@principles/host-runtime 0.7.14 → 0.8.0

package/dist/prompt-activation-deliverability.js

@@ -0,0 +1,176 @@
+import fs from 'node:fs';
+import path from 'node:path';
+import { RUNTIME_V2_PRINCIPLE_BUDGET, SqliteConnection, SqlitePIArtifactStore, computeFeatureFlagsFromConfig, listEntryLine, renderPrinciplesToDirectives, resolvePrincipleFromArtifact, trimToBudget, } from '@principles/core/runtime-v2';
+import { escapeXml } from '@principles/core/prompt-builder';
+import { loadPdConfigForPlugin } from './pd-config.js';
+import { PROMPT_INJECTION_UNIT, promptRouteForHost, resolvePromptInjectionRouteDecision, } from './prompt-injection-projection.js';
+function syntheticPendingActivation(artifactId) {
+    return {
+        activationId: `pending:${artifactId}`,
+        idempotencyKey: `pending:${artifactId}::prompt`,
+        artifactId,
+        channel: 'prompt',
+        action: 'prompt_activate',
+        targetRef: `pending://${artifactId}`,
+        activatedAt: new Date(0).toISOString(),
+        deactivatedAt: null,
+    };
+}
+/** Resolve the REAL principle identity + text from the artifact content. */
+export function resolvePromptCandidatePrinciple(artifact) {
+    return resolvePrincipleFromArtifact({
+        artifact_id: artifact.artifactId,
+        artifact_kind: artifact.artifactKind,
+        content_json: artifact.contentJson,
+        validation_status: artifact.validationStatus,
+    }, syntheticPendingActivation(artifact.artifactId));
+}
+function selfReportEnabledFor(workspaceDir) {
+    return computeFeatureFlagsFromConfig(loadPdConfigForPlugin(workspaceDir).effective).flags.principle_receipt_self_report?.enabled === true;
+}
+/**
+ * Positive single-item evidence under a given route, using the production
+ * selector itself (AC-06: a row is "fits" because its own serialized entry
+ * fits — never because it is absent from a bounded diagnostic list).
+ *
+ * `costChars` is what the single-entry selection would consume, measured the
+ * same way the route's projection reports `usedChars` (the joined selected
+ * lines). For an entry that does NOT fit, trimToBudget returns only the
+ * header line, so the would-be cost is reconstructed from the header line it
+ * DID return plus the real entry line (same format authority, listEntryLine).
+ */
+export function computePromptSingleItemFit(input) {
+    if (input.route === 'shared_render') {
+        const render = renderPrinciplesToDirectives([input.principle], new Set([input.principle.principleId]), { escapeFn: escapeXml, selfReportInstruction: input.selfReportEnabled });
+        return { fits: render.length <= RUNTIME_V2_PRINCIPLE_BUDGET, costChars: render.length };
+    }
+    const trimmed = trimToBudget([input.principle], RUNTIME_V2_PRINCIPLE_BUDGET, escapeXml);
+    const fits = trimmed.injectedIds.has(input.principle.principleId);
+    const costChars = trimmed.lines.length > 1
+        ? trimmed.lines.join('\n').length
+        : (trimmed.lines[0]?.length ?? 0) + 1 + listEntryLine(input.principle, escapeXml).length;
+    return { fits, costChars };
+}
+const UNDELIVERABLE_NEXT_ACTION = 'shorten the principle statement and resubmit, or use the activations page "modify to injectable version" entry to create a replacement artifact (the approval facts are preserved)';
+/**
+ * Precheck one artifact against the workspace's effective injection route.
+ * Pure read — no state mutation, safe to call before any governance write.
+ */
+export async function checkPromptArtifactDeliverability(input) {
+    if (!input.artifact) {
+        return {
+            status: 'unconfirmed',
+            reason: 'artifact_unavailable: artifact could not be read from the store',
+            nextAction: 'check pi_artifacts for the approval artifact, then retry',
+        };
+    }
+    const resolved = resolvePromptCandidatePrinciple(input.artifact);
+    if (!resolved.ok) {
+        return {
+            status: 'unconfirmed',
+            reason: `artifact_content_unresolved: ${resolved.warning}`,
+            nextAction: 'fix the artifact content (kind/validation/principleId/statement), then retry',
+        };
+    }
+    const selfReportEnabled = selfReportEnabledFor(input.workspaceDir);
+    const decision = resolvePromptInjectionRouteDecision({
+        workspaceDir: input.workspaceDir,
+        targetHost: input.targetHost,
+    });
+    if (decision.status === 'confirmed' && decision.route !== undefined) {
+        const { fits, costChars } = computePromptSingleItemFit({
+            principle: resolved.principle,
+            route: decision.route,
+            selfReportEnabled,
+        });
+        const budgetScope = decision.route === 'shared_render'
+            ? 'full_directive_context'
+            : 'selected_lines';
+        if (fits) {
+            return {
+                status: 'deliverable',
+                route: decision.route,
+                ...(decision.hostKind !== undefined ? { hostKind: decision.hostKind } : {}),
+                ...(decision.basis !== undefined ? { basis: decision.basis } : {}),
+                budget: RUNTIME_V2_PRINCIPLE_BUDGET,
+                costChars,
+                budgetScope,
+                unit: PROMPT_INJECTION_UNIT,
+            };
+        }
+        return {
+            status: 'undeliverable',
+            reason: 'single_item_exceeds_budget',
+            route: decision.route,
+            ...(decision.hostKind !== undefined ? { hostKind: decision.hostKind } : {}),
+            ...(decision.basis !== undefined ? { basis: decision.basis } : {}),
+            budget: RUNTIME_V2_PRINCIPLE_BUDGET,
+            costChars,
+            overByChars: costChars - RUNTIME_V2_PRINCIPLE_BUDGET,
+            budgetScope,
+            unit: PROMPT_INJECTION_UNIT,
+            nextAction: UNDELIVERABLE_NEXT_ACTION,
+        };
+    }
+    // Route unconfirmed: report per-host fit for every standard host instead of
+    // guessing (R-A1) — the write gate refuses, the UI can show both facts.
+    const hosts = ['openclaw', 'codex'];
+    const perHost = hosts.map((hostKind) => {
+        const route = promptRouteForHost(hostKind, decision.flagEnabled);
+        const { fits, costChars } = computePromptSingleItemFit({
+            principle: resolved.principle,
+            route,
+            selfReportEnabled,
+        });
+        return { hostKind, fits, costChars };
+    });
+    return {
+        status: 'unconfirmed',
+        reason: `route_unconfirmed: ${decision.unconfirmedReason ?? 'effective injection route cannot be confirmed'}`,
+        nextAction: decision.nextAction ?? 'pass an explicit target host (openclaw|codex)',
+        perHost,
+    };
+}
+/** Load one artifact read-only from `<workspace>/.pd/state.db`. Failures carry a reason (rc-9). */
+export async function loadPromptArtifactById(workspaceDir, artifactId) {
+    const stateDbPath = path.join(workspaceDir, '.pd', 'state.db');
+    if (!fs.existsSync(stateDbPath)) {
+        return { ok: false, reason: `activation_db_not_found: ${stateDbPath}; nextAction=initialize_workspace_runtime_state` };
+    }
+    let connection;
+    try {
+        connection = new SqliteConnection({ workspaceDir, readonly: true, bootstrapIfMissing: false });
+        const record = await new SqlitePIArtifactStore(connection).getArtifactById(artifactId);
+        if (record) {
+            return {
+                ok: true,
+                artifact: {
+                    artifactId: record.artifactId,
+                    artifactKind: record.artifactKind,
+                    contentJson: record.contentJson,
+                    validationStatus: record.validationStatus,
+                },
+            };
+        }
+        return { ok: false, reason: `artifact_not_found: artifactId=${artifactId}; nextAction=check_pi_artifacts_table` };
+    }
+    catch (error) {
+        const message = error instanceof Error ? error.message : String(error);
+        return { ok: false, reason: `artifact_read_failed: ${message}; nextAction=check_workspace_pd_state_db` };
+    }
+    finally {
+        connection?.close();
+    }
+}
+/** Combined load + precheck for write gates that only hold an artifact id (CLI approve). */
+export async function checkPromptArtifactDeliverabilityById(input) {
+    const loaded = await loadPromptArtifactById(input.workspaceDir, input.artifactId);
+    if (!loaded.ok) {
+        return {
+            status: 'unconfirmed',
+            reason: loaded.reason,
+            nextAction: 'fix the artifact store readability, then retry the approval',
+        };
+    }
+    return checkPromptArtifactDeliverability({ ...input, artifact: loaded.artifact });
+}

package/dist/prompt-injection-event-evidence.d.ts

@@ -0,0 +1,51 @@
+/**
+ * PD_PROMPT_CAPACITY_V1 Phase C / AC-12: read-model over the EXISTING
+ * injection-event JSONL (`<stateDir>/logs/events_<date>.jsonl`, written by the
+ * OpenClaw EventLog and the Codex shared path via appendEventLogLine).
+ *
+ * Honesty rules this model enforces (SPEC §6):
+ * - NO logs ≠ zero injections: an activation with no events is simply absent
+ *   from `rows`; the caller reports "unknown", never "0 proven injections".
+ * - Duplicate lines (identical serialized payloads — rollover/replay) count
+ *   once; the dedupe count is reported, not hidden.
+ * - Statistics never mix entities: rows are keyed by (workspaceDir,
+ *   activationId); the same runId across different workspaces/sessions stays
+ *   separate.
+ * - Old events missing identity fields (runId) still count as injection FACTS
+ *   but flag `runIdComplete` false — the numbers degrade to "known counts,
+ *   incomplete binding", never to zero.
+ * - Model self-report (principle_applications kind self_reported) is a
+ *   separate signal and is deliberately NOT read here: self-report ≠
+ *   compliance.
+ *
+ * Untrusted input discipline: every line is parsed as `unknown` and narrowed
+ * with typeof guards (rc-1..rc-5); structurally invalid lines are counted in
+ * `parseFailures` and skipped loudly, never guessed (rc-3).
+ */
+export interface InjectionEvidenceRow {
+    workspaceDir: string;
+    activationId: string;
+    hostKind: 'openclaw' | 'codex' | 'unknown';
+    hostIdentityComplete: boolean;
+    eventIdentityComplete: boolean;
+    /** Deduplicated injection facts: this activation appeared in the injected set. */
+    provenInjections: number;
+    /** Raw matching events before dedupe. */
+    rawEventCount: number;
+    duplicateEventsDeduped: number;
+    sessions: string[];
+    runIds: string[];
+    /** False when any counted event lacked runId (old events / hosts without turn ids). */
+    runIdComplete: boolean;
+    lastEventAt: string | null;
+}
+export interface InjectionEventEvidenceReport {
+    filesRead: string[];
+    lines: number;
+    parseFailures: number;
+    rows: InjectionEvidenceRow[];
+    note: string;
+}
+export declare function readInjectionEventEvidence(input: {
+    stateDir: string;
+}): InjectionEventEvidenceReport;

package/dist/prompt-injection-event-evidence.js

@@ -0,0 +1,141 @@
+import fs from 'node:fs';
+import path from 'node:path';
+function isRecord(value) {
+    return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
+function nonEmptyString(value) {
+    return typeof value === 'string' && value.length > 0 ? value : undefined;
+}
+export function readInjectionEventEvidence(input) {
+    const logsRoot = path.resolve(input.stateDir, 'logs');
+    const filesRead = [];
+    if (!fs.existsSync(logsRoot)) {
+        return {
+            filesRead,
+            lines: 0,
+            parseFailures: 0,
+            rows: [],
+            note: 'no_logs: the injection-event log directory does not exist — injection/coverage numbers are UNKNOWN, not zero',
+        };
+    }
+    const files = fs.readdirSync(logsRoot)
+        .filter((name) => name.startsWith('events_') && name.endsWith('.jsonl'))
+        .sort();
+    let lines = 0;
+    let parseFailures = 0;
+    // Rows are separated by workspace, host, and activation. Old hostless events
+    // remain in an explicit unknown bucket and cannot merge with either host.
+    const rows = new Map();
+    for (const name of files) {
+        // Containment guard: only bare event filenames inside the resolved logs
+        // root are ever read — a crafted name cannot escape the directory.
+        const filePath = path.resolve(logsRoot, name);
+        if (!filePath.startsWith(logsRoot + path.sep) || path.basename(name) !== name)
+            continue;
+        filesRead.push(filePath);
+        const raw = fs.readFileSync(filePath, 'utf8');
+        for (const line of raw.split('\n')) {
+            if (line.trim().length === 0)
+                continue;
+            lines += 1;
+            let parsed;
+            try {
+                parsed = JSON.parse(line);
+            }
+            catch {
+                parseFailures += 1;
+                continue;
+            }
+            if (!isRecord(parsed)) {
+                parseFailures += 1;
+                continue;
+            }
+            if (nonEmptyString(parsed.type) !== 'runtime_v2_prompt_activations_injected')
+                continue;
+            const ts = nonEmptyString(parsed.ts) ?? null;
+            const { data } = parsed;
+            if (!isRecord(data)) {
+                parseFailures += 1;
+                continue;
+            }
+            const workspaceDir = nonEmptyString(data.workspaceDir);
+            const sessionId = nonEmptyString(data.sessionId) ?? nonEmptyString(parsed.sessionId);
+            const runId = nonEmptyString(data.runId);
+            const eventId = nonEmptyString(data.eventId);
+            const rawHostKind = data.hostKind;
+            const hostKind = rawHostKind === 'openclaw' || rawHostKind === 'codex' ? rawHostKind : 'unknown';
+            const { activationIds } = data;
+            if (workspaceDir === undefined || sessionId === undefined || !Array.isArray(activationIds)
+                || !activationIds.every((id) => typeof id === 'string')) {
+                // rc-3/rc-4: identity binding incomplete → loud skip, never a guess.
+                parseFailures += 1;
+                continue;
+            }
+            const dedupeKey = eventId !== undefined
+                ? JSON.stringify(['event', hostKind, eventId])
+                : JSON.stringify(['legacy', hostKind, workspaceDir, sessionId, runId ?? null, ts, activationIds.join(','), data.injectedCharCount, data.selectionPolicy ?? null, data.rotationStartIndex ?? null]);
+            for (const activationId of activationIds) {
+                const rowKey = JSON.stringify([workspaceDir, hostKind, activationId]);
+                let row = rows.get(rowKey);
+                if (row === undefined) {
+                    row = {
+                        workspaceDir,
+                        activationId,
+                        hostKind,
+                        hostIdentityComplete: hostKind !== 'unknown',
+                        eventIdentityComplete: true,
+                        provenInjections: 0,
+                        rawEventCount: 0,
+                        duplicateEventsDeduped: 0,
+                        sessions: [],
+                        runIds: [],
+                        runIdComplete: true,
+                        lastEventAt: null,
+                        seen: new Set(),
+                    };
+                    rows.set(rowKey, row);
+                }
+                row.rawEventCount += 1;
+                if (hostKind === 'unknown')
+                    row.hostIdentityComplete = false;
+                if (eventId === undefined)
+                    row.eventIdentityComplete = false;
+                if (!row.seen.has(dedupeKey)) {
+                    row.seen.add(dedupeKey);
+                    row.provenInjections += 1;
+                    if (!row.sessions.includes(sessionId))
+                        row.sessions.push(sessionId);
+                    if (runId !== undefined && !row.runIds.includes(runId))
+                        row.runIds.push(runId);
+                    if (ts !== null && (row.lastEventAt === null || ts > row.lastEventAt))
+                        row.lastEventAt = ts;
+                }
+                else {
+                    row.duplicateEventsDeduped += 1;
+                }
+                if (runId === undefined)
+                    row.runIdComplete = false;
+            }
+        }
+    }
+    return {
+        filesRead,
+        lines,
+        parseFailures,
+        rows: [...rows.values()].map((row) => ({
+            workspaceDir: row.workspaceDir,
+            activationId: row.activationId,
+            hostKind: row.hostKind,
+            hostIdentityComplete: row.hostIdentityComplete,
+            eventIdentityComplete: row.eventIdentityComplete,
+            provenInjections: row.provenInjections,
+            rawEventCount: row.rawEventCount,
+            duplicateEventsDeduped: row.duplicateEventsDeduped,
+            sessions: row.sessions,
+            runIds: row.runIds,
+            runIdComplete: row.runIdComplete,
+            lastEventAt: row.lastEventAt,
+        })),
+        note: 'absence from rows means UNKNOWN (no logs), never zero; self-report is a separate signal and is not compliance evidence; rows never merge workspaces',
+    };
+}

package/dist/prompt-injection-projection.d.ts

@@ -1,7 +1,69 @@
 import { type PromptSelectionPolicy } from '@principles/core/runtime-v2';
+/** Hosts with a production prompt-injection path today (shared GovernanceHostKind boundary). */
+export type PromptInjectionTargetHost = 'openclaw' | 'codex';
+export declare const PROMPT_INJECTION_TARGET_HOSTS: readonly PromptInjectionTargetHost[];
+export type PromptInjectionRouteName = 'legacy_trim' | 'shared_render';
+/**
+ * Which serialization the budget is charged against (SPEC R-A2): the legacy
+ * list route bills only the selected `- [id] text` lines (the directive
+ * wrapper and the self-report footer live OUTSIDE that budget on that route),
+ * while the shared route bills the full rendered directive context including
+ * wrapper and footer. Both are UTF-16 code units (`String.prototype.length`).
+ */
+export type PromptInjectionBudgetScope = 'selected_lines' | 'full_directive_context';
+export declare const PROMPT_INJECTION_UNIT: 'utf16_code_units';
+/**
+ * AC-01: the effective injection route is a fact about WHICH HOST will run
+ * the prompt build, not about the workspace flag alone. Codex always injects
+ * through the shared route (`codex-adapter/src/pd-hook.ts`); OpenClaw routes
+ * by its `abstraction_layer_v1` gate (`openclaw-plugin/src/index.ts`). Host
+ * facts come from the existing durable provenance (declarations ∪ pain
+ * evidence — `readWorkspaceHostKindFacts`); an explicit request-level target
+ * overrides them. When the applicable hosts disagree (flag OFF + both hosts
+ * possible, or no host facts at all) the decision is `unconfirmed` and every
+ * consumer must say so instead of guessing FIFO or rotation (SPEC R-A1).
+ */
+export interface PromptInjectionRouteDecision {
+    status: 'confirmed' | 'unconfirmed';
+    /** Present when status === 'confirmed' AND a single host is bound. */
+    hostKind?: PromptInjectionTargetHost;
+    /** Present when status === 'confirmed'. */
+    route?: PromptInjectionRouteName;
+    basis?: 'explicit_target' | 'workspace_host_facts' | 'flag_shared_all_hosts';
+    /** Present when explicit binding succeeds while workspace-wide host facts are unreadable. */
+    hostFactsStatus?: 'unreadable';
+    /** Raw `abstraction_layer_v1` flag state (context for the OpenClaw branch). */
+    flagEnabled: boolean;
+    declaredHostKinds: readonly string[];
+    effectiveHostKinds: readonly string[];
+    /** Present when status === 'unconfirmed'. */
+    unconfirmedReason?: string;
+    /** Present when status === 'unconfirmed'. */
+    nextAction?: string;
+    /** Route each standard host WOULD take (context for unconfirmed decisions). */
+    perHost?: readonly {
+        hostKind: PromptInjectionTargetHost;
+        route: PromptInjectionRouteName;
+    }[];
+}
+/**
+ * THE one route formula (P4): Codex always injects through the shared route
+ * (codex-adapter has no flag branch); OpenClaw routes by its
+ * `abstraction_layer_v1` gate. Every consumer that needs "which route would
+ * host X take" must call this — never re-type the ternary.
+ */
+export declare function promptRouteForHost(hostKind: PromptInjectionTargetHost, flagEnabled: boolean): PromptInjectionRouteName;
+/**
+ * Resolve the effective route for this workspace. Pure read of existing
+ * config + provenance facts — no new registry, no persisted state.
+ */
+export declare function resolvePromptInjectionRouteDecision(input: {
+    workspaceDir: string;
+    targetHost?: PromptInjectionTargetHost;
+}): PromptInjectionRouteDecision;
 export interface PromptInjectionProjection {
-    /** Which real injection route the workspace is on (abstraction_layer_v1 flag). */
-    route: 'legacy_trim' | 'shared_render';
+    /** Which real injection route THIS projection ran (explicit target or flag). */
+    route: PromptInjectionRouteName;
     budget: number;
     /**
      * Char count the REAL prompt path would consume: legacy route counts the
@@ -46,19 +108,48 @@ export interface PromptInjectionProjection {
      * or starved. They differ exactly in the case this whole fix is about.
      */
     productionRotates: boolean;
+    /** R-A2: the unit `usedChars`/`budget` are counted in. */
+    unit: typeof PROMPT_INJECTION_UNIT;
+    /** R-A2: which serialization the budget is charged against on this route. */
+    budgetScope: PromptInjectionBudgetScope;
+    /**
+     * R-A3: activation ids whose own entry cannot fit the budget even in an
+     * empty payload, independent of `truncated` (bounded diagnostic list —
+     * absence from a capped list is NOT evidence of fitting; see
+     * `oversizedDiagnosticTruncated`).
+     */
+    oversizedActivationIds: string[];
+    /** R-A3: activation ids dropped for insufficient remaining budget (bounded). */
+    droppedActivationIds: string[];
+    /** True when a bounded diagnostic list hit its cap — more ids may exist. */
+    oversizedDiagnosticTruncated: boolean;
+    droppedDiagnosticTruncated: boolean;
+    /**
+     * R-A2 (list route only): length of the FULL directive render of the
+     * injected set under the workspace self-report flag — the whole PD output
+     * block, NOT the host request and NOT tokens. Undefined on the shared
+     * route (where `usedChars` already IS the full render).
+     */
+    fullRenderChars?: number;
 }
 /**
  * PR #1844 follow-up: forecast the prompt-injection budget from the SAME
- * projection the agent injection itself uses, routed by the same
- * `abstraction_layer_v1` flag the OpenClaw plugin's runtime gate reads:
+ * projection the agent injection itself uses:
+ *
+ * - legacy route: activation candidates from `readPromptActivationCandidates`
+ *   (same FIFO query + artifact resolve as the plugin's list path) trimmed by
+ *   the REAL `trimToBudget` — identical input × ordering × trim logic as
+ *   `openclaw-plugin/src/hooks/prompt.ts`;
+ * - shared route: delegate to `buildActivePrinciplePromptContext`, which IS
+ *   the production shared path's projection source (Codex always; OpenClaw
+ *   when its `abstraction_layer_v1` gate is on).
  *
- * - legacy route (live default, flag OFF): activation candidates from
- *   `readPromptActivationCandidates` (same FIFO query + artifact resolve as
- *   the plugin's `PromptActivationReader`) trimmed by the REAL
- *   `trimToBudget` — identical input × ordering × trim logic as
- *   `openclaw-plugin/src/hooks/prompt.ts`.
- * - shared route (flag ON): delegate to `buildActivePrinciplePromptContext`,
- *   which IS the production shared path's projection source.
+ * Route selection here is EXPLICIT: `targetHost: 'codex'` forces the shared
+ * route (production truth for Codex), `targetHost: 'openclaw'` follows the
+ * workspace flag, and no target follows the flag (the historical behavior —
+ * callers that lack host context should prefer
+ * `resolveLivePromptInjectionProjection`, which binds the route to real host
+ * facts and refuses to guess).
  *
  * Known conservative gap: the plugin's legacy route additionally dedups
  * candidates against the legacy evolution ledger before trimming; the
@@ -66,14 +157,13 @@ export interface PromptInjectionProjection {
  * forecast slightly MORE consumption than the real injection (never less).
  *
  * PR-1894 — round-key alignment. The plugin derives its fair-rotation round
- * key from the CURRENT session's turn ordinal
- * (`nextSessionTurnOrdinal`), which the console has no access to. Passing no
- * key therefore does NOT make the forecast "more conservative": it selects a
- * DIFFERENT policy (`legacy_fifo_prefix_v1`) than the one production runs, and
- * legacy FIFO structurally excludes the newest activation from every
- * truncated selection. The console must either supply the round key or
- * report the policy honestly, so this function takes the key as an explicit
- * input and exposes `selectionPolicy` on the result.
+ * key from the CURRENT session's turn ordinal (`nextSessionTurnOrdinal`),
+ * which the console has no access to. Passing no key therefore does NOT make
+ * the forecast "more conservative": it selects a DIFFERENT policy
+ * (`legacy_fifo_prefix_v1`) than the one production runs. The console must
+ * either supply the round key or report the policy honestly, so this
+ * function takes the key as an explicit input and exposes
+ * `selectionPolicy` on the result.
  */
 export declare function buildLivePromptInjectionProjection(input: {
     workspaceDir: string;
@@ -85,4 +175,30 @@ export declare function buildLivePromptInjectionProjection(input: {
      * rather than assuming FIFO.
      */
     roundKey?: number;
+    /** AC-01: explicit route binding — 'codex' always shared, 'openclaw' by flag. */
+    targetHost?: PromptInjectionTargetHost;
 }): Promise<PromptInjectionProjection>;
+/**
+ * AC-01/R-A1: the host-aware entry every console/CLI consumer should use.
+ * Binds the route to real host facts (or an explicit request-level target)
+ * and returns either one confirmed projection or an honest `unconfirmed`
+ * result carrying per-host forecasts — never a guessed route.
+ */
+export type LivePromptInjectionProjectionResolution = {
+    status: 'confirmed';
+    decision: PromptInjectionRouteDecision;
+    projection: PromptInjectionProjection;
+} | {
+    status: 'unconfirmed';
+    decision: PromptInjectionRouteDecision;
+    perHost: readonly {
+        hostKind: PromptInjectionTargetHost;
+        projection: PromptInjectionProjection;
+    }[];
+};
+export declare function resolveLivePromptInjectionProjection(input: {
+    workspaceDir: string;
+    targetHost?: PromptInjectionTargetHost;
+    excludePrincipleIds?: ReadonlySet<string>;
+    roundKey?: number;
+}): Promise<LivePromptInjectionProjectionResolution>;