@principles/host-runtime 0.3.3 → 0.3.4

package/dist/codex-disclosure.d.ts

@@ -0,0 +1,23 @@
+/**
+ * Codex conversation-ingestion consent disclosure — G2A frozen text (Slice D).
+ *
+ * The Chinese text below is copied VERBATIM from the Owner-approved decision
+ * package:
+ *   docs/superpowers/specs/2026-08-28-codex-governance-closure-g0-g2a-decision.md
+ *   § "Frozen consent disclosure text (setup will show this verbatim)"
+ *
+ * That document is the language SSoT. The frozen text "must not be weakened
+ * during implementation without a new Owner decision" — the guard test
+ * (codex-disclosure-g2a-guard.test.ts) re-extracts the frozen section from
+ * the document and asserts byte equality with this constant, so any drift
+ * here fails CI.
+ *
+ * The English rendering states the same facts; per the G2A binding note it is
+ * produced at setup implementation time from the frozen Chinese text. Setup
+ * surfaces always present the Chinese SSoT first.
+ */
+export declare const CODEX_INGESTION_DISCLOSURE_VERSION = "g2a-2026-08-28";
+export type CodexIngestionDisclosureLanguage = 'zh' | 'en';
+export declare const CODEX_INGESTION_DISCLOSURE_ZH = "### Principles Disciple \u2014 \u5BF9\u8BDD\u89C2\u5BDF\u4E0E\u6CBB\u7406\u95ED\u73AF\uFF08Codex\uFF09\n\n**\u5F00\u542F\u540E PD \u4F1A\u8BFB\u53D6\u4EC0\u4E48\uFF1F**\n\u8BFB\u53D6\u672C\u5DE5\u4F5C\u533A\u5185 Codex \u660E\u786E\u63D0\u4F9B\u7ED9 PD \u7684\u4F1A\u8BDD\u8BB0\u5F55\uFF08transcript\uFF09\u3002\u8FDB\u5165\u6CBB\u7406\u89C2\u5BDF\u7684\u53EA\u6709\u53EF\u89C1\u5185\u5BB9\uFF1A\u4F60\u53D1\u51FA\u7684\u6D88\u606F\u3001\u52A9\u624B\u7684\u53EF\u89C1\u56DE\u590D\u3001\u4EE5\u53CA\u5DE5\u5177\u8C03\u7528\u7684\u540D\u79F0/\u8F93\u5165/\u7ED3\u679C\uFF08\u7528\u4E8E\u8BC6\u522B\u53CD\u590D\u51FA\u73B0\u7684\u95EE\u9898\uFF09\u3002\u8BB0\u5F55\u4E2D\u540C\u65F6\u5B58\u5728\u7684\u9690\u85CF\u601D\u8003\u8FC7\u7A0B\uFF08Codex \u4EE5\u52A0\u5BC6\u5F62\u5F0F\u4FDD\u5B58\uFF09\u3001\u7CFB\u7EDF/\u5F00\u53D1\u8005\u63D0\u793A\u8BCD\u3001\u5BBF\u4E3B\u6CE8\u5165\u7684\u73AF\u5883\u4E0A\u4E0B\u6587\uFF0C\u4F1A\u5728\u89E3\u6790\u65F6\u88AB\u8BC6\u522B\u5E76\u4E22\u5F03\u2014\u2014\u4E0D\u4F1A\u88AB\u4FDD\u5B58\u3001\u4E0D\u4F1A\u8FDB\u5165\u65E5\u5FD7\u3001\u4E0D\u4F1A\u53D1\u9001\u7ED9\u8BCA\u65AD\u6A21\u578B\u3002\n\n**\u4E3A\u4EC0\u4E48\u8BFB\u53D6\uFF1F**\n\u4E3A\u4E86\u8BA9 PD \u5728 Codex \u4E0A\u5B8C\u6210\u5B83\u627F\u8BFA\u7684\u95ED\u73AF\uFF1A\u628A\u4F60\u53CD\u590D\u7EA0\u6B63\u7684\u5730\u65B9\u53D8\u6210\u4E00\u6761\u53EF\u5BA1\u67E5\u7684\u539F\u5219\u5019\u9009\u2014\u2014\u4F60\u9700\u8981\u5148\u770B\u5230\u8BC1\u636E\uFF0C\u518D\u51B3\u5B9A\u662F\u5426\u91C7\u7EB3\u3002\u4E0D\u89E3\u6790\u5BF9\u8BDD\uFF0CPD \u5C31\u53EA\u80FD\u7BA1\u5DE5\u5177\uFF0C\u5B66\u4E0D\u5230\u7EA0\u6B63\u3002\n\n**\u4FDD\u5B58\u591A\u5C11\u3001\u591A\u4E45\uFF1F**\n\u6BCF\u4E2A\u4F1A\u8BDD\u53EA\u4FDD\u7559\u6700\u8FD1 32 \u6761\u53EF\u89C1\u6D88\u606F\u3001\u6700\u591A 7 \u5929\uFF08\u5148\u5230\u671F\u5148\u5220\u9664\uFF09\u3002\u5F53\u67D0\u4E2A\u95EE\u9898\u88AB\u6B63\u5F0F\u7ACB\u4E3A pain \u65F6\uFF0C\u624D\u4F1A\u628A\u5B83\u7684\u524D 12 \u6761\u6D88\u606F + \u89E6\u53D1\u70B9 + \u52A9\u624B\u7684\u4E0B\u4E00\u6761\u5B8C\u6574\u56DE\u590D\u5347\u7EA7\u4E3A\u957F\u671F\u6CBB\u7406\u8BC1\u636E\uFF0C\u6309\u73B0\u6709\u6CBB\u7406\u6570\u636E\u7684\u751F\u547D\u5468\u671F\u7BA1\u7406\u3002\u4FDD\u5B58\u7684\u5DE5\u5177\u8BC1\u636E\u5728\u843D\u76D8\u524D\u4F1A\u7ECF\u8FC7\u65E2\u6709\u7684\u654F\u611F\u5B57\u6BB5\u4E0E\u5E38\u89C1\u5BC6\u94A5\u683C\u5F0F\u8131\u654F\uFF1B\u4F46\u8BF7\u6CE8\u610F\uFF1A\u5982\u679C\u4E00\u6BB5\u5BC6\u94A5\u770B\u8D77\u6765\u5C31\u50CF\u666E\u901A\u6587\u5B57\uFF0C\u4EFB\u4F55\u8FC7\u6EE4\u5668\u90FD\u65E0\u6CD5\u8BC6\u522B\u5B83\u2014\u2014\u8BF7\u4E0D\u8981\u8BA9 PD \u89C2\u5BDF\u5305\u542B\u6B64\u7C7B\u5185\u5BB9\u7684\u4F1A\u8BDD\u3002\n\n**\u6570\u636E\u4F1A\u79BB\u5F00\u672C\u673A\u5417\uFF1F**\n\u89C2\u5BDF\u6570\u636E\u672C\u8EAB\u53EA\u5B58\u5728\u672C\u673A\u5DE5\u4F5C\u533A\u3002\u88AB\u5347\u7EA7\u4E3A\u6CBB\u7406\u8BC1\u636E\u7684\u5BF9\u8BDD\u7247\u6BB5\uFF0C\u4F1A\u50CF\u73B0\u6709\u8BCA\u65AD\u6D41\u7A0B\u4E00\u6837\u53D1\u9001\u7ED9\u4F60\u914D\u7F6E\u7684 LLM API \u505A\u8BCA\u65AD\u2014\u2014\u8FD9\u662F\u552F\u4E00\u7684\u5916\u53D1\u8DEF\u5F84\uFF0C\u4E0E OpenClaw \u4E0A\u7684\u73B0\u6709\u884C\u4E3A\u4E00\u81F4\u3002\u4EA7\u54C1\u9065\u6D4B\u4E0D\u5305\u542B\u4EFB\u4F55\u6D88\u606F\u5185\u5BB9\u6216\u4F1A\u8BDD\u6807\u8BC6\u3002\n\n**\u5982\u4F55\u5173\u95ED\uFF1F\u968F\u65F6\u3002**\n\u5173\u95ED\u540E PD \u7ACB\u5373\u505C\u6B62\u8BFB\u53D6 transcript\uFF08\u4E0D\u662F\"\u8BFB\u4E86\u518D\u4E22\u5F03\"\uFF0C\u800C\u662F\u6839\u672C\u4E0D\u6253\u5F00\uFF09\u3002\u5DF2\u6709\u7684\u539F\u5219\u6CE8\u5165\u3001\u5DE5\u5177\u62E6\u622A\u3001\u65E2\u6709\u5DE5\u5177\u8BC1\u636E\u5B8C\u5168\u4E0D\u53D7\u5F71\u54CD\u3002\u5DF2\u4FDD\u5B58\u7684\u5185\u5BB9\u6309\u4E0A\u8FF0\u671F\u9650\u81EA\u7136\u8FC7\u671F\uFF1B\u5347\u7EA7\u8FC7\u7684\u8BC1\u636E\u53EA\u80FD\u7531\u4F60\u901A\u8FC7\u65E2\u6709\u6CBB\u7406\u6E05\u7406\u547D\u4EE4\u663E\u5F0F\u5220\u9664\u3002\u5378\u8F7D\u4E0D\u4F1A\u9759\u9ED8\u5220\u9664\u4EFB\u4F55\u8BC1\u636E\u3002\n\n**\u9ED8\u8BA4\u72B6\u6001\uFF1F**\n\u9ED8\u8BA4\u5173\u95ED\u3002\u53EA\u6709\u4F60\u5728\u770B\u5230\u672C\u8BF4\u660E\u540E\u660E\u786E\u9009\u62E9\u5F00\u542F\u624D\u4F1A\u751F\u6548\uFF1B\u5347\u7EA7 PD \u6C38\u8FDC\u4E0D\u4F1A\u66FF\u4F60\u5F00\u542F\u3002";
+export declare const CODEX_INGESTION_DISCLOSURE_EN = "### Principles Disciple \u2014 Conversation Observation & Governance Closure (Codex)\n\n**What does PD read once enabled?**\nPD reads the Codex session transcripts that Codex explicitly provides to PD inside this workspace. Only visible content enters governance observation: the messages you send, the assistant's visible replies, and the names/inputs/results of tool calls (used to recognize recurring problems). The hidden reasoning process that Codex stores in encrypted form, system/developer prompts, and host-injected environment context present in the same records are recognized and discarded during parsing \u2014 never saved, never written to logs, never sent to the diagnosis model.\n\n**Why read at all?**\nSo that PD can deliver on its promised closed loop on Codex: turning the places you repeatedly correct into a reviewable principle candidate \u2014 you see the evidence first, then decide whether to adopt it. Without parsing conversations, PD can only govern tools and cannot learn your corrections.\n\n**How much is kept, and for how long?**\nPer session, only the most recent 32 visible messages are kept, for at most 7 days (expired first, deleted first). Only when a problem is formally established as a pain are its preceding 12 messages + the trigger point + the assistant's next complete reply promoted into long-term governance evidence, managed under the existing governance data lifecycle. Saved tool evidence passes through the existing sensitive-field and common-secret-format redaction before being written; but note: if a secret looks like ordinary text, no filter can recognize it \u2014 please do not let PD observe sessions containing such content.\n\n**Does data leave this machine?**\nObservation data itself lives only in the local workspace. Conversation fragments promoted into governance evidence are sent to your configured LLM API for diagnosis, exactly like the existing diagnosis flow \u2014 this is the only egress path, consistent with current behavior on OpenClaw. Product telemetry contains no message content and no session identifiers.\n\n**How do I turn it off? Anytime.**\nOnce off, PD immediately stops reading transcripts (not \"read then discard\" \u2014 the transcript is never opened at all). Existing principle injection, tool interception, and existing tool evidence are completely unaffected. Saved content expires naturally per the limits above; promoted evidence can only be deleted explicitly by you through the existing governance cleanup commands. Uninstall never silently deletes any evidence.\n\n**Default state?**\nOff by default. It takes effect only after you explicitly choose to enable it after seeing this disclosure; upgrading PD never enables it for you.";
+export declare function getCodexIngestionDisclosureText(language: CodexIngestionDisclosureLanguage): string;

package/dist/codex-disclosure.js

@@ -0,0 +1,60 @@
+/**
+ * Codex conversation-ingestion consent disclosure — G2A frozen text (Slice D).
+ *
+ * The Chinese text below is copied VERBATIM from the Owner-approved decision
+ * package:
+ *   docs/superpowers/specs/2026-08-28-codex-governance-closure-g0-g2a-decision.md
+ *   § "Frozen consent disclosure text (setup will show this verbatim)"
+ *
+ * That document is the language SSoT. The frozen text "must not be weakened
+ * during implementation without a new Owner decision" — the guard test
+ * (codex-disclosure-g2a-guard.test.ts) re-extracts the frozen section from
+ * the document and asserts byte equality with this constant, so any drift
+ * here fails CI.
+ *
+ * The English rendering states the same facts; per the G2A binding note it is
+ * produced at setup implementation time from the frozen Chinese text. Setup
+ * surfaces always present the Chinese SSoT first.
+ */
+export const CODEX_INGESTION_DISCLOSURE_VERSION = 'g2a-2026-08-28';
+export const CODEX_INGESTION_DISCLOSURE_ZH = `### Principles Disciple — 对话观察与治理闭环（Codex）
+
+**开启后 PD 会读取什么？**
+读取本工作区内 Codex 明确提供给 PD 的会话记录（transcript）。进入治理观察的只有可见内容：你发出的消息、助手的可见回复、以及工具调用的名称/输入/结果（用于识别反复出现的问题）。记录中同时存在的隐藏思考过程（Codex 以加密形式保存）、系统/开发者提示词、宿主注入的环境上下文，会在解析时被识别并丢弃——不会被保存、不会进入日志、不会发送给诊断模型。
+
+**为什么读取？**
+为了让 PD 在 Codex 上完成它承诺的闭环：把你反复纠正的地方变成一条可审查的原则候选——你需要先看到证据，再决定是否采纳。不解析对话，PD 就只能管工具，学不到纠正。
+
+**保存多少、多久？**
+每个会话只保留最近 32 条可见消息、最多 7 天（先到期先删除）。当某个问题被正式立为 pain 时，才会把它的前 12 条消息 + 触发点 + 助手的下一条完整回复升级为长期治理证据，按现有治理数据的生命周期管理。保存的工具证据在落盘前会经过既有的敏感字段与常见密钥格式脱敏；但请注意：如果一段密钥看起来就像普通文字，任何过滤器都无法识别它——请不要让 PD 观察包含此类内容的会话。
+
+**数据会离开本机吗？**
+观察数据本身只存在本机工作区。被升级为治理证据的对话片段，会像现有诊断流程一样发送给你配置的 LLM API 做诊断——这是唯一的外发路径，与 OpenClaw 上的现有行为一致。产品遥测不包含任何消息内容或会话标识。
+
+**如何关闭？随时。**
+关闭后 PD 立即停止读取 transcript（不是"读了再丢弃"，而是根本不打开）。已有的原则注入、工具拦截、既有工具证据完全不受影响。已保存的内容按上述期限自然过期；升级过的证据只能由你通过既有治理清理命令显式删除。卸载不会静默删除任何证据。
+
+**默认状态？**
+默认关闭。只有你在看到本说明后明确选择开启才会生效；升级 PD 永远不会替你开启。`;
+export const CODEX_INGESTION_DISCLOSURE_EN = `### Principles Disciple — Conversation Observation & Governance Closure (Codex)
+
+**What does PD read once enabled?**
+PD reads the Codex session transcripts that Codex explicitly provides to PD inside this workspace. Only visible content enters governance observation: the messages you send, the assistant's visible replies, and the names/inputs/results of tool calls (used to recognize recurring problems). The hidden reasoning process that Codex stores in encrypted form, system/developer prompts, and host-injected environment context present in the same records are recognized and discarded during parsing — never saved, never written to logs, never sent to the diagnosis model.
+
+**Why read at all?**
+So that PD can deliver on its promised closed loop on Codex: turning the places you repeatedly correct into a reviewable principle candidate — you see the evidence first, then decide whether to adopt it. Without parsing conversations, PD can only govern tools and cannot learn your corrections.
+
+**How much is kept, and for how long?**
+Per session, only the most recent 32 visible messages are kept, for at most 7 days (expired first, deleted first). Only when a problem is formally established as a pain are its preceding 12 messages + the trigger point + the assistant's next complete reply promoted into long-term governance evidence, managed under the existing governance data lifecycle. Saved tool evidence passes through the existing sensitive-field and common-secret-format redaction before being written; but note: if a secret looks like ordinary text, no filter can recognize it — please do not let PD observe sessions containing such content.
+
+**Does data leave this machine?**
+Observation data itself lives only in the local workspace. Conversation fragments promoted into governance evidence are sent to your configured LLM API for diagnosis, exactly like the existing diagnosis flow — this is the only egress path, consistent with current behavior on OpenClaw. Product telemetry contains no message content and no session identifiers.
+
+**How do I turn it off? Anytime.**
+Once off, PD immediately stops reading transcripts (not "read then discard" — the transcript is never opened at all). Existing principle injection, tool interception, and existing tool evidence are completely unaffected. Saved content expires naturally per the limits above; promoted evidence can only be deleted explicitly by you through the existing governance cleanup commands. Uninstall never silently deletes any evidence.
+
+**Default state?**
+Off by default. It takes effect only after you explicitly choose to enable it after seeing this disclosure; upgrading PD never enables it for you.`;
+export function getCodexIngestionDisclosureText(language) {
+    return language === 'en' ? CODEX_INGESTION_DISCLOSURE_EN : CODEX_INGESTION_DISCLOSURE_ZH;
+}

package/dist/codex-ingestion-consent.d.ts

@@ -0,0 +1,111 @@
+/**
+ * Codex conversation-ingestion consent store — Codex Governance Closure
+ * Slice D (SPEC rev 2 §17; G2A frozen disclosure).
+ *
+ * Persists the Owner's recorded consent decision for enabling
+ * `codex_conversation_ingestion` in ONE workspace to
+ * `<workspace>/.pd/codex-ingestion-consent.json`.
+ *
+ * Authority model (P4): the FEATURE FLAG stays the runtime authority for
+ * whether ingestion runs (the hook gate reads only the flag — consent never
+ * sits on the hot path). This store is the GOVERNANCE RECORD that the flag
+ * may only be enabled THROUGH the disclosed consent flow (G2A); health uses
+ * it to report consent state and to flag `flag_on_without_grant` as a
+ * governance warning. Declining must never flip the flag off by side effect
+ * — the setup flow owns that ordering, not this store.
+ *
+ * Scope: per-workspace (the flag and the transcripts it gates are
+ * workspace-scoped). This file is consent control state — it never contains
+ * any captured conversation text (SPEC §15 "consent state without displaying
+ * captured text").
+ *
+ * Patterns mirror the product-telemetry consent store: missing file is the
+ * normal never-asked case; a malformed file fails loud (rc-3/rc-9) because
+ * silently treating it as "never asked" could re-prompt against a recorded
+ * Owner decision; writes are atomic (temp + rename); unknown/malformed
+ * fields are rejected via guards, never `as` (rc-1/rc-2/rc-5).
+ */
+export declare const CODEX_INGESTION_CONSENT_FILENAME = "codex-ingestion-consent.json";
+export declare const CODEX_INGESTION_CONSENT_SCHEMA_VERSION = "2";
+/**
+ * Consent transition states (review round 2, governance consistency):
+ *
+ *   absent ──(disclosure shown, explicit decision)──▶ pending
+ *   pending ──(flag enabled successfully)───────────▶ granted
+ *   pending ──(declined / flag regularized off)─────▶ revoked
+ *   pending ──(flag enable failed)──────────────────▶ failed (with reason)
+ *   granted ──(explicit decline)────────────────────▶ revoked
+ *
+ * `granted` is only ever recorded AFTER the runtime flag activation has
+ * succeeded — consent can never become granted before activation, and a
+ * failed activation leaves an EXPLAINED `failed` state (reason + nextAction),
+ * never a silent granted/disabled mismatch. The flag remains the runtime
+ * authority; this record is the governance state machine that makes every
+ * observed flag/consent combination interpretable.
+ */
+export type CodexIngestionConsentDecision = 'pending' | 'granted' | 'revoked' | 'failed';
+export type CodexIngestionConsentDecidedVia = 'pd_codex_setup' | 'codex_plugin_setup';
+export interface CodexIngestionConsentRecord {
+    decision: CodexIngestionConsentDecision;
+    disclosureVersion: string;
+    decidedAt: string;
+    decidedVia: CodexIngestionConsentDecidedVia;
+    /** Populated when decision='failed': why the flag activation did not land. */
+    failureReason?: string;
+    schemaVersion: string;
+}
+export type CodexIngestionConsentRead = {
+    ok: true;
+    existed: boolean;
+    record: CodexIngestionConsentRecord | null;
+} | {
+    ok: false;
+    reason: string;
+    nextAction: string;
+};
+export type CodexIngestionConsentWrite = {
+    ok: true;
+    record: CodexIngestionConsentRecord;
+} | {
+    ok: false;
+    reason: string;
+    nextAction: string;
+};
+/** Health-surface consent state (SPEC §15). No captured text, ever. */
+export type CodexIngestionConsentState = 'granted' | 'revoked' | 'pending' | 'failed' | 'not_present' | 'flag_on_without_grant';
+export declare function getCodexIngestionConsentPath(workspaceDir: string): string;
+/**
+ * Read the consent record. ENOENT is the normal never-asked case
+ * (existed=false, record=null). Anything unreadable/malformed fails loud —
+ * degrading to "never asked" could re-prompt or re-enable against the
+ * Owner's recorded decision.
+ */
+export declare function readCodexIngestionConsent(workspaceDir: string): CodexIngestionConsentRead;
+/**
+ * Record an explicit consent decision made AFTER the disclosure was
+ * presented (the setup flow presents the frozen text before calling this).
+ * The flag itself is intentionally untouched — enabling it is the setup
+ * flow's explicit, ordered step.
+ */
+export declare function recordCodexIngestionConsent(workspaceDir: string, input: {
+    decision: CodexIngestionConsentDecision;
+    decidedVia: CodexIngestionConsentDecidedVia;
+    decidedAt?: string;
+    failureReason?: string;
+}): CodexIngestionConsentWrite;
+/**
+ * Combine the consent record with the ingestion flag into the health-surface
+ * state (SPEC §15). Every flag×record combination maps to exactly one
+ * interpretable state — none of them reads as silently healthy:
+ *
+ *   record granted  + flag any      → 'granted'    (activation succeeded)
+ *   record revoked  + flag any      → 'revoked'    (Owner said no; flag-off
+ *                                              path also regularizes the flag)
+ *   record failed   + flag any      → 'failed'     (activation did not land;
+ *                                              failureReason explains why)
+ *   record pending  + flag off      → 'pending'    (decision recorded, activation not yet applied)
+ *   record pending  + flag on       → 'pending'    (activation applied, terminal write pending)
+ *   no record       + flag on       → 'flag_on_without_grant'  (governance warning)
+ *   no record       + flag off      → 'not_present'
+ */
+export declare function deriveCodexIngestionConsentState(record: CodexIngestionConsentRecord | null, ingestionFlagEnabled: boolean): CodexIngestionConsentState;

package/dist/codex-ingestion-consent.js

@@ -0,0 +1,223 @@
+/**
+ * Codex conversation-ingestion consent store — Codex Governance Closure
+ * Slice D (SPEC rev 2 §17; G2A frozen disclosure).
+ *
+ * Persists the Owner's recorded consent decision for enabling
+ * `codex_conversation_ingestion` in ONE workspace to
+ * `<workspace>/.pd/codex-ingestion-consent.json`.
+ *
+ * Authority model (P4): the FEATURE FLAG stays the runtime authority for
+ * whether ingestion runs (the hook gate reads only the flag — consent never
+ * sits on the hot path). This store is the GOVERNANCE RECORD that the flag
+ * may only be enabled THROUGH the disclosed consent flow (G2A); health uses
+ * it to report consent state and to flag `flag_on_without_grant` as a
+ * governance warning. Declining must never flip the flag off by side effect
+ * — the setup flow owns that ordering, not this store.
+ *
+ * Scope: per-workspace (the flag and the transcripts it gates are
+ * workspace-scoped). This file is consent control state — it never contains
+ * any captured conversation text (SPEC §15 "consent state without displaying
+ * captured text").
+ *
+ * Patterns mirror the product-telemetry consent store: missing file is the
+ * normal never-asked case; a malformed file fails loud (rc-3/rc-9) because
+ * silently treating it as "never asked" could re-prompt against a recorded
+ * Owner decision; writes are atomic (temp + rename); unknown/malformed
+ * fields are rejected via guards, never `as` (rc-1/rc-2/rc-5).
+ */
+import fs from 'node:fs';
+import path from 'node:path';
+import { CODEX_INGESTION_DISCLOSURE_VERSION } from './codex-disclosure.js';
+export const CODEX_INGESTION_CONSENT_FILENAME = 'codex-ingestion-consent.json';
+export const CODEX_INGESTION_CONSENT_SCHEMA_VERSION = '2';
+export function getCodexIngestionConsentPath(workspaceDir) {
+    return path.join(path.resolve(workspaceDir), '.pd', CODEX_INGESTION_CONSENT_FILENAME);
+}
+function isDecision(value) {
+    return value === 'granted' || value === 'pending' || value === 'revoked' || value === 'failed';
+}
+function isDecidedVia(value) {
+    return value === 'pd_codex_setup' || value === 'codex_plugin_setup';
+}
+function isNonShortString(value, max) {
+    return typeof value === 'string' && value.length > 0 && value.length <= max;
+}
+function isIsoTimestamp(value) {
+    return isNonShortString(value, 40) && !Number.isNaN(Date.parse(value));
+}
+/**
+ * Read the consent record. ENOENT is the normal never-asked case
+ * (existed=false, record=null). Anything unreadable/malformed fails loud —
+ * degrading to "never asked" could re-prompt or re-enable against the
+ * Owner's recorded decision.
+ */
+export function readCodexIngestionConsent(workspaceDir) {
+    const filePath = getCodexIngestionConsentPath(workspaceDir);
+    let raw;
+    try {
+        raw = fs.readFileSync(filePath, 'utf8');
+    }
+    catch (error) {
+        const codeValue = typeof error === 'object' && error !== null && Object.hasOwn(error, 'code')
+            ? error.code
+            : undefined;
+        if (codeValue === 'ENOENT') {
+            return { ok: true, existed: false, record: null };
+        }
+        const code = typeof codeValue === 'string' ? codeValue : String(error);
+        return {
+            ok: false,
+            reason: `codex_ingestion_consent_unreadable: ${code.slice(0, 120)}`,
+            nextAction: `Check permissions on ${filePath}`,
+        };
+    }
+    let parsed;
+    try {
+        parsed = JSON.parse(raw);
+    }
+    catch {
+        return {
+            ok: false,
+            reason: 'codex_ingestion_consent_malformed_json',
+            nextAction: `Fix or delete ${filePath} (delete = consent returns to not_present; the ingestion flag itself is unchanged)`,
+        };
+    }
+    if (typeof parsed !== 'object' || parsed === null || Array.isArray(parsed)) {
+        return {
+            ok: false,
+            reason: 'codex_ingestion_consent_malformed_shape',
+            nextAction: `Fix or delete ${filePath} (delete = consent returns to not_present; the ingestion flag itself is unchanged)`,
+        };
+    }
+    const obj = parsed;
+    const allowedKeys = ['decision', 'disclosureVersion', 'decidedAt', 'decidedVia', 'failureReason', 'schemaVersion'];
+    const errors = [];
+    for (const key of Object.keys(obj)) {
+        if (!allowedKeys.includes(key))
+            errors.push(`unknown field '${key}'`);
+    }
+    if (!isDecision(obj.decision))
+        errors.push('decision must be pending|granted|revoked|failed');
+    if (!isNonShortString(obj.disclosureVersion, 40))
+        errors.push('disclosureVersion must be a short non-empty string');
+    if (!isIsoTimestamp(obj.decidedAt))
+        errors.push('decidedAt must be a parseable ISO-8601 string');
+    if (!isDecidedVia(obj.decidedVia))
+        errors.push('decidedVia must be pd_codex_setup|codex_plugin_setup');
+    if (obj.failureReason !== undefined && !isNonShortString(obj.failureReason, 200)) {
+        errors.push('failureReason must be a non-empty string (≤200 chars) when present');
+    }
+    if (obj.schemaVersion !== CODEX_INGESTION_CONSENT_SCHEMA_VERSION) {
+        errors.push(`schemaVersion must be '${CODEX_INGESTION_CONSENT_SCHEMA_VERSION}'`);
+    }
+    if (errors.length > 0) {
+        return {
+            ok: false,
+            reason: `codex_ingestion_consent_malformed: ${errors.join('; ')}`,
+            nextAction: `Fix or delete ${filePath} (delete = consent returns to not_present; the ingestion flag itself is unchanged)`,
+        };
+    }
+    // Post-validation reconstruction from guard-narrowed fields — no `as` on
+    // the untrusted parsed object (rc-2). The errors check above proves every
+    // guard passes; the re-invoked guards here satisfy the type system the
+    // same way the telemetry consent store does.
+    return {
+        ok: true,
+        existed: true,
+        record: {
+            decision: isDecision(obj.decision) ? obj.decision : 'failed',
+            disclosureVersion: isNonShortString(obj.disclosureVersion, 40) ? obj.disclosureVersion : '',
+            decidedAt: isIsoTimestamp(obj.decidedAt) ? obj.decidedAt : '',
+            decidedVia: isDecidedVia(obj.decidedVia) ? obj.decidedVia : 'pd_codex_setup',
+            ...(isNonShortString(obj.failureReason, 200) && obj.failureReason !== undefined ? { failureReason: obj.failureReason } : {}),
+            schemaVersion: CODEX_INGESTION_CONSENT_SCHEMA_VERSION,
+        },
+    };
+}
+/**
+ * Record an explicit consent decision made AFTER the disclosure was
+ * presented (the setup flow presents the frozen text before calling this).
+ * The flag itself is intentionally untouched — enabling it is the setup
+ * flow's explicit, ordered step.
+ */
+export function recordCodexIngestionConsent(workspaceDir, input) {
+    // Write-side validation mirrors the read-side guards (review round 3): a
+    // record this writer produces must never be rejected by its own reader.
+    const errors = [];
+    if (input.decidedAt !== undefined && !isIsoTimestamp(input.decidedAt))
+        errors.push('decidedAt must be a parseable ISO-8601 string when provided');
+    if (input.decision === 'failed' && (input.failureReason === undefined || input.failureReason.trim().length === 0)) {
+        errors.push('decision=failed requires a non-empty failureReason');
+    }
+    if (input.failureReason !== undefined && input.decision !== 'failed' && input.failureReason.trim().length === 0) {
+        errors.push('failureReason must be non-empty when provided');
+    }
+    if (errors.length > 0) {
+        return {
+            ok: false,
+            reason: 'codex_ingestion_consent_input_invalid: ' + errors.join('; '),
+            nextAction: 'Fix the recordCodexIngestionConsent arguments at the call site.',
+        };
+    }
+    const filePath = getCodexIngestionConsentPath(workspaceDir);
+    const record = {
+        decision: input.decision,
+        disclosureVersion: CODEX_INGESTION_DISCLOSURE_VERSION,
+        decidedAt: input.decidedAt ?? new Date().toISOString(),
+        decidedVia: input.decidedVia,
+        ...(input.failureReason !== undefined ? { failureReason: input.failureReason.slice(0, 200) } : {}),
+        schemaVersion: CODEX_INGESTION_CONSENT_SCHEMA_VERSION,
+    };
+    const dir = path.dirname(filePath);
+    const tmpPath = `${filePath}.tmp-${process.pid}-${Date.now()}`;
+    try {
+        fs.mkdirSync(dir, { recursive: true });
+        fs.writeFileSync(tmpPath, `${JSON.stringify(record, null, 2)}\n`, { encoding: 'utf8', mode: 0o600 });
+        fs.renameSync(tmpPath, filePath);
+        return { ok: true, record };
+    }
+    catch (error) {
+        const message = error instanceof Error ? error.message : String(error);
+        try {
+            fs.rmSync(tmpPath, { force: true });
+        }
+        catch {
+            // best-effort cleanup; the write failure below is the loud signal
+        }
+        return {
+            ok: false,
+            reason: `codex_ingestion_consent_write_failed: ${message.slice(0, 200)}`,
+            nextAction: `Check permissions on ${dir}`,
+        };
+    }
+}
+/**
+ * Combine the consent record with the ingestion flag into the health-surface
+ * state (SPEC §15). Every flag×record combination maps to exactly one
+ * interpretable state — none of them reads as silently healthy:
+ *
+ *   record granted  + flag any      → 'granted'    (activation succeeded)
+ *   record revoked  + flag any      → 'revoked'    (Owner said no; flag-off
+ *                                              path also regularizes the flag)
+ *   record failed   + flag any      → 'failed'     (activation did not land;
+ *                                              failureReason explains why)
+ *   record pending  + flag off      → 'pending'    (decision recorded, activation not yet applied)
+ *   record pending  + flag on       → 'pending'    (activation applied, terminal write pending)
+ *   no record       + flag on       → 'flag_on_without_grant'  (governance warning)
+ *   no record       + flag off      → 'not_present'
+ */
+export function deriveCodexIngestionConsentState(record, ingestionFlagEnabled) {
+    if (record === null) {
+        return ingestionFlagEnabled ? 'flag_on_without_grant' : 'not_present';
+    }
+    switch (record.decision) {
+        case 'granted':
+            return 'granted';
+        case 'revoked':
+            return 'revoked';
+        case 'failed':
+            return 'failed';
+        case 'pending':
+            return 'pending';
+    }
+}

package/dist/codex-legacy-registration.d.ts

@@ -0,0 +1,18 @@
+/**
+ * Legacy Codex global-hook registration detection — Codex Governance Closure
+ * Slice D (PRI-625; SPEC rev 2 §17 legacy-installer retirement).
+ *
+ * ONE authority for the "is a PD-owned legacy global registration present"
+ * fact: the pure parser lives in @principles/core/host
+ * (parseLegacyCodexHooksRegistration); this wrapper is the FS edge for
+ * host-runtime consumers (health/setup surfaces). The retired installer uses
+ * the same core parser at its own edge.
+ */
+import { type LegacyCodexRegistration } from '@principles/core/host';
+/**
+ * Detect a PD-owned legacy global hook registration in ~/.codex/hooks.json.
+ * Unreadable/malformed/absent ⇒ detected:false (nothing provably ours to
+ * migrate); the health surface reports the unreadable state separately via
+ * its own hooks.json presence check.
+ */
+export declare function detectLegacyCodexHookRegistration(hooksJsonPathOverride?: string): LegacyCodexRegistration;

package/dist/codex-legacy-registration.js

@@ -0,0 +1,34 @@
+/**
+ * Legacy Codex global-hook registration detection — Codex Governance Closure
+ * Slice D (PRI-625; SPEC rev 2 §17 legacy-installer retirement).
+ *
+ * ONE authority for the "is a PD-owned legacy global registration present"
+ * fact: the pure parser lives in @principles/core/host
+ * (parseLegacyCodexHooksRegistration); this wrapper is the FS edge for
+ * host-runtime consumers (health/setup surfaces). The retired installer uses
+ * the same core parser at its own edge.
+ */
+import fs from 'node:fs';
+import os from 'node:os';
+import * as path from 'node:path';
+import { parseLegacyCodexHooksRegistration } from '@principles/core/host';
+function getCodexHooksJsonPath() {
+    return path.join(os.homedir(), '.codex', 'hooks.json');
+}
+/**
+ * Detect a PD-owned legacy global hook registration in ~/.codex/hooks.json.
+ * Unreadable/malformed/absent ⇒ detected:false (nothing provably ours to
+ * migrate); the health surface reports the unreadable state separately via
+ * its own hooks.json presence check.
+ */
+export function detectLegacyCodexHookRegistration(hooksJsonPathOverride) {
+    const hooksJsonPath = hooksJsonPathOverride ?? getCodexHooksJsonPath();
+    let parsed;
+    try {
+        parsed = JSON.parse(fs.readFileSync(hooksJsonPath, 'utf8'));
+    }
+    catch {
+        return { detected: false, legacyAsyncPostToolUse: false };
+    }
+    return parseLegacyCodexHooksRegistration(parsed);
+}

package/dist/codex-transcript-locate.d.ts

@@ -0,0 +1,16 @@
+export type CodexTranscriptLookup = {
+    ok: true;
+    transcriptPath: string; /** file size in bytes at lookup time (null when stat fails); lets health compute lag without its own stat call */
+    sizeBytes: number | null;
+} | {
+    ok: false;
+    reason: 'catch_up_rollout_identity_invalid' | 'catch_up_sessions_root_missing' | 'catch_up_transcript_missing' | 'catch_up_transcript_ambiguous' | 'catch_up_lookup_exhausted';
+    nextAction: string;
+};
+/** rollout-<timestamp>-<uuid>.jsonl — returns the rollout uuid, or null when the name is off-contract. */
+export declare function parseRolloutFileName(fileName: string): string | null;
+/**
+ * Resolve one previously-authenticated rollout identity to its transcript
+ * path by exact-uuid filename match under `<codexHome>/sessions`.
+ */
+export declare function locateCodexTranscriptByRolloutIdentity(codexHome: string, rolloutIdentity: string): CodexTranscriptLookup;

package/dist/codex-transcript-locate.js

@@ -0,0 +1,106 @@
+/**
+ * Codex transcript locator — moved to host-runtime in Slice D (PRI-625):
+ * the §15 health surface must compute per-rollout lag with the SAME locator
+ * the catch-up path uses (one truth for "where is this rollout's transcript"),
+ * and host-runtime cannot import codex-adapter. The adapter re-exports it.
+ *
+ * The durable checkpoint stores only the rollout uuid (SPEC §18 scenario 9
+ * forbids raw paths in the DB), so catch-up must resolve a checkpointed
+ * rollout back to its transcript file. This is NOT session discovery: the
+ * lookup searches for the EXACT rollout uuid of a rollout the authenticated
+ * Workspace hook previously delivered (only hooks write checkpoints). It
+ * never guesses a "latest session", never returns a partial match, and
+ * refuses ambiguities (ADR-0020 §11.2 / SPEC §9).
+ */
+import fs from 'node:fs';
+import path from 'node:path';
+/** Bounded walk: hard cap on visited directory entries so a pathological sessions tree cannot stall the worker. */
+const MAX_LOOKUP_ENTRIES = 5000;
+const ROLLOUT_IDENTITY_PATTERN = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/;
+const UUID_HEX = /^[0-9a-fA-F]+$/;
+function isHex(value) {
+    return UUID_HEX.test(value);
+}
+/** rollout-<timestamp>-<uuid>.jsonl — returns the rollout uuid, or null when the name is off-contract. */
+export function parseRolloutFileName(fileName) {
+    if (!fileName.startsWith('rollout-') || !fileName.endsWith('.jsonl'))
+        return null;
+    const stem = fileName.slice('rollout-'.length, -'.jsonl'.length);
+    const parts = stem.split('-');
+    if (parts.length < 6)
+        return null; // at least one timestamp segment + the five uuid groups
+    const [a, b, c, d, e] = parts.slice(-5);
+    if (a === undefined || b === undefined || c === undefined || d === undefined || e === undefined)
+        return null;
+    if (a.length !== 8 || b.length !== 4 || c.length !== 4 || d.length !== 4 || e.length !== 12)
+        return null;
+    if (!isHex(a) || !isHex(b) || !isHex(c) || !isHex(d) || !isHex(e))
+        return null;
+    return parts.slice(-5).join('-').toLowerCase();
+}
+/**
+ * Resolve one previously-authenticated rollout identity to its transcript
+ * path by exact-uuid filename match under `<codexHome>/sessions`.
+ */
+export function locateCodexTranscriptByRolloutIdentity(codexHome, rolloutIdentity) {
+    if (!ROLLOUT_IDENTITY_PATTERN.test(rolloutIdentity)) {
+        return { ok: false, reason: 'catch_up_rollout_identity_invalid', nextAction: 'the checkpointed rollout identity is not a rollout uuid; inspect the workspace trajectory database.' };
+    }
+    const sessionsRoot = path.join(codexHome, 'sessions');
+    let rootStats;
+    try {
+        rootStats = fs.statSync(sessionsRoot);
+    }
+    catch {
+        return { ok: false, reason: 'catch_up_sessions_root_missing', nextAction: 'the configured CODEX_HOME has no sessions root; verify the Codex home used by the hook and by catch-up matches.' };
+    }
+    if (!rootStats.isDirectory()) {
+        return { ok: false, reason: 'catch_up_sessions_root_missing', nextAction: 'the configured CODEX_HOME sessions path is not a directory; verify the Codex home configuration.' };
+    }
+    const matches = [];
+    let visited = 0;
+    const stack = [sessionsRoot];
+    while (stack.length > 0 && matches.length < 2) {
+        const dir = stack.pop();
+        if (dir === undefined)
+            break;
+        let entries;
+        try {
+            entries = fs.readdirSync(dir, { withFileTypes: true });
+        }
+        catch {
+            continue; // unreadable subtree — other subtrees may still hold the rollout
+        }
+        for (const entry of entries) {
+            visited += 1;
+            if (visited > MAX_LOOKUP_ENTRIES) {
+                return { ok: false, reason: 'catch_up_lookup_exhausted', nextAction: 'the sessions tree exceeded the bounded catch-up lookup; keep CODEX_HOME/sessions pruned or catch up rollouts manually.' };
+            }
+            if (entry.isDirectory()) {
+                stack.push(path.join(dir, entry.name));
+            }
+            else if (entry.isFile() && entry.name.endsWith('.jsonl')) {
+                if (parseRolloutFileName(entry.name) === rolloutIdentity) {
+                    matches.push(path.join(dir, entry.name));
+                    if (matches.length >= 2)
+                        break;
+                }
+            }
+        }
+    }
+    if (matches.length === 0) {
+        return { ok: false, reason: 'catch_up_transcript_missing', nextAction: 'the checkpointed rollout has no transcript under the Codex sessions root (rotated or cleaned by Codex); its committed observations remain, the pending lag cannot be recovered.' };
+    }
+    if (matches.length > 1) {
+        return { ok: false, reason: 'catch_up_transcript_ambiguous', nextAction: 'multiple transcripts match the rollout identity; refuse to guess — inspect the Codex sessions tree.' };
+    }
+    const transcriptPath = matches[0];
+    let sizeBytes;
+    try {
+        sizeBytes = fs.statSync(transcriptPath).size;
+    }
+    catch {
+        sizeBytes = null;
+    }
+    return { ok: true, transcriptPath, sizeBytes };
+}

package/dist/codex-worker-status.d.ts

@@ -0,0 +1,24 @@
+/**
+ * Codex worker status-mode semantics — moved to host-runtime in Slice D
+ * (PRI-625): the §15 health surface needs the SAME mode authority in the CLI,
+ * the Console, and the worker itself, and this evaluation only depends on
+ * host-neutral inputs (workspace directory, .pd/config.yaml flags, install
+ * manifest registration). codex-adapter re-exports it for compatibility.
+ *
+ * SPEC §15 worker mode, evaluated WITHOUT executing anything (no lease, no
+ * LLM, no transcript I/O). `manual_action_required` means no
+ * Companion-registered worker serves this workspace — the manual CLI path
+ * (catch-up / diagnose / run-once) is the recovery route. 'ready' here means
+ * "an automatic worker would run and hold the workspace task leases";
+ * live-worker liveness surfacing belongs to the Slice D health surface.
+ */
+export type CodexWorkerMode = 'ready' | 'manual_action_required' | 'paused' | 'degraded';
+export interface CodexWorkerStatusEvaluation {
+    readonly mode: CodexWorkerMode;
+    readonly reason?: string;
+    readonly nextAction?: string;
+}
+export declare function computeCodexWorkerStatusMode(input: {
+    workspaceDir: string;
+    registeredInInstallManifest: boolean;
+}): CodexWorkerStatusEvaluation;

package/dist/codex-worker-status.js

@@ -0,0 +1,52 @@
+/**
+ * Codex worker status-mode semantics — moved to host-runtime in Slice D
+ * (PRI-625): the §15 health surface needs the SAME mode authority in the CLI,
+ * the Console, and the worker itself, and this evaluation only depends on
+ * host-neutral inputs (workspace directory, .pd/config.yaml flags, install
+ * manifest registration). codex-adapter re-exports it for compatibility.
+ *
+ * SPEC §15 worker mode, evaluated WITHOUT executing anything (no lease, no
+ * LLM, no transcript I/O). `manual_action_required` means no
+ * Companion-registered worker serves this workspace — the manual CLI path
+ * (catch-up / diagnose / run-once) is the recovery route. 'ready' here means
+ * "an automatic worker would run and hold the workspace task leases";
+ * live-worker liveness surfacing belongs to the Slice D health surface.
+ */
+import * as fs from 'node:fs';
+import * as path from 'node:path';
+import { loadPdConfigForPlugin } from './pd-config.js';
+import { computeFeatureFlagsFromConfig } from '@principles/core/runtime-v2';
+function directoryExists(dir) {
+    try {
+        return fs.statSync(dir).isDirectory();
+    }
+    catch {
+        return false;
+    }
+}
+export function computeCodexWorkerStatusMode(input) {
+    const workspaceDir = path.resolve(input.workspaceDir);
+    if (!directoryExists(workspaceDir)) {
+        return { mode: 'degraded', reason: 'workspace_missing', nextAction: 'The workspace directory does not exist; restore it or remove it from the install manifest.' };
+    }
+    const config = loadPdConfigForPlugin(workspaceDir);
+    if (!config.ok) {
+        const [first] = config.errors;
+        return { mode: 'degraded', reason: `pd_config_invalid:${first?.reason ?? 'unknown'}`, nextAction: first?.nextAction ?? 'Repair .pd/config.yaml.' };
+    }
+    const { flags } = computeFeatureFlagsFromConfig(config.effective);
+    if (flags['host.codex']?.enabled !== true) {
+        return { mode: 'paused', reason: 'host.codex_disabled', nextAction: 'Set features.host.codex.enabled=true in the Workspace .pd/config.yaml to enable Codex PD behavior.' };
+    }
+    if (flags.internalization_auto_consumer?.enabled !== true) {
+        return { mode: 'paused', reason: 'internalization_auto_consumer_disabled', nextAction: 'Automatic execution is paused; manual commands remain available: pd diagnose, pd runtime internalization run-once.' };
+    }
+    if (!input.registeredInInstallManifest) {
+        return {
+            mode: 'manual_action_required',
+            reason: 'workspace_not_in_install_manifest',
+            nextAction: `No Companion worker is registered for this workspace. Manual path: pd codex ingest catch-up --workspace "${workspaceDir}", then pd diagnose / pd runtime internalization run-once.`,
+        };
+    }
+    return { mode: 'ready' };
+}

package/dist/governance-observation-store.d.ts

@@ -6,7 +6,8 @@ export declare const GOVERNANCE_PENDING_TAIL_STALE_MS: number;
 export type GovernanceObservationKind = 'user_turn' | 'assistant_turn' | 'tool_call';
 export type GovernanceObservationSource = 'live_hook' | 'transcript';
 export type GovernanceObservationCompleteness = 'complete' | 'partial';
-export type GovernanceRetentionClass = 'operational' | 'promoted' | 'expired' | 'rolled_back';
+/** `quarantined` (Slice D §15): audited, permanently-invalid row; bodies dropped, metadata kept. */
+export type GovernanceRetentionClass = 'operational' | 'promoted' | 'expired' | 'rolled_back' | 'quarantined';
 export interface GovernanceObservationInput {
     readonly hostKind: 'codex';
     readonly rolloutIdentity: string;
@@ -193,4 +194,79 @@ export type ListGovernanceObservationsResult = {
 } | Degradation;
 export declare function listGovernanceObservations(input: ListGovernanceObservationsInput): ListGovernanceObservationsResult;
 export declare function promoteGovernanceEvidence(input: PromoteGovernanceEvidenceInput): PromoteGovernanceEvidenceResult;
+export interface QuarantineGovernanceObservationArgs {
+    readonly workspaceDir: string;
+    readonly hostKind: 'codex';
+    readonly rolloutIdentity: string;
+    /** governance_observations.id — `pd codex ingest quarantine --record <id>`. */
+    readonly recordId: number;
+    /** Why this record is permanently invalid (bounded, stored verbatim). */
+    readonly reason: string;
+    /** Who ran the quarantine (operator identity string, bounded). */
+    readonly operator: string;
+    /** false = dry run (default contract): report, never mutate. */
+    readonly confirm?: boolean;
+    readonly databaseFactory?: ObservationDatabaseFactory;
+}
+export interface QuarantinedRecordSummary {
+    readonly id: number;
+    readonly kind: string;
+    readonly logicalKey: string;
+    readonly observedAt: string;
+    readonly retentionClass: GovernanceRetentionClass;
+    /** SHA-256 over the row's stored content (hex) — computed the same way for dry runs. */
+    readonly digest: string;
+    /** Bounded neighbor description: `prev=<order|none>;next=<order|none>;record=<order|null>`. */
+    readonly gap: string;
+}
+export type QuarantineGovernanceObservationResult = {
+    ok: true;
+    dryRun: boolean;
+    alreadyQuarantined: boolean;
+    record: QuarantinedRecordSummary;
+} | {
+    ok: false;
+    reason: string;
+    nextAction: string;
+};
+/**
+ * Audited quarantine for a permanently invalid governance observation
+ * (SPEC §15). Dry run is the contract default: without `confirm` the store
+ * reports what WOULD happen and mutates nothing. With `confirm`:
+ *  - bodies (visible_text / sanitized_tool_facts_json) are dropped;
+ *  - retention_class becomes `quarantined` (terminal class — never pruned,
+ *    never promoted);
+ *  - digest, reason, operator, timestamp, and the neighbor gap are recorded;
+ *  - the Codex transcript is never read or touched (this function opens only
+ *    the workspace trajectory.db).
+ * Promoted evidence is refused: Owner-decided evidence leaves only through
+ * the Owner governance cleanup commands.
+ */
+export declare function quarantineGovernanceObservation(args: QuarantineGovernanceObservationArgs): QuarantineGovernanceObservationResult;
+export interface GovernanceObservationStats {
+    readonly operational: number;
+    readonly promoted: number;
+    readonly quarantined: number;
+    readonly terminalOther: number;
+    /** Oldest operational observed_at + retention window — when the next row ages out. */
+    readonly nextExpiryAt: string | null;
+    readonly lastObservationAt: string | null;
+}
+export type ReadGovernanceObservationStatsResult = {
+    ok: true;
+    stats: GovernanceObservationStats;
+} | {
+    ok: false;
+    reason: string;
+    nextAction: string;
+};
+/**
+ * Bounded read-only counts for the §15 health surface. Unknown is reported
+ * as a structured degradation — never silently as zero (§15: unknown is not
+ * reported as healthy).
+ */
+export declare function readGovernanceObservationStats(args: {
+    workspaceDir: string;
+    databaseFactory?: ObservationDatabaseFactory;
+}): ReadGovernanceObservationStatsResult;
 export {};

package/dist/governance-observation-store.js

@@ -26,6 +26,7 @@
  */
 import fs from 'node:fs';
 import path from 'node:path';
+import { createHash } from 'node:crypto';
 import Database from 'better-sqlite3';
 import { sanitizeString, sanitizeValue } from '@principles/core/runtime-v2';
 // ─── Retention policy constants (Owner-approved, SPEC rev 2 §11) ────────────
@@ -33,7 +34,7 @@ export const GOVERNANCE_RETENTION_MAX_TURNS = 32;
 export const GOVERNANCE_RETENTION_MAX_AGE_MS = 7 * 24 * 60 * 60 * 1000;
 export const GOVERNANCE_PROMOTION_PRECEDING_TURNS = 12;
 export const GOVERNANCE_PENDING_TAIL_STALE_MS = 7 * 24 * 60 * 60 * 1000;
-const GOVERNANCE_OBSERVATION_SCHEMA_VERSION = 2;
+const GOVERNANCE_OBSERVATION_SCHEMA_VERSION = 3;
 const MAX_TEXT_BOUND = 200; // matches MAX_EVIDENCE_VALUE_CHARS; guards stored identity fields
 const MAX_JSON_COLUMN = 8_000;
 function isRecord(value) {
@@ -154,11 +155,19 @@ const V2_ADDED_COLUMNS = [
     { table: 'governance_observations', name: 'source_order', type: 'INTEGER' },
     { table: 'governance_observations', name: 'source_ordinal', type: 'INTEGER' },
 ];
+/** Column additions in v3 (Slice D §15 quarantine: audited recovery metadata). */
+const V3_ADDED_COLUMNS = [
+    { table: 'governance_observations', name: 'quarantined_at', type: 'TEXT' },
+    { table: 'governance_observations', name: 'quarantine_reason', type: 'TEXT' },
+    { table: 'governance_observations', name: 'quarantine_digest', type: 'TEXT' },
+    { table: 'governance_observations', name: 'quarantine_operator', type: 'TEXT' },
+    { table: 'governance_observations', name: 'quarantine_gap', type: 'TEXT' },
+];
 function ensureGovernanceObservationSchema(db) {
     db.transaction(() => {
         for (const statement of CREATE_STATEMENTS)
             db.exec(statement);
-        for (const column of V2_ADDED_COLUMNS) {
+        for (const column of [...V2_ADDED_COLUMNS, ...V3_ADDED_COLUMNS]) {
             try {
                 db.exec(`ALTER TABLE ${column.table} ADD COLUMN ${column.name} ${column.type}`);
             }
@@ -460,7 +469,7 @@ export function ingestGovernanceObservations(input) {
         })();
         if (result === 'conflict') {
             return {
-                ok: false, reason: 'logical_key_content_conflict', nextAction: 'the first committed content was preserved and the observation is marked partial; run the audited quarantine/recovery command once available (Slice D) or re-ingest from a fresh rollout',
+                ok: false, reason: 'logical_key_content_conflict', nextAction: 'the first committed content was preserved and the observation is marked partial; run `pd codex ingest quarantine --workspace <path> --rollout <id> --record <id>` (audited, dry-run default) or re-ingest from a fresh rollout',
                 inserted, enriched, duplicates, checkpointCommitted: false, warnings: [`conflict:${conflictKey}`],
             };
         }
@@ -694,3 +703,179 @@ export function promoteGovernanceEvidence(input) {
         close();
     }
 }
+const QUARANTINE_REASON_MAX = 200;
+const QUARANTINE_OPERATOR_MAX = 80;
+function observationDigest(row) {
+    // Digest the row's stored content exactly as persisted (rc-8: hashing
+    // string columns only — never JSON.stringify of untrusted unknowns). The
+    // digest lets a future audit recognize the same record if it reappears.
+    const hash = createHash('sha256');
+    for (const column of ['rollout_identity', 'logical_key', 'transcript_record_key', 'kind', 'source', 'completeness', 'visible_text', 'sanitized_tool_facts_json', 'observed_at']) {
+        const value = row[column];
+        hash.update(`${column}=`);
+        hash.update(value === null || value === undefined ? '<null>' : String(value));
+        hash.update('\n');
+    }
+    return hash.digest('hex');
+}
+/**
+ * Audited quarantine for a permanently invalid governance observation
+ * (SPEC §15). Dry run is the contract default: without `confirm` the store
+ * reports what WOULD happen and mutates nothing. With `confirm`:
+ *  - bodies (visible_text / sanitized_tool_facts_json) are dropped;
+ *  - retention_class becomes `quarantined` (terminal class — never pruned,
+ *    never promoted);
+ *  - digest, reason, operator, timestamp, and the neighbor gap are recorded;
+ *  - the Codex transcript is never read or touched (this function opens only
+ *    the workspace trajectory.db).
+ * Promoted evidence is refused: Owner-decided evidence leaves only through
+ * the Owner governance cleanup commands.
+ */
+export function quarantineGovernanceObservation(args) {
+    const { workspaceDir, hostKind, rolloutIdentity, recordId, reason, operator, confirm = false } = args;
+    if (!Number.isInteger(recordId) || recordId <= 0) {
+        return { ok: false, reason: 'record_id_invalid', nextAction: 'Pass the numeric governance_observations.id (--record <id>); run `pd codex ingest catch-up --json` output or inspect trajectory.db to find it.' };
+    }
+    if (typeof reason !== 'string' || reason.trim().length === 0 || reason.length > QUARANTINE_REASON_MAX) {
+        return { ok: false, reason: 'reason_required', nextAction: `Provide a non-empty reason (≤ ${QUARANTINE_REASON_MAX} chars) describing why the record is permanently invalid.` };
+    }
+    if (typeof operator !== 'string' || operator.trim().length === 0 || operator.length > QUARANTINE_OPERATOR_MAX) {
+        return { ok: false, reason: 'operator_required', nextAction: `Provide the operator identity (≤ ${QUARANTINE_OPERATOR_MAX} chars).` };
+    }
+    const opened = openStore(workspaceDir, args.databaseFactory);
+    if (!('db' in opened))
+        return opened;
+    const { db, close } = opened;
+    try {
+        const outcome = db.transaction(() => {
+            const rolloutRow = db.prepare('SELECT id FROM governance_rollouts WHERE host_kind = ? AND rollout_identity = ?').get(hostKind, rolloutIdentity);
+            if (!isRecord(rolloutRow)) {
+                return { ok: false, reason: 'rollout_not_found', nextAction: `No governed rollout '${rolloutIdentity}' for host '${hostKind}' in this workspace; check the identity (see \`pd codex ingest catch-up\` output).` };
+            }
+            const rolloutRowId = rowField(rolloutRow, 'id');
+            const row = db.prepare('SELECT * FROM governance_observations WHERE id = ? AND rollout_row_id = ?').get(recordId, rolloutRowId);
+            if (!isRecord(row)) {
+                return { ok: false, reason: 'record_not_found', nextAction: `Record ${recordId} does not exist in rollout '${rolloutIdentity}' of this workspace; verify the id.` };
+            }
+            const retentionClassRaw = String(rowField(row, 'retention_class'));
+            // rc-2: the DB column is untrusted — only known classes enter the typed
+            // summary; anything else reads as 'expired' semantics for reporting but
+            // still fails the quarantinable check below.
+            const retentionClass = retentionClassRaw === 'operational' || retentionClassRaw === 'promoted'
+                || retentionClassRaw === 'quarantined' || retentionClassRaw === 'rolled_back'
+                ? retentionClassRaw
+                : 'expired';
+            const quarantinedAt = rowField(row, 'quarantined_at');
+            const sourceOrder = typeof rowField(row, 'source_order') === 'number' ? rowField(row, 'source_order') : null;
+            const neighborQuery = (direction) => {
+                if (sourceOrder === null)
+                    return 'none';
+                const comparison = direction === 'prev' ? '<' : '>';
+                const ordering = direction === 'prev' ? 'DESC' : 'ASC';
+                const neighbor = db.prepare(`SELECT source_order FROM governance_observations
+          WHERE rollout_row_id = ? AND source_order IS NOT NULL AND source_order ${comparison} ?
+          ORDER BY source_order ${ordering} LIMIT 1`).get(rolloutRowId, sourceOrder);
+                const value = isRecord(neighbor) ? rowField(neighbor, 'source_order') : undefined;
+                return typeof value === 'number' ? value : 'none';
+            };
+            const summary = {
+                id: recordId,
+                kind: String(rowField(row, 'kind')),
+                logicalKey: String(rowField(row, 'logical_key')),
+                observedAt: String(rowField(row, 'observed_at')),
+                retentionClass,
+                digest: observationDigest(row),
+                gap: `prev=${neighborQuery('prev')};next=${neighborQuery('next')};record=${sourceOrder === null ? 'null' : sourceOrder}`,
+            };
+            if (typeof quarantinedAt === 'string' && quarantinedAt.length > 0) {
+                // Already terminal: report the RECORDED audit digest/gap, not a
+                // re-hash of the row (bodies were dropped at quarantine time, so a
+                // fresh hash would silently differ from the audited one). dryRun
+                // reflects THIS invocation's intent — a dry-run call reports
+                // dryRun:true even on an already-quarantined row (review round 3).
+                const recordedDigest = rowField(row, 'quarantine_digest');
+                const recordedGap = rowField(row, 'quarantine_gap');
+                return {
+                    ok: true, dryRun: !confirm, alreadyQuarantined: true,
+                    record: {
+                        ...summary,
+                        digest: typeof recordedDigest === 'string' && recordedDigest.length > 0 ? recordedDigest : summary.digest,
+                        gap: typeof recordedGap === 'string' && recordedGap.length > 0 ? recordedGap : summary.gap,
+                    },
+                };
+            }
+            if (retentionClass === 'promoted') {
+                return { ok: false, reason: 'record_is_promoted_evidence', nextAction: 'Promoted evidence is Owner-decided governance evidence; quarantine never touches it. Use the existing Owner governance cleanup commands if the evidence must be removed.' };
+            }
+            if (retentionClass !== 'operational') {
+                return { ok: false, reason: `record_not_quarantinable:${retentionClass}`, nextAction: 'Only operational records can be quarantined; expired and rolled-back rows are already terminal.' };
+            }
+            if (!confirm) {
+                return { ok: true, dryRun: true, alreadyQuarantined: false, record: summary };
+            }
+            const now = new Date().toISOString();
+            db.prepare(`UPDATE governance_observations
+        SET visible_text = NULL, sanitized_tool_facts_json = NULL, retention_class = 'quarantined',
+            quarantined_at = ?, quarantine_reason = ?, quarantine_digest = ?, quarantine_operator = ?, quarantine_gap = ?
+        WHERE id = ? AND retention_class = 'operational'`)
+                .run(now, reason, summary.digest, operator, summary.gap, recordId);
+            return { ok: true, dryRun: false, alreadyQuarantined: false, record: summary };
+        })();
+        return outcome;
+    }
+    catch (error) {
+        const detail = error instanceof Error ? error.message.slice(0, 200) : String(error).slice(0, 200);
+        return { ok: false, reason: `governance_quarantine_failed:${detail}`, nextAction: 'inspect the workspace trajectory database and retry; the transaction rolled back, nothing was partially mutated' };
+    }
+    finally {
+        close();
+    }
+}
+/**
+ * Bounded read-only counts for the §15 health surface. Unknown is reported
+ * as a structured degradation — never silently as zero (§15: unknown is not
+ * reported as healthy).
+ */
+export function readGovernanceObservationStats(args) {
+    const opened = openStore(args.workspaceDir, args.databaseFactory);
+    if (!('db' in opened))
+        return opened;
+    const { db, close } = opened;
+    try {
+        const counts = db.prepare(`SELECT
+        SUM(CASE WHEN retention_class = 'operational' THEN 1 ELSE 0 END) AS operational,
+        SUM(CASE WHEN retention_class = 'promoted' THEN 1 ELSE 0 END) AS promoted,
+        SUM(CASE WHEN retention_class = 'quarantined' THEN 1 ELSE 0 END) AS quarantined,
+        SUM(CASE WHEN retention_class IN ('expired', 'rolled_back') THEN 1 ELSE 0 END) AS terminal_other,
+        MIN(CASE WHEN retention_class = 'operational' THEN observed_at END) AS oldest_operational,
+        MAX(observed_at) AS last_observation
+      FROM governance_observations`).get();
+        if (!isRecord(counts)) {
+            return { ok: false, reason: 'governance_stats_unavailable', nextAction: 'Inspect the workspace trajectory.db governance_observations table.' };
+        }
+        const numberOr = (value) => (typeof value === 'number' ? value : 0);
+        const stringOr = (value) => (typeof value === 'string' && value.length > 0 ? value : null);
+        const oldest = stringOr(own(counts, 'oldest_operational'));
+        const nextExpiry = oldest !== null && !Number.isNaN(Date.parse(oldest))
+            ? new Date(Date.parse(oldest) + GOVERNANCE_RETENTION_MAX_AGE_MS).toISOString()
+            : null;
+        return {
+            ok: true,
+            stats: {
+                operational: numberOr(own(counts, 'operational')),
+                promoted: numberOr(own(counts, 'promoted')),
+                quarantined: numberOr(own(counts, 'quarantined')),
+                terminalOther: numberOr(own(counts, 'terminal_other')),
+                nextExpiryAt: nextExpiry,
+                lastObservationAt: stringOr(own(counts, 'last_observation')),
+            },
+        };
+    }
+    catch (error) {
+        const detail = error instanceof Error ? error.message.slice(0, 160) : String(error);
+        return { ok: false, reason: `governance_stats_failed:${detail}`, nextAction: 'Inspect the workspace trajectory.db; the health surface degraded without mutating anything.' };
+    }
+    finally {
+        close();
+    }
+}

package/dist/governance-signal-admission.d.ts

@@ -225,4 +225,30 @@ export interface ReconcileGovernanceContinuationResult {
  * Not a background worker — Slice C's Companion worker and the CLI call this.
  */
 export declare function reconcileGovernanceContinuation(input: ReconcileGovernanceContinuationInput): Promise<ReconcileGovernanceContinuationResult>;
+export interface GovernanceAdmissionCounts {
+    readonly admitted: number;
+    /** Admitted pains with no Diagnostician task link — the §15 orphan count. */
+    readonly admittedWithoutTask: number;
+    readonly pendingTails: number;
+    readonly staleTails: number;
+    readonly completedTails: number;
+    readonly lastAdmissionAt: string | null;
+}
+export type ReadGovernanceAdmissionCountsResult = {
+    ok: true;
+    counts: GovernanceAdmissionCounts;
+} | {
+    ok: false;
+    reason: string;
+    nextAction: string;
+};
+/**
+ * Bounded read-only counts for the §15 health surface: admitted-pain-without-
+ * task count and promotion-tail states. Read-only — reconciliation itself
+ * stays in `reconcileGovernanceContinuation`.
+ */
+export declare function readGovernanceAdmissionCounts(args: {
+    workspaceDir: string;
+    databaseFactory?: ObservationDatabaseFactory;
+}): ReadGovernanceAdmissionCountsResult;
 export {};

package/dist/governance-signal-admission.js

@@ -857,3 +857,50 @@ export async function reconcileGovernanceContinuation(input) {
         close();
     }
 }
+/**
+ * Bounded read-only counts for the §15 health surface: admitted-pain-without-
+ * task count and promotion-tail states. Read-only — reconciliation itself
+ * stays in `reconcileGovernanceContinuation`.
+ */
+export function readGovernanceAdmissionCounts(args) {
+    const opened = openAdmissionStore(args.workspaceDir, args.databaseFactory);
+    if (!('db' in opened))
+        return opened;
+    const { db, close } = opened;
+    try {
+        const admissions = db.prepare(`SELECT
+        SUM(CASE WHEN decision = 'admitted' THEN 1 ELSE 0 END) AS admitted,
+        SUM(CASE WHEN decision = 'admitted' AND diagnostician_task_id IS NULL THEN 1 ELSE 0 END) AS admitted_without_task,
+        MAX(created_at) AS last_admission
+      FROM governance_signal_admissions`).get();
+        if (!isRecord(admissions)) {
+            return { ok: false, reason: 'governance_admission_counts_unavailable', nextAction: 'Inspect the governance_signal_admissions table in the workspace trajectory.db.' };
+        }
+        const numberOr = (value) => (typeof value === 'number' ? value : 0);
+        const stringOr = (value) => (typeof value === 'string' && value.length > 0 ? value : null);
+        const tails = db.prepare(`SELECT
+        SUM(CASE WHEN state = 'pending' THEN 1 ELSE 0 END) AS pending,
+        SUM(CASE WHEN state = 'stale' THEN 1 ELSE 0 END) AS stale,
+        SUM(CASE WHEN state = 'completed' THEN 1 ELSE 0 END) AS completed
+      FROM governance_pending_promotion_tails`).get();
+        const tailRow = isRecord(tails) ? tails : {};
+        return {
+            ok: true,
+            counts: {
+                admitted: numberOr(own(admissions, 'admitted')),
+                admittedWithoutTask: numberOr(own(admissions, 'admitted_without_task')),
+                pendingTails: numberOr(own(tailRow, 'pending')),
+                staleTails: numberOr(own(tailRow, 'stale')),
+                completedTails: numberOr(own(tailRow, 'completed')),
+                lastAdmissionAt: stringOr(own(admissions, 'last_admission')),
+            },
+        };
+    }
+    catch (error) {
+        const detail = error instanceof Error ? error.message.slice(0, 160) : String(error);
+        return { ok: false, reason: `governance_admission_counts_failed:${detail}`, nextAction: 'Inspect the workspace trajectory.db; the health surface degraded without mutating anything.' };
+    }
+    finally {
+        close();
+    }
+}

package/dist/index.d.ts

@@ -24,6 +24,11 @@ export * from './product-telemetry/eligibility.js';
 export * from './product-telemetry/exporter.js';
 export * from './product-telemetry/milestone-readers.js';
 export * from './product-telemetry/service.js';
+export * from './codex-disclosure.js';
+export * from './codex-ingestion-consent.js';
+export * from './codex-worker-status.js';
+export * from './codex-legacy-registration.js';
+export * from './codex-transcript-locate.js';
 export declare const HOST_RUNTIME_ROUTES: readonly ['before_prompt_build', 'before_tool_call', 'after_tool_call'];
 export type HostRuntimeRoute = (typeof HOST_RUNTIME_ROUTES)[number];
 export type HostRuntimePort = (event: HostEvent) => HostEventResult | Promise<HostEventResult>;

package/dist/index.js

@@ -33,6 +33,20 @@ export * from './product-telemetry/eligibility.js';
 export * from './product-telemetry/exporter.js';
 export * from './product-telemetry/milestone-readers.js';
 export * from './product-telemetry/service.js';
+// PRI-625 Slice D: Codex conversation-ingestion consent — G2A frozen
+// disclosure SSoT constant + workspace consent record (governance layer; the
+// runtime gate remains the feature flag alone).
+export * from './codex-disclosure.js';
+export * from './codex-ingestion-consent.js';
+// PRI-625 Slice D: ONE §15 worker-mode authority, moved from codex-adapter so
+// the CLI, the Console, and the worker share the same semantics.
+export * from './codex-worker-status.js';
+// PRI-625 Slice D: ONE legacy-registration predicate (installer refusal,
+// health dualRegistration, and future setup flows all read the same fact).
+export * from './codex-legacy-registration.js';
+// PRI-625 Slice D: transcript locator moved here so the §15 health service
+// computes per-rollout lag with the SAME locator the catch-up path uses.
+export * from './codex-transcript-locate.js';
 export const HOST_RUNTIME_ROUTES = [
     'before_prompt_build',
     'before_tool_call',

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@principles/host-runtime",
-  "version": "0.3.3",
+  "version": "0.3.4",
   "description": "Shared host-neutral orchestration for Principles Disciple MVP-Core hook paths.",
   "type": "module",
   "main": "./dist/index.js",