@principles/pd-cli 1.138.0 → 1.140.0

package/src/commands/__tests__/runtime-activation-nextaction.test.ts

@@ -34,15 +34,17 @@ describe('deriveActivationStatusAndNextAction', () => {
     expect(nextAction).not.toContain('--confirm');
   });
 
-  it('shadow mode: promote nextAction MUST contain --confirm', () => {
+  it('shadow mode: nextAction requires Owner review instead of advertising direct mutation', () => {
     const { status, nextAction } = deriveActivationStatusAndNextAction({
       ...base,
       mode: 'shadow',
     });
     expect(status).toBe('active');
     expect(nextAction).toBeDefined();
-    expect(nextAction).toContain('pd activation promote');
-    expect(nextAction).toContain('--confirm');
+    expect(nextAction).toBe(
+      'Keep shadow; promotion requires an authenticated Owner decision, immutable evidence bindings, and a passing Promotion Readiness result.',
+    );
+    expect(nextAction).not.toContain('pd activation promote');
   });
 
   it('deactivated record: status deactivated, no nextAction', () => {

package/src/commands/runtime-activation.ts

@@ -1,4 +1,6 @@
 import * as path from 'path';
+import * as fs from 'node:fs';
+import { createHash, randomUUID } from 'node:crypto';
 import type { Command } from 'commander';
 import {
   RuntimeStateManager,
@@ -15,6 +17,12 @@ import {
   isArtifactRevisionOf,
   extractEvidenceRefs,
   extractPrincipleId,
+  isFeatureEnabled,
+  RuleCodeOwnerDecisionService,
+  PromotionReadinessReader,
+  SqliteActivationSafetyStore,
+  collectOpenClawPromotionChecks,
+  summarizeRuleCodeShadowEvents,
 } from '@principles/core/runtime-v2';
 import type {
   ActivationDecision,
@@ -23,7 +31,8 @@ import type {
   ApprovalDecisionResult,
   ApprovalCompletionResult,
 } from '@principles/core/runtime-v2';
-import type { PIArtifactRecord, ActivationStatusRecord } from '@principles/core/runtime-v2';
+import type { PIArtifactRecord, ActivationStatusRecord, PromotionEvidenceSnapshot } from '@principles/core/runtime-v2';
+import { OPENCLAW_HOST_LIVENESS_CONTRACT } from '@principles/host-runtime';
 import { resolveWorkspaceDir } from '../resolve-workspace.js';
 import { loadPdConfig, computeFlagsFromLoadResult } from '../services/pd-config-loader.js';
 
@@ -35,6 +44,22 @@ function isRecord(value: unknown): value is Record<string, unknown> {
   return value !== null && value !== undefined && typeof value === 'object' && !Array.isArray(value);
 }
 
+function unavailableShadowSummary(): PromotionEvidenceSnapshot['shadowSummary'] {
+  return {
+    observed: null, matched: null, wouldBlock: null, wouldAllow: null,
+    requireApproval: null, autoCorrect: null, errors: null, neutralControl: null,
+    firstObservedAt: null, lastObservedAt: null,
+  };
+}
+
+function readShadowSummary(workspaceDir: string, activationId: string): PromotionEvidenceSnapshot['shadowSummary'] {
+  const logsDir = path.join(workspaceDir, '.pd', 'logs'); if (!fs.existsSync(logsDir)) return unavailableShadowSummary();
+  const entries: unknown[] = [];
+  try { for (const file of fs.readdirSync(logsDir).filter(name => /^events_.*\.jsonl$/.test(name)).sort().slice(-7)) for (const line of fs.readFileSync(path.join(logsDir, file), 'utf8').split('\n').filter(Boolean)) { try { entries.push(JSON.parse(line) as unknown); } catch { /* exclude malformed telemetry */ } } }
+  catch { return unavailableShadowSummary(); }
+  return summarizeRuleCodeShadowEvents(entries, activationId);
+}
+
 interface ActivationDispatchOptions {
   workspace?: string;
   artifactId?: string;
@@ -345,6 +370,12 @@ export interface ActivationPromoteOptions {
   dryRun?: boolean;
   confirm?: boolean;
   json?: boolean;
+  artifactId?: string;
+  artifactDigest?: string;
+  controlVersion?: number;
+  idempotencyKey?: string;
+  reasonCode?: string;
+  note?: string;
 }
 
 export interface ActivationPromoteResult {
@@ -353,13 +384,19 @@ export interface ActivationPromoteResult {
   activationId: string;
   promotedAt?: string;
   reason?: string;
+  reasonCode?: string;
+  summary?: string;
+  failedChecks?: { checkId: string; reasonCode: string }[];
   nextAction?: string;
 }
 
 export async function handleRuntimeActivationPromote(opts: ActivationPromoteOptions): Promise<void> {
   const activationId = opts.activationId?.trim() ?? '';
-  const refuse = (reason: string, nextAction: string): void => {
-    const result: ActivationPromoteResult = { ok: false, decision: 'refused', activationId, reason, nextAction };
+  const refuse = (reason: string, nextAction: string, details?: { summary?: string; failedChecks?: { checkId: string; reasonCode: string }[] }): void => {
+    const result: ActivationPromoteResult = {
+      ok: false, decision: 'refused', activationId, reason, reasonCode: reason, nextAction,
+      summary: details?.summary, failedChecks: details?.failedChecks,
+    };
     if (opts.json) console.log(JSON.stringify(result));
     else {
       console.error(`Promotion refused: ${reason}`);
@@ -380,63 +417,116 @@ export async function handleRuntimeActivationPromote(opts: ActivationPromoteOpti
   let stateManager: RuntimeStateManager | undefined;
   try {
     const workspaceDir = opts.workspace ? path.resolve(opts.workspace) : resolveWorkspaceDir();
-    stateManager = new RuntimeStateManager({ workspaceDir });
-    await stateManager.initialize();
-    const store = new SqliteActivationStateStore(stateManager.connection);
-    const activeHooks = await store.listCodeToolHookActivations(false);
-    // CodeRabbit PR2 Comment 3: dry-run must apply the same eligibility checks
-    // as the real promote path. `promoteActivation` runs a COUNT guard inside a
-    // BEGIN IMMEDIATE transaction and refuses when the count of matching shadow
-    // rows is not exactly 1. The previous dry-run branch used `find()` (returns
-    // the first match) and reported `would_promote` even when duplicates would
-    // make the confirm path throw. Mirror the store's uniqueness check here so
-    // dry-run and confirm agree (cli-5: failure paths must not mutate state;
-    // cli-6: degraded/refused results carry a structured reason + nextAction).
-    const matchingShadows = activeHooks.filter(
-      (record) => record.activationId === activationId && record.action === 'code_tool_hook_shadow_activate',
-    );
-    if (matchingShadows.length === 0) {
-      refuse(
-        'not_found_inactive_or_not_shadow',
-        'Refresh `pd activation list --channel code_tool_hook`; only active shadow activations can be promoted.',
-      );
-      return;
-    }
-    if (matchingShadows.length > 1) {
-      refuse(
-        'duplicate_shadow_activations',
-        `${matchingShadows.length} shadow activations share activation_id=${activationId}; resolve duplicates before promoting.`,
-      );
-      return;
-    }
-
-    if (opts.confirm !== true) {
-      const result: ActivationPromoteResult = {
-        ok: true,
-        decision: 'would_promote',
-        activationId,
-        nextAction: `Run pd activation promote --activation-id ${activationId} --confirm to enable live blocking.`,
-      };
-      if (opts.json) console.log(JSON.stringify(result));
-      else {
-        console.log(`Would promote: ${activationId}`);
-        console.log(`  nextAction: ${result.nextAction}`);
+    const flags = computeFlagsFromLoadResult(loadPdConfig(workspaceDir));
+    const ownerId = process.env.PD_OWNER_ID?.trim();
+    const credentialId = process.env.PD_OWNER_CREDENTIAL_ID?.trim();
+    const consoleToken = process.env.PD_CONSOLE_TOKEN?.trim();
+    const operatorId = process.env.USERNAME?.trim() || process.env.USER?.trim();
+    const actor = ownerId && credentialId && consoleToken
+      ? {
+          principal: { kind: 'configured_owner' as const, ownerId },
+          authentication: { method: 'cli_owner_credential' as const, credentialId },
+          ...(operatorId ? { operator: { kind: 'local_user' as const, operatorId } } : {}),
+        }
+      : {
+          principal: { kind: 'break_glass' as const, reason: 'local_no_auth_emergency' as const },
+          authentication: { method: 'local_break_glass' as const },
+        };
+    const getStateManager = async (): Promise<RuntimeStateManager> => {
+      if (!stateManager) {
+        stateManager = new RuntimeStateManager({ workspaceDir, readonly: opts.dryRun === true });
+        await stateManager.initialize();
       }
+      return stateManager;
+    };
+    const service = new RuleCodeOwnerDecisionService({
+      ownerLiveDecisionEnabled: () => isFeatureEnabled(flags, 'rulecode_owner_live_decision'),
+      safetyControlsEnabled: () => isFeatureEnabled(flags, 'rulecode_safety_controls'),
+      evaluateReadiness: async request => {
+        const manager = await getStateManager();
+        const activationStore = new SqliteActivationStateStore(manager.connection);
+        const writer = new RuleHostWriter({
+          gateDeps: createProductionGateDeps(),
+          featureFlagProbe: flagId => isFeatureEnabled(flags, flagId),
+        });
+        const reader = new PromotionReadinessReader({
+          listCodeToolHookActivations: () => activationStore.listCodeToolHookActivations(false),
+          getArtifactById: artifactId => manager.piArtifactStore.getArtifactById(artifactId),
+          computeArtifactDigest: artifact => `sha256:${createHash('sha256').update(JSON.stringify(artifact), 'utf8').digest('hex')}`,
+          validateProductionArtifact: artifact => writer.canActivate(artifact),
+          collectHostChecks: async artifact => {
+            const liveArtifacts: PIArtifactSnapshot[] = [];
+            const activations = await activationStore.listCodeToolHookActivations(false);
+            for (const active of activations) {
+              if (active.action !== 'code_tool_hook_live_activate' || active.deactivatedAt !== null) continue;
+              const liveArtifact = await manager.piArtifactStore.getArtifactById(active.artifactId);
+              if (liveArtifact) liveArtifacts.push(liveArtifact);
+            }
+            return collectOpenClawPromotionChecks(artifact, {
+              ownerIdentityConfigured: actor.principal.kind === 'configured_owner'
+                && actor.authentication.method === 'cli_owner_credential',
+              safetyControlsEnabled: isFeatureEnabled(flags, 'rulecode_safety_controls'),
+              hostContract: OPENCLAW_HOST_LIVENESS_CONTRACT,
+              existingLiveArtifacts: liveArtifacts,
+              validateProductionArtifact: value => writer.canActivate(value),
+            });
+          },
+          buildEvidenceSnapshot: (checks, artifact) => {
+            const createdAt = new Date().toISOString();
+            const artifactDigest = artifact
+              ? `sha256:${createHash('sha256').update(JSON.stringify(artifact), 'utf8').digest('hex')}`
+              : request.expectedArtifactDigest;
+            const snapshotBody = JSON.stringify({ artifactDigest, checks, createdAt });
+            return {
+              snapshotId: `snapshot-${randomUUID()}`,
+              snapshotDigest: `sha256:${createHash('sha256').update(snapshotBody, 'utf8').digest('hex')}`,
+              artifactDigest,
+              lineageRefs: artifact ? [artifact.sourceTaskId, ...artifact.lineageArtifactIds] : [],
+              hostRuntimeVersion: 'openclaw-legacy@1', safetyGateResults: checks,
+              shadowSummary: readShadowSummary(workspaceDir, activationId),
+              configurationVersion: 'pd-config-current',
+              redaction: { version: 'v1', rawParametersStored: false }, createdAt,
+            };
+          },
+          newEvaluationId: () => `readiness-${randomUUID()}`,
+        });
+        return reader.evaluate(request);
+      },
+      commitPromotion: async input => {
+        const manager = await getStateManager();
+        return new SqliteActivationSafetyStore(manager.connection).commitPromotion(input);
+      },
+      newDecisionId: () => `decision-${randomUUID()}`,
+      now: () => new Date().toISOString(),
+    });
+    const result = await service.promote({
+      activationId,
+      expectedArtifactId: opts.artifactId?.trim() ?? '',
+      expectedArtifactDigest: opts.artifactDigest?.trim() ?? '',
+      expectedControlVersion: opts.controlVersion ?? 0,
+      idempotencyKey: opts.idempotencyKey?.trim() ?? '',
+      reasonCode: opts.reasonCode?.trim() ?? '',
+      note: opts.note,
+      confirmed: opts.confirm === true,
+      dryRun: opts.dryRun === true,
+    }, actor);
+    if (!result.ok) {
+      refuse(result.reasonCode, result.nextAction, { summary: result.summary, failedChecks: result.failedChecks });
       return;
     }
-
-    const promotedAt = new Date().toISOString();
-    const promoted = await store.promoteActivation(activationId, promotedAt);
-    if (!promoted) {
-      refuse('promotion_precondition_changed', 'Refresh the activation list; the activation changed before promotion.');
+    if (result.decision === 'would_promote') {
+      const output: ActivationPromoteResult = {
+        ok: true, decision: 'would_promote', activationId: result.activationId,
+        summary: `Readiness ${result.readinessEvaluationId} passed without mutation.`,
+        nextAction: `Re-run with --confirm using evidence snapshot ${result.evidenceSnapshotDigest}.`,
+      };
+      if (opts.json) console.log(JSON.stringify(output));
+      else console.log(`Would promote: ${result.activationId}`);
       return;
     }
-    const result: ActivationPromoteResult = { ok: true, decision: 'promoted', activationId, promotedAt };
-    if (opts.json) console.log(JSON.stringify(result));
-    else {
-      console.log(`Promoted live: ${activationId}`);
-      console.log(`  promotedAt: ${promotedAt}`);
-    }
+    const output: ActivationPromoteResult = { ok: true, decision: 'promoted', activationId: result.activationId, promotedAt: result.promotedAt };
+    if (opts.json) console.log(JSON.stringify(output));
+    else console.log(`Promoted live: ${result.activationId}`);
   } catch (err: unknown) {
     refuse(
       `promotion_failed: ${err instanceof Error ? err.message : String(err)}`,
@@ -472,9 +562,9 @@ export interface ActivationStatusDerivation {
 /**
  * Derive owner-facing status + nextAction for an activation record.
  *
- * Extract as a pure function so the CLI hints (promote/deactivate) can be
- * regression-tested. Rule: deactivate never takes --confirm (promote does);
- * keep the two templates distinct to avoid copy-paste regressions.
+ * Extract as a pure function so the CLI hints can be regression-tested.
+ * Shadow activations point at the Owner decision contract instead of
+ * advertising a raw lifecycle mutation that can bypass review evidence.
  */
 export function deriveActivationStatusAndNextAction(
   input: ActivationNextActionInput,
@@ -492,7 +582,7 @@ export function deriveActivationStatusAndNextAction(
   if (mode === 'shadow') {
     return {
       status: 'active',
-      nextAction: `pd activation promote --activation-id ${activationId} --confirm`,
+      nextAction: 'Keep shadow; promotion requires an authenticated Owner decision, immutable evidence bindings, and a passing Promotion Readiness result.',
     };
   }
   if (mode === 'live') {
@@ -1257,6 +1347,12 @@ export function registerRuntimeActivationPromoteCommand(parent: Command): Comman
     .option('-w, --workspace <path>', 'Workspace directory')
     .option('--dry-run', 'Validate eligibility without changing activation state')
     .option('--confirm', 'Confirm promotion to live blocking')
+    .option('--artifact-id <id>', 'Expected artifact ID from Owner review')
+    .option('--artifact-digest <digest>', 'Expected artifact digest from Owner review')
+    .option('--control-version <n>', 'Expected activation control version', (value) => Number.parseInt(value, 10))
+    .option('--idempotency-key <key>', 'Idempotency key for the Owner decision')
+    .option('--reason <code>', 'Owner decision reason code')
+    .option('--note <text>', 'Required CLI Owner review note')
     .option('--json', 'Output raw JSON')
     .action(async (opts) => {
       await handleRuntimeActivationPromote({
@@ -1265,6 +1361,12 @@ export function registerRuntimeActivationPromoteCommand(parent: Command): Comman
         dryRun: opts.dryRun,
         confirm: opts.confirm,
         json: opts.json,
+        artifactId: opts.artifactId,
+        artifactDigest: opts.artifactDigest,
+        controlVersion: opts.controlVersion,
+        idempotencyKey: opts.idempotencyKey,
+        reasonCode: opts.reason,
+        note: opts.note,
       });
     });
 }