@principles/pd-cli 1.152.12 → 1.152.13

package/src/commands/pain-record.ts

@@ -1,612 +0,0 @@
-/**
- * pd pain record command — Runtime v2 pain signal entry point.
- *
- * Uses PainToPrincipleService as the single write-side orchestration API.
- * PRI-642 (review blocker 1): the ingress semantic interpretation — origin,
- * bound/unbound correlation, provenance derivation, sentinel handling,
- * submit/degrade/refuse semantics and painIngress.v1 construction — comes
- * from the SHARED evaluator `evaluatePainIngress` in @principles/core
- * (the same authority the OpenClaw funnel uses). This adapter only does
- * host-specific ACQUISITION: read --session, validate it against this
- * workspace's trajectory.db, and collect raw evidence entries.
- *
- * Usage:
- *   pd pain record --reason <text> [--score N] [--source manual] [--workspace <path>] [--session <id>] [--host openclaw|codex] [--rollout-id <id> --host-turn-id <id>] [--json]
- *
- * PRI-743: `--host` makes host attribution explicit instead of assumed.
- * `--host openclaw` records the default attribution without the disclosure
- * warning. `--host codex` requires the caller to supply the REAL Codex
- * lineage — `--rollout-id` / `--host-turn-id`, with `--session` as the Codex
- * root session — because the shared ingress evaluator only writes
- * `host_kind=codex` for a bound correlation carrying the complete lineage
- * tuple (rc-6). The CLI never synthesises that tuple: an unverifiable Codex
- * attribution would be a PRI-642 recurrence in another shape (Evidence Over
- * Assumption). `--logical-key` overrides the derived observation key; a key
- * that does not embed the given rollout identity is refused by the evaluator
- * (lineage_mismatch). The correlation schema itself is NOT changed —
- * PainIngressCorrelationV1 bound branches only admit openclaw/codex.
- */
-import {
-  PainToPrincipleService,
-  PrincipleTreeLedgerAdapter,
-  resolveRuntimeConfig,
-  isRuntimeConfigError,
-  isFeatureEnabled,
-  isBuiltinPiAiProvider,
-  evaluatePainIngress,
-} from '@principles/core/runtime-v2';
-import type { PainIngressDecision, IngressEvidenceEntry, PainEvidenceEntry, PainCorrelation } from '@principles/core/runtime-v2';
-import { resolveWorkspaceDir } from '../resolve-workspace.js';
-import { loadPdConfig, computeFlagsFromLoadResult } from '../services/pd-config-loader.js';
-import { acquireTrajectoryEvidenceFromDb } from './build-trajectory-evidence.js';
-
-interface RecordOptions {
-  reason?: string;
-  score?: number;
-  source?: string;
-  workspace?: string;
-  json?: boolean;
-  session?: string;
-  wait?: boolean;
-  /** PRI-743: explicit host attribution for a bound --session pain. */
-  host?: string;
-  /** PRI-743 follow-up: Codex rollout identity — required by --host codex. */
-  rolloutId?: string;
-  /** PRI-743 follow-up: Codex turn id — required by --host codex. */
-  hostTurnId?: string;
-  /** PRI-743 follow-up: Codex logical observation key override for --host codex. */
-  logicalKey?: string;
-}
-
-function emitSessionBindingFailure(
-  opts: RecordOptions,
-  failure: { reason: string; message: string; nextAction: string },
-): void {
-  if (opts.json) {
-    console.log(JSON.stringify({
-      status: 'failed',
-      reason: failure.reason,
-      message: failure.message,
-      nextAction: failure.nextAction,
-    }, null, 2));
-  } else {
-    console.error(`Error: ${failure.message}`);
-    console.error(`Reason: ${failure.reason}`);
-    console.error(`Next action: ${failure.nextAction}`);
-  }
-  process.exit(1);
-}
-
-function toIngressEntry(entry: PainEvidenceEntry): IngressEvidenceEntry {
-  // Trajectory evidence references observed behavior (owner messages,
-  // assistant turns, tool-call failures) — behavior traces.
-  return { kind: 'behavior_trace', sourceRef: entry.sourceRef, note: entry.note };
-}
-
-/**
- * PRI-642 (SPEC §7.3/§7.4, review blocker 1): build the report from this
- * adapter's host-specific facts and let the SHARED evaluator decide.
- *
- * Per-channel policy (SPEC §7.3/§8.2 vs OpenClaw):
- *
- * - explicit `--session` + acquisition available (real session + real entries):
- *     → cli_explicit_session + bound → submit with real evidence.
- * - explicit `--session` + acquisition unavailable with the binding VERIFIED
- *     (empty_trajectory / evidence-table-level evidence_read_failed — the
- *     sessions table was queried and DID contain the id; SPEC §8.2: binding
- *     failure and evidence failure are separate axes, a real session with
- *     unusable evidence is bound + unavailable, not unbound):
- *     → cli_explicit_session + bound → shared evaluator DEGRADES (row 4):
- *       submit with honest empty evidence; the admission gate owns what
- *       empty evidence is worth. PRI-783 Owner directive: a correct current
- *       session id is sufficient — empty evidence must not hard-refuse.
- * - explicit `--session` + acquisition unavailable with the binding
- *     UNVERIFIED (session_not_found / trajectory_unavailable / DB-open-level
- *     evidence_read_failed — SPEC §8.2's "real session" premise does not
- *     hold: the CLI verifies session ids against trajectory.db itself, so
- *     when that DB is missing or unopenable the id is unproven):
- *     → cli_explicit_session + unbound → shared evaluator REFUSES (row 5)
- *       before any LLM/task/candidate mutation. Claiming bound here would
- *       also let the observability writer persist the unverified id into a
- *       freshly created trajectory.db — laundering an unproven fact into
- *       future "evidence" (PRI-783 review P1, self-proving loop).
- * - no `--session` → unbound Owner report (matrix row 6) → submit with
- *   disclosure; no sentinel session, no placeholder evidence, no trajectory
- *   projection (the CLI skips observability when the ingress yields no
- *   bound session — SPEC §7.4).
- */
-function resolveIngressDecision(
-  input: { opts: RecordOptions; stateDir: string; workspaceDir: string; painId: string },
-): { decision: PainIngressDecision; acquisitionDetail: string | null; acquisitionReason: string | null } {
-  const { opts, stateDir, workspaceDir, painId } = input;
-  const score = opts.score ?? 80;
-  const base = {
-    identity: { kind: 'manual_pain_id' as const, painId },
-    painType: 'user_frustration' as const,
-    source: opts.source ?? 'manual',
-    reason: opts.reason ?? '',
-    score,
-  };
-
-  // PRI-743 follow-up: an explicit Codex attribution. The lineage ids are the
-  // caller's (presence validated in handlePainRecord); the logical observation
-  // key is derived with the SAME rule the Codex ingestion path uses
-  // (codex-adapter admission.ts buildLiveCorrectionCandidate →
-  // `codex|<rolloutIdentity>|<turnId>|user`) unless --logical-key overrides it.
-  // The CLI cannot read the Codex trajectory (that is the ingestion path's
-  // job), so the evidence class is honestly 'unavailable': the shared
-  // evaluator takes its bound+unavailable 'degrade' branch and submits the
-  // pain with real lineage and empty evidence rather than fabricating either.
-  if (opts.host === 'codex') {
-    const rolloutIdentity = opts.rolloutId as string;
-    const hostTurnId = opts.hostTurnId as string;
-    const rootSessionId = opts.session as string;
-    const correlation: PainCorrelation = {
-      status: 'bound',
-      hostKind: 'codex',
-      rootSessionId,
-      rolloutIdentity,
-      logicalObservationKey: opts.logicalKey ?? `codex|${rolloutIdentity}|${hostTurnId}|user`,
-      hostTurnId,
-    };
-    const decision = evaluatePainIngress({
-      ...base,
-      origin: { kind: 'owner_manual', channel: 'cli_explicit_session' },
-      correlation,
-      evidence: { status: 'unavailable', reason: 'trajectory_unavailable' },
-    });
-    return { decision, acquisitionDetail: null, acquisitionReason: null };
-  }
-
-  if (!opts.session) {
-    // No --session: external unbound Owner report (matrix row 6). Allowed
-    // by SPEC §7.4 with a disclosure warning; never claims host binding.
-    const decision = evaluatePainIngress({
-      ...base,
-      origin: { kind: 'owner_manual', channel: 'external_cli_unbound' },
-      correlation: { status: 'unbound', reason: 'external_cli' },
-      evidence: { status: 'unavailable', reason: 'not_applicable_unbound' },
-    });
-    return { decision, acquisitionDetail: null, acquisitionReason: null };
-  }
-
-  // --session: SPEC §7.3/§8.2. Binding failure and evidence failure are
-  // separate axes, and the acquisition result carries the binding fact
-  // directly (PRI-783 review): 'verified' = the sessions table was queried
-  // and DID contain the id; 'unverified' = missing/unopenable DB or absent
-  // id. Only a VERIFIED binding may degrade to a bound submission (row 4);
-  // an unverified one is refused (row 5) — claiming bound for an unverified
-  // id would let the observability writer persist that id into a freshly
-  // created trajectory.db (self-proving loop). Per-channel policy differs;
-  // semantic authority is shared.
-  const acquisition = acquireTrajectoryEvidenceFromDb(stateDir, opts.session, workspaceDir);
-  if (acquisition.status === 'unavailable') {
-    const { reasonCode, binding } = acquisition;
-    if (binding === 'verified') {
-      // empty_trajectory / evidence-table-level evidence_read_failed —
-      // bound + unavailable (row 4): degrade to an honest empty-evidence
-      // submission; the admission gate decides what empty evidence is worth.
-      const decision = evaluatePainIngress({
-        ...base,
-        origin: { kind: 'owner_manual', channel: 'cli_explicit_session' },
-        correlation: { status: 'bound', hostKind: 'openclaw', sessionId: opts.session },
-        evidence: { status: 'unavailable', reason: reasonCode },
-      });
-      return { decision, acquisitionDetail: acquisition.detail, acquisitionReason: reasonCode };
-    }
-    // binding 'unverified' (session_not_found / trajectory_unavailable /
-    // DB-open-level evidence_read_failed) — the binding claim could not be
-    // validated: refuse (row 5) before any mutation.
-    const decision = evaluatePainIngress({
-      ...base,
-      origin: { kind: 'owner_manual', channel: 'cli_explicit_session' },
-      correlation: { status: 'unbound', reason: 'external_cli' },
-      evidence: { status: 'unavailable', reason: 'not_applicable_unbound' },
-    });
-    if (decision.action === 'refuse') {
-      return { decision, acquisitionDetail: acquisition.detail, acquisitionReason: reasonCode };
-    }
-  }
-
-  // Available evidence: a real session with real entries — submit, bound.
-  if (acquisition.status === 'available') {
-    // PRI-743: host attribution is explicit when --host openclaw is given;
-    // absent --host keeps the pre-PRI-743 'openclaw' default (validated and
-    // disclosed by handlePainRecord — rc-9). --host codex never reaches this
-    // point — it returns from its own branch above and must not read the
-    // OpenClaw trajectory — so the bound correlation here is the openclaw shape.
-    const hostKind = 'openclaw' as const;
-    const decision = evaluatePainIngress({
-      ...base,
-      origin: { kind: 'owner_manual', channel: 'cli_explicit_session' },
-      correlation: { status: 'bound', hostKind, sessionId: opts.session },
-      evidence: { status: 'available', entries: acquisition.entries.map(toIngressEntry) as [IngressEvidenceEntry, ...IngressEvidenceEntry[]] },
-    });
-    return { decision, acquisitionDetail: null, acquisitionReason: null };
-  }
-
-  // Exhaustive — acquireTrajectoryEvidenceFromDb returns {available, unavailable}
-  // only. Unavailable either returned above (degrade for verified bindings,
-  // refuse for unverified ones); a future-added reason must be classified
-  // explicitly here rather than silently degrading.
-  const decision = evaluatePainIngress({
-    ...base,
-    origin: { kind: 'owner_manual', channel: 'cli_explicit_session' },
-    correlation: { status: 'unbound', reason: 'external_cli' },
-    evidence: { status: 'unavailable', reason: 'not_applicable_unbound' },
-  });
-  return { decision, acquisitionDetail: null, acquisitionReason: null };
-}
-
-export async function handlePainRecord(opts: RecordOptions): Promise<void> {
-  // PRI-743: fail loud on an unknown --host before any mutation (cli-5/cli-6).
-  if (opts.host !== undefined && opts.host !== 'openclaw' && opts.host !== 'codex') {
-    const message = `invalid --host: expected openclaw | codex, got ${opts.host}`;
-    if (opts.json) {
-      console.log(JSON.stringify({
-        status: 'failed',
-        reason: 'invalid_host_kind',
-        message,
-        nextAction: 'Pass --host openclaw or --host codex, or omit --host (defaults to openclaw).',
-      }, null, 2));
-    } else {
-      console.error(`Error: ${message}`);
-      console.error('Next action: pass --host openclaw or --host codex, or omit --host (defaults to openclaw).');
-    }
-    process.exit(1);
-    return; // guard: test stubs of process.exit continue execution (cli-2-exit-stops)
-  }
-
-  // PRI-743 follow-up: --host codex must carry the REAL Codex lineage. The
-  // shared ingress evaluator only attributes `host_kind=codex` to a bound
-  // correlation holding the complete tuple (rootSessionId / rolloutIdentity /
-  // logicalObservationKey / hostTurnId — rc-6); the CLI never synthesises that
-  // tuple, because an unverifiable Codex attribution would itself be the
-  // misattribution PRI-743 exists to remove. Missing lineage fails loud before
-  // any mutation (cli-5/cli-6) — the caller owns those ids.
-  if (opts.host === 'codex') {
-    const missing: string[] = [];
-    if (!opts.session) missing.push('--session <codex root session id>');
-    if (!opts.rolloutId) missing.push('--rollout-id <codex rollout identity>');
-    if (!opts.hostTurnId) missing.push('--host-turn-id <codex turn id>');
-    if (missing.length > 0) {
-      const message = `--host codex requires the real Codex lineage — missing ${missing.join(', ')}`;
-      const nextAction = 'Pass --session <root session id> --rollout-id <rollout identity> --host-turn-id <turn id> so the pain carries verifiable Codex lineage, or use --host openclaw for OpenClaw-attributed sessions.';
-      if (opts.json) {
-        console.log(JSON.stringify({
-          status: 'failed',
-          reason: 'codex_lineage_required',
-          message,
-          nextAction,
-        }, null, 2));
-      } else {
-        console.error(`Error: ${message}`);
-        console.error(`Next action: ${nextAction}`);
-      }
-      process.exit(1);
-      return; // guard: test stubs of process.exit continue execution (cli-2-exit-stops)
-    }
-  }
-
-  if (!opts.reason) {
-    console.error('Error: --reason <text> is required');
-    console.error('Usage: pd pain record --reason <text> [--score N] [--source manual] [--workspace <path>] [--session <id>] [--host openclaw|codex] [--rollout-id <id> --host-turn-id <id>] [--json]');
-    process.exit(1);
-    return;
-  }
-
-  // Bug-P fix: enforce reason length limit to prevent oversized data entering the pipeline.
-  // Consistent with pain-flood-simulation.ts (MAX_REASON_LENGTH = 500) and synthetic-baseline.ts.
-  // CodeRabbit review fix: emit JSON on --json and stop execution after exit (cli-1, cli-2, cli-5).
-  const MAX_REASON_LENGTH = 500;
-  if (opts.reason.length > MAX_REASON_LENGTH) {
-    if (opts.json) {
-      console.log(JSON.stringify({
-        status: 'failed',
-        reason: 'reason_too_long',
-        message: `--reason must be at most ${MAX_REASON_LENGTH} characters (got ${opts.reason.length})`,
-        nextAction: 'Shorten the reason text or split it into multiple pain records.',
-      }, null, 2));
-    } else {
-      console.error(`Error: --reason must be at most ${MAX_REASON_LENGTH} characters (got ${opts.reason.length})`);
-      console.error('Next action: shorten the reason text or split it into multiple pain records.');
-    }
-    process.exit(1);
-    return;
-  }
-
-  if (opts.score !== undefined && (isNaN(opts.score) || opts.score < 0 || opts.score > 100)) {
-    if (opts.json) {
-      console.log(JSON.stringify({
-        status: 'failed',
-        reason: 'score_invalid',
-        message: '--score must be a number between 0 and 100',
-        nextAction: 'Provide --score as an integer from 0 to 100, or omit it for the default (80).',
-      }, null, 2));
-    } else {
-      console.error('Error: --score must be a number between 0 and 100');
-      console.error('Next action: provide --score as an integer from 0 to 100, or omit it for the default (80).');
-    }
-    process.exit(1);
-    return;
-  }
-
-  const workspaceDir = resolveWorkspaceDir(opts.workspace);
-  const stateDir = `${workspaceDir}/.state`;
-  const painId = `manual_${Date.now()}_${Math.random().toString(36).slice(2, 10)}`;
-
-  // PRI-642: run the SHARED ingress evaluator before any service/LLM/task
-  // mutation; the decision (submit/degrade/refuse) is not made here.
-  const { decision, acquisitionDetail, acquisitionReason } = resolveIngressDecision({ opts, stateDir, workspaceDir, painId });
-
-  if (decision.action === 'refuse') {
-    // SPEC §7.3: the CLI must surface the specific acquisition reason —
-    // the shared evaluator produces the refuse decision; we map the
-    // acquisition detail to the Operator reason. PRI-783: the evaluator's
-    // generic next action suggests `pd pain record --session` — the exact
-    // path that just failed — so every CLI acquisition refuse gets honest,
-    // reason-specific guidance instead.
-    const reason = opts.session !== undefined && acquisitionReason !== null
-      ? acquisitionReason
-      : decision.reasonCode;
-    const detailSuffix = acquisitionDetail !== null ? ` (${acquisitionDetail})` : '';
-    const nextAction =
-      reason === 'session_not_found'
-        ? 'Check the session id — it is not present in this workspace trajectory — or drop --session to record an unbound Owner report.'
-        : reason === 'trajectory_unavailable'
-          ? 'No trajectory.db exists in this workspace, so the session id could not be verified — point --workspace at the workspace that owns the session, or drop --session to record an unbound Owner report.'
-          : reason === 'evidence_read_failed'
-            ? 'The workspace trajectory could not be read, so the session id could not be verified — resolve access to .state/trajectory.db, or drop --session to record an unbound Owner report.'
-            : decision.nextAction;
-    emitSessionBindingFailure(opts, {
-      reason,
-      message: `${decision.warning}${detailSuffix}`,
-      nextAction,
-    });
-    return;
-  }
-
-  const binding = decision.legacy;
-  // SPEC §7.4: without a bound session the trajectory projection is skipped
-  // (disclosed below) instead of fabricating the sentinel session 'cli'.
-  const recordObservability = binding.sessionId !== undefined;
-
-  const ledgerAdapter = new PrincipleTreeLedgerAdapter({ stateDir });
-  // PRI-306: Load .pd/config.yaml for config-driven runtime binding
-  const configResult = loadPdConfig(workspaceDir);
-  if (!configResult.ok) {
-    // ERR-009 / Runtime Contract Rule 9: fail loud with reason, don't silently swallow
-    console.error(`Warning: .pd/config.yaml has errors — using defaults:`);
-    for (const e of configResult.errors) {
-      console.error(`  ${e.path}: ${e.reason}`);
-      if (e.nextAction) console.error(`    nextAction: ${e.nextAction}`);
-    }
-  }
-  const effectiveConfig = configResult.ok ? configResult.effective : configResult.defaults;
-
-  // PRI-369: Determine async mode from feature flag + --wait override
-  const featureFlags = computeFlagsFromLoadResult(configResult);
-  const asyncFlagEnabled = isFeatureEnabled(featureFlags, 'diagnostician_async_cli');
-  const asyncMode = asyncFlagEnabled && !opts.wait; // --wait overrides flag to force sync
-
-  const service = new PainToPrincipleService({
-    workspaceDir,
-    stateDir,
-    ledgerAdapter,
-    owner: 'pd-cli',
-    autoIntakeEnabled: true,
-    effectiveConfig,
-    getEnvVar: (name: string) => process.env[name],
-    asyncMode,
-  });
-
-  const result = await service.recordPain({
-    painId,
-    painType: 'user_frustration',
-    source: opts.source ?? 'manual',
-    reason: opts.reason,
-    score: opts.score ?? 80,
-    sessionId: binding.sessionId,
-    agentId: 'pd-cli',
-    provenance: binding.provenance,
-    hostKind: binding.hostKind,
-    evidence: binding.evidence,
-    recordObservability,
-    painIngress: binding.painIngress,
-  });
-
-  // Show diagnostic info for config failures
-  if (result.failureCategory === 'config_missing') {
-    const legacyConfig = resolveRuntimeConfig(stateDir);
-    if (isRuntimeConfigError(legacyConfig)) {
-      if (opts.json) {
-        console.log(JSON.stringify({
-          status: 'failed',
-          painId: result.painId,
-          taskId: result.taskId,
-          failureCategory: result.failureCategory,
-          message: result.message,
-          configError: {
-            reason: legacyConfig.reason,
-            message: legacyConfig.message,
-            nextAction: legacyConfig.nextAction,
-          },
-        }, null, 2));
-      } else {
-        console.error(`  Config resolution failed: ${legacyConfig.reason}`);
-        console.error(`  ${legacyConfig.message}`);
-        console.error(`  nextAction: ${legacyConfig.nextAction}`);
-      }
-      process.exit(1);
-      return;
-    }
-    const config = legacyConfig;
-    const missing: string[] = [];
-    if (!config.provider) missing.push('provider');
-    if (!config.model) missing.push('model');
-    if (!config.apiKeyEnv) missing.push('apiKeyEnv');
-    if (config.provider) {
-      // PRI-621 PR2 review: the pi-ai catalog lookup is a core capability —
-      // the CLI queries it through @principles/core and must not depend on
-      // pi-ai directly (EP-06).
-      if (!isBuiltinPiAiProvider(config.provider) && !config.baseUrl) {
-        missing.push('baseUrl');
-      }
-    }
-
-    if (missing.length > 0 || config.provider || config.apiKeyEnv) {
-      console.error('Error: Pain signal failed\n');
-
-      if (missing.length > 0) {
-        console.error('  Missing configuration:');
-        for (const m of missing) {
-          console.error(`    - ${m}`);
-        }
-        console.error('');
-      }
-
-      if (config.provider || config.model || config.apiKeyEnv || config.baseUrl) {
-        console.error('  Current workflow policy (pd-runtime-v2-diagnosis):');
-        console.error(`    runtimeKind: ${config.runtimeKind}`);
-        if (config.provider) console.error(`    provider:    ${config.provider}`);
-        if (config.model) console.error(`    model:       ${config.model}`);
-        if (config.apiKeyEnv) console.error(`    apiKeyEnv:   ${config.apiKeyEnv}`);
-        if (config.baseUrl) console.error(`    baseUrl:     ${config.baseUrl}`);
-        console.error('');
-      }
-
-      console.error('  To diagnose and configure your runtime, run:');
-      console.error('    pd runtime probe --runtime pi-ai --provider <name> --model <id> --apiKeyEnv <name>');
-      console.error('');
-
-      if (result.message) console.error(`  Details: ${result.message}`);
-      process.exit(1);
-      return;
-    }
-  }
-
-  // PRI-642 (SPEC §12.1.6): generated-but-unadmitted candidates must never
-  // read as completed internalization — surface the admission disposition.
-  const admissionDecisions = result.admissionResults?.map(r => r.admission.decision) ?? [];
-  const admittedCount = admissionDecisions.filter(d => d === 'admitted').length;
-  const gatedWarning = result.status === 'succeeded'
-    && result.candidateIds.length > 0
-    && admittedCount === 0
-    ? `admitted: 0 of ${result.candidateIds.length} candidates (all gated — needs_evidence/deferred); `
-      + 'nothing was internalized. See admissionResults for per-candidate reasons; add --session evidence or Owner context to raise confidence above the admission threshold.'
-    : null;
-  // PRI-642: the ingress decision's own disclosures (degrade warning /
-  // unbound context_unbound warning) are surfaced to the operator.
-  const decisionWarnings = decision.action === 'degrade'
-    ? [`${decision.warning} Next action: ${decision.nextAction}`]
-    : decision.action === 'submit'
-      ? decision.warnings
-      : [];
-  const cliWarnings = [...decisionWarnings, gatedWarning].filter((w): w is string => w !== null && w !== undefined);
-
-  // PRI-743: the pre-existing 'openclaw' default is an assumption, not
-  // evidence — disclose it whenever it actually applies (rc-9), so host
-  // attribution can never silently distort PRI-743-style host comparisons.
-  // Unbound reports (no --session) keep host_kind NULL: they carry no host
-  // trace at all, so labelling them 'openclaw' would be a fresh misattribution
-  // rather than a compatibility default.
-  const hostDefaultWarning = binding.sessionId !== undefined && opts.host === undefined
-    ? 'host kind not specified, defaulting to openclaw; pass --host codex with --rollout-id/--host-turn-id to attribute this pain to the Codex host.'
-    : null;
-  if (hostDefaultWarning !== null) cliWarnings.push(hostDefaultWarning);
-
-  if (opts.json) {
-    const out: Record<string, unknown> = { ...result };
-    // PRI-743: surface the effective host attribution explicitly in --json
-    // (machine consumers doing host comparisons must not re-derive it).
-    if (binding.sessionId !== undefined) {
-      out.hostAttribution = binding.hostKind;
-    }
-    // Ensure nextAction is present for actionable states
-    if (out.status === 'submitted') {
-      if (!out.nextAction) {
-        out.nextAction = `pd diagnose run --task-id ${out.taskId} --workspace "${workspaceDir}" --runtime pi-ai --json`;
-      }
-      if (!out.reason) {
-        out.reason = out.message;
-      }
-    }
-    // PRI-570: async submission has NO automatic consumer — the
-    // internalization auto-consumer's runner kinds (dreamer..rollout_reviewer)
-    // do not include 'diagnostician', so a submitted task stays pending until
-    // the owner runs the diagnose command. Never let that stay implicit (rc-9).
-    // PRI-642: unbound/gated disclosures join the same warnings channel.
-    const submittedWarning = out.status === 'submitted'
-      ? 'Async mode: no background consumer picks up diagnostician tasks. '
-        + `Run ${out.nextAction} or the pain signal will remain pending indefinitely. `
-        + 'Use --wait to diagnose synchronously instead.'
-      : null;
-    const allWarnings = [...cliWarnings];
-    if (submittedWarning !== null) allWarnings.unshift(submittedWarning);
-    if (allWarnings.length > 0) {
-      out.warning = allWarnings.join(' ');
-      out.warnings = allWarnings;
-    }
-    console.log(JSON.stringify(out, null, 2));
-    if (result.status !== 'succeeded' && result.status !== 'skipped' && result.status !== 'retried' && result.status !== 'submitted') {
-      process.exit(1);
-      return;
-    }
-  } else {
-    if (result.status === 'succeeded') {
-      console.log('[OK] Pain signal recorded via PainToPrincipleService');
-      console.log(`   Pain ID: ${result.painId}`);
-      console.log(`   Task ID: ${result.taskId}`);
-      if (result.runId) console.log(`   Run ID: ${result.runId}`);
-      if (result.artifactId) console.log(`   Artifact ID: ${result.artifactId}`);
-      if (result.candidateIds.length > 0) console.log(`   Candidate IDs: ${result.candidateIds.join(', ')}`);
-      if (result.ledgerEntryIds.length > 0) console.log(`   Ledger Entry IDs: ${result.ledgerEntryIds.join(', ')}`);
-      if (result.progress && result.progress.seededTaskIds.length > 0) {
-        console.log(`   Seeded Task IDs: ${result.progress.seededTaskIds.join(', ')}`);
-      }
-      console.log(`   Reason: ${opts.reason}`);
-      console.log(`   Score: ${opts.score ?? 80}`);
-      console.log(`   Source: ${opts.source ?? 'manual'}`);
-      console.log(`   Workspace: ${workspaceDir}`);
-      if (binding.sessionId) {
-        console.log(`   Session: ${binding.sessionId} (bound, host=${binding.hostKind}, ${binding.evidence.length} evidence entries)`);
-      } else {
-        console.log('   Session: unbound (Owner report; no trajectory evidence)');
-      }
-      if (result.admissionResults && result.admissionResults.length > 0) {
-        console.log(`   Admission: ${admittedCount} of ${result.admissionResults.length} candidates admitted`);
-        for (const r of result.admissionResults) {
-          console.log(`     - ${r.candidateId}: ${r.admission.decision} (${r.admission.reason})`);
-        }
-      }
-      if (result.latencyMs !== undefined) console.log(`   Latency: ${result.latencyMs}ms`);
-      for (const w of cliWarnings) {
-        console.warn(`   ⚠️  ${w}`);
-      }
-      console.log(`\nDiagnostician pipeline running. Check progress with:`);
-      console.log(`   pd task show ${result.taskId} --workspace "${workspaceDir}"`);
-    } else if (result.status === 'submitted') {
-      console.log('[SUBMITTED] Pain signal submitted for async diagnosis');
-      console.log(`   Pain ID: ${result.painId}`);
-      console.log(`   Task ID: ${result.taskId}`);
-      console.log(`   Status: submitted`);
-      // PRI-570: no background consumer picks up diagnostician tasks — say so
-      // explicitly instead of implying async diagnosis happens on its own (rc-9).
-      console.error('   WARNING: async mode has no automatic consumer for diagnostician tasks.');
-      console.error(`   Run: pd diagnose run --task-id ${result.taskId} --workspace "${workspaceDir}" --runtime pi-ai`);
-      console.error('   Or re-record with --wait to diagnose synchronously. Without this, the task stays pending indefinitely.');
-    } else if (result.status === 'skipped') {
-      console.log(`[SKIP] Task already in progress: ${result.message ?? 'unknown'}`);
-      console.log(`   Pain ID: ${result.painId}`);
-      console.log(`   Task ID: ${result.taskId}`);
-    } else if (result.status === 'retried') {
-      console.log(`[RETRY] Task retried: ${result.message ?? 'unknown'}`);
-      console.log(`   Pain ID: ${result.painId}`);
-      console.log(`   Task ID: ${result.taskId}`);
-    } else {
-      console.error('[FAIL] Pain signal failed:', result.message);
-      process.exit(1);
-      return;
-    }
-  }
-}