@principles/host-runtime 0.12.1 → 0.13.0

package/dist/codex-artificer-trusted-facts.d.ts

@@ -0,0 +1,7 @@
+import type { ArtificerTrustedFactsPort } from '@principles/core/runtime-v2';
+/**
+ * Codex generation can author rules against the same DesignGateFact schema
+ * that the native PreToolUse provider supplies. This declares capability only;
+ * it never resolves the current generated PI task as approved.
+ */
+export declare function createCodexArtificerTrustedFactsPort(): ArtificerTrustedFactsPort;

package/dist/codex-artificer-trusted-facts.js

@@ -0,0 +1,17 @@
+import { describeCodexRuleContextFact } from './design-gate-facts.js';
+/**
+ * Codex generation can author rules against the same DesignGateFact schema
+ * that the native PreToolUse provider supplies. This declares capability only;
+ * it never resolves the current generated PI task as approved.
+ */
+export function createCodexArtificerTrustedFactsPort() {
+    return {
+        resolveRequiredFact: ({ factKind }) => ({
+            resolution: 'unknown',
+            detail: factKind === 'design_approval'
+                ? 'Generation verifies host fact capability; current task approval is resolved only at native PreToolUse.'
+                : `Codex has no trusted source for required fact '${factKind}'.`,
+        }),
+        describeRequiredFact: describeCodexRuleContextFact,
+    };
+}

package/dist/codex-rule-context-provider.js

@@ -2,19 +2,57 @@ import path from 'node:path';
 import { computeBehaviorFacts, } from '@principles/core/runtime-v2';
 import { assembleBehaviorHistory } from './behavior-history.js';
 import { readWorkspaceRuleContextRowsBefore } from './workspace-behavior-evidence.js';
+import { readLatestCodexDesignGateDeclaration, resolveCodexDesignGateFact } from './design-gate-facts.js';
 const HISTORY_LIMIT = 100;
 const MAX_REASON_LENGTH = 240;
+const MAX_PATCH_BYTES = 1024 * 1024;
+const APPROVED_READONLY_COMMANDS = new Set([
+    'git status',
+    'git status --short',
+    'git diff --stat',
+    'git log -1 --oneline',
+]);
 function isRecord(value) {
     return typeof value === 'object' && value !== null && !Array.isArray(value);
 }
-function unavailable(reason) {
+function patchTargets(params, projectDir) {
+    if (params === null)
+        return undefined;
+    const patch = typeof params.patch === 'string'
+        ? params.patch
+        : typeof params.input === 'string' ? params.input : null;
+    if (patch === null || Buffer.byteLength(patch, 'utf8') > MAX_PATCH_BYTES)
+        return undefined;
+    const targets = [];
+    for (const line of patch.split(/\r?\n/)) {
+        const match = /^\*\*\* (?:Add|Update|Delete) File: (.+)$|^\*\*\* Move (?:from|to): (.+)$/.exec(line);
+        if (!match)
+            continue;
+        const value = (match[1] ?? match[2] ?? '').trim();
+        if (value.length === 0 || value.includes('\0'))
+            return undefined;
+        targets.push(path.resolve(projectDir, value));
+    }
+    return targets.length > 0 ? targets : undefined;
+}
+function safeReadonlyCommand(params) {
+    if (params === null)
+        return false;
+    const command = typeof params.command === 'string' ? params.command : null;
+    return command !== null && APPROVED_READONLY_COMMANDS.has(command.trim());
+}
+function unavailable(reason, designGate) {
     const history = {
         status: 'unavailable',
         unavailableReason: reason.replace(/\s+/g, ' ').slice(0, MAX_REASON_LENGTH),
         truncated: false,
         calls: [],
     };
-    return { version: 2, history, facts: computeBehaviorFacts(history, null, null) };
+    return {
+        version: 2,
+        history,
+        facts: { ...computeBehaviorFacts(history, null, null), ...(designGate !== undefined ? { designGate } : {}) },
+    };
 }
 /**
  * Read a bounded same-session trajectory window for Codex PreToolUse events.
@@ -27,24 +65,55 @@ export function createCodexRuleContextProvider(options) {
     const workspaceDir = path.resolve(options.workspaceDir);
     const projectDir = path.resolve(options.projectDir);
     return (request) => {
+        const canonicalKind = options.toolSemantics.resolve(request.toolName);
+        const targetKind = canonicalKind === 'agent' ? 'other' : canonicalKind;
+        const raw = request.rawPayload;
+        const rawParams = isRecord(raw) && isRecord(raw.toolInput) && isRecord(raw.toolInput.params)
+            ? raw.toolInput.params
+            : null;
+        const readonlyExecute = targetKind === 'execute' && safeReadonlyCommand(rawParams);
+        // Fail fast before the fact resolution below: a non-string or empty
+        // sessionId cannot bind a declaration (an empty id resolves the fact to
+        // unknown) and would otherwise throw inside resolveCodexDesignGateFact,
+        // surfacing as a provider_failed fault instead of the precise reason.
+        // The enabled and workspace-scope checks deliberately stay AFTER
+        // resolution: the design-gate fact is independent of the
+        // rulecode_context_v2 capability (it reads the governance declaration
+        // store directly), so those degraded paths must still carry the resolved
+        // fact for enforcement (SPEC-RULECODE-CODEX-LOCAL-CLOSURE-001 §6).
+        if (typeof request.sessionId !== 'string' || request.sessionId.trim().length === 0) {
+            return unavailable('session_id_invalid');
+        }
+        const designGate = resolveCodexDesignGateFact({
+            governanceWorkspacePath: workspaceDir,
+            projectWorkspacePath: projectDir,
+            hostSessionId: request.sessionId,
+            targetPath: targetKind === 'execute' ? projectDir : request.targetPath,
+            ...(targetKind === 'write' && request.toolName === 'apply_patch'
+                ? { targetPaths: patchTargets(rawParams, projectDir) ?? [] }
+                : {}),
+            ...(targetKind === 'execute' ? { projectScopedExecution: true } : {}),
+            toolKind: readonlyExecute ? 'read' : targetKind,
+        }, {
+            getLatestDeclaration(projectWorkspacePath, hostSessionId) {
+                return readLatestCodexDesignGateDeclaration(workspaceDir, projectWorkspacePath, hostSessionId);
+            },
+        });
         if (!options.enabled)
-            return unavailable('codex_rule_context_disabled');
+            return unavailable('codex_rule_context_disabled', designGate);
         if (path.resolve(request.workspaceDir) !== workspaceDir)
-            return unavailable('workspace_scope_mismatch');
-        if (typeof request.sessionId !== 'string' || request.sessionId.trim().length === 0)
-            return unavailable('session_id_invalid');
-        const raw = request.rawPayload;
+            return unavailable('workspace_scope_mismatch', designGate);
         const toolInput = isRecord(raw) && isRecord(raw.toolInput) ? raw.toolInput : null;
         if (toolInput === null
             || toolInput.toolName !== request.toolName
             || !isRecord(toolInput.params)
             || !path.isAbsolute(projectDir)
             || options.currentToolUseId.trim().length === 0) {
-            return unavailable('codex_pre_tool_scope_mismatch');
+            return unavailable('codex_pre_tool_scope_mismatch', designGate);
         }
         const cutoff = options.cutoffAt;
         if (!(cutoff instanceof Date) || !Number.isFinite(cutoff.getTime()))
-            return unavailable('history_cutoff_invalid');
+            return unavailable('history_cutoff_invalid', designGate);
         try {
             const historyRows = readWorkspaceRuleContextRowsBefore(workspaceDir, {
                 sessionId: request.sessionId,
@@ -54,9 +123,9 @@ export function createCodexRuleContextProvider(options) {
                 limit: HISTORY_LIMIT,
             });
             if (historyRows.unscopedPriorRows)
-                return unavailable('trajectory_project_scope_incomplete');
+                return unavailable('trajectory_project_scope_incomplete', designGate);
             if (historyRows.rows.length === 0)
-                return unavailable('no_prior_session_history');
+                return unavailable('no_prior_session_history', designGate);
             const history = assembleBehaviorHistory(historyRows.rows, historyRows.truncated, {
                 projectDir,
                 toolSemantics: options.toolSemantics,
@@ -79,11 +148,11 @@ export function createCodexRuleContextProvider(options) {
             return {
                 version: 2,
                 history,
-                facts,
+                facts: { ...facts, designGate },
             };
         }
         catch (error) {
-            return unavailable(`trajectory_history_unavailable:${error instanceof Error ? error.message : String(error)}`);
+            return unavailable(`trajectory_history_unavailable:${error instanceof Error ? error.message : String(error)}`, designGate);
         }
     };
 }

package/dist/design-gate-facts.d.ts

@@ -0,0 +1,37 @@
+import { type DesignGateFact } from '@principles/core/runtime-v2';
+export declare const DESIGN_GATE_FACT_KIND: 'design_approval';
+export declare const DESIGN_GATE_FACT_INPUT_PATH: 'input.context.facts.designGate';
+export declare const CODEX_DESIGN_GATE_SOURCE: 'codex-native-pretool-design-gate-v1';
+export interface DesignGateSpecSnapshot {
+    realPath: string;
+    digest: string;
+    byteLength: number;
+}
+export interface CodexDesignGateRequest {
+    governanceWorkspacePath: string;
+    projectWorkspacePath: string;
+    hostSessionId: string;
+    targetPath: string;
+    /** All paths named by a bounded native patch payload, when available. */
+    targetPaths?: readonly string[];
+    /** True only when the Owner explicitly scoped execute invocations to the project root. */
+    projectScopedExecution?: boolean;
+    toolKind: 'read' | 'search' | 'write' | 'execute' | 'other';
+}
+export interface DesignGateDeclarationReader {
+    getLatestDeclaration(projectWorkspacePath: string, hostSessionId: string): unknown;
+}
+/** Read and hash the current SPEC after realpath confinement on every call. */
+export declare function readDesignGateSpecSnapshot(projectWorkspacePath: string, specPath: string): DesignGateSpecSnapshot;
+/** Resolve a live Codex event against the latest Owner declaration, without caching or writes. */
+export declare function resolveCodexDesignGateFact(request: CodexDesignGateRequest, declarationReader: DesignGateDeclarationReader): DesignGateFact;
+/** Read the current declaration from the governance workspace's existing state.db. */
+export declare function readLatestCodexDesignGateDeclaration(governanceWorkspacePath: string, projectWorkspacePath: string, hostSessionId: string): unknown;
+export declare function describeCodexRuleContextFact(input: {
+    factKind: string;
+}): {
+    supported: boolean;
+    schemaVersion?: string;
+    inputPath?: string;
+    source?: string;
+};

package/dist/design-gate-facts.js

@@ -0,0 +1,249 @@
+import { createHash } from 'node:crypto';
+import fs from 'node:fs';
+import path from 'node:path';
+import { DESIGN_GATE_FACT_SCHEMA_VERSION, SqliteConnection, SqliteDesignGateStore, isDesignGateDeclaration, } from '@principles/core/runtime-v2';
+export const DESIGN_GATE_FACT_KIND = 'design_approval';
+export const DESIGN_GATE_FACT_INPUT_PATH = 'input.context.facts.designGate';
+export const CODEX_DESIGN_GATE_SOURCE = 'codex-native-pretool-design-gate-v1';
+const MAX_SPEC_BYTES = 2 * 1024 * 1024;
+function inside(parent, child) {
+    const relative = path.relative(parent, child);
+    return relative === '' || (!relative.startsWith(`..${path.sep}`) && relative !== '..' && !path.isAbsolute(relative));
+}
+function realPathForTarget(candidate) {
+    if (!path.isAbsolute(candidate))
+        throw new Error('target_path_not_absolute');
+    let current = path.resolve(candidate);
+    const suffix = [];
+    while (true) {
+        try {
+            const realCurrent = fs.realpathSync.native(current);
+            return path.join(realCurrent, ...suffix.reverse());
+        }
+        catch {
+            const parent = path.dirname(current);
+            if (parent === current)
+                throw new Error('target_path_unresolvable');
+            suffix.push(path.basename(current));
+            current = parent;
+        }
+    }
+}
+/** Read and hash the current SPEC after realpath confinement on every call. */
+export function readDesignGateSpecSnapshot(projectWorkspacePath, specPath) {
+    if (!path.isAbsolute(projectWorkspacePath) || !path.isAbsolute(specPath))
+        throw new Error('spec_path_invalid');
+    const projectRoot = fs.realpathSync.native(projectWorkspacePath);
+    const realPath = fs.realpathSync.native(specPath);
+    if (!inside(projectRoot, realPath))
+        throw new Error('spec_path_invalid');
+    // Open once and validate the descriptor: the checked and the read bytes are
+    // guaranteed to be the same file (no path-recheck race between stat and read).
+    const fd = fs.openSync(realPath, 'r');
+    try {
+        const stat = fs.fstatSync(fd);
+        if (!stat.isFile() || stat.size > MAX_SPEC_BYTES)
+            throw new Error('spec_path_invalid');
+        const bytes = fs.readFileSync(fd);
+        if (bytes.byteLength > MAX_SPEC_BYTES)
+            throw new Error('spec_path_invalid');
+        return {
+            realPath,
+            digest: createHash('sha256').update(bytes).digest('hex'),
+            byteLength: bytes.byteLength,
+        };
+    }
+    finally {
+        fs.closeSync(fd);
+    }
+}
+function scopeReference(paths, actions) {
+    const canonical = JSON.stringify({
+        paths: [...paths].sort((left, right) => left.localeCompare(right)),
+        actions: [...actions].sort((left, right) => left.localeCompare(right)),
+    });
+    return createHash('sha256').update(canonical).digest('hex');
+}
+function unknownFact(taskRef, reason, requiresApproval = true) {
+    return {
+        version: 1,
+        sourceRef: null,
+        revision: null,
+        requiresApproval,
+        taskRef,
+        specDigest: null,
+        scopeRef: null,
+        decisionTaskRef: null,
+        decisionSpecDigest: null,
+        decisionScopeRef: null,
+        resolution: 'unknown',
+        revoked: false,
+        invalidationReason: reason,
+    };
+}
+function targetIsInDeclaredScope(projectPath, targetPath, scopePaths) {
+    try {
+        const target = realPathForTarget(targetPath);
+        const projectRoot = fs.realpathSync.native(projectPath);
+        if (!inside(projectRoot, target))
+            return null;
+        for (const declaredPath of scopePaths) {
+            const resolved = path.isAbsolute(declaredPath) ? declaredPath : path.resolve(projectRoot, declaredPath);
+            const scopePath = realPathForTarget(resolved);
+            if (!inside(projectRoot, scopePath))
+                continue;
+            let directory = false;
+            try {
+                directory = fs.statSync(scopePath).isDirectory();
+            }
+            catch { /* a new file may be an exact scope */ }
+            if (target === scopePath || (directory && inside(scopePath, target)))
+                return true;
+        }
+        return false;
+    }
+    catch {
+        return null;
+    }
+}
+function everyTargetIsInDeclaredScope(projectPath, targetPaths, scopePaths) {
+    if (targetPaths.length === 0)
+        return null;
+    for (const targetPath of targetPaths) {
+        if (!path.isAbsolute(targetPath))
+            return null;
+        const matches = targetIsInDeclaredScope(projectPath, targetPath, scopePaths);
+        if (matches !== true)
+            return matches;
+    }
+    return true;
+}
+/** Resolve a live Codex event against the latest Owner declaration, without caching or writes. */
+export function resolveCodexDesignGateFact(request, declarationReader) {
+    const taskRef = request.hostSessionId.trim().length > 0 ? `codex:${request.hostSessionId}` : null;
+    if (taskRef === null)
+        return unknownFact(null, 'host_identity_unavailable');
+    if (!path.isAbsolute(request.governanceWorkspacePath) || !path.isAbsolute(request.projectWorkspacePath)) {
+        return unknownFact(taskRef, 'project_scope_mismatch');
+    }
+    // Codex's declared read/search tool semantics are sufficient evidence that
+    // the current action is investigative and does not require design approval.
+    if (request.toolKind === 'read' || request.toolKind === 'search') {
+        return {
+            version: 1,
+            sourceRef: null,
+            revision: null,
+            requiresApproval: false,
+            taskRef,
+            specDigest: null,
+            scopeRef: null,
+            decisionTaskRef: null,
+            decisionSpecDigest: null,
+            decisionScopeRef: null,
+            resolution: 'not_required',
+            revoked: false,
+        };
+    }
+    if (request.toolKind !== 'write' && request.toolKind !== 'execute') {
+        return unknownFact(taskRef, 'action_scope_unknown');
+    }
+    // An execute declaration scoped to `.` governs invocations from this native
+    // Codex project/session. It does not claim to confine the process effects.
+    let projectRoot;
+    let governanceRoot;
+    try {
+        projectRoot = fs.realpathSync.native(request.projectWorkspacePath);
+        governanceRoot = fs.realpathSync.native(request.governanceWorkspacePath);
+    }
+    catch {
+        return unknownFact(taskRef, 'project_scope_mismatch');
+    }
+    let declarationValue;
+    try {
+        declarationValue = declarationReader.getLatestDeclaration(projectRoot, request.hostSessionId);
+    }
+    catch {
+        return unknownFact(taskRef, 'declaration_unavailable');
+    }
+    if (declarationValue === null)
+        return unknownFact(taskRef, 'unregistered_scope');
+    if (!isDesignGateDeclaration(declarationValue))
+        return unknownFact(taskRef, 'declaration_invalid');
+    const declaration = declarationValue;
+    try {
+        if (fs.realpathSync.native(declaration.projectWorkspacePath) !== projectRoot
+            || fs.realpathSync.native(declaration.governanceWorkspacePath) !== governanceRoot
+            || declaration.hostSessionId !== request.hostSessionId
+            || declaration.taskRef !== taskRef) {
+            return unknownFact(taskRef, 'project_scope_mismatch');
+        }
+    }
+    catch {
+        return unknownFact(taskRef, 'project_scope_mismatch');
+    }
+    const action = request.toolKind;
+    if (!declaration.scope.actions.includes(action))
+        return unknownFact(taskRef, 'action_scope_unknown');
+    const projectScopedExecution = request.toolKind === 'execute'
+        && request.projectScopedExecution === true
+        && declaration.scope.paths.includes('.');
+    const targetScope = projectScopedExecution
+        ? true
+        : request.targetPaths !== undefined
+            ? everyTargetIsInDeclaredScope(projectRoot, request.targetPaths, declaration.scope.paths)
+            : request.toolKind === 'execute'
+                ? null
+                : targetIsInDeclaredScope(projectRoot, request.targetPath, declaration.scope.paths);
+    if (targetScope !== true)
+        return unknownFact(taskRef, 'target_scope_unknown');
+    let snapshot;
+    try {
+        snapshot = readDesignGateSpecSnapshot(projectRoot, declaration.specPath);
+    }
+    catch {
+        return unknownFact(taskRef, 'spec_path_invalid');
+    }
+    if (snapshot.digest !== declaration.specDigest)
+        return unknownFact(taskRef, 'spec_digest_mismatch');
+    const currentScopeRef = scopeReference(declaration.scope.paths, declaration.scope.actions);
+    const resolution = declaration.revoked ? 'not_approved' : declaration.decision;
+    return {
+        version: 1,
+        sourceRef: declaration.sourceRef,
+        revision: declaration.revision,
+        requiresApproval: declaration.revoked || declaration.decision !== 'not_required',
+        taskRef,
+        specDigest: snapshot.digest,
+        scopeRef: currentScopeRef,
+        decisionTaskRef: declaration.taskRef,
+        decisionSpecDigest: declaration.specDigest,
+        decisionScopeRef: currentScopeRef,
+        resolution,
+        revoked: declaration.revoked,
+        ...(declaration.revoked ? { invalidationReason: 'declaration_revoked' } : {}),
+    };
+}
+/** Read the current declaration from the governance workspace's existing state.db. */
+export function readLatestCodexDesignGateDeclaration(governanceWorkspacePath, projectWorkspacePath, hostSessionId) {
+    const connection = new SqliteConnection({
+        workspaceDir: governanceWorkspacePath,
+        readonly: true,
+        bootstrapIfMissing: false,
+    });
+    try {
+        return new SqliteDesignGateStore(connection).getLatestDeclaration(projectWorkspacePath, hostSessionId);
+    }
+    finally {
+        connection.close();
+    }
+}
+export function describeCodexRuleContextFact(input) {
+    if (input.factKind !== DESIGN_GATE_FACT_KIND)
+        return { supported: false };
+    return {
+        supported: DESIGN_GATE_FACT_SCHEMA_VERSION === '1',
+        schemaVersion: DESIGN_GATE_FACT_SCHEMA_VERSION,
+        inputPath: DESIGN_GATE_FACT_INPUT_PATH,
+        source: CODEX_DESIGN_GATE_SOURCE,
+    };
+}

package/dist/index.d.ts

@@ -91,3 +91,6 @@ export * from './behavior-history.js';
 export * from './codex-rule-context-provider.js';
 export { createWorkspaceBehaviorEvidencePort } from './workspace-behavior-evidence.js';
 export * from './explicit-owner-statement-prefix.js';
+export { listObservedDesignGateSessions } from './workspace-behavior-evidence.js';
+export { readDesignGateSpecSnapshot, describeCodexRuleContextFact } from './design-gate-facts.js';
+export { createCodexArtificerTrustedFactsPort } from './codex-artificer-trusted-facts.js';

package/dist/index.js

@@ -1,6 +1,7 @@
 import { randomUUID } from 'node:crypto';
 import { isHostEvent, isHostEventResult, } from '@principles/core/host';
-import { getPromptModelCatalog, resolvePromptBudget } from '@principles/core/runtime-v2';
+import { getPromptModelCatalog, operatorDeclaredContextWindow, resolvePromptBudget } from '@principles/core/runtime-v2';
+import { loadPdConfigForPlugin } from './pd-config.js';
 import { buildActivePrinciplePromptContext } from './active-principle-prompt.js';
 import { createProductionRuleHostGate } from './production-rulehost-gate.js';
 import { createProductionPainEvidenceHandler } from './production-pain-evidence.js';
@@ -212,6 +213,19 @@ export function createProductionHostRuntime(options = {}) {
             // reports `legacy_fifo_prefix_v1` honestly. The selector's fair-rotation
             // capability is retained and stays reachable for callers that DO hold a
             // legitimate advancing round authority.
+            // PRI-1020: the Owner's declared window (.pd/config.yaml promptBudget)
+            // is tier 0 of the budget chain — resolved per host and fed into the
+            // SAME single resolver below. One extra sync config read per prompt
+            // build (the candidates reader loads it independently): deliberate, so
+            // a config flip applies on the next turn with no cache to invalidate.
+            // Malformed config degrades to defaults (no declaration) and is already
+            // surfaced as config_invalid warnings by readPromptActivationCandidates.
+            const promptBudgetHostKind = options.hostKind === 'openclaw' || options.hostKind === 'codex' || options.hostKind === 'workbuddy'
+                ? options.hostKind
+                : undefined;
+            const declaredWindow = promptBudgetHostKind === undefined
+                ? undefined
+                : operatorDeclaredContextWindow(loadPdConfigForPlugin(event.context.workspaceDir).effective.config.promptBudget, promptBudgetHostKind);
             const prompt = await buildActivePrinciplePromptContext({
                 workspaceDir: event.context.workspaceDir,
                 excludePrincipleIds: options.promptExcludePrincipleIds?.(event),
@@ -221,6 +235,8 @@ export function createProductionHostRuntime(options = {}) {
                     // Codex+WorkBuddy model id) against the installed local Pi AI
                     // catalog — no network, no LLM call. Missing/untrusted facts
                     // resolve to the legacy fixed budget with an observable reason.
+                    // PRI-1020: an Owner declaration outranks all of these (tier 0).
+                    ...(declaredWindow !== undefined ? { operatorDeclared: { contextWindowTokens: declaredWindow } } : {}),
                     hostCapacity: event.context.modelContext === undefined
                         ? undefined
                         : {
@@ -307,3 +323,6 @@ export * from './behavior-history.js';
 export * from './codex-rule-context-provider.js';
 export { createWorkspaceBehaviorEvidencePort } from './workspace-behavior-evidence.js';
 export * from './explicit-owner-statement-prefix.js';
+export { listObservedDesignGateSessions } from './workspace-behavior-evidence.js';
+export { readDesignGateSpecSnapshot, describeCodexRuleContextFact } from './design-gate-facts.js';
+export { createCodexArtificerTrustedFactsPort } from './codex-artificer-trusted-facts.js';

package/dist/production-rulehost-gate.js

@@ -43,6 +43,13 @@ async function withinGateDeadline(value, startedAt) {
 function isRecord(value) {
     return typeof value === 'object' && value !== null && !Array.isArray(value);
 }
+function requiresDesignGateFact(value) {
+    if (!isRecord(value) || !Object.hasOwn(value, 'requiredFactKinds'))
+        return false;
+    return Array.isArray(value.requiredFactKinds)
+        && value.requiredFactKinds.every((kind) => typeof kind === 'string')
+        && value.requiredFactKinds.includes('design_approval');
+}
 function readToolInput(rawPayload) {
     if (!isRecord(rawPayload) || !Object.hasOwn(rawPayload, 'toolInput'))
         return null;
@@ -375,7 +382,24 @@ export function createProductionRuleHostGate(options = {}) {
                             // sibling rules (v1 or well-fed v2) keep evaluating, and no
                             // governance state changes. Intentional behavior change vs the
                             // pre-fix "legal unavailable still executed" path.
-                            if (context === undefined || context.history.status !== 'available') {
+                            //
+                            // PRI-1019 exception: a rule whose ONLY declared dependence is
+                            // the design_approval fact stays eligible on an actionable fact
+                            // (resolution !== 'unknown') even when history is unavailable.
+                            // SPEC-RULECODE-CODEX-LOCAL-CLOSURE-001 §6 requires a managed
+                            // action with an authoritative not_approved to be blocked
+                            // regardless of history, and the Artificer prompt contract
+                            // (V2_CONTEXT_INSTRUCTION) requires history-dependent behavior
+                            // to allow while the independently supplied fact stays
+                            // enforceable. Without this exception the first managed action
+                            // of a new session (no prior history) would never evaluate the
+                            // rule, and an authoritative not_approved could not block.
+                            const designGateFact = context?.facts.designGate;
+                            const designGateActionable = designGateFact !== undefined && designGateFact.resolution !== 'unknown'
+                                ? designGateFact
+                                : undefined;
+                            if ((context === undefined || context.history.status !== 'available')
+                                && !(requiresDesignGateFact(content.ruleHostInputContract) && designGateActionable !== undefined)) {
                                 // Reference identity against the frozen sentinel distinguishes
                                 // "the provider faulted" from "the provider legitimately
                                 // declared history unavailable" (same wire shape, different
@@ -388,6 +412,18 @@ export function createProductionRuleHostGate(options = {}) {
                                 addWarning(warnings, `rule_context_v2_unavailable: ${fault} (activation=${activationId})`, 'enable and wire the host rule context provider, or regenerate the rule without context dependence');
                                 continue;
                             }
+                            const inputContract = content.ruleHostInputContract;
+                            if (isRecord(inputContract) && Object.hasOwn(inputContract, 'requiredFactKinds')) {
+                                if (!Array.isArray(inputContract.requiredFactKinds)
+                                    || !inputContract.requiredFactKinds.every((kind) => typeof kind === 'string')) {
+                                    addWarning(warnings, `rule_required_fact_contract_invalid: activation=${activationId}`, 'regenerate the rule artifact from validated Scribe execution conditions');
+                                    continue;
+                                }
+                                if (requiresDesignGateFact(inputContract) && designGateActionable === undefined) {
+                                    addWarning(warnings, `rule_required_fact_unavailable: design_approval (activation=${activationId})`, 'verify the current Owner design declaration and scope before retrying');
+                                    continue;
+                                }
+                            }
                         }
                         const ruleId = typeof content.ruleId === 'string' ? content.ruleId : typeof row.source_rule_id === 'string' ? row.source_rule_id : artifactId;
                         const principleId = typeof content.principleId === 'string' ? content.principleId : typeof row.source_principle_id === 'string' ? row.source_principle_id : ruleId;

package/dist/prompt-injection-budget-observation.d.ts

@@ -1,4 +1,4 @@
-import { PROMPT_BUDGET_POLICY_VERSION, type PromptBudgetCapacitySource, type PromptBudgetCapacityStatus, type PromptBudgetFallbackReason, type PromptBudgetResolution } from '@principles/core/runtime-v2';
+import { PROMPT_BUDGET_POLICY_VERSION, type PromptBudgetCapacitySource, type PromptBudgetCapacityStatus, type PromptBudgetFallbackReason, type PromptBudgetResolution, type PromptBudgetConfig } from '@principles/core/runtime-v2';
 import { type PromptInjectionTargetHost } from './prompt-injection-projection.js';
 /**
  * PRI-1017: runtime budget OBSERVATION read model over the EXISTING
@@ -174,3 +174,12 @@ export declare function selectConsoleRuntimeBudgetFacts(input: {
  * rides events or console payloads.
  */
 export declare function runtimeBudgetObservationToResolution(observation: RuntimePromptBudgetObservation): PromptBudgetResolution;
+/**
+ * PRI-1020: the Owner's declared window as a budget resolution, for console
+ * surfaces with NO fresh runtime observation. Goes through the same single
+ * resolver (tier 0) so an injected forecast and the console fallback can
+ * never disagree about what a declaration means. Undefined when the
+ * workspace declares nothing — the caller then keeps the historical fixed
+ * fallback.
+ */
+export declare function operatorDeclaredBudgetResolution(promptBudget: PromptBudgetConfig | undefined, hostKind: PromptInjectionTargetHost): PromptBudgetResolution | undefined;

package/dist/prompt-injection-budget-observation.js

@@ -1,6 +1,6 @@
 import fs from 'node:fs';
 import path from 'node:path';
-import { PROMPT_BUDGET_POLICY_VERSION, RUNTIME_V2_PRINCIPLE_BUDGET, isValidContextWindowTokens, promptBudgetCharsForContextWindow, } from '@principles/core/runtime-v2';
+import { PROMPT_BUDGET_POLICY_VERSION, RUNTIME_V2_PRINCIPLE_BUDGET, isValidContextWindowTokens, promptBudgetCharsForContextWindow, resolvePromptBudget, operatorDeclaredContextWindow, } from '@principles/core/runtime-v2';
 import { isPromptInjectionTargetHost, } from './prompt-injection-projection.js';
 /**
  * PRI-1017: runtime budget OBSERVATION read model over the EXISTING
@@ -104,6 +104,7 @@ function parseObservedAt(value) {
     return Number.isFinite(parsed) ? parsed : null;
 }
 const BUDGET_CAPACITY_SOURCES = new Set([
+    'operator_declared',
     'host_effective_window',
     'pi_catalog_exact',
     'legacy_fallback',
@@ -177,7 +178,11 @@ function narrowObservation(parsed, workspaceDir, nowMs) {
     // formula derives from it; the legacy fallback needs the legacy budget, no
     // window, and a bounded reason. Anything else is not a trustworthy fact.
     if (rawStatus === 'confirmed') {
-        if (rawSource !== 'host_effective_window' && rawSource !== 'pi_catalog_exact')
+        // PRI-1020: operator_declared joins the confirmed set — a declared window
+        // is a real window (the Owner's explicit cap), so its observations carry
+        // the window and the exact formula budget like the other confirmed
+        // sources.
+        if (rawSource !== 'operator_declared' && rawSource !== 'host_effective_window' && rawSource !== 'pi_catalog_exact')
             return null;
         if (!isValidContextWindowTokens(rawWindow))
             return null;
@@ -447,3 +452,17 @@ export function runtimeBudgetObservationToResolution(observation) {
         ...(observation.fallbackReason !== null ? { fallbackReason: observation.fallbackReason } : {}),
     };
 }
+/**
+ * PRI-1020: the Owner's declared window as a budget resolution, for console
+ * surfaces with NO fresh runtime observation. Goes through the same single
+ * resolver (tier 0) so an injected forecast and the console fallback can
+ * never disagree about what a declaration means. Undefined when the
+ * workspace declares nothing — the caller then keeps the historical fixed
+ * fallback.
+ */
+export function operatorDeclaredBudgetResolution(promptBudget, hostKind) {
+    const declaredWindow = operatorDeclaredContextWindow(promptBudget, hostKind);
+    if (declaredWindow === undefined)
+        return undefined;
+    return resolvePromptBudget({ operatorDeclared: { contextWindowTokens: declaredWindow } });
+}

package/dist/workspace-behavior-evidence.d.ts

@@ -19,3 +19,12 @@ export declare function readWorkspaceRuleContextRowsBefore(workspaceDir: string,
     truncated: boolean;
     unscopedPriorRows: boolean;
 };
+/**
+ * List only Codex sessions proven by normalized host evidence and a matching
+ * project-scoped trajectory row. The trajectory schema has no host_kind on
+ * tool_calls, so that table alone is never used to infer the host.
+ */
+export declare function listObservedDesignGateSessions(workspaceDir: string): {
+    projectWorkspacePath: string;
+    hostSessionId: string;
+}[];

package/dist/workspace-behavior-evidence.js

@@ -1,6 +1,8 @@
 /** Read-only adapter over the canonical trajectory store; never creates/migrates it. */
 import path from 'node:path';
+import fs from 'node:fs';
 import Database from 'better-sqlite3';
+import { SqliteConnection } from '@principles/core/runtime-v2';
 import { createOwnerEvidenceScopeError } from '@principles/core/runtime-v2/internalization/evidence-readiness';
 import { BehaviorExamplePackAssembler } from './behavior-example-pack-assembler.js';
 import { resolveWorkspaceHostToolSemantics } from './host-tool-semantic-resolver.js';
@@ -119,3 +121,86 @@ export function readWorkspaceRuleContextRowsBefore(workspaceDir, input) {
         db.close();
     }
 }
+/**
+ * List only Codex sessions proven by normalized host evidence and a matching
+ * project-scoped trajectory row. The trajectory schema has no host_kind on
+ * tool_calls, so that table alone is never used to infer the host.
+ */
+export function listObservedDesignGateSessions(workspaceDir) {
+    const connection = new SqliteConnection({ workspaceDir, readonly: true, bootstrapIfMissing: false });
+    let evidenceRefs;
+    try {
+        const db = connection.getDb();
+        const exists = db.prepare("SELECT 1 FROM sqlite_master WHERE type = 'table' AND name = 'intervention_evidence_records'").get();
+        if (exists === undefined)
+            return [];
+        const rawRows = db.prepare(`
+      SELECT native_refs_json, recorded_at
+      FROM intervention_evidence_records
+      ORDER BY recorded_at DESC
+      LIMIT 1000
+    `).all();
+        const found = new Map();
+        for (const raw of rawRows) {
+            if (!record(raw) || typeof raw.native_refs_json !== 'string' || typeof raw.recorded_at !== 'string')
+                continue;
+            let refs;
+            try {
+                refs = JSON.parse(raw.native_refs_json);
+            }
+            catch {
+                continue;
+            }
+            if (!record(refs) || refs.hostKind !== 'codex' || typeof refs.sessionId !== 'string' || refs.sessionId.trim().length === 0)
+                continue;
+            if (!found.has(refs.sessionId))
+                found.set(refs.sessionId, raw.recorded_at);
+        }
+        evidenceRefs = [...found].map(([hostSessionId, lastObservedAt]) => ({ hostSessionId, lastObservedAt }));
+    }
+    finally {
+        connection.close();
+    }
+    const trajectoryPath = path.join(workspaceDir, '.state', 'trajectory.db');
+    const trajectory = new Database(trajectoryPath, { readonly: true, fileMustExist: true });
+    try {
+        const selectProject = trajectory.prepare(`
+      SELECT project_dir, MAX(created_at) AS last_seen
+      FROM tool_calls
+      WHERE session_id = ? AND project_dir IS NOT NULL
+      GROUP BY project_dir
+      ORDER BY last_seen DESC
+    `);
+        const candidates = [];
+        for (const evidence of evidenceRefs) {
+            const rows = selectProject.all(evidence.hostSessionId);
+            for (const raw of rows) {
+                if (!record(raw) || typeof raw.project_dir !== 'string' || !path.isAbsolute(raw.project_dir)
+                    || typeof raw.last_seen !== 'string')
+                    continue;
+                try {
+                    candidates.push({
+                        projectWorkspacePath: fs.realpathSync.native(raw.project_dir),
+                        hostSessionId: evidence.hostSessionId,
+                        seenAt: raw.last_seen > evidence.lastObservedAt ? raw.last_seen : evidence.lastObservedAt,
+                    });
+                }
+                catch { /* stale project paths are not offered as selectable sessions */ }
+            }
+        }
+        const unique = new Map();
+        for (const candidate of candidates) {
+            const key = `${candidate.projectWorkspacePath}\0${candidate.hostSessionId}`;
+            const current = unique.get(key);
+            if (!current || candidate.seenAt > current.seenAt)
+                unique.set(key, candidate);
+        }
+        return [...unique.values()]
+            .sort((left, right) => right.seenAt.localeCompare(left.seenAt))
+            .slice(0, 100)
+            .map(({ projectWorkspacePath, hostSessionId }) => ({ projectWorkspacePath, hostSessionId }));
+    }
+    finally {
+        trajectory.close();
+    }
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@principles/host-runtime",
-  "version": "0.12.1",
+  "version": "0.13.0",
   "description": "Shared host-neutral orchestration for Principles Disciple MVP-Core hook paths.",
   "type": "module",
   "main": "./dist/index.js",
@@ -31,7 +31,7 @@
     "lint": "eslint \"src/**/*.ts\""
   },
   "dependencies": {
-    "@principles/core": "^1.295.2",
+    "@principles/core": "^1.296.0",
     "@principles/install-layout": "^0.4.0",
     "better-sqlite3": "^13.0.3",
     "js-yaml": "^5.4.3"