@principles/host-runtime 0.7.7 → 0.7.10

package/dist/active-principle-prompt.d.ts

@@ -1,3 +1,4 @@
+import { type ActivatedPrinciple } from '@principles/core/runtime-v2';
 export interface ActivePrinciplePromptResult {
     additionalContext: string;
     principleIds: string[];
@@ -11,6 +12,25 @@ export interface ActivePrinciplePromptResult {
     exclusionReason?: 'host_principle_overlap';
     allValidatedPrinciplesExcluded: boolean;
 }
+export interface PromptActivationCandidates {
+    principles: ActivatedPrinciple[];
+    excludedPrincipleIds: string[];
+    warnings: string[];
+    /** true = prompt flag off or state.db missing — candidates are necessarily empty */
+    aborted: boolean;
+    selfReportEnabled: boolean;
+    abstractionLayerEnabled: boolean;
+}
+/**
+ * PR #1844 follow-up: the activation READ half of buildActivePrinciplePromptContext,
+ * exported so the console budget projection can share the exact same input
+ * selection (FIFO activations → artifact resolve → exclude partition) without
+ * duplicating logic.
+ */
+export declare function readPromptActivationCandidates(input: {
+    workspaceDir: string;
+    excludePrincipleIds?: ReadonlySet<string>;
+}): Promise<PromptActivationCandidates>;
 export declare function buildActivePrinciplePromptContext(input: {
     workspaceDir: string;
     excludePrincipleIds?: ReadonlySet<string>;

package/dist/active-principle-prompt.js

@@ -3,7 +3,13 @@ import fs from 'node:fs';
 import path from 'node:path';
 import { escapeXml } from '@principles/core/prompt-builder';
 import { loadPdConfigForPlugin } from './pd-config.js';
-export async function buildActivePrinciplePromptContext(input) {
+/**
+ * PR #1844 follow-up: the activation READ half of buildActivePrinciplePromptContext,
+ * exported so the console budget projection can share the exact same input
+ * selection (FIFO activations → artifact resolve → exclude partition) without
+ * duplicating logic.
+ */
+export async function readPromptActivationCandidates(input) {
     const warnings = [];
     const principles = [];
     const excludedPrincipleIds = [];
@@ -11,24 +17,21 @@ export async function buildActivePrinciplePromptContext(input) {
     if (!config.ok) {
         warnings.push(...config.errors.map((error) => `config_invalid: ${error.reason}; nextAction=${error.nextAction}`));
     }
-    const promptFlag = computeFeatureFlagsFromConfig(config.effective).flags.prompt;
+    const { flags } = computeFeatureFlagsFromConfig(config.effective);
+    const { prompt: promptFlag } = flags;
+    const abstractionLayerEnabled = flags.abstraction_layer_v1?.enabled === true;
     if (!promptFlag?.enabled) {
         warnings.push('prompt_feature_disabled; nextAction=set features.prompt.enabled=true in .pd/config.yaml');
-        return { additionalContext: '', principleIds: [], activationIds: [], artifactIds: [], warnings, budget: RUNTIME_V2_PRINCIPLE_BUDGET, truncated: false, excludedPrincipleIds, excludedCount: 0, allValidatedPrinciplesExcluded: false };
+        return { principles, excludedPrincipleIds, warnings, aborted: true, selfReportEnabled: false, abstractionLayerEnabled };
     }
     // PRI-532: agent self-report instruction rides the directive template when
     // the flag is on (flag-off keeps the template byte-identical).
-    const selfReportEnabled = computeFeatureFlagsFromConfig(config.effective)
-        .flags.principle_receipt_self_report?.enabled === true;
+    const selfReportEnabled = flags.principle_receipt_self_report?.enabled === true;
     let connection;
     const stateDbPath = path.join(input.workspaceDir, '.pd', 'state.db');
     if (!fs.existsSync(stateDbPath)) {
         warnings.push('activation_db_not_found; nextAction=initialize_workspace_runtime_state');
-        return {
-            additionalContext: '', principleIds: [], activationIds: [], artifactIds: [], warnings,
-            budget: RUNTIME_V2_PRINCIPLE_BUDGET, truncated: false, excludedPrincipleIds,
-            excludedCount: 0, allValidatedPrinciplesExcluded: false,
-        };
+        return { principles, excludedPrincipleIds, warnings, aborted: true, selfReportEnabled, abstractionLayerEnabled };
     }
     try {
         connection = new SqliteConnection({ workspaceDir: input.workspaceDir, readonly: true, bootstrapIfMissing: false });
@@ -73,6 +76,17 @@ export async function buildActivePrinciplePromptContext(input) {
     finally {
         connection?.close();
     }
+    return { principles, excludedPrincipleIds, warnings, aborted: false, selfReportEnabled, abstractionLayerEnabled };
+}
+export async function buildActivePrinciplePromptContext(input) {
+    const { principles, excludedPrincipleIds, warnings, aborted, selfReportEnabled } = await readPromptActivationCandidates(input);
+    if (aborted) {
+        return {
+            additionalContext: '', principleIds: [], activationIds: [], artifactIds: [], warnings,
+            budget: RUNTIME_V2_PRINCIPLE_BUDGET, truncated: false, excludedPrincipleIds,
+            excludedCount: excludedPrincipleIds.length, allValidatedPrinciplesExcluded: false,
+        };
+    }
     const included = [];
     let additionalContext = '';
     let truncated = false;

package/dist/degraded-enforcement-marker.d.ts

@@ -0,0 +1,15 @@
+export interface DegradedEnforcementRecord {
+    workspaceDir: string;
+    reason: string;
+    firstSeenAt: string;
+    lastSeenAt: string;
+    occurrences: number;
+}
+/** Stable per-workspace marker path (keyed by resolved workspace dir). */
+export declare function markerPathFor(workspaceDir: string): string;
+/**
+ * Record (or bump) the degraded-enforcement marker for a workspace.
+ * Overwrites atomically; repeated occurrences accumulate a counter and refresh
+ * `lastSeenAt` so a stale marker is distinguishable from an active one.
+ */
+export declare function recordDegradedEnforcement(workspaceDir: string, reason: string, now?: Date): void;

package/dist/degraded-enforcement-marker.js

@@ -0,0 +1,66 @@
+/**
+ * Durable degraded-enforcement marker (security audit run-1,
+ * gate-failopen-allow-on-state-corruption).
+ *
+ * The RuleHost gate fails open when the governance store is unavailable
+ * (missing/corrupt `.pd/state.db`) — the documented availability posture. But
+ * the store lives in a space the governed agent can write, so "unavailable"
+ * is an attacker-choosable state, and the only in-source trace was a per-call
+ * warning plus an ambiguous console read model. This module records a durable
+ * marker OUTSIDE the agent-writable workspace (`~/.pd/enforcement-health/`)
+ * so an Owner can distinguish "enforcement degraded because the governance
+ * store was deleted/corrupt" from an ordinary never-initialized workspace.
+ *
+ * Best-effort by contract: every failure is swallowed. This is observability
+ * layered on top of the fail-open decision — it must never break gating.
+ */
+import { createHash } from 'node:crypto';
+import * as fs from 'node:fs';
+import * as os from 'node:os';
+import * as path from 'node:path';
+function markerDir() {
+    return path.join(path.resolve(os.homedir()), '.pd', 'enforcement-health');
+}
+/** Stable per-workspace marker path (keyed by resolved workspace dir). */
+export function markerPathFor(workspaceDir) {
+    const key = createHash('sha256').update(path.resolve(workspaceDir), 'utf8').digest('hex').slice(0, 16);
+    return path.join(markerDir(), `degraded-${key}.json`);
+}
+/**
+ * Record (or bump) the degraded-enforcement marker for a workspace.
+ * Overwrites atomically; repeated occurrences accumulate a counter and refresh
+ * `lastSeenAt` so a stale marker is distinguishable from an active one.
+ */
+export function recordDegradedEnforcement(workspaceDir, reason, now = new Date()) {
+    try {
+        const dir = markerDir();
+        fs.mkdirSync(dir, { recursive: true });
+        const markerPath = markerPathFor(workspaceDir);
+        let previous = null;
+        try {
+            const parsed = JSON.parse(fs.readFileSync(markerPath, 'utf8'));
+            if (parsed && typeof parsed === 'object' && !Array.isArray(parsed)) {
+                previous = parsed;
+            }
+        }
+        catch {
+            // First occurrence, or the previous marker was unreadable — start fresh.
+        }
+        const timestamp = now.toISOString();
+        const record = {
+            workspaceDir: path.resolve(workspaceDir),
+            reason,
+            firstSeenAt: typeof previous?.firstSeenAt === 'string' ? previous.firstSeenAt : timestamp,
+            lastSeenAt: timestamp,
+            occurrences: (typeof previous?.occurrences === 'number' && Number.isSafeInteger(previous.occurrences)
+                ? previous.occurrences
+                : 0) + 1,
+        };
+        const tmpPath = `${markerPath}.tmp.${process.pid}.${Date.now()}`;
+        fs.writeFileSync(tmpPath, JSON.stringify(record, null, 2), { encoding: 'utf8', mode: 0o600 });
+        fs.renameSync(tmpPath, markerPath);
+    }
+    catch {
+        // Observability only — the gate's fail-open decision stands regardless.
+    }
+}

package/dist/index.d.ts

@@ -5,6 +5,7 @@ import type { RuleImplementationRuntime } from './rule-implementation-runtime.js
 import { type PainDatabaseFactory, type PainEnrichmentProvider } from './production-pain-evidence.js';
 import type { GovernanceHostKind, ToolSemanticRegistry } from '@principles/core/runtime-v2';
 export * from './active-principle-prompt.js';
+export * from './prompt-injection-projection.js';
 export * from './pd-config.js';
 export * from './production-rulehost-gate.js';
 export * from './rule-implementation-runtime.js';

package/dist/index.js

@@ -4,6 +4,7 @@ import { buildActivePrinciplePromptContext } from './active-principle-prompt.js'
 import { createProductionRuleHostGate } from './production-rulehost-gate.js';
 import { createProductionPainEvidenceHandler } from './production-pain-evidence.js';
 export * from './active-principle-prompt.js';
+export * from './prompt-injection-projection.js';
 export * from './pd-config.js';
 export * from './production-rulehost-gate.js';
 export * from './rule-implementation-runtime.js';

package/dist/internalization-consumer-cycle.js

@@ -20,7 +20,7 @@
  * Hosts inject: a logger, a structured-event sink, their tool catalog, and an
  * env getter. Everything else is the existing production path.
  */
-import { createRuntimeStateHandle, InternalizationOrchestrator, DreamerRunner, PhilosopherRunner, ScribeRunner, ArtificerRunner, buildArtificerHostSemanticContext, EvaluatorRunner, RolloutReviewerRunner, DefaultDreamerValidator, DefaultPhilosopherValidator, DefaultScribeValidator, DefaultArtificerValidator, DefaultEvaluatorValidator, DefaultRolloutReviewerValidator, PiAiRuntimeAdapter, L2AgentLoopAdapter, ArtificerL2Adapter, buildL2PrincipleReaderFromLedger, OpenClawCliRuntimeAdapter, storeEmitter, createProductionGateDeps, resolveRuntimeConfigFromPdConfig, resolveRuntimeConfigForAgent, AGENT_NAME_FOR_TASK_KIND, isRuntimeConfigError, computeConsumerDecision, FULL_CHAIN_CONSUMER_RUNNER_KINDS, DEFAULT_CONSUMER_RUNNER_KINDS, InternalizationQueueReadModel, MVP_CORE_TASK_KINDS, SqliteConnection, SqliteReconciliationCursorStore, SUCCEEDED_TRANSITIONS_SCOPE, 
+import { createRuntimeStateHandle, InternalizationOrchestrator, DreamerRunner, PhilosopherRunner, ScribeRunner, ArtificerRunner, buildArtificerHostSemanticContext, EvaluatorRunner, RolloutReviewerRunner, DefaultDreamerValidator, DefaultPhilosopherValidator, DefaultScribeValidator, DefaultArtificerValidator, DefaultEvaluatorValidator, DefaultRolloutReviewerValidator, PiAiRuntimeAdapter, L2AgentLoopAdapter, ArtificerL2Adapter, buildL2PrincipleReaderFromLedger, OpenClawCliRuntimeAdapter, storeEmitter, createProductionGateDeps, resolveRuntimeConfigFromPdConfig, resolveRuntimeConfigForAgent, AGENT_NAME_FOR_TASK_KIND, isRuntimeConfigError, computeConsumerDecision, FULL_CHAIN_CONSUMER_RUNNER_KINDS, DEFAULT_CONSUMER_RUNNER_KINDS, InternalizationQueueReadModel, MVP_CORE_TASK_KINDS, SqliteConnection, SqliteReconciliationCursorStore, SUCCEEDED_TRANSITIONS_SCOPE, PrincipleTreeLedgerAdapter, 
 // PRI-714: resolve outputLanguage from the same effective config the
 // runners already receive (EP-07: canonical resolved value, not raw input).
 resolveOutputLanguage, } from '@principles/core/runtime-v2';
@@ -459,7 +459,18 @@ export async function runInternalizationConsumerCycle(workspaceDir, ports) {
                 runner = new PhilosopherRunner({ stateManager, runtimeAdapter: adapter, eventEmitter: storeEmitter, artifactStore: stateManager.piArtifactStore, validator: new DefaultPhilosopherValidator() }, runnerOptions);
                 break;
             case 'scribe':
-                runner = new ScribeRunner({ stateManager, runtimeAdapter: adapter, eventEmitter: storeEmitter, artifactStore: stateManager.piArtifactStore, validator: new DefaultScribeValidator() }, runnerOptions);
+                runner = new ScribeRunner({
+                    stateManager, runtimeAdapter: adapter, eventEmitter: storeEmitter, artifactStore: stateManager.piArtifactStore, validator: new DefaultScribeValidator(),
+                    // I2 — CHAIN STAMPING (Owner review of PR #1856, P1): the scribe
+                    // stamps the ledger principle UUID (minted at intake, keyed by the
+                    // dreamer task seed's candidateId) onto the artifact it writes, so
+                    // the dispatcher's ledger identity gate sees a resolvable
+                    // identity on the live production chain. listForCandidate reads
+                    // the ledger from disk per call — no cross-cycle staleness.
+                    ledgerIdentity: {
+                        listForCandidate: (candidateId) => new PrincipleTreeLedgerAdapter({ stateDir: `${workspaceDir}/.state` }).listForCandidate(candidateId),
+                    },
+                }, runnerOptions);
                 break;
             case 'artificer':
                 runner = new ArtificerRunner({ stateManager, runtimeAdapter: adapter, eventEmitter: storeEmitter, artifactStore: stateManager.piArtifactStore, validator: new DefaultArtificerValidator() }, 
@@ -483,6 +494,14 @@ export async function runInternalizationConsumerCycle(workspaceDir, ports) {
                 runner = new EvaluatorRunner({
                     stateManager, runtimeAdapter: adapter, eventEmitter: workspaceEmitter,
                     artifactStore: stateManager.piArtifactStore, validator: new DefaultEvaluatorValidator(),
+                    // PRI-911A (I1 writer boundary): the rule artifact's identity is a
+                    // ledger UUID or nothing. hasPrinciple turns "UUID-shaped" into
+                    // "UUID the ledger actually mints", so a shaped-but-unknown id is
+                    // refused as invalid_identity instead of being carried forward.
+                    // Same per-call disk read as the scribe wiring above.
+                    ledgerIdentity: {
+                        hasPrinciple: (principleId) => new PrincipleTreeLedgerAdapter({ stateDir: `${workspaceDir}/.state` }).hasPrinciple(principleId),
+                    },
                     ...createEvaluatorRepairDeps(workspaceDir, stateManager, logger),
                 }, {
                     ...runnerOptions,

package/dist/internalization-consumer-governance.js

@@ -14,7 +14,7 @@
  * dedupes by `${artifactId}::${channel}`; reopen idempotency is owned by
  * orchestrator.reopenTaskForRevision.
  */
-import { ActivationDispatcher, PromptWriter, DeferArchiveWriter, RuleHostWriter, SqliteConnection, SqliteActivationStateStore, SqliteApprovalQueueStore, SqlitePIArtifactStore, createProductionGateDeps, createPITaskDiagnosticJson, artificerRepairTaskId, computeFeatureFlagsFromConfig, isFeatureEnabled, } from '@principles/core/runtime-v2';
+import { ActivationDispatcher, PromptWriter, DeferArchiveWriter, RuleHostWriter, SqliteConnection, SqliteActivationStateStore, SqliteApprovalQueueStore, SqlitePIArtifactStore, PrincipleTreeLedgerAdapter, createProductionGateDeps, createPITaskDiagnosticJson, artificerRepairTaskId, computeFeatureFlagsFromConfig, isFeatureEnabled, } from '@principles/core/runtime-v2';
 import { loadPdConfigForPlugin } from './pd-config.js';
 function normalizeDecision(decision) {
     if (decision.decision === 'activated') {
@@ -64,6 +64,27 @@ export async function dispatchRolloutActivation(workspaceDir, input, options = {
         const activationStateStore = new SqliteActivationStateStore(connection);
         const approvalQueueStore = new SqliteApprovalQueueStore(connection);
         const flagProbe = makeFlagProbe(workspaceDir);
+        // I3 upgrade (Owner review of PR #1856, P1): the production dispatch path
+        // verifies ledger membership BEFORE the approval record and the activation
+        // commit. The ledger SSOT lives in <workspace>/.state (same dir the intake
+        // used to mint the principle UUID); candidate lineage reuses the artifact
+        // read model plus raw diagnostic_json reads.
+        const ledgerIdentity = {
+            ledger: new PrincipleTreeLedgerAdapter({ stateDir: `${workspaceDir}/.state` }),
+            getArtifactById: artifactReadModel.getArtifactById,
+            getTaskDiagnosticJson: (taskId) => {
+                try {
+                    const row = connection
+                        .getDb()
+                        .prepare('SELECT diagnostic_json FROM tasks WHERE task_id = ?')
+                        .get(taskId);
+                    return row?.diagnostic_json ?? null;
+                }
+                catch {
+                    return null;
+                }
+            },
+        };
         const dispatcher = new ActivationDispatcher(artifactReadModel, activationStateStore, {
             writers: [
                 new PromptWriter(),
@@ -79,6 +100,7 @@ export async function dispatchRolloutActivation(workspaceDir, input, options = {
                 new DeferArchiveWriter(),
             ],
             approvalQueueStore,
+            ledgerIdentity,
         });
         const decision = await dispatcher.dispatch({
             artifactId: input.artifactId,

package/dist/production-rulehost-gate.js

@@ -1,7 +1,8 @@
 import fs from 'node:fs';
 import path from 'node:path';
-import { buildRuleHostAction, buildToolSemanticRegistry, deriveToolHintsFromCanonicalKind, estimateLineChanges, mergeDecisions, SqliteConnection, UNAVAILABLE_RULE_CONTEXT, validateRuleContextV2, validateRuleHostResult, } from '@principles/core/runtime-v2';
+import { buildRuleHostAction, buildToolSemanticRegistry, deriveToolHintsFromCanonicalKind, estimateLineChanges, mergeDecisions, SqliteConnection, UNAVAILABLE_RULE_CONTEXT, validateRuleContextV2, validateRuleHostResult, verifyPiArtifactRowDigest, } from '@principles/core/runtime-v2';
 import { scanRetiredContractSymbols } from './legacy-rule-contract-symbols.js';
+import { recordDegradedEnforcement } from './degraded-enforcement-marker.js';
 import { createNodeRuleImplementationRuntime, MAX_ACTIVE_RULES, RULE_BATCH_SOURCE_BYTES, RULE_SOURCE_BYTES, } from './rule-implementation-runtime.js';
 const WARNING_LIMIT = 500;
 const MAX_WARNINGS = 16;
@@ -130,6 +131,12 @@ export function createProductionRuleHostGate(options = {}) {
             return { decision: 'allow', source: event.source, warnings: [boundedWarning('gate_deadline_exceeded', 'inspect host context providers and active RuleCode resource use')] };
         }
         if (!fs.existsSync(dbPath)) {
+            // Security audit run-1 (gate-failopen-allow-on-state-corruption):
+            // fail-open stays the availability contract, but a missing governance
+            // store is agent-choosable state — record a durable marker OUTSIDE the
+            // agent-writable workspace so the degradation is Owner-visible and
+            // distinguishable from a never-initialized workspace.
+            recordDegradedEnforcement(event.context.workspaceDir, 'activation_db_not_found');
             return { decision: 'allow', source: event.source, warnings: [boundedWarning('activation_db_not_found', 'initialize_workspace_runtime_state')] };
         }
         const connection = new SqliteConnection({ workspaceDir: event.context.workspaceDir, readonly: true, bootstrapIfMissing: false });
@@ -150,7 +157,10 @@ export function createProductionRuleHostGate(options = {}) {
         SELECT a.activation_id, a.artifact_id, a.target_ref, a.action,
                c.enforcement, c.isolation_decision_id,
                p.source_rule_id, p.source_principle_id,
-               length(CAST(p.content_json AS BLOB)) AS content_bytes
+               length(CAST(p.content_json AS BLOB)) AS content_bytes,
+               (SELECT d.artifact_digest FROM activation_decisions d
+                WHERE d.subject_kind = 'activation' AND d.activation_id = a.activation_id
+                ORDER BY d.decided_at DESC, d.rowid DESC LIMIT 1) AS approved_artifact_digest
         FROM activations a
         JOIN pi_artifacts p ON a.artifact_id = p.artifact_id
         LEFT JOIN activation_control_states c ON a.activation_id = c.activation_id
@@ -220,7 +230,10 @@ export function createProductionRuleHostGate(options = {}) {
                         continue;
                     }
                     const contentRow = connection.getDb().prepare(`
-            SELECT content_json, length(CAST(content_json AS BLOB)) AS content_bytes
+            SELECT artifact_id, artifact_kind, source_task_id, source_principle_id, source_rule_id,
+                   lineage_artifact_ids, validation_status, content_json,
+                   created_at, updated_at,
+                   length(CAST(content_json AS BLOB)) AS content_bytes
             FROM pi_artifacts WHERE artifact_id = ?
           `).get(artifactId);
                     if (!isRecord(contentRow) || typeof contentRow.content_json !== 'string'
@@ -248,6 +261,34 @@ export function createProductionRuleHostGate(options = {}) {
                         }
                         return { decision: 'allow', source: event.source, warnings: [boundedWarning(`artifact_content_size_changed: activation=${activationId}`, 'retry after the active artifact update completes')], metadata: { evaluatedLiveRules: 0 } };
                     }
+                    // Enforcement-time content binding (security audit run-1,
+                    // rulecode-approval-content-unbound): the Owner decision recorded
+                    // activation_decisions.artifact_digest over the promotion-time
+                    // artifact snapshot. Re-verify the CURRENT row against that digest
+                    // before compiling — a workspace-local writer can UPDATE
+                    // content_json, and executing content the Owner never approved
+                    // silently defeats enforcement. A digest mismatch is an integrity
+                    // failure, not an availability failure: skip this activation with a
+                    // structured warning instead of failing open. Rows without a
+                    // recorded activation-scoped decision (legacy activations from
+                    // before the owner-decision lifecycle) keep their prior behavior.
+                    // The check itself is core-owned (verifyPiArtifactRowDigest) so the
+                    // gate and the plugin RuleHost cannot drift.
+                    const approvedArtifactDigest = typeof row.approved_artifact_digest === 'string' ? row.approved_artifact_digest : null;
+                    const digestCheck = verifyPiArtifactRowDigest(contentRow, contentJson, approvedArtifactDigest);
+                    if (digestCheck.outcome === 'unverifiable') {
+                        addWarning(warnings, `activation_artifact_invalid: ${activationId} (${digestCheck.error})`, 'inspect state.db artifact row integrity; the approved digest could not be re-verified');
+                        continue;
+                    }
+                    if (digestCheck.outcome === 'tampered') {
+                        const digestNextAction = 'the artifact content no longer matches the Owner-approved digest — deactivate and re-approve the rule; execution was skipped';
+                        if (activationMode === 'shadow') {
+                            addWarning(warnings, `artifact_digest_mismatch (shadow): activation=${activationId}`, `${digestNextAction}; live enforcement is unaffected`);
+                            continue;
+                        }
+                        addWarning(warnings, `artifact_content_tampered: activation=${activationId} approved=${approvedArtifactDigest} actual=${digestCheck.actualDigest}`, digestNextAction);
+                        continue;
+                    }
                     try {
                         const content = JSON.parse(contentJson);
                         if (!isRecord(content) || typeof content.implementationCode !== 'string' || content.implementationCode.length === 0) {
@@ -453,6 +494,14 @@ export function createProductionRuleHostGate(options = {}) {
         }
         catch (error) {
             addWarning(warnings, `activation_read_failed: ${error instanceof Error ? error.message : String(error)}`, 'inspect state.db schema and integrity');
+            // Same durable-marker contract as the missing-DB branch: a corrupt or
+            // unreadable governance store degrades enforcement to allow, so the
+            // degradation must leave a durable, Owner-visible trace outside the
+            // agent-writable workspace. Best-effort; never replaces the decision.
+            try {
+                recordDegradedEnforcement(event.context.workspaceDir, `activation_read_failed: ${error instanceof Error ? error.message : String(error)}`.slice(0, 300));
+            }
+            catch { /* observability only */ }
             return { decision: 'allow', source: event.source, warnings, metadata: { evaluatedLiveRules: 0 } };
         }
         finally {

package/dist/prompt-injection-projection.d.ts

@@ -0,0 +1,38 @@
+export interface PromptInjectionProjection {
+    /** Which real injection route the workspace is on (abstraction_layer_v1 flag). */
+    route: 'legacy_trim' | 'shared_render';
+    budget: number;
+    /**
+     * Char count the REAL prompt path would consume: legacy route counts the
+     * trimToBudget lines joined as injected content (the render wrapper does
+     * NOT consume budget on that route); shared route counts the rendered
+     * directive context in full.
+     */
+    usedChars: number;
+    truncated: boolean;
+    injectedPrincipleIds: string[];
+    injectedActivationIds: string[];
+    warnings: string[];
+}
+/**
+ * PR #1844 follow-up: forecast the prompt-injection budget from the SAME
+ * projection the agent injection itself uses, routed by the same
+ * `abstraction_layer_v1` flag the OpenClaw plugin's runtime gate reads:
+ *
+ * - legacy route (live default, flag OFF): activation candidates from
+ *   `readPromptActivationCandidates` (same FIFO query + artifact resolve as
+ *   the plugin's `PromptActivationReader`) trimmed by the REAL
+ *   `trimToBudget` — identical input × ordering × trim logic as
+ *   `openclaw-plugin/src/hooks/prompt.ts`.
+ * - shared route (flag ON): delegate to `buildActivePrinciplePromptContext`,
+ *   which IS the production shared path's projection source.
+ *
+ * Known conservative gap: the plugin's legacy route additionally dedups
+ * candidates against the legacy evolution ledger before trimming; the
+ * console cannot replay that reducer read-only, so this projection may
+ * forecast slightly MORE consumption than the real injection (never less).
+ */
+export declare function buildLivePromptInjectionProjection(input: {
+    workspaceDir: string;
+    excludePrincipleIds?: ReadonlySet<string>;
+}): Promise<PromptInjectionProjection>;

package/dist/prompt-injection-projection.js

@@ -0,0 +1,61 @@
+import { RUNTIME_V2_PRINCIPLE_BUDGET, computeFeatureFlagsFromConfig, trimToBudget, } from '@principles/core/runtime-v2';
+import { escapeXml } from '@principles/core/prompt-builder';
+import { loadPdConfigForPlugin } from './pd-config.js';
+import { buildActivePrinciplePromptContext, readPromptActivationCandidates } from './active-principle-prompt.js';
+/**
+ * PR #1844 follow-up: forecast the prompt-injection budget from the SAME
+ * projection the agent injection itself uses, routed by the same
+ * `abstraction_layer_v1` flag the OpenClaw plugin's runtime gate reads:
+ *
+ * - legacy route (live default, flag OFF): activation candidates from
+ *   `readPromptActivationCandidates` (same FIFO query + artifact resolve as
+ *   the plugin's `PromptActivationReader`) trimmed by the REAL
+ *   `trimToBudget` — identical input × ordering × trim logic as
+ *   `openclaw-plugin/src/hooks/prompt.ts`.
+ * - shared route (flag ON): delegate to `buildActivePrinciplePromptContext`,
+ *   which IS the production shared path's projection source.
+ *
+ * Known conservative gap: the plugin's legacy route additionally dedups
+ * candidates against the legacy evolution ledger before trimming; the
+ * console cannot replay that reducer read-only, so this projection may
+ * forecast slightly MORE consumption than the real injection (never less).
+ */
+export async function buildLivePromptInjectionProjection(input) {
+    const sharedRoute = computeFeatureFlagsFromConfig(loadPdConfigForPlugin(input.workspaceDir).effective).flags.abstraction_layer_v1?.enabled === true;
+    if (sharedRoute) {
+        const context = await buildActivePrinciplePromptContext(input);
+        return {
+            route: 'shared_render',
+            budget: context.budget,
+            usedChars: context.additionalContext.length,
+            truncated: context.truncated,
+            injectedPrincipleIds: context.principleIds,
+            injectedActivationIds: context.activationIds,
+            warnings: context.warnings,
+        };
+    }
+    const candidates = await readPromptActivationCandidates(input);
+    const { principles, warnings } = candidates;
+    if (candidates.aborted || principles.length === 0) {
+        return {
+            route: 'legacy_trim',
+            budget: RUNTIME_V2_PRINCIPLE_BUDGET,
+            usedChars: 0,
+            truncated: false,
+            injectedPrincipleIds: [],
+            injectedActivationIds: [],
+            warnings,
+        };
+    }
+    const trimmed = trimToBudget(principles, RUNTIME_V2_PRINCIPLE_BUDGET, escapeXml);
+    const injected = principles.filter((p) => trimmed.injectedIds.has(p.principleId));
+    return {
+        route: 'legacy_trim',
+        budget: RUNTIME_V2_PRINCIPLE_BUDGET,
+        usedChars: trimmed.lines.join('\n').length,
+        truncated: trimmed.truncated,
+        injectedPrincipleIds: [...trimmed.injectedIds],
+        injectedActivationIds: injected.map((p) => p.activationId),
+        warnings,
+    };
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@principles/host-runtime",
-  "version": "0.7.7",
+  "version": "0.7.10",
   "description": "Shared host-neutral orchestration for Principles Disciple MVP-Core hook paths.",
   "type": "module",
   "main": "./dist/index.js",
@@ -21,8 +21,8 @@
     "lint": "eslint \"src/**/*.ts\""
   },
   "dependencies": {
-    "@principles/core": "^1.74.1",
-    "@principles/install-layout": "^0.2.0",
+    "@principles/core": "^1.287.5",
+    "@principles/install-layout": "^0.2.7",
     "better-sqlite3": "^13.0.3",
     "js-yaml": "^5.4.1"
   },