@principles/host-runtime 0.7.8 → 0.7.11

package/dist/active-principle-prompt.d.ts

@@ -1,4 +1,4 @@
-import { type ActivatedPrinciple } from '@principles/core/runtime-v2';
+import { type ActivatedPrinciple, type PromptSelectionPolicy } from '@principles/core/runtime-v2';
 export interface ActivePrinciplePromptResult {
     additionalContext: string;
     principleIds: string[];
@@ -11,6 +11,16 @@ export interface ActivePrinciplePromptResult {
     excludedCount: number;
     exclusionReason?: 'host_principle_overlap';
     allValidatedPrinciplesExcluded: boolean;
+    /** PRI-904: budget-packing policy that produced this selection. */
+    selectionPolicy?: PromptSelectionPolicy;
+    /** PRI-904: candidates that reached the budget selector. */
+    eligibleCount?: number;
+    /** PRI-904: circular scan start; present only under fair_rotation_v1. */
+    rotationStartIndex?: number;
+    /** PRI-904 (bounded, max 16): activation ids dropped for insufficient remaining budget. */
+    droppedActivationIds?: string[];
+    /** PRI-904 (bounded, max 16): activation ids that cannot fit even in an empty payload. */
+    oversizedActivationIds?: string[];
 }
 export interface PromptActivationCandidates {
     principles: ActivatedPrinciple[];
@@ -34,4 +44,10 @@ export declare function readPromptActivationCandidates(input: {
 export declare function buildActivePrinciplePromptContext(input: {
     workspaceDir: string;
     excludePrincipleIds?: ReadonlySet<string>;
+    /**
+     * PRI-904 fair-rotation round key (derive via roundKeyFromRunIdentity from
+     * the host run/turn id). Absent → legacy FIFO prefix policy (rollback /
+     * characterization baseline).
+     */
+    roundKey?: number;
 }): Promise<ActivePrinciplePromptResult>;

package/dist/active-principle-prompt.js

@@ -3,6 +3,8 @@ import fs from 'node:fs';
 import path from 'node:path';
 import { escapeXml } from '@principles/core/prompt-builder';
 import { loadPdConfigForPlugin } from './pd-config.js';
+/** PRI-904 SPEC §10: bounded diagnostic id lists (mirrors the core selector's cap of 16). */
+const MAX_SHARED_DIAGNOSTIC_IDS = 16;
 /**
  * PR #1844 follow-up: the activation READ half of buildActivePrinciplePromptContext,
  * exported so the console budget projection can share the exact same input
@@ -85,17 +87,49 @@ export async function buildActivePrinciplePromptContext(input) {
             additionalContext: '', principleIds: [], activationIds: [], artifactIds: [], warnings,
             budget: RUNTIME_V2_PRINCIPLE_BUDGET, truncated: false, excludedPrincipleIds,
             excludedCount: excludedPrincipleIds.length, allValidatedPrinciplesExcluded: false,
+            selectionPolicy: 'legacy_fifo_prefix_v1', eligibleCount: 0,
         };
     }
     const included = [];
     let additionalContext = '';
     let truncated = false;
-    for (const principle of principles) {
+    // PRI-904: same fair-rotation semantics as the plugin route's trimToBudget —
+    // deterministic rotating start over the base (ASC) candidate order, circular
+    // scan, continue-on-non-fit. Costs are measured with the REAL serializer
+    // (renderPrinciplesToDirectives) so budget accounting stays exact here too.
+    const { roundKey } = input;
+    const selectionPolicy = roundKey === undefined || principles.length === 0 ? 'legacy_fifo_prefix_v1' : 'fair_rotation_v1';
+    const n = principles.length;
+    // Guard on the policy, not just the key: an all-excluded candidate list has
+    // n === 0 and must not emit a NaN start (core trimToBudget omits the field
+    // for empty input — parity requires the same here).
+    const rotationStartIndex = selectionPolicy === 'fair_rotation_v1' && roundKey !== undefined
+        ? ((roundKey % n) + n) % n
+        : undefined;
+    const droppedActivationIds = [];
+    const oversizedActivationIds = [];
+    const standaloneFits = (principle) => renderPrinciplesToDirectives([principle], new Set([principle.principleId]), { escapeFn: escapeXml, selfReportInstruction: selfReportEnabled }).length
+        <= RUNTIME_V2_PRINCIPLE_BUDGET;
+    const scanOrder = rotationStartIndex === undefined
+        ? principles
+        : principles.slice(rotationStartIndex).concat(principles.slice(0, rotationStartIndex));
+    for (const principle of scanOrder) {
         const candidate = [...included, principle];
         const candidateContext = renderPrinciplesToDirectives(candidate, new Set(candidate.map((entry) => entry.principleId)), { escapeFn: escapeXml, selfReportInstruction: selfReportEnabled });
         if (candidateContext.length > RUNTIME_V2_PRINCIPLE_BUDGET) {
-            truncated = true;
-            break;
+            if (standaloneFits(principle)) {
+                // Fits alone but not now — normal budget truncation.
+                truncated = true;
+                if (droppedActivationIds.length < MAX_SHARED_DIAGNOSTIC_IDS)
+                    droppedActivationIds.push(principle.activationId);
+            }
+            else if (oversizedActivationIds.length < MAX_SHARED_DIAGNOSTIC_IDS) {
+                // Can never fit alone — oversize, not starvation (PRI-904 SPEC §6.6).
+                oversizedActivationIds.push(principle.activationId);
+            }
+            if (selectionPolicy === 'legacy_fifo_prefix_v1')
+                break;
+            continue;
         }
         included.push(principle);
         additionalContext = candidateContext;
@@ -116,5 +150,10 @@ export async function buildActivePrinciplePromptContext(input) {
         excludedCount: excludedPrincipleIds.length,
         allValidatedPrinciplesExcluded: excludedPrincipleIds.length > 0 && principles.length === 0,
         ...(excludedPrincipleIds.length > 0 ? { exclusionReason: 'host_principle_overlap' } : {}),
+        selectionPolicy,
+        eligibleCount: principles.length,
+        ...(rotationStartIndex !== undefined ? { rotationStartIndex } : {}),
+        ...(droppedActivationIds.length > 0 ? { droppedActivationIds } : {}),
+        ...(oversizedActivationIds.length > 0 ? { oversizedActivationIds } : {}),
     };
 }

package/dist/index.js

@@ -177,6 +177,16 @@ export function createProductionHostRuntime(options = {}) {
         }),
         beforeToolCall: options.beforeToolCall ?? productionGate,
         async beforePromptBuild(event) {
+            // PRI-904 Phase-1 (Option 3): this production path is ALSO the Codex
+            // route, and Codex never writes trajectory.db::user_turns — its
+            // ingestion writes governance_* rows instead. Reading a session turn
+            // ordinal here would therefore be a false round authority: on Codex it
+            // either throws (→ legacy) or returns a constant 1 (→ fixed start, a
+            // different positional starvation while the event still claimed a fair
+            // rotation). So the shared production path passes NO round key and
+            // reports `legacy_fifo_prefix_v1` honestly. The selector's fair-rotation
+            // capability is retained and stays reachable for callers that DO hold a
+            // legitimate advancing round authority.
             const prompt = await buildActivePrinciplePromptContext({
                 workspaceDir: event.context.workspaceDir,
                 excludePrincipleIds: options.promptExcludePrincipleIds?.(event),
@@ -203,6 +213,14 @@ export function createProductionHostRuntime(options = {}) {
                     budget: RUNTIME_V2_PRINCIPLE_BUDGET,
                     ...(prompt.truncated !== undefined ? { v2Truncated: prompt.truncated } : {}),
                     ...(event.context.turnId !== undefined ? { runId: event.context.turnId } : {}),
+                    // PRI-904: selection diagnostics (bounded, optional). On this route
+                    // the policy is legacy_fifo_prefix_v1 and NO rotation provenance is
+                    // emitted — a fair claim would be untrue here (see above).
+                    ...(prompt.selectionPolicy !== undefined ? { selectionPolicy: prompt.selectionPolicy } : {}),
+                    ...(prompt.eligibleCount !== undefined ? { eligibleCount: prompt.eligibleCount } : {}),
+                    ...(prompt.rotationStartIndex !== undefined ? { rotationStartIndex: prompt.rotationStartIndex } : {}),
+                    ...(prompt.droppedActivationIds !== undefined && prompt.droppedActivationIds.length > 0 ? { droppedActivationIds: prompt.droppedActivationIds } : {}),
+                    ...(prompt.oversizedActivationIds !== undefined && prompt.oversizedActivationIds.length > 0 ? { oversizedActivationIds: prompt.oversizedActivationIds } : {}),
                 });
             }
             catch (err) {

package/dist/internalization-consumer-cycle.js

@@ -20,7 +20,7 @@
  * Hosts inject: a logger, a structured-event sink, their tool catalog, and an
  * env getter. Everything else is the existing production path.
  */
-import { createRuntimeStateHandle, InternalizationOrchestrator, DreamerRunner, PhilosopherRunner, ScribeRunner, ArtificerRunner, buildArtificerHostSemanticContext, EvaluatorRunner, RolloutReviewerRunner, DefaultDreamerValidator, DefaultPhilosopherValidator, DefaultScribeValidator, DefaultArtificerValidator, DefaultEvaluatorValidator, DefaultRolloutReviewerValidator, PiAiRuntimeAdapter, L2AgentLoopAdapter, ArtificerL2Adapter, buildL2PrincipleReaderFromLedger, OpenClawCliRuntimeAdapter, storeEmitter, createProductionGateDeps, resolveRuntimeConfigFromPdConfig, resolveRuntimeConfigForAgent, AGENT_NAME_FOR_TASK_KIND, isRuntimeConfigError, computeConsumerDecision, FULL_CHAIN_CONSUMER_RUNNER_KINDS, DEFAULT_CONSUMER_RUNNER_KINDS, InternalizationQueueReadModel, MVP_CORE_TASK_KINDS, SqliteConnection, SqliteReconciliationCursorStore, SUCCEEDED_TRANSITIONS_SCOPE, 
+import { createRuntimeStateHandle, InternalizationOrchestrator, DreamerRunner, PhilosopherRunner, ScribeRunner, ArtificerRunner, buildArtificerHostSemanticContext, EvaluatorRunner, RolloutReviewerRunner, DefaultDreamerValidator, DefaultPhilosopherValidator, DefaultScribeValidator, DefaultArtificerValidator, DefaultEvaluatorValidator, DefaultRolloutReviewerValidator, PiAiRuntimeAdapter, L2AgentLoopAdapter, ArtificerL2Adapter, buildL2PrincipleReaderFromLedger, OpenClawCliRuntimeAdapter, storeEmitter, createProductionGateDeps, resolveRuntimeConfigFromPdConfig, resolveRuntimeConfigForAgent, AGENT_NAME_FOR_TASK_KIND, isRuntimeConfigError, computeConsumerDecision, FULL_CHAIN_CONSUMER_RUNNER_KINDS, DEFAULT_CONSUMER_RUNNER_KINDS, InternalizationQueueReadModel, MVP_CORE_TASK_KINDS, SqliteConnection, SqliteReconciliationCursorStore, SUCCEEDED_TRANSITIONS_SCOPE, PrincipleTreeLedgerAdapter, 
 // PRI-714: resolve outputLanguage from the same effective config the
 // runners already receive (EP-07: canonical resolved value, not raw input).
 resolveOutputLanguage, } from '@principles/core/runtime-v2';
@@ -459,7 +459,18 @@ export async function runInternalizationConsumerCycle(workspaceDir, ports) {
                 runner = new PhilosopherRunner({ stateManager, runtimeAdapter: adapter, eventEmitter: storeEmitter, artifactStore: stateManager.piArtifactStore, validator: new DefaultPhilosopherValidator() }, runnerOptions);
                 break;
             case 'scribe':
-                runner = new ScribeRunner({ stateManager, runtimeAdapter: adapter, eventEmitter: storeEmitter, artifactStore: stateManager.piArtifactStore, validator: new DefaultScribeValidator() }, runnerOptions);
+                runner = new ScribeRunner({
+                    stateManager, runtimeAdapter: adapter, eventEmitter: storeEmitter, artifactStore: stateManager.piArtifactStore, validator: new DefaultScribeValidator(),
+                    // I2 — CHAIN STAMPING (Owner review of PR #1856, P1): the scribe
+                    // stamps the ledger principle UUID (minted at intake, keyed by the
+                    // dreamer task seed's candidateId) onto the artifact it writes, so
+                    // the dispatcher's ledger identity gate sees a resolvable
+                    // identity on the live production chain. listForCandidate reads
+                    // the ledger from disk per call — no cross-cycle staleness.
+                    ledgerIdentity: {
+                        listForCandidate: (candidateId) => new PrincipleTreeLedgerAdapter({ stateDir: `${workspaceDir}/.state` }).listForCandidate(candidateId),
+                    },
+                }, runnerOptions);
                 break;
             case 'artificer':
                 runner = new ArtificerRunner({ stateManager, runtimeAdapter: adapter, eventEmitter: storeEmitter, artifactStore: stateManager.piArtifactStore, validator: new DefaultArtificerValidator() }, 
@@ -483,6 +494,14 @@ export async function runInternalizationConsumerCycle(workspaceDir, ports) {
                 runner = new EvaluatorRunner({
                     stateManager, runtimeAdapter: adapter, eventEmitter: workspaceEmitter,
                     artifactStore: stateManager.piArtifactStore, validator: new DefaultEvaluatorValidator(),
+                    // PRI-911A (I1 writer boundary): the rule artifact's identity is a
+                    // ledger UUID or nothing. hasPrinciple turns "UUID-shaped" into
+                    // "UUID the ledger actually mints", so a shaped-but-unknown id is
+                    // refused as invalid_identity instead of being carried forward.
+                    // Same per-call disk read as the scribe wiring above.
+                    ledgerIdentity: {
+                        hasPrinciple: (principleId) => new PrincipleTreeLedgerAdapter({ stateDir: `${workspaceDir}/.state` }).hasPrinciple(principleId),
+                    },
                     ...createEvaluatorRepairDeps(workspaceDir, stateManager, logger),
                 }, {
                     ...runnerOptions,

package/dist/internalization-consumer-governance.js

@@ -14,7 +14,7 @@
  * dedupes by `${artifactId}::${channel}`; reopen idempotency is owned by
  * orchestrator.reopenTaskForRevision.
  */
-import { ActivationDispatcher, PromptWriter, DeferArchiveWriter, RuleHostWriter, SqliteConnection, SqliteActivationStateStore, SqliteApprovalQueueStore, SqlitePIArtifactStore, createProductionGateDeps, createPITaskDiagnosticJson, artificerRepairTaskId, computeFeatureFlagsFromConfig, isFeatureEnabled, } from '@principles/core/runtime-v2';
+import { ActivationDispatcher, PromptWriter, DeferArchiveWriter, RuleHostWriter, SqliteConnection, SqliteActivationStateStore, SqliteApprovalQueueStore, SqlitePIArtifactStore, PrincipleTreeLedgerAdapter, createProductionGateDeps, createPITaskDiagnosticJson, artificerRepairTaskId, computeFeatureFlagsFromConfig, isFeatureEnabled, } from '@principles/core/runtime-v2';
 import { loadPdConfigForPlugin } from './pd-config.js';
 function normalizeDecision(decision) {
     if (decision.decision === 'activated') {
@@ -64,6 +64,27 @@ export async function dispatchRolloutActivation(workspaceDir, input, options = {
         const activationStateStore = new SqliteActivationStateStore(connection);
         const approvalQueueStore = new SqliteApprovalQueueStore(connection);
         const flagProbe = makeFlagProbe(workspaceDir);
+        // I3 upgrade (Owner review of PR #1856, P1): the production dispatch path
+        // verifies ledger membership BEFORE the approval record and the activation
+        // commit. The ledger SSOT lives in <workspace>/.state (same dir the intake
+        // used to mint the principle UUID); candidate lineage reuses the artifact
+        // read model plus raw diagnostic_json reads.
+        const ledgerIdentity = {
+            ledger: new PrincipleTreeLedgerAdapter({ stateDir: `${workspaceDir}/.state` }),
+            getArtifactById: artifactReadModel.getArtifactById,
+            getTaskDiagnosticJson: (taskId) => {
+                try {
+                    const row = connection
+                        .getDb()
+                        .prepare('SELECT diagnostic_json FROM tasks WHERE task_id = ?')
+                        .get(taskId);
+                    return row?.diagnostic_json ?? null;
+                }
+                catch {
+                    return null;
+                }
+            },
+        };
         const dispatcher = new ActivationDispatcher(artifactReadModel, activationStateStore, {
             writers: [
                 new PromptWriter(),
@@ -79,6 +100,7 @@ export async function dispatchRolloutActivation(workspaceDir, input, options = {
                 new DeferArchiveWriter(),
             ],
             approvalQueueStore,
+            ledgerIdentity,
         });
         const decision = await dispatcher.dispatch({
             artifactId: input.artifactId,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@principles/host-runtime",
-  "version": "0.7.8",
+  "version": "0.7.11",
   "description": "Shared host-neutral orchestration for Principles Disciple MVP-Core hook paths.",
   "type": "module",
   "main": "./dist/index.js",
@@ -21,7 +21,7 @@
     "lint": "eslint \"src/**/*.ts\""
   },
   "dependencies": {
-    "@principles/core": "^1.287.2",
+    "@principles/core": "^1.287.6",
     "@principles/install-layout": "^0.2.7",
     "better-sqlite3": "^13.0.3",
     "js-yaml": "^5.4.1"