, options) {
         // like 'shell'/'cmd'/'delete_file' previously degraded to 'other' here
         // while the gate classified them as bash/write (vocabulary drift).
         const canonicalKind = toolSemantics.resolve(toolName);
-        // Extract normalized path using the same pure logic as buildRuleHostAction
-        // (avoids production/replay drift, spec §4.4)
-        const rawPath = extractFilePathFromParams(parsedParams, {
-            isBashTool: canonicalKind === 'execute',
-            isWriteTool: canonicalKind === 'write',
-            toolName,
-        });
-        const normalizedPath = normalizePathPure(rawPath, projectDir);
+        // Use the shared action builder so history and live/replay preserve the
+        // same distinction between extracted paths and opaque shell commands.
+        const { normalizedPath } = buildRuleHostAction(toolName, parsedParams, projectDir, { canonicalKind });
         records.push({
             sequenceId: row.id,
             toolName,

package/dist/codex-rule-context-provider.d.ts

@@ -0,0 +1,23 @@
+import { type ToolSemanticRegistry } from '@principles/core/runtime-v2';
+import type { RuleContextProvider } from './production-rulehost-gate.js';
+export interface CodexRuleContextProviderOptions {
+    /** The resolved PD workspace whose trajectory database is authoritative. */
+    workspaceDir: string;
+    /** Native Codex project cwd; history rows must have this exact stored scope. */
+    projectDir: string;
+    /** Existing `rulecode_context_v2` and `codex_conversation_ingestion` gates. */
+    enabled: boolean;
+    /** Timestamp captured immediately after decoding this PreToolUse event. */
+    cutoffAt: Date;
+    /** Host-authoritative current Codex tool_use_id, excluded even on timestamp ties. */
+    currentToolUseId: string;
+    toolSemantics: ToolSemanticRegistry;
+}
+/**
+ * Read a bounded same-session trajectory window for Codex PreToolUse events.
+ * It never reads the Codex transcript itself: only already-ingested tool rows
+ * from the resolved workspace are eligible, and rows at/after the captured
+ * hook epoch or belonging to the current tool_use_id are excluded. Disabled
+ * or unverifiable sources return explicit unknowns.
+ */
+export declare function createCodexRuleContextProvider(options: CodexRuleContextProviderOptions): RuleContextProvider;

package/dist/codex-rule-context-provider.js

@@ -0,0 +1,89 @@
+import path from 'node:path';
+import { computeBehaviorFacts, } from '@principles/core/runtime-v2';
+import { assembleBehaviorHistory } from './behavior-history.js';
+import { readWorkspaceRuleContextRowsBefore } from './workspace-behavior-evidence.js';
+const HISTORY_LIMIT = 100;
+const MAX_REASON_LENGTH = 240;
+function isRecord(value) {
+    return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
+function unavailable(reason) {
+    const history = {
+        status: 'unavailable',
+        unavailableReason: reason.replace(/\s+/g, ' ').slice(0, MAX_REASON_LENGTH),
+        truncated: false,
+        calls: [],
+    };
+    return { version: 2, history, facts: computeBehaviorFacts(history, null, null) };
+}
+/**
+ * Read a bounded same-session trajectory window for Codex PreToolUse events.
+ * It never reads the Codex transcript itself: only already-ingested tool rows
+ * from the resolved workspace are eligible, and rows at/after the captured
+ * hook epoch or belonging to the current tool_use_id are excluded. Disabled
+ * or unverifiable sources return explicit unknowns.
+ */
+export function createCodexRuleContextProvider(options) {
+    const workspaceDir = path.resolve(options.workspaceDir);
+    const projectDir = path.resolve(options.projectDir);
+    return (request) => {
+        if (!options.enabled)
+            return unavailable('codex_rule_context_disabled');
+        if (path.resolve(request.workspaceDir) !== workspaceDir)
+            return unavailable('workspace_scope_mismatch');
+        if (typeof request.sessionId !== 'string' || request.sessionId.trim().length === 0)
+            return unavailable('session_id_invalid');
+        const raw = request.rawPayload;
+        const toolInput = isRecord(raw) && isRecord(raw.toolInput) ? raw.toolInput : null;
+        if (toolInput === null
+            || toolInput.toolName !== request.toolName
+            || !isRecord(toolInput.params)
+            || !path.isAbsolute(projectDir)
+            || options.currentToolUseId.trim().length === 0) {
+            return unavailable('codex_pre_tool_scope_mismatch');
+        }
+        const cutoff = options.cutoffAt;
+        if (!(cutoff instanceof Date) || !Number.isFinite(cutoff.getTime()))
+            return unavailable('history_cutoff_invalid');
+        try {
+            const historyRows = readWorkspaceRuleContextRowsBefore(workspaceDir, {
+                sessionId: request.sessionId,
+                projectDir,
+                beforeCreatedAt: cutoff.toISOString(),
+                excludeToolUseId: options.currentToolUseId,
+                limit: HISTORY_LIMIT,
+            });
+            if (historyRows.unscopedPriorRows)
+                return unavailable('trajectory_project_scope_incomplete');
+            if (historyRows.rows.length === 0)
+                return unavailable('no_prior_session_history');
+            const history = assembleBehaviorHistory(historyRows.rows, historyRows.truncated, {
+                projectDir,
+                toolSemantics: options.toolSemantics,
+            });
+            // Codex exposes shell as execute, and other host tools may be MCP calls
+            // absent from this host's semantic registry. Either may read or mutate
+            // files, so neither target-read absence nor exact action counts can be
+            // asserted from this partial semantic view.
+            const factsIncomplete = history.truncated || history.calls.some((call) => call.canonicalKind === 'execute' || call.canonicalKind === 'other');
+            const computedFacts = computeBehaviorFacts(history, factsIncomplete ? null : request.targetPath, null);
+            const facts = factsIncomplete
+                ? {
+                    priorReadOfTarget: 'unknown',
+                    readCount: null,
+                    writeCount: null,
+                    uniqueWritePathCount: null,
+                    sameActionBlockCount: null,
+                }
+                : computedFacts;
+            return {
+                version: 2,
+                history,
+                facts,
+            };
+        }
+        catch (error) {
+            return unavailable(`trajectory_history_unavailable:${error instanceof Error ? error.message : String(error)}`);
+        }
+    };
+}

package/dist/governance-signal-admission.d.ts

@@ -98,6 +98,8 @@ export interface GovernanceToolFailureCandidate {
     readonly toolCallId?: string;
     /** Host tool-call id (SPEC-CODEX-PAIN-CLOSURE-001 CR-01) — same id the live PostToolUse path records into tool_calls.tool_use_id for the dedup join. */
     readonly toolUseId?: string;
+    /** Native host cwd, when supplied by a live hook; absent for transcript catch-up. */
+    readonly projectDir?: string;
     readonly toolInput?: unknown;
     readonly toolOutput?: unknown;
     readonly observedAt: string;
@@ -142,12 +144,23 @@ export type AdmitGovernanceSignalsResult = {
     ok: true;
     outcomes: readonly GovernanceAdmissionOutcome[];
 } | Degradation;
+/** Public generic intake stays Codex + explicit WorkBuddy only. */
+export declare function admitGovernanceSignals(input: AdmitGovernanceSignalsInput): AdmitGovernanceSignalsResult;
+/** Pure check: no DB, no filesystem, no classifier, no historical transcript. */
+export declare function assessWorkbuddyLiveKeyword(text: string, sessionId: string): {
+    matched: boolean;
+    reason: 'matched' | 'not_a_signal' | 'prompt_too_large';
+};
 /**
- * Admit governance signal candidates. Each candidate commits in its own
- * trajectory.db transaction (marker + pain row + quota together), so one
- * failing candidate never rolls back another's admission.
+ * Narrow native event gateway: validate true current user origin and flags.
+ * The ordinary generic admission API cannot bypass this WorkBuddy gate.
  */
-export declare function admitGovernanceSignals(input: AdmitGovernanceSignalsInput): AdmitGovernanceSignalsResult;
+export declare function admitTrustedWorkbuddyLiveCorrection(input: {
+    workspaceDir: string;
+    rawEvent: unknown;
+    now?: Date;
+    databaseFactory?: ObservationDatabaseFactory;
+}): AdmitGovernanceSignalsResult;
 export interface EnsureGovernanceTaskInput {
     readonly workspaceDir: string;
     readonly logicalObservationKey: string;

package/dist/governance-signal-admission.js

@@ -34,7 +34,7 @@
 import fs from 'node:fs';
 import path from 'node:path';
 import Database from 'better-sqlite3';
-import { collectSync, CORRECTION_SEED_KEYWORDS, buildToolFailureObservation, evaluateTriage, evaluateTriggerController, resolveSourceKind, PainToPrincipleService, PrincipleTreeLedgerAdapter, RuntimeStateManager, createDiagnosticianTaskId, disposePainSignalBridgesForWorkspace, sanitizeString, boundCorrectionEvidenceText, MAX_EVIDENCE_VALUE_CHARS, } from '@principles/core/runtime-v2';
+import { collectSync, computeFeatureFlagsFromConfig, CORRECTION_SEED_KEYWORDS, buildToolFailureObservation, evaluateTriage, evaluateTriggerController, resolveSourceKind, PainToPrincipleService, PrincipleTreeLedgerAdapter, RuntimeStateManager, createDiagnosticianTaskId, disposePainSignalBridgesForWorkspace, sanitizeString, boundCorrectionEvidenceText, MAX_EVIDENCE_VALUE_CHARS, } from '@principles/core/runtime-v2';
 import { deriveProductionCorrectionPainIdentity, deriveProductionToolPainIdentity, hasProductionPainSchema, PRODUCTION_WRITE_TOOLS, } from './production-pain-evidence.js';
 import { promoteGovernanceEvidence, ensureGovernanceSchema } from './governance-observation-store.js';
 import { loadPdConfigForPlugin } from './pd-config.js';
@@ -303,13 +303,23 @@ function ensureGovernanceAdmissionSchema(db) {
         if (hasToolCalls) {
             try {
                 db.exec('ALTER TABLE tool_calls ADD COLUMN tool_use_id TEXT');
-                db.exec('CREATE INDEX IF NOT EXISTS idx_tool_calls_session_tool_use_id ON tool_calls(session_id, tool_use_id)');
             }
             catch (err) {
                 const message = err instanceof Error ? err.message : String(err);
                 if (!message.includes('duplicate column name'))
                     throw err;
             }
+            try {
+                // Additive project scope for live Codex admission rows. Existing rows
+                // deliberately remain NULL because their originating cwd is unknown.
+                db.exec('ALTER TABLE tool_calls ADD COLUMN project_dir TEXT');
+            }
+            catch (err) {
+                const message = err instanceof Error ? err.message : String(err);
+                if (!message.includes('duplicate column name'))
+                    throw err;
+            }
+            db.exec('CREATE INDEX IF NOT EXISTS idx_tool_calls_session_tool_use_id ON tool_calls(session_id, tool_use_id)');
         }
     })();
 }
@@ -422,7 +432,8 @@ function toolFailureTaskPayload(fields) {
     };
     return JSON.stringify(payload);
 }
-function taskSubmissionPayload(candidate, workspaceDir, reason) {
+function taskSubmissionPayload(candidate, workspaceDir, details) {
+    const { reason, canonicalPainId } = details;
     if (candidate.kind === 'user_correction') {
         // P1-1 privacy (review round 2): sanitize the FULL text before any
         // truncation — a token crossing the 200-char boundary must be redacted, not
@@ -436,9 +447,14 @@ function taskSubmissionPayload(candidate, workspaceDir, reason) {
             hostKind: candidate.hostKind,
             // WorkBuddy explicit intake has no transcript observation to promote.
             // The classified Owner statement is its input basis, not a pseudo-trace.
-            evidence: candidate.hostKind === 'workbuddy' && candidate.explicitOwnerStatement === true
-                ? []
-                : [{ sourceRef: `governance_observation:${candidate.logicalObservationKey}`, note: sanitizeString(candidate.text, workspaceDir) }],
+            evidence: candidate.hostKind === 'workbuddy'
+                ? candidate.explicitOwnerStatement === true ? [] : [{
+                        // WorkBuddy has no governance_observation, anchor to the canonical
+                        // Pain persisted in this same trajectory.db transaction.
+                        sourceRef: 'pain_event:' + (canonicalPainId ?? ''),
+                        note: sanitizeString(candidate.text, workspaceDir),
+                    }]
+                : [{ sourceRef: 'governance_observation:' + candidate.logicalObservationKey, note: sanitizeString(candidate.text, workspaceDir) }],
             // SPEC-CODEX-PAIN-CLOSURE-001 CR-02 (merged from main): an explicit
             // Owner statement rides as classified correction evidence — never
             // summarized by an AI, never inside evidence[] pseudo-trace entries.
@@ -534,7 +550,7 @@ function admitCorrection({ db, candidate, workspaceDir, now, nowIso, keywordStor
                 // detection, so `detection` is optional — no ruleVersion exists for them.
                 ruleVersion: detection?.ruleVersion ?? null,
                 reason,
-                payloadJson: taskSubmissionPayload(candidate, workspaceDir, reason),
+                payloadJson: taskSubmissionPayload(candidate, workspaceDir, { reason, canonicalPainId: painId }),
                 nowIso,
             });
         })();
@@ -608,8 +624,11 @@ function admitToolFailure({ db, candidate, workspaceDir, nowIso }) {
         else {
             db.prepare(`INSERT INTO sessions (session_id, started_at, updated_at) VALUES (?, ?, ?) ON CONFLICT(session_id) DO UPDATE SET updated_at = excluded.updated_at`)
                 .run(candidate.rootSessionId, nowIso, nowIso);
-            db.prepare(`INSERT INTO tool_calls (session_id, tool_name, outcome, duration_ms, exit_code, error_type, error_message, gfi_before, gfi_after, params_json, result_preview, created_at, tool_use_id) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`)
-                .run(candidate.rootSessionId, candidate.toolName, outcome.outcome, outcome.durationMs ?? null, outcome.exitCode, outcome.error ? outcome.error.split(/[\s:]/, 1)[0] : null, outcome.error ?? null, null, null, paramsJson, resultPreview, nowIso, candidate.toolUseId ?? null);
+            const projectDir = typeof candidate.projectDir === 'string' && path.isAbsolute(candidate.projectDir)
+                ? path.resolve(candidate.projectDir)
+                : null;
+            db.prepare(`INSERT INTO tool_calls (session_id, tool_name, outcome, duration_ms, exit_code, error_type, error_message, gfi_before, gfi_after, params_json, result_preview, created_at, tool_use_id, project_dir) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`)
+                .run(candidate.rootSessionId, candidate.toolName, outcome.outcome, outcome.durationMs ?? null, outcome.exitCode, outcome.error ? outcome.error.split(/[\s:]/, 1)[0] : null, outcome.error ?? null, null, null, paramsJson, resultPreview, nowIso, candidate.toolUseId ?? null, projectDir);
             reason = `tool=${candidate.toolName}; error=${outcome.error ?? `exit=${outcome.exitCode}`}; path=${relativePath}`;
             db.prepare(`INSERT INTO pain_events (session_id, source, score, reason, severity, origin, confidence, text, canonical_pain_id, runtime_task_id, host_kind, created_at) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`)
                 .run(candidate.rootSessionId, sourceObservation.failureSource ?? 'tool_failure', painScore, reason, painScore >= 70 ? 'severe' : painScore >= 40 ? 'moderate' : 'mild', 'system_infer', null, null, painId, null, candidate.hostKind, nowIso);
@@ -624,7 +643,7 @@ function admitToolFailure({ db, candidate, workspaceDir, nowIso }) {
                 canonicalPainId: painId,
                 ruleVersion: null,
                 reason: sanitizeString(reason, workspaceDir),
-                payloadJson: taskSubmissionPayload(candidate, workspaceDir, reason),
+                payloadJson: taskSubmissionPayload(candidate, workspaceDir, { reason }),
                 nowIso,
             });
         }
@@ -637,8 +656,8 @@ function admitToolFailure({ db, candidate, workspaceDir, nowIso }) {
     }
     return { disposition: 'admitted', kind: 'tool_failure', logicalObservationKey: candidate.logicalObservationKey, canonicalPainId: painId, duplicate, ruleVersion: null };
 }
-function admitOne({ db, candidate, workspaceDir, now, nowIso, keywordStore, onDegradation }) {
-    if (candidate.hostKind !== 'codex' && !(candidate.hostKind === 'workbuddy' && candidate.kind === 'user_correction' && candidate.explicitOwnerStatement === true)) {
+function admitOne({ db, candidate, workspaceDir, now, nowIso, keywordStore, onDegradation, trustedWorkbuddyLive }) {
+    if (candidate.hostKind !== 'codex' && !(candidate.hostKind === 'workbuddy' && candidate.kind === 'user_correction' && (candidate.explicitOwnerStatement === true || trustedWorkbuddyLive === true))) {
         return { ok: false, reason: 'unsupported_host_kind', nextAction: 'governance signal admission accepts Codex observations or explicit WorkBuddy Owner statements' };
     }
     const marker = db.prepare('SELECT * FROM governance_signal_admissions WHERE logical_observation_key = ?').get(candidate.logicalObservationKey);
@@ -663,7 +682,7 @@ function admitOne({ db, candidate, workspaceDir, now, nowIso, keywordStore, onDe
  * trajectory.db transaction (marker + pain row + quota together), so one
  * failing candidate never rolls back another's admission.
  */
-export function admitGovernanceSignals(input) {
+function admitGovernanceSignalsInternal(input, trustedWorkbuddyLive = false) {
     const opened = openAdmissionStore(input.workspaceDir, input.databaseFactory);
     if (!('db' in opened))
         return opened;
@@ -678,7 +697,7 @@ export function admitGovernanceSignals(input) {
     const outcomes = [];
     try {
         for (const candidate of input.candidates) {
-            outcomes.push(admitOne({ db, candidate, workspaceDir, now, nowIso, ...(input.keywordStore ? { keywordStore: input.keywordStore } : {}), ...(input.onDegradation ? { onDegradation: input.onDegradation } : {}) }));
+            outcomes.push(admitOne({ db, candidate, workspaceDir, now, nowIso, ...(input.keywordStore ? { keywordStore: input.keywordStore } : {}), ...(input.onDegradation ? { onDegradation: input.onDegradation } : {}), trustedWorkbuddyLive }));
         }
         return { ok: true, outcomes };
     }
@@ -690,6 +709,87 @@ export function admitGovernanceSignals(input) {
         close();
     }
 }
+/** Public generic intake stays Codex + explicit WorkBuddy only. */
+export function admitGovernanceSignals(input) {
+    return admitGovernanceSignalsInternal(input);
+}
+/** P0: a four-term projection of existing canonical high-precision seeds. */
+const WORKBUDDY_AUTO_TERMS = new Set(['这是错的', '不要自作主张', '不应该这么做', '又搞错']);
+const WORKBUDDY_MAX_PROMPT_BYTES = 16 * 1024;
+function workbuddyP0KeywordStore() {
+    const seed = buildSharedSeedKeywordStore();
+    const terms = {};
+    for (const [term, def] of Object.entries(seed.terms)) {
+        if (WORKBUDDY_AUTO_TERMS.has(term) && def.category === 'correction' && def.precision === 'high') {
+            terms[term] = def;
+        }
+    }
+    return { version: seed.version, terms };
+}
+/** Pure check: no DB, no filesystem, no classifier, no historical transcript. */
+export function assessWorkbuddyLiveKeyword(text, sessionId) {
+    if (Buffer.byteLength(text, 'utf8') > WORKBUDDY_MAX_PROMPT_BYTES) {
+        return { matched: false, reason: 'prompt_too_large' };
+    }
+    const store = workbuddyP0KeywordStore();
+    // Prefer precision to recall: reject quoted/embedded/reported phrases.
+    if (!Object.keys(store.terms).some(term => text.trimStart().toLowerCase().startsWith(term.toLowerCase()))) {
+        return { matched: false, reason: 'not_a_signal' };
+    }
+    const out = collectSync(text, sessionId, store, SYNC_DETECTION_CONFIG, new Date().toISOString());
+    const matched = out.isSignal && out.strength === 'STRONG' &&
+        out.type === 'correction' && out.matchedPrecision === 'high';
+    return { matched, reason: matched ? 'matched' : 'not_a_signal' };
+}
+/**
+ * Narrow native event gateway: validate true current user origin and flags.
+ * The ordinary generic admission API cannot bypass this WorkBuddy gate.
+ */
+export function admitTrustedWorkbuddyLiveCorrection(input) {
+    const raw = input.rawEvent;
+    if (!isRecord(raw) || own(raw, 'hook_event_name') !== 'UserPromptSubmit' ||
+        own(raw, 'is_internal_continuation') !== false) {
+        return { ok: false, reason: 'native_current_user_unverified', nextAction: 'Require a real current WorkBuddy UserPromptSubmit event.' };
+    }
+    const sessionId = own(raw, 'session_id');
+    const generationId = own(raw, 'generation_id');
+    const prompt = own(raw, 'prompt');
+    if (typeof sessionId !== 'string' || !sessionId.trim() ||
+        typeof generationId !== 'string' || !generationId.trim() ||
+        typeof prompt !== 'string') {
+        return { ok: false, reason: 'native_identity_invalid', nextAction: 'Require nonblank native session_id/generation_id and prompt.' };
+    }
+    const config = loadPdConfigForPlugin(input.workspaceDir);
+    if (!config.ok)
+        return { ok: false, reason: 'workbuddy_config_invalid', nextAction: 'Repair WorkBuddy governance workspace config.' };
+    const { flags } = computeFeatureFlagsFromConfig(config.effective);
+    if (flags['host.workbuddy']?.enabled !== true || flags.workbuddy_live_keyword_pain?.enabled !== true) {
+        return { ok: false, reason: 'workbuddy_auto_disabled', nextAction: 'Explicitly enable both WorkBuddy host and live keyword Pain.' };
+    }
+    if (prompt.trimStart().startsWith('PD记录痛苦')) {
+        return { ok: false, reason: 'explicit_owner_statement_reserved', nextAction: 'Use original Owner intake; no keyword fallback.' };
+    }
+    if (!assessWorkbuddyLiveKeyword(prompt, sessionId).matched) {
+        return { ok: true, outcomes: [] };
+    }
+    const nativeIdentity = JSON.stringify(['workbuddy', sessionId, generationId]);
+    return admitGovernanceSignalsInternal({
+        workspaceDir: input.workspaceDir,
+        candidates: [{
+                kind: 'user_correction',
+                hostKind: 'workbuddy',
+                logicalObservationKey: nativeIdentity + '|user',
+                rolloutIdentity: JSON.stringify(['workbuddy', sessionId]),
+                rootSessionId: sessionId,
+                hostTurnId: nativeIdentity,
+                text: prompt,
+                observedAt: (input.now ?? new Date()).toISOString(),
+            }],
+        keywordStore: workbuddyP0KeywordStore(),
+        ...(input.now ? { now: input.now } : {}),
+        ...(input.databaseFactory ? { databaseFactory: input.databaseFactory } : {}),
+    }, true);
+}
 // ─── Diagnostician continuation (one pain → exactly one pending task) ───────
 function isGovernanceTaskPayload(value) {
     if (!isRecord(value))

package/dist/index.d.ts

@@ -87,5 +87,6 @@ export declare function createProductionHostRuntime(options?: Partial<Pick<HostR
 }): HostRuntime;
 export * from './behavior-example-pack-assembler.js';
 export * from './behavior-history.js';
-export * from './workspace-behavior-evidence.js';
+export * from './codex-rule-context-provider.js';
+export { createWorkspaceBehaviorEvidencePort } from './workspace-behavior-evidence.js';
 export * from './explicit-owner-statement-prefix.js';

package/dist/index.js

@@ -181,6 +181,7 @@ export function createHostRuntime(options) {
 }
 export function createProductionHostRuntime(options = {}) {
     const productionGate = createProductionRuleHostGate({
+        ...(options.hostKind ? { hostKind: options.hostKind } : {}),
         ...(options.projectDir ? { projectDir: options.projectDir } : {}),
         ...(options.ruleContextProvider ? { ruleContextProvider: options.ruleContextProvider } : {}),
         ...(options.ruleInputEnrichmentProvider ? { ruleInputEnrichmentProvider: options.ruleInputEnrichmentProvider } : {}),
@@ -192,6 +193,7 @@ export function createProductionHostRuntime(options = {}) {
             ...(options.painEnrichmentProvider ? { painEnrichmentProvider: options.painEnrichmentProvider } : {}),
             ...(options.painDatabaseFactory ? { painDatabaseFactory: options.painDatabaseFactory } : {}),
             ...(options.hostKind ? { hostKind: options.hostKind } : {}),
+            ...(options.projectDir ? { projectDir: options.projectDir } : {}),
             ...(options.events ? { events: options.events } : {}),
         }),
         beforeToolCall: options.beforeToolCall ?? productionGate,
@@ -267,5 +269,6 @@ export function createProductionHostRuntime(options = {}) {
 }
 export * from './behavior-example-pack-assembler.js';
 export * from './behavior-history.js';
-export * from './workspace-behavior-evidence.js';
+export * from './codex-rule-context-provider.js';
+export { createWorkspaceBehaviorEvidencePort } from './workspace-behavior-evidence.js';
 export * from './explicit-owner-statement-prefix.js';

package/dist/internalization-consumer-cycle.js

@@ -693,7 +693,7 @@ export async function runInternalizationConsumerCycle(workspaceDir, ports) {
                 break;
             case 'scribe':
                 runner = new ScribeRunner({
-                    stateManager, runtimeAdapter: adapter, eventEmitter: storeEmitter, artifactStore: stateManager.piArtifactStore, validator: new DefaultScribeValidator(),
+                    stateManager, runtimeAdapter: adapter, eventEmitter: storeEmitter, artifactStore: stateManager.piArtifactStore, validator: new DefaultScribeValidator({ requireRuleCodeContracts: true }),
                     // I2 — CHAIN STAMPING (Owner review of PR #1856, P1): the scribe
                     // stamps the ledger principle UUID (minted at intake, keyed by the
                     // dreamer task seed's candidateId) onto the artifact it writes, so

package/dist/internalization-consumer-governance.js

@@ -170,6 +170,9 @@ export function createEvaluatorRepairDeps(workspaceDir, stateManager, logger) {
                     timeoutMs: params.inheritedTimeoutMs,
                     inputArtifactRefs: [...params.inheritedInputArtifactRefs],
                     outputArtifactRefs: [],
+                    ...(params.ownerEvidenceSelection !== undefined
+                        ? { ownerEvidenceSelection: params.ownerEvidenceSelection }
+                        : {}),
                     repairPayload: params.repairPayload,
                 }),
             });

package/dist/production-pain-evidence.d.ts

@@ -143,6 +143,7 @@ export declare function createProductionPainEvidenceHandler(options?: {
     painEnrichmentProvider?: PainEnrichmentProvider;
     painDatabaseFactory?: PainDatabaseFactory;
     hostKind?: GovernanceHostKind;
+    projectDir?: string;
     events?: HostEventEmitter;
 }): (event: HostEvent) => Promise<HostEventResult>;
 export declare function resetProductionPainCooldownForTest(): void;

package/dist/production-pain-evidence.js

@@ -225,7 +225,7 @@ export function deriveProductionCorrectionPainIdentity(fields) {
 }
 const REQUIRED_COLUMNS = {
     sessions: { session_id: 'TEXT', started_at: 'TEXT', updated_at: 'TEXT' },
-    tool_calls: { session_id: 'TEXT', tool_name: 'TEXT', outcome: 'TEXT', duration_ms: 'INTEGER', exit_code: 'INTEGER', error_type: 'TEXT', error_message: 'TEXT', gfi_before: 'REAL', gfi_after: 'REAL', params_json: 'TEXT', result_preview: 'TEXT', created_at: 'TEXT' },
+    tool_calls: { session_id: 'TEXT', tool_name: 'TEXT', outcome: 'TEXT', duration_ms: 'INTEGER', exit_code: 'INTEGER', error_type: 'TEXT', error_message: 'TEXT', gfi_before: 'REAL', gfi_after: 'REAL', params_json: 'TEXT', result_preview: 'TEXT', created_at: 'TEXT', project_dir: 'TEXT' },
     pain_events: { session_id: 'TEXT', source: 'TEXT', score: 'REAL', reason: 'TEXT', severity: 'TEXT', origin: 'TEXT', confidence: 'REAL', text: 'TEXT', canonical_pain_id: 'TEXT', runtime_task_id: 'TEXT', host_kind: 'TEXT', created_at: 'TEXT' },
 };
 function pragmaField(row, key) {
@@ -277,7 +277,7 @@ function hasCanonicalSchema(db) {
     db.prepare('SELECT 1 FROM tool_calls WHERE session_id = ? AND tool_name = ? AND params_json = ? AND outcome = ? AND exit_code IS ? AND error_message IS ? AND result_preview IS ?');
     db.prepare('SELECT 1 FROM pain_events WHERE canonical_pain_id = ?');
     db.prepare('INSERT INTO sessions (session_id, started_at, updated_at) VALUES (?, ?, ?) ON CONFLICT(session_id) DO UPDATE SET updated_at = excluded.updated_at');
-    db.prepare('INSERT INTO tool_calls (session_id, tool_name, outcome, duration_ms, exit_code, error_type, error_message, gfi_before, gfi_after, params_json, result_preview, created_at, tool_use_id) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)');
+    db.prepare('INSERT INTO tool_calls (session_id, tool_name, outcome, duration_ms, exit_code, error_type, error_message, gfi_before, gfi_after, params_json, result_preview, created_at, tool_use_id, project_dir) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)');
     db.prepare('INSERT INTO pain_events (session_id, source, score, reason, severity, origin, confidence, text, canonical_pain_id, runtime_task_id, host_kind, created_at) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)');
     return true;
 }
@@ -301,6 +301,19 @@ function ensureToolCallsToolUseIdColumn(db) {
         // the prepared-statement readiness check below fails loud if it is truly absent.
     }
 }
+/** Additive migration for verified host cwd binding; legacy rows stay NULL. */
+function ensureToolCallsProjectDirColumn(db) {
+    const columns = db.prepare('PRAGMA table_info(tool_calls)').all();
+    if (columns.some((row) => pragmaField(row, 'name') === 'project_dir'))
+        return;
+    try {
+        db.exec('ALTER TABLE tool_calls ADD COLUMN project_dir TEXT');
+    }
+    catch {
+        // A concurrent writer may have added it between the check and the ALTER;
+        // the prepared-statement readiness check below fails loud if absent.
+    }
+}
 /**
  * SPEC-CODEX-PAIN-CLOSURE-001 CR-01: upgrade the live-hook observation of a
  * tool call with the host-verified final result (exit code) read through the
@@ -412,6 +425,7 @@ export function createProductionPainEvidenceHandler(options = {}) {
             db = options.painDatabaseFactory ? options.painDatabaseFactory(dbPath) : new Database(dbPath);
             db.pragma('busy_timeout = 5000');
             ensureToolCallsToolUseIdColumn(db);
+            ensureToolCallsProjectDirColumn(db);
             if (!hasCanonicalSchema(db)) {
                 db.close();
                 db = undefined;
@@ -518,8 +532,8 @@ export function createProductionPainEvidenceHandler(options = {}) {
                     return;
                 }
                 db.prepare(`INSERT INTO sessions (session_id, started_at, updated_at) VALUES (?, ?, ?) ON CONFLICT(session_id) DO UPDATE SET updated_at = excluded.updated_at`).run(event.context.sessionId, createdAt, createdAt);
-                db.prepare(`INSERT INTO tool_calls (session_id, tool_name, outcome, duration_ms, exit_code, error_type, error_message, gfi_before, gfi_after, params_json, result_preview, created_at, tool_use_id) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`)
-                    .run(event.context.sessionId, toolName, outcome.outcome, outcome.durationMs ?? null, outcome.exitCode, outcome.error ? outcome.error.split(/[\s:]/, 1)[0] : null, outcome.error ?? null, null, null, paramsJson, resultPreview, createdAt, event.context.toolCallId ?? null);
+                db.prepare(`INSERT INTO tool_calls (session_id, tool_name, outcome, duration_ms, exit_code, error_type, error_message, gfi_before, gfi_after, params_json, result_preview, created_at, tool_use_id, project_dir) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`)
+                    .run(event.context.sessionId, toolName, outcome.outcome, outcome.durationMs ?? null, outcome.exitCode, outcome.error ? outcome.error.split(/[\s:]/, 1)[0] : null, outcome.error ?? null, null, null, paramsJson, resultPreview, createdAt, event.context.toolCallId ?? null, path.resolve(options.projectDir ?? event.context.workspaceDir));
                 if (admitted) {
                     // Raw observation only (Pain Diagnosis Persistence SPEC §8): the
                     // pain row must record WHAT happened, not WHY. Attribution

package/dist/production-rulehost-gate.d.ts

@@ -1,4 +1,4 @@
-import { type ToolSemanticRegistry } from '@principles/core/runtime-v2';
+import { type ToolSemanticRegistry, type GovernanceHostKind } from '@principles/core/runtime-v2';
 import type { HostEvent, HostEventResult } from '@principles/core/host';
 import { type RuleImplementationRuntime } from './rule-implementation-runtime.js';
 export interface ProductionRuleContextRequest {
@@ -17,6 +17,7 @@ export interface RuleInputEnrichment {
 export type RuleInputEnrichmentProvider = (request: ProductionRuleContextRequest) => unknown | Promise<unknown>;
 export interface ProductionRuleHostGateOptions {
     projectDir?: string;
+    hostKind?: GovernanceHostKind;
     ruleContextProvider?: RuleContextProvider;
     ruleInputEnrichmentProvider?: RuleInputEnrichmentProvider;
     implementationRuntime?: RuleImplementationRuntime;

package/dist/production-rulehost-gate.js

@@ -1,6 +1,7 @@
 import fs from 'node:fs';
 import path from 'node:path';
 import { buildRuleHostAction, buildToolSemanticRegistry, deriveToolHintsFromCanonicalKind, estimateLineChanges, mergeDecisions, SqliteConnection, UNAVAILABLE_RULE_CONTEXT, validateRuleContextV2, validateRuleHostResult, verifyPiArtifactRowDigest, } from '@principles/core/runtime-v2';
+import { isSensitiveSystemPath } from '@principles/core/runtime-v2/internalization/rule-host-input-builder';
 import { scanRetiredContractSymbols } from './legacy-rule-contract-symbols.js';
 import { recordDegradedEnforcement } from './degraded-enforcement-marker.js';
 import { createNodeRuleImplementationRuntime, MAX_ACTIVE_RULES, RULE_BATCH_SOURCE_BYTES, RULE_SOURCE_BYTES, } from './rule-implementation-runtime.js';
@@ -174,6 +175,8 @@ export function createProductionRuleHostGate(options = {}) {
         SELECT a.activation_id, a.artifact_id, a.target_ref, a.action,
                c.enforcement, c.isolation_decision_id,
                p.source_rule_id, p.source_principle_id,
+               EXISTS (SELECT 1 FROM approvals ap WHERE ap.artifact_id = a.artifact_id
+                 AND ap.channel = 'code_tool_hook' AND ap.status = 'approved') AS owner_approved,
                length(CAST(p.content_json AS BLOB)) AS content_bytes,
                (SELECT d.artifact_digest FROM activation_decisions d
                 WHERE d.subject_kind = 'activation' AND d.activation_id = a.activation_id
@@ -232,8 +235,8 @@ export function createProductionRuleHostGate(options = {}) {
                     // through the SAME budget/content/context validation and
                     // evaluateBatch pipeline as live rows, but their results are
                     // collected as observations only and never join mergeDecisions
-                    // (shadow observes, never enforces). The v2 gate below stays ahead
-                    // of any evaluation, so Codex v2 shadow remains suspended.
+                    // (shadow observes, never enforces). The v2 qualification and context
+                    // checks below remain ahead of evaluation for both activation modes.
                     const activationMode = row.action === 'code_tool_hook_live_activate'
                         ? 'live'
                         : row.action === 'code_tool_hook_shadow_activate' ? 'shadow' : null;
@@ -325,6 +328,42 @@ export function createProductionRuleHostGate(options = {}) {
                                 addWarning(warnings, `unsupported_context_version: ${String(content.requiresContextVersion)}`, 'regenerate the rule artifact for context version 2');
                                 continue;
                             }
+                            // Codex V2 is opt-in per regenerated, Owner-approved artifact.
+                            // This system-stamped contract is emitted only after current
+                            // evaluator replay; merely wiring history must not revive old
+                            // activations. Live execution additionally needs the existing
+                            // promotion decision's binding to this exact artifact snapshot.
+                            if (options.hostKind === 'codex') {
+                                const contract = content.ruleHostInputContract;
+                                const hosts = isRecord(contract) ? contract.hostKinds : undefined;
+                                let contentBindingVerified = digestCheck.outcome === 'verified';
+                                if (activationMode === 'shadow' && row.owner_approved === 1) {
+                                    // Old databases remain readable without writing a migration
+                                    // from this enforcement reader. A legacy approval without a
+                                    // content digest cannot grant Codex V2 execution eligibility.
+                                    const approvalColumns = connection.getDb().prepare('PRAGMA table_info(approvals)').all();
+                                    if (approvalColumns.some((column) => isRecord(column) && column.name === 'artifact_digest')) {
+                                        const approval = connection.getDb().prepare(`
+                      SELECT artifact_digest FROM approvals
+                      WHERE artifact_id = ? AND channel = 'code_tool_hook' AND status = 'approved'
+                      ORDER BY decided_at DESC LIMIT 1
+                    `).get(artifactId);
+                                        const approvalDigest = isRecord(approval) && typeof approval.artifact_digest === 'string'
+                                            ? approval.artifact_digest : null;
+                                        contentBindingVerified = verifyPiArtifactRowDigest(contentRow, contentJson, approvalDigest).outcome === 'verified';
+                                    }
+                                    else {
+                                        contentBindingVerified = false;
+                                    }
+                                }
+                                if (!isRecord(contract) || contract.version !== 1 || contract.contextVersion !== 2
+                                    || !Array.isArray(hosts) || !hosts.every((host) => typeof host === 'string')
+                                    || !hosts.includes('codex') || row.owner_approved !== 1
+                                    || !contentBindingVerified) {
+                                    addWarning(warnings, `codex_rule_context_v2_unqualified: activation=${activationId}`, 'regenerate and replay this artifact for Codex, approve it for shadow observation, and use the existing Owner promotion flow for live execution');
+                                    continue;
+                                }
+                            }
                             // SPEC-RULECODE-QUALITY-001 A3 / §7.1 (Q10): MANDATORY runtime
                             // suspension of context-dependent rules. A v2 rule may only
                             // execute when the provider resolved a schema-valid context
@@ -379,7 +418,7 @@ export function createProductionRuleHostGate(options = {}) {
             }
             const hostInput = {
                 action,
-                workspace: { isRiskPath: false },
+                workspace: { isRiskPath: isSensitiveSystemPath(action.normalizedPath) },
                 session: { sessionId: event.context.sessionId, currentGfi: enrichment.currentGfi },
                 evolution: { epTier: enrichment.epTier },
                 derived: { estimatedLineChanges: estimateLineChanges({ toolName: input.toolName, params: input.params }), bashRisk: enrichment.bashRisk },
@@ -401,7 +440,9 @@ export function createProductionRuleHostGate(options = {}) {
             if (remaining <= 0) {
                 return { decision: 'allow', source: event.source, warnings: [boundedWarning('gate_deadline_exceeded', 'reduce active RuleCode count or source size and retry')], metadata: { evaluatedLiveRules: 0 } };
             }
-            const liveBatch = implementationRuntime.evaluateBatch(liveCandidates.map((candidate) => ({ source: candidate.source, filename: `activation-${candidate.implId}` })), hostInput, remaining);
+            const liveBatch = liveCandidates.length === 0
+                ? { ok: true, results: [] }
+                : implementationRuntime.evaluateBatch(liveCandidates.map((candidate) => ({ source: candidate.source, filename: `activation-${candidate.implId}` })), hostInput, remaining);
             if (!liveBatch.ok || !liveBatch.results) {
                 return { decision: 'allow', source: event.source, warnings: [boundedWarning(`${liveBatch.reason ?? 'rule_batch_failed'}: ${liveBatch.detail ?? 'unknown failure'}`, 'inspect active RuleCode resource use and repair or deactivate the unhealthy rule')], metadata: { evaluatedLiveRules: 0 } };
             }

package/dist/workspace-behavior-evidence.d.ts

@@ -1,3 +1,21 @@
 import type { BehaviorEvidencePort, ToolSemanticRegistry } from '@principles/core/runtime-v2';
+import type { RuleHostContextRow } from '@principles/core/trajectory-types';
 /** Lazy storage access: missing labels need no DB, and a failed open remains observable. */
 export declare function createWorkspaceBehaviorEvidencePort(workspaceDir: string, toolSemantics?: ToolSemanticRegistry): BehaviorEvidencePort;
+/**
+ * Read one bounded, same-session history window from the canonical trajectory
+ * database. The timestamp is the caller's pre-event cutoff; rows at or after
+ * it are excluded so replayed/future calls cannot enter a live RuleContext.
+ * This is read-only and never creates or migrates trajectory state.
+ */
+export declare function readWorkspaceRuleContextRowsBefore(workspaceDir: string, input: {
+    sessionId: string;
+    projectDir: string;
+    beforeCreatedAt: string;
+    excludeToolUseId: string;
+    limit: number;
+}): {
+    rows: readonly RuleHostContextRow[];
+    truncated: boolean;
+    unscopedPriorRows: boolean;
+};

package/dist/workspace-behavior-evidence.js

@@ -72,3 +72,50 @@ export function createWorkspaceBehaviorEvidencePort(workspaceDir, toolSemantics)
         },
     };
 }
+/**
+ * Read one bounded, same-session history window from the canonical trajectory
+ * database. The timestamp is the caller's pre-event cutoff; rows at or after
+ * it are excluded so replayed/future calls cannot enter a live RuleContext.
+ * This is read-only and never creates or migrates trajectory state.
+ */
+export function readWorkspaceRuleContextRowsBefore(workspaceDir, input) {
+    const { sessionId, projectDir, beforeCreatedAt, excludeToolUseId, limit } = input;
+    if (sessionId.trim().length === 0)
+        throw new Error('history_session_id_invalid');
+    if (!path.isAbsolute(projectDir))
+        throw new Error('history_project_dir_invalid');
+    if (excludeToolUseId.trim().length === 0)
+        throw new Error('history_tool_use_id_invalid');
+    if (!Number.isSafeInteger(limit) || limit < 1 || limit > 100)
+        throw new Error('history_limit_invalid');
+    if (!Number.isFinite(Date.parse(beforeCreatedAt)))
+        throw new Error('history_cutoff_invalid');
+    const db = new Database(path.join(workspaceDir, '.state', 'trajectory.db'), { readonly: true, fileMustExist: true });
+    try {
+        db.pragma('busy_timeout = 100');
+        return db.transaction(() => {
+            const rows = db.prepare(`
+        SELECT id, tool_name, outcome, params_json
+        FROM tool_calls
+        WHERE session_id = ? AND project_dir = ? AND created_at < ? AND (tool_use_id IS NULL OR tool_use_id <> ?)
+        ORDER BY created_at DESC, id DESC
+        LIMIT ?
+      `).all(sessionId, projectDir, beforeCreatedAt, excludeToolUseId, limit + 1);
+            const unscoped = db.prepare(`
+        SELECT 1 AS found FROM tool_calls
+        WHERE session_id = ? AND project_dir IS NULL AND created_at < ?
+          AND (tool_use_id IS NULL OR tool_use_id <> ?) LIMIT 1
+      `).get(sessionId, beforeCreatedAt, excludeToolUseId);
+            if (!Array.isArray(rows))
+                throw new Error('history_query_invalid');
+            return {
+                rows: rows.slice(0, limit).reverse().map(contextRow),
+                truncated: rows.length > limit,
+                unscopedPriorRows: unscoped !== undefined,
+            };
+        })();
+    }
+    finally {
+        db.close();
+    }
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@principles/host-runtime",
-  "version": "0.10.2",
+  "version": "0.10.4",
   "description": "Shared host-neutral orchestration for Principles Disciple MVP-Core hook paths.",
   "type": "module",
   "main": "./dist/index.js",
@@ -31,7 +31,7 @@
     "lint": "eslint \"src/**/*.ts\""
   },
   "dependencies": {
-    "@principles/core": "^1.293.4",
+    "@principles/core": "^1.294.1",
     "@principles/install-layout": "^0.4.0",
     "better-sqlite3": "^13.0.3",
     "js-yaml": "^5.4.3"