@principles/pd-cli 1.152.5 → 1.152.6

package/src/services/rulehost-pipeline-runner.ts

@@ -17,10 +17,9 @@
  *   - The artificer↔evaluator stage delegates to `runAdversarialLoop` (PRI-428),
  *     which never throws and degrades to { decision: 'rejected' } with a reason.
  *   - gateDeps (the sandbox adapter) is built from `compileDemoRule` +
- *     `evaluateInRefinerSandbox`. Per the Explore finding, `compileDemoRule` is
- *     byte-equivalent to openclaw-plugin's `loadRuleImplementationModule`; the
- *     duplication is a package-boundary necessity (pd-cli cannot import
- *     openclaw-plugin), not a capability gap.
+ *     `evaluateInRefinerSandbox`. `compileDemoRule` delegates to the canonical
+ *     hardened replay evaluator in @principles/core (PRI-809), so pre-activation
+ *     replay crosses the same vm trust boundary as the production gate.
  *
  * @see docs/plans/rulehost-mvp-activation.md
  * @see runAdversarialLoop in @principles/core/runtime-v2
@@ -226,11 +225,9 @@ export interface RuleHostPipelineResult {
 /**
  * Build the sandbox gate deps for adversarial replay.
  *
- * `compileDemoRule` is byte-equivalent to openclaw-plugin's
- * `loadRuleImplementationModule` (same vm.createContext, same normalize, same
- * evaluate-shape check). pd-cli cannot import openclaw-plugin (package
- * boundary), so this duplicate is intentional and capability-identical, not a
- * stripped demo. See demo-rule-compiler.ts header comment.
+ * `compileDemoRule` delegates to the canonical hardened replay evaluator in
+ * @principles/core (PRI-809) — capability-identical across packages without a
+ * duplicate vm implementation. See demo-rule-compiler.ts header comment.
  */
 export function createSandboxGateDeps(): RefinerRuleHostGateDeps {
   return {

package/tests/commands/build-trajectory-evidence.test.ts

@@ -400,3 +400,109 @@ describe('acquireTrajectoryEvidenceFromDb — typed CLI acquisition (PRI-642 Sco
     expect(unreadable.reasonCode).toBe('evidence_read_failed');
   });
 });
+
+// ── PRI-783 review P1: the binding fact gates degrade vs refuse ─────────────
+// 'verified' = the sessions table was queried and DID contain the id;
+// 'unverified' = DB missing / unopenable / id absent / sessions table
+// unreadable. Only verified bindings may degrade to a bound submission.
+
+describe('acquisition binding fact (PRI-783 review P1)', () => {
+  beforeEach(() => {
+    createStateDir();
+  });
+
+  afterEach(() => {
+    try {
+      fs.rmSync(tmpDir, { recursive: true, force: true });
+    } catch {
+      // ignore cleanup errors
+    }
+  });
+
+  it('session present with zero evidence → empty_trajectory, binding verified (degrade precondition)', async () => {
+    const { acquireTrajectoryEvidenceFromDb } = await import('../../src/commands/build-trajectory-evidence.js');
+    const db = createTrajectoryDb();
+    db.prepare('INSERT INTO sessions (session_id, started_at, updated_at) VALUES (?, ?, ?)')
+      .run('quiet-session', '2026-01-01T09:00:00Z', '2026-01-01T09:00:00Z');
+    insertUserTurn(db, 'quiet-session', 'ordinary message', false, '2026-01-01T09:01:00Z');
+    db.close();
+
+    const result = acquireTrajectoryEvidenceFromDb(stateDir, 'quiet-session', tmpDir);
+
+    expect(result.status).toBe('unavailable');
+    if (result.status !== 'unavailable') return;
+    expect(result.reasonCode).toBe('empty_trajectory');
+    expect(result.binding).toBe('verified');
+  });
+
+  it('id absent from sessions table → session_not_found, binding unverified', async () => {
+    const { acquireTrajectoryEvidenceFromDb } = await import('../../src/commands/build-trajectory-evidence.js');
+    const db = createTrajectoryDb();
+    db.close();
+
+    const result = acquireTrajectoryEvidenceFromDb(stateDir, 'no-such-session', tmpDir);
+
+    expect(result.status).toBe('unavailable');
+    if (result.status !== 'unavailable') return;
+    expect(result.reasonCode).toBe('session_not_found');
+    expect(result.binding).toBe('unverified');
+  });
+
+  it('missing trajectory.db → trajectory_unavailable, binding unverified', async () => {
+    const { acquireTrajectoryEvidenceFromDb } = await import('../../src/commands/build-trajectory-evidence.js');
+    const result = acquireTrajectoryEvidenceFromDb(stateDir, 'some-session', tmpDir);
+
+    expect(result.status).toBe('unavailable');
+    if (result.status !== 'unavailable') return;
+    expect(result.reasonCode).toBe('trajectory_unavailable');
+    expect(result.binding).toBe('unverified');
+  });
+
+  it('corrupt DB (open fails) → evidence_read_failed, binding unverified', async () => {
+    const { acquireTrajectoryEvidenceFromDb } = await import('../../src/commands/build-trajectory-evidence.js');
+    const dbPath = path.join(stateDir, 'trajectory.db');
+    fs.writeFileSync(dbPath, Buffer.from('this is not a sqlite database at all'));
+
+    const result = acquireTrajectoryEvidenceFromDb(stateDir, 'some-session', tmpDir);
+
+    expect(result.status).toBe('unavailable');
+    if (result.status !== 'unavailable') return;
+    expect(result.reasonCode).toBe('evidence_read_failed');
+    expect(result.binding).toBe('unverified');
+  });
+
+  it('session verified but evidence tables unreadable → evidence_read_failed, binding verified', async () => {
+    const { acquireTrajectoryEvidenceFromDb } = await import('../../src/commands/build-trajectory-evidence.js');
+    const db = createTrajectoryDb();
+    db.prepare('INSERT INTO sessions (session_id, started_at, updated_at) VALUES (?, ?, ?)')
+      .run('readable-session', '2026-01-01T09:00:00Z', '2026-01-01T09:00:00Z');
+    db.close();
+    // Drop the evidence tables after the session row exists: the sessions
+    // check passed, the evidence read cannot.
+    const raw = new Database(path.join(stateDir, 'trajectory.db'));
+    raw.exec('DROP TABLE user_turns');
+    raw.close();
+
+    const result = acquireTrajectoryEvidenceFromDb(stateDir, 'readable-session', tmpDir);
+
+    expect(result.status).toBe('unavailable');
+    if (result.status !== 'unavailable') return;
+    expect(result.reasonCode).toBe('evidence_read_failed');
+    expect(result.binding).toBe('verified');
+  });
+
+  it('sessions table missing entirely → nothing is verified (unverified even when the reason is evidence_read_failed)', async () => {
+    const { acquireTrajectoryEvidenceFromDb } = await import('../../src/commands/build-trajectory-evidence.js');
+    const db = new Database(path.join(stateDir, 'trajectory.db'));
+    db.exec('CREATE TABLE user_turns (id INTEGER PRIMARY KEY AUTOINCREMENT, session_id TEXT NOT NULL, raw_excerpt TEXT, correction_detected INTEGER NOT NULL DEFAULT 0, correction_cue TEXT, created_at TEXT NOT NULL)');
+    db.close();
+
+    const result = acquireTrajectoryEvidenceFromDb(stateDir, 'never-seen', tmpDir);
+
+    expect(result.status).toBe('unavailable');
+    if (result.status !== 'unavailable') return;
+    // assistant_turns/tool_calls tables missing → readFailed → evidence_read_failed
+    expect(result.reasonCode).toBe('evidence_read_failed');
+    expect(result.binding).toBe('unverified');
+  });
+});

package/tests/commands/pain-record-session-parser.test.ts

@@ -13,6 +13,7 @@ import Database from 'better-sqlite3';
 import * as fs from 'node:fs';
 import * as path from 'node:path';
 import * as os from 'node:os';
+import { acquireTrajectoryEvidenceFromDb } from '../../src/commands/build-trajectory-evidence.js';
 
 let tmpDir: string;
 
@@ -24,7 +25,12 @@ function createWorkspace(): void {
   const db = new Database(path.join(stateDir, 'trajectory.db'));
   db.exec("CREATE TABLE IF NOT EXISTS sessions (session_id TEXT PRIMARY KEY, started_at TEXT, updated_at TEXT)");
   db.exec("CREATE TABLE IF NOT EXISTS assistant_turns (id INTEGER PRIMARY KEY AUTOINCREMENT, session_id TEXT NOT NULL, sanitized_text TEXT, stop_reason TEXT, created_at TEXT NOT NULL)");
-  db.exec("CREATE TABLE IF NOT EXISTS user_turns (id INTEGER PRIMARY KEY AUTOINCREMENT, session_id TEXT NOT NULL, raw_excerpt TEXT, correction_detected INTEGER NOT NULL DEFAULT 0, created_at TEXT NOT NULL)");
+  // PRI-783 lesson recorded on the fixture: user_turns MUST carry
+  // correction_cue — collectEvidenceFromDb SELECTs it, and a missing column
+  // silently degraded the user-turns read into evidence_read_failed, so this
+  // file's 'accepts --session' case never actually exercised a real evidence
+  // read (it vacuously asserted on a refusal).
+  db.exec("CREATE TABLE IF NOT EXISTS user_turns (id INTEGER PRIMARY KEY AUTOINCREMENT, session_id TEXT NOT NULL, raw_excerpt TEXT, correction_detected INTEGER NOT NULL DEFAULT 0, correction_cue TEXT, created_at TEXT NOT NULL)");
   db.exec("CREATE TABLE IF NOT EXISTS tool_calls (id INTEGER PRIMARY KEY AUTOINCREMENT, session_id TEXT NOT NULL, tool_name TEXT NOT NULL, outcome TEXT NOT NULL, error_type TEXT, exit_code INTEGER, params_json TEXT NOT NULL DEFAULT '{}', result_preview TEXT, created_at TEXT NOT NULL)");
   db.prepare('INSERT INTO sessions (session_id, started_at, updated_at) VALUES (?, ?, ?)')
     .run('real-session-1', '2026-01-01T09:00:00Z', '2026-01-01T09:00:00Z');
@@ -157,22 +163,66 @@ describe('pd pain record --session (real Commander + real trajectory.db)', () =>
     expect(typeof parsed.nextAction).toBe('string');
   }, 15_000);
 
-  it('accepts --session for a session that exists in the trajectory (validation passes, submission proceeds)', async () => {
+  it('accepts --session for a session that exists in the trajectory (real acquisition returns available evidence)', async () => {
+    // The spawned-CLI route is used above for the refusal contracts. The
+    // acceptance route ends in the diagnostician pipeline (out of this file's
+    // scope — the service has its own suite), so the acceptance boundary is
+    // asserted against the REAL acquisition function the CLI delegates to,
+    // over this file's real trajectory.db fixture (cli-7: real parser wiring
+    // is covered by the refusal spawns; real DB semantics here — PRI-783).
+    const stateDir = path.join(tmpDir, '.state');
+    const acquisition = acquireTrajectoryEvidenceFromDb(stateDir, 'real-session-1', tmpDir);
+
+    expect(acquisition.status).toBe('available');
+    if (acquisition.status !== 'available') return;
+    expect(acquisition.entries.length).toBeGreaterThanOrEqual(1);
+    expect(acquisition.entries.some(e => e.sourceRef.startsWith('owner_message:'))).toBe(true);
+  }, 15_000);
+
+  // ── PRI-783 review P1: unverified bindings must refuse, never persist ──────
+
+  it('locks the review P1: --session with a missing trajectory.db refuses and NEVER creates a db containing the fake id', async () => {
+    // Remove the fixture db so the id cannot be verified at all (the shared
+    // createWorkspace always seeds one). The run must fail loud
+    // (trajectory_unavailable) BEFORE any mutation — the observability writer
+    // must not create a trajectory.db and upsert the unverified id into
+    // sessions (self-proving loop).
+    fs.rmSync(path.join(tmpDir, '.state', 'trajectory.db'), { force: true });
     const result = await runBuiltCli([
       'pain', 'record',
-      '--reason', 'parser test pain with real session',
-      '--session', 'real-session-1',
+      '--reason', 'PRI-783 review P1 lock',
+      '--session', 'fake-unverified-id',
       '--workspace', tmpDir,
       '--json',
     ]);
 
-    // The session exists, so session validation must NOT reject it. The run
-    // may still fail later (no LLM runtime configured in this temp
-    // workspace) — the assertion is only about the validation stage.
-    const trimmed = result.stdout.trim();
-    expect(trimmed.length).toBeGreaterThan(0);
-    const parsed = JSON.parse(trimmed) as Record<string, unknown>;
-    expect(parsed.reason).not.toBe('session_not_found');
-    expect(parsed.reason).not.toBe('empty_trajectory');
+    expect(result.status).not.toBe(0);
+    const parsed = JSON.parse(result.stdout.trim()) as Record<string, unknown>;
+    expect(parsed.status).toBe('failed');
+    expect(parsed.reason).toBe('trajectory_unavailable');
+    expect(parsed.nextAction).not.toMatch(/pd pain record --session/);
+    // The lock: no trajectory.db was created by this run — the fake id can
+    // never appear in a sessions table.
+    expect(fs.existsSync(path.join(tmpDir, '.state', 'trajectory.db'))).toBe(false);
+  }, 15_000);
+
+  it('real empty session reports empty_trajectory with a VERIFIED binding (the degrade precondition)', async () => {
+    // Gate the degrade path on the real acquisition semantics: a session
+    // row that exists with zero evidence rows is the only unavailable shape
+    // allowed to degrade to a bound submission.
+    const stateDir = path.join(tmpDir, '.state');
+    const db = new Database(path.join(stateDir, 'trajectory.db'));
+    db.prepare('INSERT INTO sessions (session_id, started_at, updated_at) VALUES (?, ?, ?)')
+      .run('real-empty-session', '2026-01-01T08:00:00Z', '2026-01-01T08:00:00Z');
+    db.prepare('INSERT INTO user_turns (session_id, raw_excerpt, correction_detected, correction_cue, created_at) VALUES (?, ?, ?, ?, ?)')
+      .run('real-empty-session', 'ordinary message, not a correction', 0, null, '2026-01-01T08:01:00Z');
+    db.close();
+
+    const acquisition = acquireTrajectoryEvidenceFromDb(stateDir, 'real-empty-session', tmpDir);
+
+    expect(acquisition.status).toBe('unavailable');
+    if (acquisition.status !== 'unavailable') return;
+    expect(acquisition.reasonCode).toBe('empty_trajectory');
+    expect(acquisition.binding).toBe('verified');
   }, 15_000);
 });

package/tests/commands/pain-record.test.ts

@@ -566,6 +566,7 @@ describe('pd pain record', () => {
       status: 'unavailable',
       reasonCode: 'session_not_found',
       detail: 'session not present in trajectory.db sessions table',
+      binding: 'unverified',
     } as any);
     const logSpy = vi.spyOn(console, 'log').mockImplementation(() => {});
     const errorSpy = vi.spyOn(console, 'error').mockImplementation(() => {});
@@ -579,6 +580,9 @@ describe('pd pain record', () => {
     expect(jsonOutput.status).toBe('failed');
     expect(jsonOutput.reason).toBe('session_not_found');
     expect(jsonOutput.nextAction).toBeTruthy();
+    // PRI-783: the next action must not recommend retrying the exact path
+    // that just failed (`pd pain record --session`).
+    expect(jsonOutput.nextAction).not.toMatch(/pd pain record --session/);
     // cli-2/cli-5: execution stopped — no service mutation, exit 1
     expect(lastRecordPainInput).toBeNull();
     expect(exitSpy).toHaveBeenCalledWith(1);
@@ -593,6 +597,7 @@ describe('pd pain record', () => {
       status: 'unavailable',
       reasonCode: 'session_not_found',
       detail: 'session not present',
+      binding: 'unverified',
     } as any);
     const logSpy = vi.spyOn(console, 'log').mockImplementation(() => {});
     const exitSpy = mockProcessExit();
@@ -607,70 +612,105 @@ describe('pd pain record', () => {
     exitSpy.mockRestore();
   });
 
-  it('fails before mutation on empty_trajectory (CLI never claims host_context_bound without a verified session)', async () => {
-    // Per Evidence Over Assumption: the CLI does not own session identity
-    // the way the OpenClaw host command context does. Unverified sessions
-    // (any acquisition that does not yield 'available') must refuse before
-    // any LLM/task/candidate mutation.
+  it('degrades to a bound, honest empty-evidence submission on empty_trajectory (PRI-783: a verified session must not be refused)', async () => {
+    // SPEC §8.2: binding failure and evidence failure are separate axes — a
+    // real session with no usable evidence rows is bound + unavailable
+    // (row 4, degrade), not unbound (row 5, refuse). PRI-783 Owner
+    // directive: a correct current session id is sufficient; empty evidence
+    // must not hard-refuse the report.
     vi.mocked(acquireTrajectoryEvidenceFromDb).mockReturnValueOnce({
       status: 'unavailable',
       reasonCode: 'empty_trajectory',
       detail: 'session exists but no usable evidence',
+      binding: 'verified',
     } as any);
     const logSpy = vi.spyOn(console, 'log').mockImplementation(() => {});
     const exitSpy = mockProcessExit();
 
     await handlePainRecord({ reason: 'test pain', session: 'quiet-session', json: true });
 
-    expect(lastRecordPainInput).toBeNull();
+    // Bound correlation with honest empty evidence — nothing fabricated.
+    expect(lastRecordPainInput).not.toBeNull();
+    expect(lastRecordPainInput!.sessionId).toBe('quiet-session');
+    expect(lastRecordPainInput!.hostKind).toBe('openclaw');
+    expect(lastRecordPainInput!.evidence).toEqual([]);
+    expect(lastRecordPainInput!.painIngress.correlation.status).toBe('bound');
+    expect(lastRecordPainInput!.painIngress.evidenceClass).toEqual({
+      status: 'unavailable',
+      reason: 'empty_trajectory',
+    });
+    // Degradation is disclosed, and the report is NOT refused.
     const jsonOutput = JSON.parse(logSpy.mock.calls[0][0]);
-    expect(jsonOutput.status).toBe('failed');
-    expect(jsonOutput.reason).toBe('empty_trajectory');
-    expect(exitSpy).toHaveBeenCalledWith(1);
+    expect(jsonOutput.status).toBe('succeeded');
+    expect(String(jsonOutput.warning ?? '')).toMatch(/empty_trajectory/);
+    expect(exitSpy).not.toHaveBeenCalledWith(1);
 
     logSpy.mockRestore();
     exitSpy.mockRestore();
   });
 
-  it('fails before mutation on evidence_read_failed (no LLM/no task when the CLI cannot verify binding)', async () => {
+  it('degrades on evidence_read_failed when the binding was verified (tables unreadable after the sessions check)', async () => {
+    // SPEC §8.2 note: a real session with an unreadable trajectory is
+    // bound + unavailable — the sessions row was found, only the evidence
+    // read failed.
     vi.mocked(acquireTrajectoryEvidenceFromDb).mockReturnValueOnce({
       status: 'unavailable',
       reasonCode: 'evidence_read_failed',
-      detail: 'trajectory.db unreadable',
+      detail: 'trajectory_tables_unreadable',
+      binding: 'verified',
     } as any);
     const logSpy = vi.spyOn(console, 'log').mockImplementation(() => {});
     const exitSpy = mockProcessExit();
 
     await handlePainRecord({ reason: 'test pain', session: 'sess-x', json: true });
 
-    expect(lastRecordPainInput).toBeNull();
+    expect(lastRecordPainInput).not.toBeNull();
+    expect(lastRecordPainInput!.sessionId).toBe('sess-x');
+    expect(lastRecordPainInput!.evidence).toEqual([]);
+    expect(lastRecordPainInput!.painIngress.correlation.status).toBe('bound');
+    expect(lastRecordPainInput!.painIngress.evidenceClass).toEqual({
+      status: 'unavailable',
+      reason: 'evidence_read_failed',
+    });
     const jsonOutput = JSON.parse(logSpy.mock.calls[0][0]);
-    expect(jsonOutput.status).toBe('failed');
-    expect(jsonOutput.reason).toBe('evidence_read_failed');
-    expect(exitSpy).toHaveBeenCalledWith(1);
+    expect(jsonOutput.status).toBe('succeeded');
+    expect(String(jsonOutput.warning ?? '')).toMatch(/evidence_read_failed/);
+    expect(exitSpy).not.toHaveBeenCalledWith(1);
 
     logSpy.mockRestore();
     exitSpy.mockRestore();
   });
 
-  it('fails before mutation on trajectory_unavailable (CLI cannot fabricate a session)', async () => {
+  it.each([
+    ['trajectory_unavailable', 'no trajectory.db at workspace .state'],
+    ['evidence_read_failed', 'trajectory_db_unreadable: file is not a database'],
+  ] as const)('refuses %s when the binding is UNVERIFIED (PRI-783 review P1: no verified session, no bound claim)', async (reasonCode, detail) => {
+    // PRI-783 review P1: when trajectory.db is missing or unopenable the id
+    // could not be verified. Claiming bound here would let the observability
+    // writer persist the unverified id into a freshly created trajectory.db —
+    // a self-proving loop. It must refuse instead.
     vi.mocked(acquireTrajectoryEvidenceFromDb).mockReturnValueOnce({
       status: 'unavailable',
-      reasonCode: 'trajectory_unavailable',
-      detail: 'no trajectory.db at workspace .state',
+      reasonCode,
+      detail,
+      binding: 'unverified',
     } as any);
     const logSpy = vi.spyOn(console, 'log').mockImplementation(() => {});
+    const errorSpy = vi.spyOn(console, 'error').mockImplementation(() => {});
     const exitSpy = mockProcessExit();
 
     await handlePainRecord({ reason: 'test pain', session: 'sess-x', json: true });
 
+    // Refused before any mutation, with honest next guidance.
     expect(lastRecordPainInput).toBeNull();
     const jsonOutput = JSON.parse(logSpy.mock.calls[0][0]);
     expect(jsonOutput.status).toBe('failed');
-    expect(jsonOutput.reason).toBe('trajectory_unavailable');
+    expect(jsonOutput.reason).toBe(reasonCode);
+    expect(jsonOutput.nextAction).not.toMatch(/pd pain record --session/);
     expect(exitSpy).toHaveBeenCalledWith(1);
 
     logSpy.mockRestore();
+    errorSpy.mockRestore();
     exitSpy.mockRestore();
   });