@principles/pd-cli 1.128.2 → 1.129.0

package/src/services/__tests__/rulehost-readiness.test.ts

@@ -0,0 +1,366 @@
+/**
+ * Unit tests for RuleHost readiness resolver (PRI-461).
+ *
+ * Tests the three readiness statuses (ready / text_principle_only / refused)
+ * against various config combinations, including the default installed config
+ * pattern from create-principles-disciple.
+ *
+ * ERR refs:
+ *   - EP-02 / ERR-024, ERR-025: tests exercise the real config resolution path
+ *   - EP-03: refused/text_principle_only include reason + nextAction
+ *   - EP-07: readiness uses the same config source as the pipeline
+ *   - EP-09: tests cover the default installed config, not just hand-written happy paths
+ */
+import { describe, it, expect, beforeEach, afterEach } from 'vitest';
+import * as fs from 'node:fs';
+import * as path from 'node:path';
+import * as os from 'node:os';
+import * as yaml from 'js-yaml';
+import { resolveRuleHostReadiness } from '../rulehost-readiness.js';
+
+// ── workspace helpers ─────────────────────────────────────────────────────
+
+function mkTmpDir(): string {
+  return fs.mkdtempSync(path.join(os.tmpdir(), 'pd-readiness-'));
+}
+
+interface ConfigOptions {
+  /** Override agent enabled flags. Defaults: all pi-ai agents enabled. */
+  readonly agentEnabled?: Partial<Record<'dreamer' | 'philosopher' | 'scribe' | 'artificer' | 'evaluator', boolean>>;
+  /** Override runtime profile type. Default: 'pi-ai'. */
+  readonly profileType?: 'pi-ai' | 'openclaw';
+  /** Override API key env var name. Default: 'TEST_API_KEY'. */
+  readonly apiKeyEnv?: string;
+  /** Override code_rule_capability feature flag. Default: true. */
+  readonly codeRuleCapabilityEnabled?: boolean;
+  /** Override profile fields. */
+  readonly profileProvider?: string;
+  readonly profileModel?: string;
+}
+
+function writeConfig(workspaceDir: string, opts: ConfigOptions = {}): void {
+  const configDir = path.join(workspaceDir, '.pd');
+  fs.mkdirSync(configDir, { recursive: true });
+
+  const profileType = opts.profileType ?? 'pi-ai';
+  const apiKeyEnv = opts.apiKeyEnv ?? 'TEST_API_KEY';
+  const profileId = profileType === 'pi-ai' ? 'pi-ai.default' : 'openclaw.default';
+
+  const profile: Record<string, unknown> = profileType === 'pi-ai'
+    ? {
+        type: 'pi-ai',
+        provider: opts.profileProvider ?? 'anthropic',
+        model: opts.profileModel ?? 'claude-sonnet',
+        apiKeyEnv,
+      }
+    : {
+        type: 'openclaw',
+        source: 'default',
+      };
+
+  const defaultEnabled: Record<string, boolean> = {
+    dreamer: true,
+    philosopher: true,
+    scribe: true,
+    artificer: true,
+    evaluator: true,
+  };
+  const agentEnabled = { ...defaultEnabled, ...opts.agentEnabled };
+
+  const cfg = {
+    version: 1,
+    features: {
+      prompt: { category: 'core', enabled: true },
+      code_tool_hook: { category: 'core', enabled: true },
+      defer_archive: { category: 'core', enabled: true },
+      code_rule_capability: { category: 'core', enabled: opts.codeRuleCapabilityEnabled ?? true },
+    },
+    runtimeProfiles: {
+      [profileId]: profile,
+    },
+    internalAgents: {
+      defaultRuntime: profileId,
+      agents: {
+        diagnostician: { enabled: true, runtimeProfile: profileId },
+        dreamer: { enabled: agentEnabled.dreamer, runtimeProfile: profileId },
+        philosopher: { enabled: agentEnabled.philosopher, runtimeProfile: profileId },
+        scribe: { enabled: agentEnabled.scribe, runtimeProfile: profileId },
+        artificer: { enabled: agentEnabled.artificer, runtimeProfile: profileId },
+        evaluator: { enabled: agentEnabled.evaluator, runtimeProfile: profileId },
+        rolloutReviewer: { enabled: false, runtimeProfile: profileId },
+        correctionObserver: { enabled: false, runtimeProfile: profileId },
+        empathyObserver: { enabled: false, runtimeProfile: profileId },
+      },
+    },
+    ui: { diagnostics: { mode: 'simple' } },
+  };
+
+  fs.writeFileSync(path.join(configDir, 'config.yaml'), yaml.dump(cfg), 'utf8');
+}
+
+/**
+ * Write the default installed config pattern from create-principles-disciple.
+ * This uses openclaw profiles and has philosopher/evaluator disabled.
+ */
+function writeDefaultInstalledConfig(workspaceDir: string): void {
+  const configDir = path.join(workspaceDir, '.pd');
+  fs.mkdirSync(configDir, { recursive: true });
+
+  const cfg = {
+    version: 1,
+    features: {
+      prompt: { category: 'core', enabled: true },
+      code_tool_hook: { category: 'core', enabled: true },
+      defer_archive: { category: 'core', enabled: true },
+      code_rule_capability: { category: 'core', enabled: true },
+    },
+    runtimeProfiles: {
+      'openclaw.default': { type: 'openclaw', source: 'default' },
+    },
+    internalAgents: {
+      defaultRuntime: 'openclaw.default',
+      agents: {
+        diagnostician: { enabled: true, runtimeProfile: 'openclaw.default' },
+        dreamer: { enabled: true, runtimeProfile: 'openclaw.default' },
+        philosopher: { enabled: false, runtimeProfile: 'openclaw.default' },
+        scribe: { enabled: true, runtimeProfile: 'openclaw.default' },
+        artificer: { enabled: true, runtimeProfile: 'openclaw.default' },
+        evaluator: { enabled: false, runtimeProfile: 'openclaw.default' },
+        rolloutReviewer: { enabled: false, runtimeProfile: 'openclaw.default' },
+        correctionObserver: { enabled: false, runtimeProfile: 'openclaw.default' },
+        empathyObserver: { enabled: false, runtimeProfile: 'openclaw.default' },
+      },
+    },
+    ui: { diagnostics: { mode: 'simple' } },
+  };
+
+  fs.writeFileSync(path.join(configDir, 'config.yaml'), yaml.dump(cfg), 'utf8');
+}
+
+function writeMalformedConfig(workspaceDir: string): void {
+  const configDir = path.join(workspaceDir, '.pd');
+  fs.mkdirSync(configDir, { recursive: true });
+  fs.writeFileSync(path.join(configDir, 'config.yaml'), 'this: is: not: valid: yaml: [', 'utf8');
+}
+
+function envLookup(env: Record<string, string | undefined>): (name: string) => string | undefined {
+  return (name) => env[name];
+}
+
+// ── tests ─────────────────────────────────────────────────────────────────
+
+describe('resolveRuleHostReadiness', () => {
+  let workspaceDir: string;
+
+  beforeEach(() => {
+    workspaceDir = mkTmpDir();
+  });
+
+  afterEach(() => {
+    try { fs.rmSync(workspaceDir, { recursive: true, force: true }); } catch { /* ignore */ }
+  });
+
+  // ── refused: config malformed ───────────────────────────────────────────
+
+  it('returns refused when config is malformed', () => {
+    writeMalformedConfig(workspaceDir);
+    const result = resolveRuleHostReadiness(workspaceDir, envLookup({}));
+    expect(result.status).toBe('refused');
+    expect(result.reason).toMatch(/config/i);
+    expect(result.nextAction).toBeDefined();
+    expect(result.nextAction.length).toBeGreaterThan(0);
+  });
+
+  // ── refused: required agent issues ──────────────────────────────────────
+
+  it('returns refused when dreamer is disabled', () => {
+    writeConfig(workspaceDir, { agentEnabled: { dreamer: false } });
+    const result = resolveRuleHostReadiness(workspaceDir, envLookup({ TEST_API_KEY: 'sk-test' }));
+    expect(result.status).toBe('refused');
+    expect(result.reason).toMatch(/dreamer/i);
+    expect(result.nextAction).toBeDefined();
+  });
+
+  it('returns refused when philosopher is disabled', () => {
+    writeConfig(workspaceDir, { agentEnabled: { philosopher: false } });
+    const result = resolveRuleHostReadiness(workspaceDir, envLookup({ TEST_API_KEY: 'sk-test' }));
+    expect(result.status).toBe('refused');
+    expect(result.reason).toMatch(/philosopher/i);
+    expect(result.nextAction).toBeDefined();
+  });
+
+  it('returns refused when scribe is disabled', () => {
+    writeConfig(workspaceDir, { agentEnabled: { scribe: false } });
+    const result = resolveRuleHostReadiness(workspaceDir, envLookup({ TEST_API_KEY: 'sk-test' }));
+    expect(result.status).toBe('refused');
+    expect(result.reason).toMatch(/scribe/i);
+    expect(result.nextAction).toBeDefined();
+  });
+
+  it('returns refused when dreamer uses openclaw profile (not pi-ai)', () => {
+    writeConfig(workspaceDir, { profileType: 'openclaw' });
+    const result = resolveRuleHostReadiness(workspaceDir, envLookup({}));
+    expect(result.status).toBe('refused');
+    expect(result.reason).toMatch(/pi-ai|openclaw|profile/i);
+    expect(result.nextAction).toBeDefined();
+  });
+
+  it('returns refused when API key env var is not set', () => {
+    writeConfig(workspaceDir, { apiKeyEnv: 'MISSING_API_KEY' });
+    // Do NOT set MISSING_API_KEY in env
+    const result = resolveRuleHostReadiness(workspaceDir, envLookup({}));
+    expect(result.status).toBe('refused');
+    expect(result.reason).toMatch(/API key|apiKeyEnv|MISSING_API_KEY/i);
+    expect(result.nextAction).toBeDefined();
+  });
+
+  it('returns refused when API key env var is set but empty', () => {
+    writeConfig(workspaceDir, { apiKeyEnv: 'EMPTY_API_KEY' });
+    const result = resolveRuleHostReadiness(workspaceDir, envLookup({ EMPTY_API_KEY: '' }));
+    expect(result.status).toBe('refused');
+    expect(result.reason).toMatch(/API key|apiKeyEnv|EMPTY_API_KEY/i);
+    expect(result.nextAction).toBeDefined();
+  });
+
+  // ── text_principle_only: code-rule capability off ───────────────────────
+
+  it('returns text_principle_only when code_rule_capability flag is OFF', () => {
+    writeConfig(workspaceDir, { codeRuleCapabilityEnabled: false });
+    const result = resolveRuleHostReadiness(workspaceDir, envLookup({ TEST_API_KEY: 'sk-test' }));
+    expect(result.status).toBe('text_principle_only');
+    expect(result.reason).toMatch(/code_rule_capability|feature flag/i);
+    expect(result.nextAction).toBeDefined();
+    expect(result.codeRuleCapability.enabled).toBe(false);
+  });
+
+  it('returns text_principle_only when evaluator is disabled', () => {
+    writeConfig(workspaceDir, { agentEnabled: { evaluator: false } });
+    const result = resolveRuleHostReadiness(workspaceDir, envLookup({ TEST_API_KEY: 'sk-test' }));
+    expect(result.status).toBe('text_principle_only');
+    expect(result.reason).toMatch(/evaluator/i);
+    expect(result.nextAction).toBeDefined();
+    expect(result.codeRuleCapability.enabled).toBe(false);
+  });
+
+  it('returns text_principle_only when artificer is disabled', () => {
+    writeConfig(workspaceDir, { agentEnabled: { artificer: false } });
+    const result = resolveRuleHostReadiness(workspaceDir, envLookup({ TEST_API_KEY: 'sk-test' }));
+    expect(result.status).toBe('text_principle_only');
+    expect(result.reason).toMatch(/artificer/i);
+    expect(result.nextAction).toBeDefined();
+    expect(result.codeRuleCapability.enabled).toBe(false);
+  });
+
+  it('returns text_principle_only when artificer API key is missing', () => {
+    // Use a config where artificer has a different profile with a missing API key
+    const configDir = path.join(workspaceDir, '.pd');
+    fs.mkdirSync(configDir, { recursive: true });
+    const cfg = {
+      version: 1,
+      features: {
+        prompt: { category: 'core', enabled: true },
+        code_tool_hook: { category: 'core', enabled: true },
+        defer_archive: { category: 'core', enabled: true },
+        code_rule_capability: { category: 'core', enabled: true },
+      },
+      runtimeProfiles: {
+        'pi-ai.main': { type: 'pi-ai', provider: 'anthropic', model: 'claude-sonnet', apiKeyEnv: 'MAIN_API_KEY' },
+        'pi-ai.artificer': { type: 'pi-ai', provider: 'openrouter', model: 'gpt-4', apiKeyEnv: 'ARTIFICER_API_KEY' },
+      },
+      internalAgents: {
+        defaultRuntime: 'pi-ai.main',
+        agents: {
+          diagnostician: { enabled: true, runtimeProfile: 'pi-ai.main' },
+          dreamer: { enabled: true, runtimeProfile: 'pi-ai.main' },
+          philosopher: { enabled: true, runtimeProfile: 'pi-ai.main' },
+          scribe: { enabled: true, runtimeProfile: 'pi-ai.main' },
+          artificer: { enabled: true, runtimeProfile: 'pi-ai.artificer' },
+          evaluator: { enabled: true, runtimeProfile: 'pi-ai.main' },
+          rolloutReviewer: { enabled: false, runtimeProfile: 'pi-ai.main' },
+          correctionObserver: { enabled: false, runtimeProfile: 'pi-ai.main' },
+          empathyObserver: { enabled: false, runtimeProfile: 'pi-ai.main' },
+        },
+      },
+      ui: { diagnostics: { mode: 'simple' } },
+    };
+    fs.writeFileSync(path.join(configDir, 'config.yaml'), yaml.dump(cfg), 'utf8');
+
+    // Do NOT set ARTIFICER_API_KEY
+    const result = resolveRuleHostReadiness(workspaceDir, envLookup({ MAIN_API_KEY: 'sk-main' }));
+    expect(result.status).toBe('text_principle_only');
+    expect(result.reason).toMatch(/artificer|ARTIFICER_API_KEY/i);
+    expect(result.nextAction).toBeDefined();
+    expect(result.codeRuleCapability.enabled).toBe(false);
+  });
+
+  // ── ready: all conditions met ───────────────────────────────────────────
+
+  it('returns ready when all agents enabled with pi-ai profiles and API keys set', () => {
+    writeConfig(workspaceDir, {});
+    const result = resolveRuleHostReadiness(workspaceDir, envLookup({ TEST_API_KEY: 'sk-test' }));
+    expect(result.status).toBe('ready');
+    expect(result.codeRuleCapability.enabled).toBe(true);
+  });
+
+  // ── default installed config (EP-09) ────────────────────────────────────
+
+  it('returns refused for the default installed config (openclaw profiles, philosopher/evaluator disabled)', () => {
+    writeDefaultInstalledConfig(workspaceDir);
+    const result = resolveRuleHostReadiness(workspaceDir, envLookup({}));
+    // Default config uses openclaw profiles — dreamer/scribe can't get pi-ai adapters.
+    // Philosopher is also disabled. So the status is refused.
+    expect(result.status).toBe('refused');
+    expect(result.reason).toBeDefined();
+    expect(result.reason.length).toBeGreaterThan(0);
+    expect(result.nextAction).toBeDefined();
+    expect(result.nextAction.length).toBeGreaterThan(0);
+  });
+
+  // ── result structure ────────────────────────────────────────────────────
+
+  it('includes per-agent statuses in the result', () => {
+    writeConfig(workspaceDir, {});
+    const result = resolveRuleHostReadiness(workspaceDir, envLookup({ TEST_API_KEY: 'sk-test' }));
+    expect(result.agentStatuses).toBeDefined();
+    expect(result.agentStatuses.dreamer).toBeDefined();
+    expect(result.agentStatuses.philosopher).toBeDefined();
+    expect(result.agentStatuses.scribe).toBeDefined();
+    expect(result.agentStatuses.artificer).toBeDefined();
+    expect(result.agentStatuses.evaluator).toBeDefined();
+  });
+
+  it('includes codeRuleCapability in the result', () => {
+    writeConfig(workspaceDir, { codeRuleCapabilityEnabled: false });
+    const result = resolveRuleHostReadiness(workspaceDir, envLookup({ TEST_API_KEY: 'sk-test' }));
+    expect(result.codeRuleCapability).toBeDefined();
+    expect(result.codeRuleCapability.enabled).toBe(false);
+    expect(result.codeRuleCapability.disabledReason).toBeDefined();
+  });
+
+  // ── env var injection ───────────────────────────────────────────────────
+
+  it('uses injected getEnvVar callback instead of process.env', () => {
+    writeConfig(workspaceDir, { apiKeyEnv: 'INJECTED_KEY' });
+    // Do NOT set INJECTED_KEY in process.env
+    const result = resolveRuleHostReadiness(workspaceDir, (name) => {
+      if (name === 'INJECTED_KEY') return 'sk-injected';
+      return undefined;
+    });
+    expect(result.status).toBe('ready');
+  });
+
+  // ── Runtime Contract #9: graceful degradation with reason ────────────────
+
+  it('returns refused when getEnvVar throws (Runtime Contract #9: never throws)', () => {
+    writeConfig(workspaceDir, { apiKeyEnv: 'TEST_KEY' });
+    const throwingGetEnv = (): string => {
+      throw new Error('env access failed');
+    };
+    const result = resolveRuleHostReadiness(workspaceDir, throwingGetEnv);
+    expect(result.status).toBe('refused');
+    expect(result.reason).toContain('readiness_resolution_failed');
+    expect(result.reason).toContain('env access failed');
+    expect(result.nextAction).toBeDefined();
+    expect(result.codeRuleCapability.enabled).toBe(false);
+  });
+});

package/src/services/rulehost-readiness.ts

@@ -0,0 +1,326 @@
+/**
+ * RuleHost Readiness Resolver — PRI-461
+ *
+ * Checks all preconditions for `run-rulehost` BEFORE constructing adapters,
+ * returning one of three user-visible statuses:
+ *   - `ready`: all agents enabled with pi-ai profiles and API keys; code-rule capability ON
+ *   - `text_principle_only`: dreamer/philosopher/scribe ready, but code-rule capability OFF
+ *     (flag disabled, or artificer/evaluator not ready)
+ *   - `refused`: dreamer/philosopher/scribe chain broken (disabled, wrong profile, missing API key,
+ *     or config malformed)
+ *
+ * This module NEVER throws. It always returns a structured result with reason + nextAction,
+ * so the CLI handler can emit a clear status instead of an opaque adapter-resolution failure.
+ *
+ * ERR refs:
+ *   - EP-02 / ERR-024, ERR-025: wired into the production handler path (runtime-internalization-run-rulehost.ts)
+ *   - EP-03: refused/text_principle_only include reason + nextAction
+ *   - EP-07: uses the same config source as the pipeline (resolveRuntimeFromPdConfig)
+ *   - EP-09: tests cover the default installed config pattern
+ */
+
+import {
+  resolveAgentRuntimeBinding,
+  checkAgentRuntimeReadiness,
+  computeFeatureFlagsFromConfig,
+  isFeatureEnabled,
+} from '@principles/core/runtime-v2';
+import type {
+  EffectivePdConfig,
+  RuntimeProfile,
+} from '@principles/core/runtime-v2';
+import { resolveRuntimeFromPdConfig } from './resolve-runtime-from-pd-config.js';
+
+// ── Types ────────────────────────────────────────────────────────────────────
+
+export type RuleHostReadinessStatus = 'ready' | 'text_principle_only' | 'refused';
+
+export interface AgentReadiness {
+  readonly status: 'ready' | 'disabled' | 'not_ready' | 'needs_setup' | 'wrong_profile_type';
+  readonly reason?: string;
+  readonly nextAction?: string;
+  readonly profileId?: string;
+  readonly profileType?: string;
+}
+
+export interface CodeRuleCapabilityReadiness {
+  readonly enabled: boolean;
+  readonly disabledReason?: string;
+}
+
+export interface RuleHostReadinessResult {
+  readonly status: RuleHostReadinessStatus;
+  readonly reason: string;
+  readonly nextAction: string;
+  readonly agentStatuses: {
+    readonly dreamer: AgentReadiness;
+    readonly philosopher: AgentReadiness;
+    readonly scribe: AgentReadiness;
+    readonly artificer: AgentReadiness;
+    readonly evaluator: AgentReadiness;
+  };
+  readonly codeRuleCapability: CodeRuleCapabilityReadiness;
+}
+
+/**
+ * The 5 internal agents that RuleHost readiness checks.
+ * Narrowed from InternalAgentName so array iteration indexes a known-shape map.
+ */
+type RuleHostAgentName = 'dreamer' | 'philosopher' | 'scribe' | 'artificer' | 'evaluator';
+
+/**
+ * Mutable builder type for agentStatuses during construction.
+ * The readonly RuleHostReadinessResult['agentStatuses'] is assigned from this.
+ */
+interface AgentStatusesMap {
+  dreamer: AgentReadiness;
+  philosopher: AgentReadiness;
+  scribe: AgentReadiness;
+  artificer: AgentReadiness;
+  evaluator: AgentReadiness;
+}
+
+// ── Constants ─────────────────────────────────────────────────────────────────
+
+/**
+ * Agents required for the text-principle path (dreamer → philosopher → scribe).
+ * If any of these is not ready, the pipeline cannot produce even text principles.
+ */
+const REQUIRED_AGENTS: readonly RuleHostAgentName[] = ['dreamer', 'philosopher', 'scribe'];
+
+/**
+ * Agents required for the code-rule capability (artificer + evaluator).
+ * Both must be ready for the adversarial loop to run.
+ */
+const CODE_RULE_AGENTS: readonly RuleHostAgentName[] = ['artificer', 'evaluator'];
+
+// ── Implementation ────────────────────────────────────────────────────────────
+
+/**
+ * Check a single agent's readiness for the RuleHost pipeline.
+ *
+ * Checks (in order):
+ *   1. Agent enabled (via resolveAgentRuntimeBinding)
+ *   2. Profile exists (via resolveAgentRuntimeBinding)
+ *   3. Profile type is 'pi-ai' (RuleHost needs PiAiRuntimeAdapter)
+ *   4. Profile is ready (via checkAgentRuntimeReadiness — provider/model/apiKeyEnv set, env var exists)
+ *
+ * Returns a structured AgentReadiness result. Never throws.
+ */
+function checkAgentReadiness(
+  effective: EffectivePdConfig,
+  agentName: RuleHostAgentName,
+  getEnvVar: (name: string) => string | undefined,
+): AgentReadiness {
+  const binding = resolveAgentRuntimeBinding(effective, agentName);
+
+  if (!binding.ok) {
+    return {
+      status: binding.readiness === 'disabled' ? 'disabled' : binding.readiness === 'needs_setup' ? 'needs_setup' : 'not_ready',
+      reason: binding.reason,
+      nextAction: binding.nextAction,
+    };
+  }
+
+  const profile: RuntimeProfile = binding.profile;
+  const profileType = profile.type;
+
+  // RuleHost pipeline constructs PiAiRuntimeAdapter instances, so the profile
+  // must be pi-ai. OpenClaw profiles delegate to OpenClaw's own runtime, which
+  // is not available in the RuleHost pipeline context.
+  if (profileType !== 'pi-ai') {
+    return {
+      status: 'wrong_profile_type',
+      reason: `Agent '${agentName}' uses profile '${binding.profileId}' with type '${profileType}', but RuleHost requires pi-ai profile type`,
+      nextAction: `Add a pi-ai runtime profile to .pd/config.yaml and assign it to ${agentName} via internalAgents.agents.${agentName}.runtimeProfile`,
+      profileId: binding.profileId,
+      profileType,
+    };
+  }
+
+  const readiness = checkAgentRuntimeReadiness(profile, getEnvVar);
+  if (readiness.readiness !== 'ready') {
+    return {
+      status: readiness.readiness === 'needs_setup' ? 'needs_setup' : 'not_ready',
+      reason: readiness.reason,
+      nextAction: readiness.nextAction,
+      profileId: binding.profileId,
+      profileType,
+    };
+  }
+
+  return {
+    status: 'ready',
+    profileId: binding.profileId,
+    profileType,
+  };
+}
+
+// ── Helpers (defined before public function to satisfy no-use-before-define) ──
+
+interface ReadinessResultParts {
+  readonly agentStatuses: AgentStatusesMap;
+  readonly codeRuleCapability: CodeRuleCapabilityReadiness;
+}
+
+function emptyAgentStatuses(): AgentStatusesMap {
+  const empty: AgentReadiness = { status: 'not_ready', reason: 'not checked' };
+  return {
+    dreamer: empty,
+    philosopher: empty,
+    scribe: empty,
+    artificer: empty,
+    evaluator: empty,
+  };
+}
+
+function buildRefusedResult(
+  reason: string,
+  nextAction: string,
+  parts: ReadinessResultParts,
+): RuleHostReadinessResult {
+  return {
+    status: 'refused',
+    reason,
+    nextAction,
+    agentStatuses: parts.agentStatuses,
+    codeRuleCapability: parts.codeRuleCapability,
+  };
+}
+
+function buildTextPrincipleOnlyResult(
+  reason: string,
+  nextAction: string,
+  parts: ReadinessResultParts,
+): RuleHostReadinessResult {
+  return {
+    status: 'text_principle_only',
+    reason,
+    nextAction,
+    agentStatuses: parts.agentStatuses,
+    codeRuleCapability: parts.codeRuleCapability,
+  };
+}
+
+function resolveRuleHostReadinessUnchecked(
+  workspaceDir: string,
+  getEnvVar: (name: string) => string | undefined,
+): RuleHostReadinessResult {
+  // ── Step 1: Load config ──
+  const { configLoadResult } = resolveRuntimeFromPdConfig(workspaceDir, getEnvVar);
+
+  if (!configLoadResult.ok) {
+    const [firstError] = configLoadResult.errors;
+    const reason = `config_malformed: ${firstError?.reason ?? 'unknown config error'}`;
+    const nextAction = firstError?.nextAction ?? 'Fix .pd/config.yaml syntax and retry';
+    return buildRefusedResult(reason, nextAction, {
+      agentStatuses: emptyAgentStatuses(),
+      codeRuleCapability: { enabled: false, disabledReason: 'config_malformed' },
+    });
+  }
+
+  const { effective } = configLoadResult;
+
+  // ── Step 2: Check required agents (dreamer, philosopher, scribe) ──
+  // Start with all 5 keys set to 'not checked'; updated as each agent is checked.
+  const agentStatuses: AgentStatusesMap = emptyAgentStatuses();
+  const requiredFailures: string[] = [];
+
+  for (const agentName of REQUIRED_AGENTS) {
+    const readiness = checkAgentReadiness(effective, agentName, getEnvVar);
+    agentStatuses[agentName] = readiness;
+    if (readiness.status !== 'ready') {
+      requiredFailures.push(`${agentName}: ${readiness.reason ?? readiness.status}`);
+    }
+  }
+
+  if (requiredFailures.length > 0) {
+    const reason = `required_agents_not_ready: ${requiredFailures.join('; ')}`;
+    const nextAction = `Fix the following agent issues in .pd/config.yaml: ${requiredFailures.join('; ')}. RuleHost requires dreamer, philosopher, and scribe agents to be enabled with pi-ai runtime profiles and valid API keys.`;
+    return buildRefusedResult(reason, nextAction, {
+      agentStatuses,
+      codeRuleCapability: { enabled: false, disabledReason: 'required_agents_not_ready' },
+    });
+  }
+
+  // ── Step 3: Check code_rule_capability feature flag ──
+  const featureFlags = computeFeatureFlagsFromConfig(effective);
+  if (!isFeatureEnabled(featureFlags, 'code_rule_capability')) {
+    const reason = 'code_rule_capability feature flag is disabled';
+    const nextAction = "Enable code_rule_capability in .pd/config.yaml features.code_rule_capability.enabled to run the full adversarial pipeline. Text-principle-only mode is available.";
+    // Still check artificer/evaluator for reporting, but they don't affect the status
+    for (const agentName of CODE_RULE_AGENTS) {
+      agentStatuses[agentName] = checkAgentReadiness(effective, agentName, getEnvVar);
+    }
+    return buildTextPrincipleOnlyResult(reason, nextAction, {
+      agentStatuses,
+      codeRuleCapability: { enabled: false, disabledReason: reason },
+    });
+  }
+
+  // ── Step 4: Check code-rule agents (artificer, evaluator) ──
+  const codeRuleFailures: string[] = [];
+
+  for (const agentName of CODE_RULE_AGENTS) {
+    const readiness = checkAgentReadiness(effective, agentName, getEnvVar);
+    agentStatuses[agentName] = readiness;
+    if (readiness.status !== 'ready') {
+      codeRuleFailures.push(`${agentName}: ${readiness.reason ?? readiness.status}`);
+    }
+  }
+
+  if (codeRuleFailures.length > 0) {
+    const reason = `code_rule_agents_not_ready: ${codeRuleFailures.join('; ')}`;
+    const nextAction = `Fix the following agent issues to enable code-rule capability: ${codeRuleFailures.join('; ')}. Text-principle-only mode is available with the current configuration.`;
+    return buildTextPrincipleOnlyResult(reason, nextAction, {
+      agentStatuses,
+      codeRuleCapability: { enabled: false, disabledReason: reason },
+    });
+  }
+
+  // ── Step 5: All checks pass → ready ──
+  return {
+    status: 'ready',
+    reason: 'All agents ready with pi-ai profiles and valid API keys. Code-rule capability is ON.',
+    nextAction: 'Pass --confirm to run the full pipeline.',
+    agentStatuses,
+    codeRuleCapability: { enabled: true },
+  };
+}
+
+/**
+ * Resolve RuleHost readiness from the workspace's .pd/config.yaml.
+ *
+ * This is the production entry point called by the `run-rulehost` handler
+ * BEFORE constructing any adapters. It returns a structured result so the
+ * handler can emit a clear status instead of an opaque adapter-resolution failure.
+ *
+ * This function NEVER throws. Any unexpected exception from config loading,
+ * feature-flag computation, agent checks, or getEnvVar is caught and converted
+ * to a `refused` result with reason + nextAction (Runtime Contract #9).
+ *
+ * @param workspaceDir - The workspace directory containing .pd/config.yaml
+ * @param getEnvVar - Env var accessor, defaults to process.env. Injected for testability.
+ * @returns Structured readiness result. Never throws.
+ */
+export function resolveRuleHostReadiness(
+  workspaceDir: string,
+  getEnvVar: (name: string) => string | undefined = (name) => process.env[name],
+): RuleHostReadinessResult {
+  try {
+    return resolveRuleHostReadinessUnchecked(workspaceDir, getEnvVar);
+  } catch (error: unknown) {
+    const message =
+      error instanceof Error && error.message.length > 0
+        ? error.message
+        : 'unknown readiness resolution error';
+    return buildRefusedResult(
+      `readiness_resolution_failed: ${message}`,
+      'Fix the readiness resolution error and retry. Run `pd config doctor` for diagnostics.',
+      {
+        agentStatuses: emptyAgentStatuses(),
+        codeRuleCapability: { enabled: false, disabledReason: 'readiness_resolution_failed' },
+      },
+    );
+  }
+}