@principles/host-runtime 0.7.4 → 0.7.6

package/dist/host-liveness-contract.d.ts

@@ -1,3 +1,60 @@
 import type { HostLivenessContract } from '@principles/core/runtime-v2';
 /** Adapter-owned facts consumed by the non-bypassable RuleCode promotion gate. */
 export declare const OPENCLAW_HOST_LIVENESS_CONTRACT: HostLivenessContract;
+export type PromotionHostLivenessResolution = {
+    ok: true;
+    hostKind: 'openclaw';
+    /**
+     * The workspace host DECLARATIONS this resolution is based on.
+     * Empty array = nothing declared yet (the OpenClaw contract is the
+     * documented historical default; review S3: callers can distinguish an
+     * undeclared workspace from a declared-OpenClaw one);
+     * `['openclaw']` = the OpenClaw host actually declared itself.
+     */
+    hostKinds: readonly string[];
+    hostContract: HostLivenessContract;
+    hostRuntimeVersion: string;
+} | {
+    ok: false;
+    /** Stable machine-readable fail-closed reason (also surfaced as the hostRuntimeVersion marker in failure snapshots / capability reporting). */
+    reason: 'host_declarations_unreadable' | 'workspace_provenance_unreadable' | 'promotion_host_unsupported' | 'multi_host_promotion_ambiguous' | 'host_declaration_missing_for_configured_host';
+    hostKinds: readonly string[];
+    hostContract: null;
+    hostRuntimeVersion: null;
+    nextAction: string;
+};
+/**
+ * PRI-813: resolve the promotion host-liveness contract from the workspace's
+ * REAL host state instead of unconditionally inheriting the OpenClaw
+ * contract (which made Codex workspaces report runtime_compatibility /
+ * runtime_shadow_evidence as passed — a false capability claim; the promotion
+ * then only ever failed on sample count, hiding the unsupported truth).
+ *
+ * Two durable provenance sources, cross-checked (Owner review round-4):
+ * 1. host declarations — `.pd/host-tool-semantics/<hostKind>.json`;
+ * 2. trajectory.db `pain_events.host_kind` — which hosts actually produced
+ *    governance evidence here (survives declaration deletion).
+ *
+ * Resolution rules (fail closed outside the one host with an approved
+ * capability authority, and fail closed whenever Codex evidence exists but
+ * its declaration is missing — never silently fall back to OpenClaw):
+ * - no declaration AND no Codex evidence → OpenClaw contract (the historical
+ *   governance default; a workspace where only OpenClaw ever ran — or no
+ *   host ran — is exactly the legacy state, and existing workspaces rely
+ *   on it);
+ * - only openclaw declared and no Codex evidence → OPENCLAW_HOST_LIVENESS_CONTRACT;
+ * - codex declared (alone) → promotion_host_unsupported (Codex promotion
+ *   stays explicitly unsupported until an evidence-backed capability
+ *   authority decision exists — no second host contract here);
+ * - multiple hosts declared → multi_host_promotion_ambiguous (never guess a
+ *   target host; the Owner decides host-selection policy separately);
+ * - Codex evidence present but codex.json missing (deleted/corrupted —
+ *   alone or alongside openclaw.json) → host_declaration_missing_for_configured_host
+ *   (re-persist the declaration before promoting);
+ * - declarations or provenance unreadable → fail closed with the reason.
+ *
+ * This function intentionally creates no Codex contract, no capability
+ * registry, and no new store — it only routes the existing single authority
+ * truthfully over state that already exists.
+ */
+export declare function resolvePromotionHostLiveness(workspaceDir: string): PromotionHostLivenessResolution;

package/dist/host-liveness-contract.js

@@ -1,3 +1,7 @@
+import fs from 'node:fs';
+import path from 'node:path';
+import Database from 'better-sqlite3';
+import { loadHostToolDeclarations } from './host-tool-declaration.js';
 /** Adapter-owned facts consumed by the non-bypassable RuleCode promotion gate. */
 export const OPENCLAW_HOST_LIVENESS_CONTRACT = {
     version: 'openclaw-legacy@1',
@@ -16,3 +20,125 @@ export const OPENCLAW_HOST_LIVENESS_CONTRACT = {
         { probeId: 'probe-owner-review', capabilityId: 'owner_review_access', toolName: 'owner_review_access', params: {}, expectedDecision: 'allow' },
     ],
 };
+/**
+ * Existing durable provenance (Owner review round-4): `trajectory.db`
+ * `pain_events.host_kind` records which host actually produced governance
+ * evidence in this workspace ('codex' rows are written by the Codex
+ * ingestion/admission path). It survives deletion of
+ * `.pd/host-tool-semantics/<hostKind>.json`, which is exactly the
+ * declaration-lost state a silent OpenClaw fallback would misread.
+ * Absent file = no evidence (normal for quiet workspaces). A pain_events
+ * table predating the host_kind column carries no host evidence BY
+ * CONSTRUCTION (nothing could have been recorded before the column existed)
+ * — equivalent to empty, not unreadable. Read-only, never mutates state.
+ */
+function readWorkspaceHostProvenance(workspaceDir) {
+    const dbPath = path.join(workspaceDir, '.state', 'trajectory.db');
+    if (!fs.existsSync(dbPath))
+        return { ok: true, kinds: [] };
+    let db;
+    try {
+        db = new Database(dbPath, { readonly: true });
+    }
+    catch (error) {
+        return { ok: false, nextAction: `inspect the workspace trajectory database before promoting: ${error instanceof Error ? error.message : String(error)}` };
+    }
+    try {
+        const columns = db.prepare('PRAGMA table_info(pain_events)').all();
+        const hasHostKindColumn = Array.isArray(columns)
+            && columns.some((column) => typeof column === 'object' && column !== null && column.name === 'host_kind');
+        if (!hasHostKindColumn)
+            return { ok: true, kinds: [] };
+        const rows = db.prepare('SELECT DISTINCT host_kind FROM pain_events WHERE host_kind IS NOT NULL').all();
+        if (!Array.isArray(rows)) {
+            return { ok: false, nextAction: 'inspect the workspace trajectory database pain_events integrity before promoting' };
+        }
+        const kinds = rows
+            .filter((row) => typeof row === 'object' && row !== null)
+            .map(row => row.host_kind)
+            .filter((kind) => typeof kind === 'string');
+        return { ok: true, kinds };
+    }
+    catch (error) {
+        return { ok: false, nextAction: `inspect the workspace trajectory database (locked, or damaged pain_events table) before promoting: ${error instanceof Error ? error.message : String(error)}` };
+    }
+    finally {
+        try {
+            db.close();
+        }
+        catch { /* best effort */ }
+    }
+}
+function promotionHostFailure(reason, hostKinds, nextAction) {
+    return { ok: false, reason, hostKinds, hostContract: null, hostRuntimeVersion: null, nextAction };
+}
+/**
+ * PRI-813: resolve the promotion host-liveness contract from the workspace's
+ * REAL host state instead of unconditionally inheriting the OpenClaw
+ * contract (which made Codex workspaces report runtime_compatibility /
+ * runtime_shadow_evidence as passed — a false capability claim; the promotion
+ * then only ever failed on sample count, hiding the unsupported truth).
+ *
+ * Two durable provenance sources, cross-checked (Owner review round-4):
+ * 1. host declarations — `.pd/host-tool-semantics/<hostKind>.json`;
+ * 2. trajectory.db `pain_events.host_kind` — which hosts actually produced
+ *    governance evidence here (survives declaration deletion).
+ *
+ * Resolution rules (fail closed outside the one host with an approved
+ * capability authority, and fail closed whenever Codex evidence exists but
+ * its declaration is missing — never silently fall back to OpenClaw):
+ * - no declaration AND no Codex evidence → OpenClaw contract (the historical
+ *   governance default; a workspace where only OpenClaw ever ran — or no
+ *   host ran — is exactly the legacy state, and existing workspaces rely
+ *   on it);
+ * - only openclaw declared and no Codex evidence → OPENCLAW_HOST_LIVENESS_CONTRACT;
+ * - codex declared (alone) → promotion_host_unsupported (Codex promotion
+ *   stays explicitly unsupported until an evidence-backed capability
+ *   authority decision exists — no second host contract here);
+ * - multiple hosts declared → multi_host_promotion_ambiguous (never guess a
+ *   target host; the Owner decides host-selection policy separately);
+ * - Codex evidence present but codex.json missing (deleted/corrupted —
+ *   alone or alongside openclaw.json) → host_declaration_missing_for_configured_host
+ *   (re-persist the declaration before promoting);
+ * - declarations or provenance unreadable → fail closed with the reason.
+ *
+ * This function intentionally creates no Codex contract, no capability
+ * registry, and no new store — it only routes the existing single authority
+ * truthfully over state that already exists.
+ */
+export function resolvePromotionHostLiveness(workspaceDir) {
+    const loaded = loadHostToolDeclarations(workspaceDir);
+    if (!loaded.ok && loaded.reason !== 'host_tool_declaration_missing') {
+        return promotionHostFailure('host_declarations_unreadable', [], `repair the host tool declarations before promoting: ${loaded.reason} (${loaded.nextAction})`);
+    }
+    const declaredKinds = loaded.ok
+        ? [...new Set(loaded.declarations.map(declaration => declaration.hostKind))].sort()
+        : [];
+    const provenance = readWorkspaceHostProvenance(workspaceDir);
+    if (!provenance.ok) {
+        return promotionHostFailure('workspace_provenance_unreadable', declaredKinds, provenance.nextAction);
+    }
+    const provenanceKinds = provenance.kinds.filter(kind => kind === 'openclaw' || kind === 'codex');
+    const effectiveKinds = [...new Set([...declaredKinds, ...provenanceKinds])].sort();
+    // The promotion host can only be the OpenClaw contract when nothing on the
+    // workspace — neither a declaration nor behavioral evidence — says Codex.
+    if (!effectiveKinds.includes('codex')) {
+        return {
+            ok: true,
+            hostKind: 'openclaw',
+            hostKinds: declaredKinds,
+            hostContract: OPENCLAW_HOST_LIVENESS_CONTRACT,
+            hostRuntimeVersion: OPENCLAW_HOST_LIVENESS_CONTRACT.version,
+        };
+    }
+    if (!declaredKinds.includes('codex')) {
+        // Codex evidence exists (declaration gone, or only openclaw.json
+        // remains) — the exact state where a silent OpenClaw fallback would
+        // resurrect the false capability PASS (Owner review round-4).
+        return promotionHostFailure('host_declaration_missing_for_configured_host', effectiveKinds, 'Codex evidence exists in this workspace but .pd/host-tool-semantics/codex.json is missing; re-run the Codex worker so it re-persists its declaration (or deactivate the Codex activation) before promoting');
+    }
+    if (declaredKinds.length > 1) {
+        return promotionHostFailure('multi_host_promotion_ambiguous', effectiveKinds, `the workspace declares multiple hosts (${declaredKinds.join(', ')}); promotion requires an unambiguous governing host — decide the promotion target host first`);
+    }
+    return promotionHostFailure('promotion_host_unsupported', effectiveKinds, `host '${declaredKinds[0]}' has no approved promotion capability authority; promotion on this host is explicitly unsupported until an evidence-backed capability decision exists`);
+}

package/dist/internalization-consumer-cycle.d.ts

@@ -1,3 +1,25 @@
+/**
+ * Shared host-neutral internalization consumer cycle (PRI-624 Slice C).
+ *
+ * Extracted verbatim from openclaw-plugin's
+ * `internalization-auto-consumer-service.ts` `runConsumerCycle` so that the
+ * OpenClaw auto-consumer scheduler and the Companion workspace worker call
+ * ONE downstream execution implementation (SPEC §13: "reusing existing
+ * downstream consumer logic" — the Companion must not copy it):
+ *
+ *   flag gate → config/runtime config → state handle → orchestrator(dryRun)
+ *   → queue read model → consumer decision → wakeOnce loop → adapter
+ *   → runner construction (dreamer…rollout_reviewer) → runner.run
+ *   → commit proposal → finally: recovery sweep + reconciliation budget
+ *
+ * The lease is acquired INSIDE runner.run by the Runtime V2 lease manager
+ * (persisted in `<workspace>/.pd/state.db`, cross-process safe) — this cycle
+ * never leases by itself, so two schedulers (OpenClaw + Companion) racing on
+ * one workspace converge to exactly-once execution via lease_conflict.
+ *
+ * Hosts inject: a logger, a structured-event sink, their tool catalog, and an
+ * env getter. Everything else is the existing production path.
+ */
 import { type ToolSemanticRegistry } from '@principles/core/runtime-v2';
 import { type ConsumerGovernanceLogger } from './internalization-consumer-governance.js';
 export declare const INTERNALIZATION_AUTO_CONSUMER_FLAG_ID = "internalization_auto_consumer";

package/dist/internalization-consumer-cycle.js

@@ -20,7 +20,6 @@
  * Hosts inject: a logger, a structured-event sink, their tool catalog, and an
  * env getter. Everything else is the existing production path.
  */
-import { createHash } from 'node:crypto';
 import { createRuntimeStateHandle, InternalizationOrchestrator, DreamerRunner, PhilosopherRunner, ScribeRunner, ArtificerRunner, buildArtificerHostSemanticContext, EvaluatorRunner, RolloutReviewerRunner, DefaultDreamerValidator, DefaultPhilosopherValidator, DefaultScribeValidator, DefaultArtificerValidator, DefaultEvaluatorValidator, DefaultRolloutReviewerValidator, PiAiRuntimeAdapter, L2AgentLoopAdapter, ArtificerL2Adapter, buildL2PrincipleReaderFromLedger, OpenClawCliRuntimeAdapter, storeEmitter, createProductionGateDeps, resolveRuntimeConfigFromPdConfig, resolveRuntimeConfigForAgent, AGENT_NAME_FOR_TASK_KIND, isRuntimeConfigError, computeConsumerDecision, FULL_CHAIN_CONSUMER_RUNNER_KINDS, DEFAULT_CONSUMER_RUNNER_KINDS, InternalizationQueueReadModel, MVP_CORE_TASK_KINDS, SqliteConnection, SqliteReconciliationCursorStore, SUCCEEDED_TRANSITIONS_SCOPE, 
 // PRI-714: resolve outputLanguage from the same effective config the
 // runners already receive (EP-07: canonical resolved value, not raw input).
@@ -30,9 +29,6 @@ import { loadPdConfigForPlugin, loadFeatureFlagFromConfig } from './pd-config.js
 import { createEvaluatorRepairDeps, createRolloutGovernanceDeps } from './internalization-consumer-governance.js';
 import { WorkspaceTelemetryEmitter } from './workspace-telemetry-emitter.js';
 export const INTERNALIZATION_AUTO_CONSUMER_FLAG_ID = 'internalization_auto_consumer';
-function contentHashFn(text) {
-    return createHash('sha256').update(text).digest('hex');
-}
 function formatRunOnceCommand(workspaceDir) {
     return `pd runtime internalization run-once --workspace "${workspaceDir}" --runner dreamer --runtime config --json`;
 }
@@ -311,6 +307,19 @@ export async function runInternalizationConsumerCycle(workspaceDir, ports) {
         // PRI-719: everything downstream reads the LEASED TASK's resolved config —
         // the kind-specific profile, not the shared gate resolution.
         const taskRuntimeKind = taskRuntimeConfig.runtimeKind;
+        // PRI-634 A3: workspace-scoped telemetry sink. Constructed here (per-wake,
+        // workspaceDir in scope) so events from THIS workspace's runners are
+        // attributable to THIS workspace — a global subscriber on the storeEmitter
+        // singleton cannot (multi-workspace isolation, see
+        // workspace-telemetry-emitter.ts). Persist failures degrade through the
+        // host's structured event port, never break the runner.
+        // PRI-795 review P1: shared by the EvaluatorRunner AND the ArtificerL2
+        // adapter so `artificer_l2_complete` evidence (abortOwner/budget/elapsed/
+        // stopReason/tokenUsage) persists durably instead of vanishing with the
+        // process (the EP002-R3 "nothing recoverable after a failure" class).
+        const workspaceEmitter = new WorkspaceTelemetryEmitter(storeEmitter, workspaceDir, (detail) => {
+            emitEvent('WORKSPACE_TELEMETRY_PERSIST_FAILED', detail);
+        });
         let adapter;
         if (taskRuntimeKind === 'pi-ai') {
             // PRI-419: when l2_dreamer flag is on AND this is a dreamer task, route
@@ -342,6 +351,13 @@ export async function runInternalizationConsumerCycle(workspaceDir, ports) {
                     // PRI-758 CodeRabbit P2: forward maxTokens + systemPrompt from profile.
                     ...(taskRuntimeConfig.maxTokens !== undefined ? { maxTokens: taskRuntimeConfig.maxTokens } : {}),
                     ...(taskRuntimeConfig.systemPrompt ? { systemPrompt: taskRuntimeConfig.systemPrompt } : {}),
+                    // PRI-795: forward the profile reasoning level — the PiAiRuntimeAdapter
+                    // branch below already receives it; the L2 loop was silently dropping
+                    // it, leaving always-thinking models at their most expensive default.
+                    ...(taskRuntimeConfig.reasoning !== undefined ? { reasoning: taskRuntimeConfig.reasoning } : {}),
+                    // PRI-795 review P1: the completion evidence must land in the
+                    // workspace's durable telemetry sink, not the in-process singleton.
+                    eventEmitter: workspaceEmitter,
                 });
             }
             else if (l2Flag.enabled && wakeResult.taskKind === 'dreamer') {
@@ -429,25 +445,24 @@ export async function runInternalizationConsumerCycle(workspaceDir, ports) {
         // subscriber on the storeEmitter singleton cannot (multi-workspace
         // isolation, see workspace-telemetry-emitter.ts). Persist failures
         // degrade through the host's structured event port, never break the runner.
-        const evaluatorEmitter = new WorkspaceTelemetryEmitter(storeEmitter, workspaceDir, (detail) => {
-            emitEvent('WORKSPACE_TELEMETRY_PERSIST_FAILED', detail);
-        });
+        // (PRI-795 review P1: the emitter itself is constructed above, before the
+        // adapter dispatch, so the ArtificerL2 adapter can share it.)
         // Dispatch by leased task kind. Only kinds listed in
         // FULL_CHAIN_CONSUMER_RUNNER_KINDS can be leased here; anything else
         // (e.g. diagnostician) hits the default branch — fail loud if it does (EP-03).
         let runner;
         switch (taskKind) {
             case 'dreamer':
-                runner = new DreamerRunner({ stateManager, runtimeAdapter: adapter, eventEmitter: storeEmitter, artifactStore: stateManager.piArtifactStore, validator: new DefaultDreamerValidator(), contentHashFn }, runnerOptions);
+                runner = new DreamerRunner({ stateManager, runtimeAdapter: adapter, eventEmitter: storeEmitter, artifactStore: stateManager.piArtifactStore, validator: new DefaultDreamerValidator() }, runnerOptions);
                 break;
             case 'philosopher':
-                runner = new PhilosopherRunner({ stateManager, runtimeAdapter: adapter, eventEmitter: storeEmitter, artifactStore: stateManager.piArtifactStore, validator: new DefaultPhilosopherValidator(), contentHashFn }, runnerOptions);
+                runner = new PhilosopherRunner({ stateManager, runtimeAdapter: adapter, eventEmitter: storeEmitter, artifactStore: stateManager.piArtifactStore, validator: new DefaultPhilosopherValidator() }, runnerOptions);
                 break;
             case 'scribe':
-                runner = new ScribeRunner({ stateManager, runtimeAdapter: adapter, eventEmitter: storeEmitter, artifactStore: stateManager.piArtifactStore, validator: new DefaultScribeValidator(), contentHashFn }, runnerOptions);
+                runner = new ScribeRunner({ stateManager, runtimeAdapter: adapter, eventEmitter: storeEmitter, artifactStore: stateManager.piArtifactStore, validator: new DefaultScribeValidator() }, runnerOptions);
                 break;
             case 'artificer':
-                runner = new ArtificerRunner({ stateManager, runtimeAdapter: adapter, eventEmitter: storeEmitter, artifactStore: stateManager.piArtifactStore, validator: new DefaultArtificerValidator(), contentHashFn }, 
+                runner = new ArtificerRunner({ stateManager, runtimeAdapter: adapter, eventEmitter: storeEmitter, artifactStore: stateManager.piArtifactStore, validator: new DefaultArtificerValidator() }, 
                 // PRI-741: thread the host semantic projection into generation.
                 { ...runnerOptions, ...(artificerHostSemanticContext !== undefined ? { hostSemanticContext: artificerHostSemanticContext } : {}) });
                 break;
@@ -466,7 +481,7 @@ export async function runInternalizationConsumerCycle(workspaceDir, ports) {
                 // 无论 OpenClaw 还是 Codex worker 执行, deterministic gate wiring
                 // 必须存在 (第二个 options 参数, 绝不放第一个 deps 参数)。
                 runner = new EvaluatorRunner({
-                    stateManager, runtimeAdapter: adapter, eventEmitter: evaluatorEmitter,
+                    stateManager, runtimeAdapter: adapter, eventEmitter: workspaceEmitter,
                     artifactStore: stateManager.piArtifactStore, validator: new DefaultEvaluatorValidator(),
                     ...createEvaluatorRepairDeps(workspaceDir, stateManager, logger),
                 }, {
@@ -492,9 +507,9 @@ export async function runInternalizationConsumerCycle(workspaceDir, ports) {
                 // authoritative values before validation, so a bad echo no longer
                 // dead-ends the candidate before the approval queue.
                 //
-                // P0-E/F 治理接线: approve_rollout → 自动 ActivationDispatcher (低风险
-                // auto_activate / 高风险 approvals.pending); needs_revision → reopen
-                // scribe/artificer 修订 (绝不进入 approval 队列, INV-04)。
+                // P0-E/F 治理接线: approve_rollout → 自动 ActivationDispatcher (PRI-811
+                // Phase B: 一律 approvals.pending, Owner 批准后才激活); needs_revision →
+                // reopen scribe/artificer 修订 (绝不进入 approval 队列, INV-04)。
                 runner = new RolloutReviewerRunner({
                     stateManager, runtimeAdapter: adapter, eventEmitter: storeEmitter,
                     artifactStore: stateManager.piArtifactStore, validator: new DefaultRolloutReviewerValidator(),

package/dist/internalization-consumer-governance.d.ts

@@ -5,9 +5,9 @@
  * (P0-D/E/F 生产接线) so the OpenClaw auto-consumer and the Companion
  * workspace worker share ONE wiring implementation instead of copying it:
  *   - evaluator: isRepairLoopEnabled + seedArtificerRepairTask (bounded repair)
- *   - rollout_reviewer: dispatchActivation (approve_rollout → ActivationDispatcher,
- *     低风险 auto_activate / 高风险 approvals.pending) + reopenRevisionTarget
- *     (needs_revision → reopen scribe/artificer, 禁止入 approval)
+ *   - rollout_reviewer: dispatchActivation (approve_rollout → ActivationDispatcher;
+ *     PRI-811 Phase B: 一律入 approvals.pending，Owner 批准后才激活) +
+ *     reopenRevisionTarget (needs_revision → reopen scribe/artificer, 禁止入 approval)
  *
  * Everything is assembled from @principles/core stores/dispatchers; the only
  * host knowledge is a structural logger. Idempotency (INV-08): dispatcher

package/dist/internalization-consumer-governance.js

@@ -5,9 +5,9 @@
  * (P0-D/E/F 生产接线) so the OpenClaw auto-consumer and the Companion
  * workspace worker share ONE wiring implementation instead of copying it:
  *   - evaluator: isRepairLoopEnabled + seedArtificerRepairTask (bounded repair)
- *   - rollout_reviewer: dispatchActivation (approve_rollout → ActivationDispatcher,
- *     低风险 auto_activate / 高风险 approvals.pending) + reopenRevisionTarget
- *     (needs_revision → reopen scribe/artificer, 禁止入 approval)
+ *   - rollout_reviewer: dispatchActivation (approve_rollout → ActivationDispatcher;
+ *     PRI-811 Phase B: 一律入 approvals.pending，Owner 批准后才激活) +
+ *     reopenRevisionTarget (needs_revision → reopen scribe/artificer, 禁止入 approval)
  *
  * Everything is assembled from @principles/core stores/dispatchers; the only
  * host knowledge is a structural logger. Idempotency (INV-08): dispatcher
@@ -83,6 +83,8 @@ export async function dispatchRolloutActivation(workspaceDir, input, options = {
         const decision = await dispatcher.dispatch({
             artifactId: input.artifactId,
             channel: input.channel, // InternalizationChannel union; rollout 链的 channel 已由任务元数据校验
+            // 'auto_activate' = rollout reviewer 推荐激活。PRI-811 Phase B 起
+            // dispatcher 对一切推荐只入 approval 队列，不直接激活。
             rolloutDecision: 'auto_activate',
             actor: { kind: 'system', source: 'rollout_reviewer' },
             now: new Date().toISOString(),

package/dist/production-rulehost-gate.js

@@ -199,7 +199,18 @@ export function createProductionRuleHostGate(options = {}) {
                         continue;
                     }
                     const [row] = group;
-                    if (!row || row.action !== 'code_tool_hook_live_activate')
+                    if (!row)
+                        continue;
+                    // PRI-813: shadow activations are no longer skipped here — they run
+                    // through the SAME budget/content/context validation and
+                    // evaluateBatch pipeline as live rows, but their results are
+                    // collected as observations only and never join mergeDecisions
+                    // (shadow observes, never enforces). The v2 gate below stays ahead
+                    // of any evaluation, so Codex v2 shadow remains suspended.
+                    const activationMode = row.action === 'code_tool_hook_live_activate'
+                        ? 'live'
+                        : row.action === 'code_tool_hook_shadow_activate' ? 'shadow' : null;
+                    if (activationMode === null)
                         continue;
                     const activationId = row.activation_id;
                     const artifactId = row.artifact_id;
@@ -220,9 +231,21 @@ export function createProductionRuleHostGate(options = {}) {
                     const contentJson = contentRow.content_json;
                     const returnedContentBytes = Buffer.byteLength(contentJson, 'utf8');
                     if (contentRow.content_bytes > ARTIFACT_CONTENT_BYTES || returnedContentBytes > ARTIFACT_CONTENT_BYTES) {
+                        // CodeRabbit CR-3: a shadow row's envelope overrun must only skip
+                        // the shadow observation — pre-PRI-813 this return was unreachable
+                        // for shadow rows, and letting it fire now would suppress live
+                        // enforcement (shadow may never influence the live outcome).
+                        if (activationMode === 'shadow') {
+                            addWarning(warnings, `artifact_content_budget_exceeded: activation=${activationId} bytes=${Math.max(contentRow.content_bytes, returnedContentBytes)} maximum=${ARTIFACT_CONTENT_BYTES}`, 'reduce the active shadow artifact envelope and reactivate the rule; live enforcement is unaffected');
+                            continue;
+                        }
                         return { decision: 'allow', source: event.source, warnings: [boundedWarning(`artifact_content_budget_exceeded: activation=${activationId} bytes=${Math.max(contentRow.content_bytes, returnedContentBytes)} maximum=${ARTIFACT_CONTENT_BYTES}`, 'reduce the active artifact envelope and reactivate the rule')], metadata: { evaluatedLiveRules: 0 } };
                     }
                     if (contentRow.content_bytes !== expectedContentBytes || returnedContentBytes !== contentRow.content_bytes) {
+                        if (activationMode === 'shadow') {
+                            addWarning(warnings, `artifact_content_size_changed: activation=${activationId}`, 'retry after the active shadow artifact update completes; live enforcement is unaffected');
+                            continue;
+                        }
                         return { decision: 'allow', source: event.source, warnings: [boundedWarning(`artifact_content_size_changed: activation=${activationId}`, 'retry after the active artifact update completes')], metadata: { evaluatedLiveRules: 0 } };
                     }
                     try {
@@ -233,6 +256,10 @@ export function createProductionRuleHostGate(options = {}) {
                         }
                         const sourceBytes = Buffer.byteLength(content.implementationCode, 'utf8');
                         if (sourceBytes > RULE_SOURCE_BYTES) {
+                            if (activationMode === 'shadow') {
+                                addWarning(warnings, `rule_source_budget_exceeded: activation=${activationId} bytes=${sourceBytes}`, `reduce the shadow RuleCode source below ${RULE_SOURCE_BYTES} bytes; live enforcement is unaffected`);
+                                continue;
+                            }
                             return { decision: 'allow', source: event.source, warnings: [boundedWarning(`rule_source_budget_exceeded: activation=${activationId} bytes=${sourceBytes}`, `reduce each RuleCode source below ${RULE_SOURCE_BYTES} bytes`)], metadata: { evaluatedLiveRules: 0 } };
                         }
                         if (Object.hasOwn(content, 'requiresContextVersion')) {
@@ -265,7 +292,7 @@ export function createProductionRuleHostGate(options = {}) {
                             continue;
                         }
                         const fallbackMeta = { name: activationId, version: '1', ruleId, coversCondition: 'all' };
-                        candidates.push({ implId: activationId, ruleId, principleId, meta: isRuleMeta(content.meta) ? content.meta : fallbackMeta, source: content.implementationCode });
+                        candidates.push({ implId: activationId, ruleId, principleId, meta: isRuleMeta(content.meta) ? content.meta : fallbackMeta, source: content.implementationCode, activationMode });
                     }
                     catch (error) {
                         addWarning(warnings, `implementation_unhealthy: ${error instanceof Error ? error.message : String(error)}`, 'fix the RuleCode and reactivate the rule');
@@ -280,27 +307,91 @@ export function createProductionRuleHostGate(options = {}) {
                 derived: { estimatedLineChanges: estimateLineChanges({ toolName: input.toolName, params: input.params }), bashRisk: enrichment.bashRisk },
                 ...(context ? { context } : {}),
             };
-            const batchSourceBytes = candidates.reduce((sum, candidate) => sum + Buffer.byteLength(candidate.source, 'utf8'), 0);
-            if (batchSourceBytes > RULE_BATCH_SOURCE_BYTES) {
-                return { decision: 'allow', source: event.source, warnings: [boundedWarning(`rule_source_budget_exceeded: batchBytes=${batchSourceBytes}`, `reduce total active RuleCode below ${RULE_BATCH_SOURCE_BYTES} bytes`)], metadata: { evaluatedLiveRules: 0 } };
+            // CodeRabbit CR-3: live and shadow evaluate in SEPARATE batches so a
+            // shadow rule's timeout/budget failure can never suppress live
+            // enforcement (shadow observes; it must not influence the live
+            // outcome). Live keeps the exact pre-PRI-813 early-return semantics;
+            // every shadow-batch failure degrades to a warning and skips the
+            // shadow observation only.
+            const liveCandidates = candidates.filter((candidate) => candidate.activationMode === 'live');
+            const shadowCandidates = candidates.filter((candidate) => candidate.activationMode === 'shadow');
+            const liveBatchBytes = liveCandidates.reduce((sum, candidate) => sum + Buffer.byteLength(candidate.source, 'utf8'), 0);
+            if (liveBatchBytes > RULE_BATCH_SOURCE_BYTES) {
+                return { decision: 'allow', source: event.source, warnings: [boundedWarning(`rule_source_budget_exceeded: batchBytes=${liveBatchBytes}`, `reduce total active RuleCode below ${RULE_BATCH_SOURCE_BYTES} bytes`)], metadata: { evaluatedLiveRules: 0 } };
             }
-            const batchSources = candidates.map((candidate) => ({ source: candidate.source, filename: `activation-${candidate.implId}` }));
-            const remaining = remainingGateMs(startedAt);
+            let remaining = remainingGateMs(startedAt);
             if (remaining <= 0) {
                 return { decision: 'allow', source: event.source, warnings: [boundedWarning('gate_deadline_exceeded', 'reduce active RuleCode count or source size and retry')], metadata: { evaluatedLiveRules: 0 } };
             }
-            const batch = implementationRuntime.evaluateBatch(batchSources, hostInput, remaining);
-            if (!batch.ok || !batch.results) {
-                return { decision: 'allow', source: event.source, warnings: [boundedWarning(`${batch.reason ?? 'rule_batch_failed'}: ${batch.detail ?? 'unknown failure'}`, 'inspect active RuleCode resource use and repair or deactivate the unhealthy rule')], metadata: { evaluatedLiveRules: 0 } };
+            const liveBatch = implementationRuntime.evaluateBatch(liveCandidates.map((candidate) => ({ source: candidate.source, filename: `activation-${candidate.implId}` })), hostInput, remaining);
+            if (!liveBatch.ok || !liveBatch.results) {
+                return { decision: 'allow', source: event.source, warnings: [boundedWarning(`${liveBatch.reason ?? 'rule_batch_failed'}: ${liveBatch.detail ?? 'unknown failure'}`, 'inspect active RuleCode resource use and repair or deactivate the unhealthy rule')], metadata: { evaluatedLiveRules: 0 } };
             }
-            const timedOutChild = batch.results.find((candidate) => !candidate.ok && candidate.error?.includes('timed out'));
+            const timedOutChild = liveBatch.results.find((candidate) => !candidate.ok && candidate.error?.includes('timed out'));
             if (timedOutChild) {
                 return { decision: 'allow', source: event.source, warnings: [boundedWarning(`rule_batch_timeout: ${timedOutChild.error ?? 'unknown child timeout'}`, 'fix or deactivate the unhealthy RuleCode and retry')], metadata: { evaluatedLiveRules: 0 } };
             }
+            // PRI-813: one canonical evaluation fact per shadow activation —
+            // observations only. Shadow results never join mergeDecisions, never
+            // block/modify/require approval: they record what a live rule WOULD
+            // have decided (ACTIVATION_CHANNELS §3.4), mirroring the legacy
+            // RuleHost report's shadowDecisions. Every failure mode below skips
+            // shadow observation without touching the live decision.
+            const shadowEvaluations = [];
+            if (shadowCandidates.length > 0) {
+                const shadowBatchBytes = shadowCandidates.reduce((sum, candidate) => sum + Buffer.byteLength(candidate.source, 'utf8'), 0);
+                remaining = remainingGateMs(startedAt);
+                if (shadowBatchBytes > RULE_BATCH_SOURCE_BYTES) {
+                    addWarning(warnings, `rule_source_budget_exceeded: shadowBatchBytes=${shadowBatchBytes}`, `reduce total shadow RuleCode below ${RULE_BATCH_SOURCE_BYTES} bytes; shadow observation was skipped, live enforcement is unaffected`);
+                }
+                else if (remaining <= 0) {
+                    addWarning(warnings, 'gate_deadline_exceeded', 'shadow observation was skipped after the live evaluation budget; live enforcement is unaffected');
+                }
+                else {
+                    const shadowBatch = implementationRuntime.evaluateBatch(shadowCandidates.map((candidate) => ({ source: candidate.source, filename: `activation-${candidate.implId}` })), hostInput, remaining);
+                    const shadowTimedOut = shadowBatch.ok && shadowBatch.results
+                        ? shadowBatch.results.find((candidate) => !candidate.ok && candidate.error?.includes('timed out'))
+                        : undefined;
+                    if (!shadowBatch.ok || !shadowBatch.results) {
+                        addWarning(warnings, `${shadowBatch.ok ? 'rule_batch_failed' : shadowBatch.reason ?? 'rule_batch_failed'}: ${shadowBatch.ok ? 'unknown failure' : shadowBatch.detail ?? 'unknown failure'}`, 'inspect active shadow RuleCode; the shadow observation was skipped, live enforcement is unaffected');
+                    }
+                    else if (shadowTimedOut) {
+                        addWarning(warnings, `rule_batch_timeout: ${shadowTimedOut.error ?? 'unknown child timeout'}`, 'fix or deactivate the unhealthy shadow RuleCode; the shadow observation was skipped, live enforcement is unaffected');
+                    }
+                    else {
+                        for (let index = 0; index < shadowCandidates.length; index += 1) {
+                            const candidate = shadowCandidates[index];
+                            const batchResult = shadowBatch.results[index];
+                            if (!candidate || !batchResult || !batchResult.ok) {
+                                addWarning(warnings, `implementation_unhealthy: ${batchResult && !batchResult.ok ? batchResult.error ?? 'unknown child error' : 'rule_batch_result_missing'}`, 'fix the shadow RuleCode and reactivate the rule; live enforcement is unaffected');
+                                continue;
+                            }
+                            const validation = validateRuleHostResult(batchResult.result);
+                            if (!isRuleResult(batchResult.result)) {
+                                addWarning(warnings, `invalid RuleHostResult: ${validation.errors.join('; ')}`, 'fix the shadow RuleCode result and reactivate the rule; live enforcement is unaffected');
+                                continue;
+                            }
+                            const shadowResult = batchResult.result.matched
+                                ? { ...batchResult.result, ruleId: candidate.ruleId, principleId: candidate.principleId }
+                                : batchResult.result;
+                            shadowEvaluations.push({
+                                toolName: input.toolName,
+                                filePath: action.normalizedPath,
+                                matched: shadowResult.matched,
+                                decision: shadowResult.decision,
+                                ruleId: candidate.ruleId,
+                                activationId: candidate.implId,
+                                activationMode: 'shadow',
+                            });
+                        }
+                    }
+                }
+            }
             const implementations = [];
-            for (let index = 0; index < candidates.length; index += 1) {
-                const candidate = candidates[index];
-                const batchResult = batch.results[index];
+            const liveEvaluatedResults = [];
+            for (let index = 0; index < liveCandidates.length; index += 1) {
+                const candidate = liveCandidates[index];
+                const batchResult = liveBatch.results[index];
                 if (!candidate || !batchResult) {
                     addWarning(warnings, 'rule_batch_result_missing', 'inspect the RuleCode runtime result contract');
                     continue;
@@ -318,18 +409,47 @@ export function createProductionRuleHostGate(options = {}) {
                     ? { ...batchResult.result, ruleId: candidate.ruleId, principleId: candidate.principleId }
                     : batchResult.result;
                 implementations.push({ ...candidate, evaluate: () => validatedResult });
+                liveEvaluatedResults.push(validatedResult);
             }
             const result = mergeDecisions(implementations, hostInput, {
                 warn(message) { addWarning(warnings, message, 'inspect the unhealthy activation and RuleCode output'); },
             });
+            // PRI-813 + CodeRabbit CR-4: attribute the winning live activation by
+            // REFERENCE IDENTITY — mergeDecisions returns the winning candidate's
+            // own result object for block/auto_correct, so indexOf is exact even
+            // when two live activations share a ruleId (the previous ruleId
+            // reverse-lookup could mis-attribute). Unattributable outcomes
+            // (requireApproval aggregate, no winner) carry no activationId.
+            const winnerIndex = result === undefined ? -1 : liveEvaluatedResults.indexOf(result);
+            const liveActivationId = winnerIndex >= 0 ? implementations[winnerIndex]?.implId : undefined;
+            // PRI-813: per-activation evaluation facts for host-side telemetry
+            // writers. HostEventResult.metadata is the designed channel for
+            // host-neutral evaluation facts; each entry maps losslessly onto the
+            // canonical RuleHostEvaluatedEventData contract.
+            const evaluations = [
+                {
+                    toolName: input.toolName,
+                    filePath: action.normalizedPath,
+                    matched: result?.matched ?? false,
+                    // CodeRabbit CR-5 / PRI-567: an EMPTY live set is 'no_rules_armed',
+                    // not a live 'allow' — enforcement statistics must not read as if a
+                    // live rule evaluated (the legacy writer already distinguishes
+                    // this; the shared path now aligns).
+                    decision: liveCandidates.length === 0 ? 'no_rules_armed' : result?.decision ?? 'allow',
+                    ...(result?.ruleId !== undefined ? { ruleId: result.ruleId } : {}),
+                    ...(liveActivationId !== undefined ? { activationId: liveActivationId } : {}),
+                    activationMode: 'live',
+                },
+                ...shadowEvaluations,
+            ];
             if (result?.decision === 'block') {
                 if (result.reason.trim().length === 0) {
                     addWarning(warnings, 'deny_reason_missing', 'fix the RuleCode to return a non-empty block reason');
-                    return { decision: 'allow', source: event.source, warnings, metadata: { evaluatedLiveRules: implementations.length } };
+                    return { decision: 'allow', source: event.source, warnings, metadata: { evaluatedLiveRules: implementations.length, evaluations } };
                 }
-                return { decision: 'deny', reason: result.reason, source: event.source, ...(warnings.length ? { warnings } : {}), metadata: { evaluatedLiveRules: implementations.length, ruleId: result.ruleId, principleId: result.principleId } };
+                return { decision: 'deny', reason: result.reason, source: event.source, ...(warnings.length ? { warnings } : {}), metadata: { evaluatedLiveRules: implementations.length, ruleId: result.ruleId, principleId: result.principleId, evaluations } };
             }
-            return { decision: 'allow', source: event.source, ...(warnings.length ? { warnings } : {}), metadata: { evaluatedLiveRules: implementations.length, ruleDecision: result?.decision ?? 'allow' } };
+            return { decision: 'allow', source: event.source, ...(warnings.length ? { warnings } : {}), metadata: { evaluatedLiveRules: implementations.length, ruleDecision: result?.decision ?? 'allow', evaluations } };
         }
         catch (error) {
             addWarning(warnings, `activation_read_failed: ${error instanceof Error ? error.message : String(error)}`, 'inspect state.db schema and integrity');

package/dist/workspace-telemetry-emitter.js

@@ -15,13 +15,16 @@ import { StoreEventEmitter } from '@principles/core/runtime-v2';
  * （ERR-092）。正确粒度是 **workspace-scoped**：本 emitter 在 consumer
  * cycle 的 per-wake 装配处构造，只经手本 workspace runner 发出的事件。
  *
- * 持久化策略：**allowlist**，只落盘 4 类 critical events（与 telemetry-event
+ * 持久化策略：**allowlist**，只落盘 critical events（与 telemetry-event
  * schema 枚举同源），不做全量 telemetry 无差别写盘（日志量 + 隐私审计面
  * 无谓扩大）：
  *   - evaluator_adversarial_replay_skipped
  *   - evaluator_adversarial_replay
  *   - evaluator_rule_assembled
  *   - evaluator_rule_assembly_failed
+ *   - artificer_l2_complete（PRI-795 review P1：Artificer L2 的 completion
+ *     证据 — abortOwner/budgetMs/elapsedMs/stopReason/tokenUsage — 必须
+ *     crash 前落盘，否则 EP002-R3 的「失败后什么都查不到」重演）
  *
  * 落点 `<workspaceDir>/.pd/telemetry/critical-events.jsonl`（JSONL，一行一
  * 事件，含完整 TelemetryEvent）。同步 append：事件量小（allowlist 限流），
@@ -34,6 +37,7 @@ const CRITICAL_EVENT_ALLOWLIST = new Set([
     'evaluator_adversarial_replay',
     'evaluator_rule_assembled',
     'evaluator_rule_assembly_failed',
+    'artificer_l2_complete',
 ]);
 export class WorkspaceTelemetryEmitter extends StoreEventEmitter {
     upstream;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@principles/host-runtime",
-  "version": "0.7.4",
+  "version": "0.7.6",
   "description": "Shared host-neutral orchestration for Principles Disciple MVP-Core hook paths.",
   "type": "module",
   "main": "./dist/index.js",