@principles/pd-cli 1.149.0 → 1.149.1

package/src/index.ts

@@ -105,7 +105,7 @@ function handleVersionFlag(args: readonly string[]): boolean {
 
 program
   .name('pd')
-  .description('PD CLI — Pain recording, sample management, and evolution tasks')
+  .description('PD CLI — Pain recording, sample management, and evolution task history')
   .option('-V, --version', 'output the canonical PD product version')
   .enablePositionalOptions();
 
@@ -123,7 +123,10 @@ painCmd
   .option('-S, --source <text>', 'Source of the pain signal', 'manual')
   .option('-w, --workspace <path>', 'Workspace directory')
   .option('--session <id>', 'Session ID to bind (validated against this workspace\'s trajectory.db; without it the record is unbound: no trajectory evidence, candidates likely gated by the admission threshold)')
-  .option('--host <kind>', 'PRI-743: explicit host attribution (openclaw | codex). openclaw = default attribution without the disclosure warning; codex refuses — the CLI cannot verify Codex lineage.', undefined)
+  .option('--host <kind>', 'PRI-743: explicit host attribution (openclaw | codex). openclaw = default attribution without the disclosure warning; codex requires the real Codex lineage (--rollout-id, --host-turn-id, and --session as the root session).', undefined)
+  .option('--rollout-id <id>', 'PRI-743: Codex rollout identity — required by --host codex', undefined)
+  .option('--host-turn-id <id>', 'PRI-743: Codex turn id — required by --host codex', undefined)
+  .option('--logical-key <key>', 'PRI-743: Codex logical observation key override for --host codex (default: codex|<rollout-id>|<host-turn-id>|user)', undefined)
   .option('--wait', 'Wait for diagnosis to complete (sync mode, overrides async flag)')
   .option('--json', 'Output raw JSON')
   .action(async (opts) => {
@@ -179,9 +182,15 @@ samplesCmd
     await handleSamplesReview({ sampleId, decision: decision === 'approve' ? 'approved' : 'rejected', note });
   });
 
+// ── Evolution task reader (hidden) ────────────────────────────────────────────
+// PRI-752 review: the worker is gone (flag retired to `gone`), but this
+// read-only surface stays for historical `evolution_tasks` rows in already-
+// provisioned workspaces — data-retention disposition is a separate Owner
+// decision (PRI-737 reality audit §7.3). Table schema + quality-scorecard
+// reader are retained accordingly.
 const evolutionCmd = program
   .command('evolution', { hidden: true })
-  .description('Evolution task management');
+  .description('Evolution task management (historical data reader)');
 
 const tasksCmd = evolutionCmd
   .command('tasks')

package/src/services/rulehost-pipeline-runner.ts

@@ -54,6 +54,7 @@ import {
   // PRI-714: resolve outputLanguage from the same effective config the
   // runners already receive (EP-07: canonical resolved value, not raw input).
   resolveOutputLanguage,
+  buildArtificerHostSemanticContext,
 } from '@principles/core/runtime-v2';
 import type {
   AdversarialLoopResult,
@@ -411,12 +412,21 @@ export async function runRuleHostPipeline(opts: RuleHostPipelineOptions): Promis
       onProgress('adversarial_loop', 'failed', refusalReason);
       return rejectedResult(opts.painId, stages, `evaluator_runtime_context_unresolvable: ${evaluatorContext.reason} (nextAction: ${evaluatorContext.nextAction})`);
     }
+    // PRI-741: artificer generation + evaluator parity BOTH anchor on the ONE
+    // registry snapshot evaluatorContext resolved above (review round: a
+    // second independent resolveWorkspaceHostToolSemantics read could observe
+    // a different declaration snapshot than the replay gate). Unresolvable
+    // provenance already failed loud at the evaluatorContext refusal above.
+    const hostSemanticContext = buildArtificerHostSemanticContext(evaluatorContext.registry, evaluatorContext.hostKinds ?? []);
     const artificerRunner = new ArtificerRunner(
       {
         stateManager, runtimeAdapter: capability.artificerAdapter, eventEmitter, validator: new DefaultArtificerValidator(), artifactStore,
         contextMode: opts.contextMode ?? 'v1', behaviorExamplePack: opts.behaviorExamplePack, contentHashFn,
       },
-      runnerOptsFor(capability.artificerAdapter),
+      {
+        ...runnerOptsFor(capability.artificerAdapter),
+        hostSemanticContext,
+      },
     );
     // PRI-510 (DEFECT-004): construct EvaluatorRunnerDeps via the centralized
     // helper so the repair-loop wiring (isRepairLoopEnabled + seeder) is
@@ -435,7 +445,13 @@ export async function runRuleHostPipeline(opts: RuleHostPipelineOptions): Promis
       // from durable provenance) — replaces the previous sandbox-only gate
       // deps so generation-time replay verdicts match the activation gate on
       // the same workspace. Options argument (2nd), never deps (1st).
-      { ...runnerOptsFor(agentAdapters.evaluator), gateDeps: evaluatorContext.gateDeps },
+      {
+        ...runnerOptsFor(agentAdapters.evaluator),
+        gateDeps: evaluatorContext.gateDeps,
+        // PRI-741: host-name parity replay case from the SAME registry
+        // snapshot as the gateDeps above (single resolution).
+        hostSemanticContext,
+      },
     );
 
     const loopResult = await runAdversarialLoop({

package/tests/commands/pain-record-session-parser.test.ts

@@ -93,7 +93,31 @@ describe('pd pain record --session (real Commander + real trajectory.db)', () =>
     // Commander wraps help text; normalize whitespace before asserting content.
     const normalized = result.stdout.replace(/\s+/g, ' ');
     expect(normalized).toContain('openclaw | codex');
-    expect(normalized).toContain('codex refuses');
+    expect(normalized).toContain('codex requires the real Codex lineage');
+  }, 15_000);
+
+  it('PRI-743: --help registers the Codex lineage flags used by --host codex', async () => {
+    const result = await runBuiltCli(['pain', 'record', '--help']);
+    expect(result.status).toBe(0);
+    expect(result.stdout).toContain('--rollout-id <id>');
+    expect(result.stdout).toContain('--host-turn-id <id>');
+    expect(result.stdout).toContain('--logical-key <key>');
+  }, 15_000);
+
+  it('PRI-743: --host codex without lineage exits non-zero with codex_lineage_required', async () => {
+    const result = await runBuiltCli([
+      'pain', 'record',
+      '--reason', 'parser test pain',
+      '--host', 'codex',
+      '--workspace', tmpDir,
+      '--json',
+    ]);
+
+    expect(result.status).not.toBe(0);
+    const parsed = JSON.parse(result.stdout.trim()) as Record<string, unknown>;
+    expect(parsed.status).toBe('failed');
+    expect(parsed.reason).toBe('codex_lineage_required');
+    expect(typeof parsed.nextAction).toBe('string');
   }, 15_000);
 
   it('PRI-743: an invalid --host value exits non-zero with a single structured JSON object', async () => {

package/tests/commands/pain-record.test.ts

@@ -414,24 +414,63 @@ describe('pd pain record', () => {
 
     const jsonOutput = JSON.parse(logSpy.mock.calls[0][0]) as { hostAttribution?: string; warnings?: string[] };
     expect(jsonOutput.hostAttribution).toBe('openclaw');
-    expect((jsonOutput.warnings ?? []).some((w) => w.includes("defaulted to 'openclaw'"))).toBe(false);
+    expect((jsonOutput.warnings ?? []).some((w) => w.includes('host kind not specified, defaulting to openclaw'))).toBe(false);
 
     logSpy.mockRestore();
     exitSpy.mockRestore();
   });
 
-  it('PRI-743: --host codex refuses loudly — the CLI cannot verify Codex lineage (rc-6)', async () => {
+  it('PRI-743: --host codex records host_kind=codex with the caller-supplied Codex lineage', async () => {
     const logSpy = vi.spyOn(console, 'log').mockImplementation(() => {});
     const exitSpy = mockProcessExit();
 
-    await handlePainRecord({ reason: 'codex mistake', session: 'sess-codex', host: 'codex', json: true });
+    await handlePainRecord({
+      reason: 'codex mistake',
+      session: 'codex-root-sess',
+      host: 'codex',
+      rolloutId: 'rollout-abc',
+      hostTurnId: 'turn-7',
+      json: true,
+    });
+
+    expect(lastRecordPainInput).toBeTruthy();
+    expect(lastRecordPainInput!.hostKind).toBe('codex');
+    expect(lastRecordPainInput!.sessionId).toBe('codex-root-sess');
+    expect(lastRecordPainInput!.provenance).toBe('host_context_bound');
+    expect(lastRecordPainInput!.recordObservability).toBe(true);
+    // The CLI must NOT read the OpenClaw trajectory for a Codex attribution.
+    expect(acquireTrajectoryEvidenceFromDb).not.toHaveBeenCalled();
+    // Codex lineage is retained unflattened in the versioned payload (SPEC §8.1);
+    // the derived key mirrors the ingestion rule (codex|<rollout>|<turn>|user).
+    expect(lastRecordPainInput!.painIngress.correlation).toEqual({
+      status: 'bound',
+      hostKind: 'codex',
+      rootSessionId: 'codex-root-sess',
+      rolloutIdentity: 'rollout-abc',
+      logicalObservationKey: 'codex|rollout-abc|turn-7|user',
+      hostTurnId: 'turn-7',
+    });
+    // The degraded-but-honest path still submits (no fabricated evidence).
+    expect(lastRecordPainInput!.evidence).toEqual([]);
+    expect(exitSpy).not.toHaveBeenCalledWith(1);
+
+    logSpy.mockRestore();
+    exitSpy.mockRestore();
+  });
+
+  it('PRI-743: --host codex without the Codex lineage fails loudly before any mutation', async () => {
+    const logSpy = vi.spyOn(console, 'log').mockImplementation(() => {});
+    const exitSpy = mockProcessExit();
+
+    await handlePainRecord({ reason: 'codex mistake', host: 'codex', json: true });
 
     // cli-1: exactly one JSON object on stdout
     expect(logSpy).toHaveBeenCalledTimes(1);
-    const jsonOutput = JSON.parse(logSpy.mock.calls[0][0]) as { status: string; reason: string; nextAction: string };
-    expect(jsonOutput).toMatchObject({ status: 'failed', reason: 'codex_lineage_unverifiable_by_cli' });
-    expect(jsonOutput.nextAction).toContain('Codex ingestion');
-    // cli-2/cli-5: refused before any evidence acquisition or service mutation
+    const jsonOutput = JSON.parse(logSpy.mock.calls[0][0]) as { status: string; reason: string; nextAction: string; message: string };
+    expect(jsonOutput).toMatchObject({ status: 'failed', reason: 'codex_lineage_required' });
+    expect(jsonOutput.message).toContain('--rollout-id');
+    expect(jsonOutput.nextAction).toContain('--host-turn-id');
+    // cli-2/cli-5: stopped before any evidence acquisition or service mutation
     expect(lastRecordPainInput).toBeNull();
     expect(acquireTrajectoryEvidenceFromDb).not.toHaveBeenCalled();
     expect(exitSpy).toHaveBeenCalledWith(1);
@@ -440,7 +479,27 @@ describe('pd pain record', () => {
     exitSpy.mockRestore();
   });
 
-  it('PRI-743: omitting --host keeps the openclaw default but discloses the assumption (rc-9)', async () => {
+  it('PRI-743: --host codex with PARTIAL lineage still fails loudly (only the missing flag is reported)', async () => {
+    const logSpy = vi.spyOn(console, 'log').mockImplementation(() => {});
+    const exitSpy = mockProcessExit();
+
+    await handlePainRecord({ reason: 'codex mistake', session: 'codex-root', host: 'codex', rolloutId: 'rollout-abc', json: true });
+
+    const jsonOutput = JSON.parse(logSpy.mock.calls[0][0]) as { status: string; reason: string; message: string };
+    expect(jsonOutput).toMatchObject({ status: 'failed', reason: 'codex_lineage_required' });
+    expect(jsonOutput.message).toContain('--host-turn-id');
+    expect(jsonOutput.message).not.toContain('--rollout-id');
+    expect(lastRecordPainInput).toBeNull();
+    expect(exitSpy).toHaveBeenCalledWith(1);
+
+    logSpy.mockRestore();
+    exitSpy.mockRestore();
+  });
+
+  // Task test #3/#4: legacy call compatibility — the pre-PRI-743 invocation
+  // (`--reason … --session …`, no --host) keeps host_kind=openclaw and only
+  // gains the disclosure wording.
+  it('PRI-743: legacy call omitting --host keeps the openclaw default but discloses it (rc-9)', async () => {
     const logSpy = vi.spyOn(console, 'log').mockImplementation(() => {});
     const exitSpy = mockProcessExit();
 
@@ -450,7 +509,7 @@ describe('pd pain record', () => {
     expect(lastRecordPainInput!.hostKind).toBe('openclaw');
     const jsonOutput = JSON.parse(logSpy.mock.calls[0][0]) as { hostAttribution?: string; warnings?: string[] };
     expect(jsonOutput.hostAttribution).toBe('openclaw');
-    expect((jsonOutput.warnings ?? []).some((w) => w.includes("defaulted to 'openclaw'") && w.includes('--host codex'))).toBe(true);
+    expect((jsonOutput.warnings ?? []).some((w) => w.includes('host kind not specified, defaulting to openclaw') && w.includes('--host codex'))).toBe(true);
 
     logSpy.mockRestore();
     exitSpy.mockRestore();

package/tests/commands/runtime-activation.test.ts

@@ -2035,7 +2035,7 @@ describe('handleRuntimeActivationDispatch — PRI-634-F R2 host provenance refus
   });
 
   it('code_tool_hook dispatch threads the resolved registry into RuleHostWriter and gateDeps', async () => {
-    const registry = { version: 1, hasHostLayer: true, resolve: () => 'write', lookup: () => null, hasHostTool: () => true };
+    const registry = { version: 1, hasHostLayer: true, resolve: () => 'write', lookup: () => null, hasHostTool: () => true, hostMappings: () => [{ rawToolName: 'write', canonicalKind: 'write' as const }] };
     vi.mocked(resolveWorkspaceToolSemantics).mockReturnValueOnce({ ok: true, registry, hostKind: 'openclaw' });
     await handleRuntimeActivationDispatch({
       workspace: WS,

package/tests/commands/runtime-internalization-run-once.test.ts

@@ -86,6 +86,7 @@ vi.mock('@principles/core/runtime-v2', () => ({
   ArtificerRunner: vi.fn().mockImplementation(function () {
     return { run: mockRun };
   }),
+  buildArtificerHostSemanticContext: (registry) => ({ hostKinds: [], tools: registry.hostMappings() }),
   EvaluatorRunner: vi.fn().mockImplementation(function () {
     return { run: mockRun };
   }),
@@ -197,6 +198,10 @@ const { mockCreateEvaluatorRuntimeContext, mockCreateRolloutGovernanceDeps, mock
   const mockCreateEvaluatorRuntimeContext = vi.fn().mockReturnValue({
     ok: true,
     gateDeps: { evaluateInSandbox: vi.fn() },
+    // PRI-741: the context resolution also carries the single registry
+    // snapshot the parity projection derives from.
+    registry: { resolve: vi.fn(), hostMappings: vi.fn().mockReturnValue([{ rawToolName: 'write', canonicalKind: 'write' }]) },
+    hostKinds: ['openclaw'],
   });
   const mockCreateRolloutGovernanceDeps = vi.fn().mockReturnValue({
     dispatchActivation: vi.fn(),
@@ -204,7 +209,9 @@ const { mockCreateEvaluatorRuntimeContext, mockCreateRolloutGovernanceDeps, mock
   });
   const mockResolveWorkspaceHostToolSemantics = vi.fn().mockReturnValue({
     ok: true,
-    registry: { resolve: vi.fn() },
+    // PRI-741: the projection reads the host layer via hostMappings() — the
+    // mock registry carries it like a real buildToolSemanticRegistry product.
+    registry: { resolve: vi.fn(), hostMappings: vi.fn().mockReturnValue([{ rawToolName: 'write', canonicalKind: 'write' }]) },
     hostKinds: ['openclaw'],
   });
   return { mockCreateEvaluatorRuntimeContext, mockCreateRolloutGovernanceDeps, mockResolveWorkspaceHostToolSemantics };