@principles/pd-cli 1.152.7 → 1.152.8

package/src/services/rulehost-pipeline-runner.ts

@@ -54,6 +54,8 @@ import {
   // runners already receive (EP-07: canonical resolved value, not raw input).
   resolveOutputLanguage,
   buildArtificerHostSemanticContext,
+  // PRI-804(a): ledger identity lookup for the source_principle_id backfill.
+  PrincipleTreeLedgerAdapter,
 } from '@principles/core/runtime-v2';
 import type {
   AdversarialLoopResult,
@@ -70,23 +72,12 @@ import type {
   SeedArtificerRepairParams,
   EvaluatorValidator,
 } from '@principles/core/runtime-v2';
-import { createHash } from 'node:crypto';
+import * as path from 'node:path';
 import { loadPdConfig } from './pd-config-loader.js';
 import { createEvaluatorRuntimeContext } from '@principles/host-runtime';
 /* eslint-disable @typescript-eslint/no-use-before-define -- helpers declared after main, matching codebase convention */
 import { compileDemoRule } from './demo-rule-compiler.js';
 
-/**
- * Layer 0 content-hash function for the internalization progressive
- * disclosure (design §6.1). Core never imports `node:crypto`, so the plugin/CLI
- * layer injects the algorithm. Consumed only when the
- * `artifact_summary_redundancy` flag is on; harmless otherwise.
- *
- * Exported so other CLI command modules (e.g. `runtime-internalization-run-once`)
- * can reuse the same algorithm without each re-importing `node:crypto`.
- */
-export const contentHashFn = (input: string): string => createHash('sha256').update(input).digest('hex');
-
 // ── Types ────────────────────────────────────────────────────────────────────
 
 /**
@@ -191,8 +182,8 @@ export interface RuleHostPipelineStage {
  *   rule artifact exists and is WAITING for owner review. This is NOT owner
  *   approval — it means the candidate is ready for the owner to review.
  * - `text_principle_only`: code-rule capability OFF (artificer or evaluator
- *   disabled). No rule artifact; a text principle artifact is produced for
- *   prompt-channel fallback.
+ *   disabled). No rule artifact; a text principle artifact is produced for the
+ *   prompt channel and enqueued into the existing approval queue (PRI-804).
  * - `generation_rejected`: pipeline failed (no dreamer task, stage failure, or
  *   evaluator rejected the candidate). No rule artifact.
  */
@@ -210,10 +201,10 @@ export interface RuleHostPipelineResult {
   readonly principleArtifactId: string | null;
   /**
    * Approval ID when the candidate was auto-enqueued into the ApprovalQueue.
-   * Present when decision='candidate_ready_for_owner_review' and the pipeline
-   * successfully enqueued the candidate for owner review (P1 #1 fix).
-   * Null when the candidate was not enqueued (text_principle_only, rejected,
-   * or enqueue failed — check degradationReason for details).
+   * Present for decision='candidate_ready_for_owner_review' (rule artifact,
+   * code_tool_hook channel) AND for decision='text_principle_only' (principle
+   * artifact, prompt channel — PRI-804 wiring). Null when the enqueue itself
+   * failed — check degradationReason for the structured reason.
    */
   readonly approvalId: string | null;
   /** Structured reason when decision is not candidate_ready_for_owner_review. */
@@ -331,7 +322,7 @@ export async function runRuleHostPipeline(opts: RuleHostPipelineOptions): Promis
       stages.push({ name: 'dreamer', taskId: dreamerSeedTaskId, status: 'succeeded' });
     } else {
       const dreamerRunner = new DreamerRunner(
-        { stateManager, runtimeAdapter: agentAdapters.dreamer, eventEmitter, validator: new DefaultDreamerValidator(), artifactStore, contentHashFn },
+        { stateManager, runtimeAdapter: agentAdapters.dreamer, eventEmitter, validator: new DefaultDreamerValidator(), artifactStore },
         runnerOptsFor(agentAdapters.dreamer),
       );
       const dreamerResult = await runStage(dreamerRunner, dreamerSeedTaskId, { maxStageRetries, pollIntervalMs });
@@ -348,7 +339,7 @@ export async function runRuleHostPipeline(opts: RuleHostPipelineOptions): Promis
     const philosopherTaskId = `${correlation}-philosopher-${Date.now().toString(36)}`;
     await createInternalizationTask(stateManager, philosopherTaskId, 'philosopher', [dreamerSeedTaskId], channel, timeoutMs);
     const philosopherRunner = new PhilosopherRunner(
-      { stateManager, runtimeAdapter: agentAdapters.philosopher, eventEmitter, validator: new DefaultPhilosopherValidator(), artifactStore, contentHashFn },
+      { stateManager, runtimeAdapter: agentAdapters.philosopher, eventEmitter, validator: new DefaultPhilosopherValidator(), artifactStore },
       runnerOptsFor(agentAdapters.philosopher),
     );
     const philosopherResult = await runStage(philosopherRunner, philosopherTaskId, { maxStageRetries, pollIntervalMs });
@@ -364,7 +355,7 @@ export async function runRuleHostPipeline(opts: RuleHostPipelineOptions): Promis
     const scribeTaskId = `${correlation}-scribe-${Date.now().toString(36)}`;
     await createInternalizationTask(stateManager, scribeTaskId, 'scribe', [philosopherTaskId], channel, timeoutMs);
     const scribeRunner = new ScribeRunner(
-      { stateManager, runtimeAdapter: agentAdapters.scribe, eventEmitter, validator: new DefaultScribeValidator(), artifactStore, contentHashFn },
+      { stateManager, runtimeAdapter: agentAdapters.scribe, eventEmitter, validator: new DefaultScribeValidator(), artifactStore },
       runnerOptsFor(agentAdapters.scribe),
     );
     const scribeResult = await runStage(scribeRunner, scribeTaskId, { maxStageRetries, pollIntervalMs });
@@ -375,6 +366,29 @@ export async function runRuleHostPipeline(opts: RuleHostPipelineOptions): Promis
     }
     onProgress('scribe', 'succeeded');
 
+    // EP002-R4 follow-up #2 + Owner Decision Experience v1 Phase A: backfill
+    // the LEDGER principle UUID on the scribe artifact for BOTH paths (rule +
+    // text). Downstream identity resolution (extractPrincipleId's column-first
+    // order) then binds the rule artifact, the approval grouping, and the
+    // post-approve ledger upgrade to the ledger UUID instead of falling back
+    // to principleDraft.title — the title namespace is what left rule-channel
+    // approvals stranded as title-keyed groups the Console detail page cannot
+    // reach.
+    //
+    // Phase A (SPEC §9.1): the binding outcome is STRUCTURED. An unverified
+    // binding no longer silently continues into Owner approval publication —
+    // the enqueue sites below refuse to create an approval subject for an
+    // artifact whose stable ledger identity is not established, while the
+    // generation chain and its artifacts are preserved for later replay.
+    const identityBinding = await backfillScribeIdentity({
+      stateManager, artifactStore, scribeTaskId, dreamerTaskId: dreamerSeedTaskId,
+      workspaceDir: opts.workspaceDir, now: new Date().toISOString(),
+    });
+    if (scribeIdentityNote(identityBinding) !== '') {
+      const scribeStage = stages.find((s) => s.name === 'scribe');
+      if (scribeStage) (scribeStage as { reason?: string }).reason = scribeIdentityNote(identityBinding).replace(/^; /, '');
+    }
+
     // ── Atomic capability branching ──
     // Per user correction (2026-06-18): ArtificerL2 + Evaluator are atomic.
     // When OFF (or not provided), skip the adversarial loop entirely and
@@ -383,7 +397,14 @@ export async function runRuleHostPipeline(opts: RuleHostPipelineOptions): Promis
     if (!capabilityEnabled) {
       stages.push({ name: 'adversarial_loop', status: 'skipped', reason: capabilityDisabledReason });
       onProgress('adversarial_loop', 'skipped', capabilityDisabledReason);
-      return await textPrincipleOnlyResult({ painId: opts.painId, stages, scribeTaskId, disabledReason: capabilityDisabledReason, artifactStore });
+      // PRI-804: text principles enter the existing prompt-channel approval
+      // queue (Owner governance, same gate as RuleCode) instead of dead-ending.
+      const approvalStore = new SqliteApprovalQueueStore(stateManager.connection);
+      return await textPrincipleOnlyResult({
+        painId: opts.painId, stages, scribeTaskId, disabledReason: capabilityDisabledReason,
+        artifactStore, approvalStore, now: new Date().toISOString(),
+        identityBinding,
+      });
     }
 
     // ── Stage: adversarial loop (artificer↔evaluator) ──
@@ -429,7 +450,7 @@ export async function runRuleHostPipeline(opts: RuleHostPipelineOptions): Promis
     const artificerRunner = new ArtificerRunner(
       {
         stateManager, runtimeAdapter: capability.artificerAdapter, eventEmitter, validator: new DefaultArtificerValidator(), artifactStore,
-        behaviorExamplePack: opts.behaviorExamplePack, contentHashFn,
+        behaviorExamplePack: opts.behaviorExamplePack,
       },
       {
         ...runnerOptsFor(capability.artificerAdapter),
@@ -488,8 +509,32 @@ export async function runRuleHostPipeline(opts: RuleHostPipelineOptions): Promis
     // owner can review it. Without this, the pipeline produces a candidate
     // artifact but it never enters the approval queue — the production chain
     // is broken at step 2→3. Tests manually called enqueue(); production did not.
+    //
+    // Owner Decision Experience v1 Phase A (SPEC §9.1.4/§9.1.6): creating an
+    // Owner approval subject is a governance publication — it requires a
+    // verified stable ledger identity. When the chain's candidate could not be
+    // bound to exactly one existing ledger principle, the rule artifact must
+    // NOT enter the approvable set, even though the artifact itself (and every
+    // intermediate artifact) is preserved. Recovery is replay: after the
+    // ledger/identity repair, re-running the pipeline re-attempts the binding
+    // idempotently and then publishes.
     let approvalId: string | null = null;
     if (pipelineDecision === 'candidate_ready_for_owner_review' && loopResult.ruleArtifactId) {
+      const ruleIdentity = await resolveRuleArtifactIdentity(artifactStore, loopResult.ruleArtifactId, identityBinding);
+      if (ruleIdentity === null) {
+        const reasonCode = scribeIdentityReasonCode(identityBinding);
+        return {
+          decision: pipelineDecision,
+          painId: opts.painId,
+          stages,
+          scribeTaskId,
+          adversarialLoop: loopResult,
+          ruleArtifactId: loopResult.ruleArtifactId,
+          principleArtifactId: loopResult.principleArtifactId,
+          approvalId: null,
+          degradationReason: `identity_binding_unverified: ${reasonCode}. Rule artifact NOT enqueued for Owner approval (governance publication boundary). Artifacts preserved; repair the ledger identity and re-run this pipeline to publish.`,
+        };
+      }
       try {
         const approvalStore = new SqliteApprovalQueueStore(stateManager.connection);
         const riskLevel = getChannelRiskLevel(channel);
@@ -657,11 +702,6 @@ export interface CreateEvaluatorRunnerDepsInputs {
   readonly artifactStore: PIArtifactStore;
   /** Workspace directory containing `.pd/config.yaml` (flag source). */
   readonly workspaceDir: string;
-  /**
-   * Layer 0 content-hash function (design §6.1). Optional — defaults to the
-   * module-level sha256-hex `contentHashFn`. Allow override for tests.
-   */
-  readonly contentHashFn?: (input: string) => string;
 }
 
 /**
@@ -686,10 +726,6 @@ export function createEvaluatorRunnerDeps(inputs: CreateEvaluatorRunnerDepsInput
     eventEmitter,
     validator,
     artifactStore,
-    // Layer 0 (design §6.1): inject the content-hash function so the evaluator
-    // writer can attach a `predecessorSummary.contentHash` for staleness
-    // detection. Defaults to the module-level sha256-hex constant.
-    contentHashFn: inputs.contentHashFn ?? contentHashFn,
     isRepairLoopEnabled: (): boolean => {
       // rc-9: never throw on malformed config — fail safe to false so the
       // legacy (non-repair) path runs. The malformed config is already
@@ -846,16 +882,313 @@ interface TextPrincipleOnlyParams {
   readonly scribeTaskId: string;
   readonly disabledReason: string;
   readonly artifactStore: PIArtifactStore;
+  /** PRI-804: approval queue used to enqueue the text principle (prompt channel). */
+  readonly approvalStore: SqliteApprovalQueueStore;
+  readonly now: string;
+  /** Phase A: structured identity outcome from the shared post-scribe backfill. */
+  readonly identityBinding: ScribeIdentityBinding;
+}
+
+/**
+ * Owner Decision Experience v1 Phase A (SPEC §9.1) — structured ledger
+ * identity binding outcome for the internalization chain.
+ *
+ * `bound`/`already_bound` mean the scribe principle artifact carries a
+ * source_principle_id that was READ BACK from the PI store after the write
+ * and, when the chain candidate resolved, that it equals the unique existing
+ * ledger principle. Every other status is a publication blocker: the reason
+ * codes follow the SPEC's suggested vocabulary
+ * (candidate_unresolved / ledger_missing / ledger_ambiguous /
+ * identity_conflict / binding_write_failed).
+ */
+export type ScribeIdentityBinding =
+  | { status: 'bound'; principleId: string }
+  | { status: 'already_bound'; principleId: string }
+  | { status: 'no_principle_artifact' }
+  | { status: 'candidate_unresolved' }
+  | { status: 'ledger_missing'; candidateId: string }
+  | { status: 'ledger_ambiguous'; candidateId: string; principleIds: string[] }
+  | { status: 'identity_conflict'; existingPrincipleId: string; resolvedPrincipleId: string }
+  | { status: 'bound_target_missing'; principleId: string }
+  | { status: 'binding_write_failed'; errorMessage: string }
+  | { status: 'binding_readback_failed'; expectedPrincipleId: string; errorMessage: string };
+
+/** Only these two statuses authorize governance publication (approval enqueue). */
+export function isIdentityBindingVerified(
+  binding: ScribeIdentityBinding,
+): binding is Extract<ScribeIdentityBinding, { status: 'bound' | 'already_bound' }> {
+  return binding.status === 'bound' || binding.status === 'already_bound';
+}
+
+/** Stable machine reason code for observability/logs (SPEC §9.1 vocabulary). */
+export function scribeIdentityReasonCode(binding: ScribeIdentityBinding): string {
+  switch (binding.status) {
+    case 'bound':
+    case 'already_bound':
+      return 'bound';
+    case 'no_principle_artifact':
+      return 'no_principle_artifact';
+    case 'candidate_unresolved':
+      return 'candidate_unresolved';
+    case 'ledger_missing':
+      return 'ledger_missing';
+    case 'ledger_ambiguous':
+      return 'ledger_ambiguous';
+    case 'identity_conflict':
+      return 'identity_conflict';
+    case 'bound_target_missing':
+      return 'identity_conflict';
+    case 'binding_write_failed':
+      return 'binding_write_failed';
+    case 'binding_readback_failed':
+      return 'binding_write_failed';
+  }
+}
+
+/** Human/telemetry note for the scribe stage; '' on a verified binding. */
+export function scribeIdentityNote(binding: ScribeIdentityBinding): string {
+  switch (binding.status) {
+    case 'bound':
+    case 'already_bound':
+      return '';
+    case 'no_principle_artifact':
+      return '; source_principle_id_backfill_skipped: no principle artifact from scribe';
+    case 'candidate_unresolved':
+      return '; source_principle_id_backfill_skipped: no candidateId on the dreamer seed (candidate_unresolved)';
+    case 'ledger_missing':
+      return `; source_principle_id_backfill_skipped: candidate ${binding.candidateId} matches no ledger principle (ledger_missing)`;
+    case 'ledger_ambiguous':
+      return `; source_principle_id_backfill_skipped: candidate ${binding.candidateId} matches ${binding.principleIds.length} ledger principles (ledger_ambiguous)`;
+    case 'identity_conflict':
+      return `; source_principle_id_backfill_refused: artifact already bound to ${binding.existingPrincipleId}, chain resolves to ${binding.resolvedPrincipleId} (identity_conflict)`;
+    case 'bound_target_missing':
+      return `; source_principle_id_backfill_refused: artifact bound to ${binding.principleId} which is absent from the ledger (identity_conflict)`;
+    case 'binding_write_failed':
+      return `; source_principle_id_backfill_failed: ${binding.errorMessage}`;
+    case 'binding_readback_failed':
+      return `; source_principle_id_backfill_unverified: read-back mismatch for ${binding.expectedPrincipleId}: ${binding.errorMessage}`;
+  }
+}
+
+/**
+ * PRI-804(a) + Phase A: resolve the UNIQUE ledger principle for the chain.
+ *
+ * The ledger principle is the identity the Console groups approvals by and the
+ * one `upgradeLedgerPrinciple` activates after approval. The only durable link
+ * from the internalization chain to the ledger is the candidateId carried in
+ * the dreamer task's diagnosticJson (set by the intake bridge) — the ledger
+ * entry stores it in derivedFromPainIds. Phase A hardens the lookup:
+ * `listForCandidate` (plural, same adapter the intake bridge uses — one
+ * authority, no second truth) rejects zero and multi matches instead of
+ * silently taking the first hit.
+ */
+async function resolveLedgerIdentity(
+  stateManager: RuntimeStateManager,
+  dreamerTaskId: string,
+  workspaceDir: string,
+): Promise<ScribeIdentityBinding | { status: 'resolved'; principleId: string }> {
+  let candidateId: string | undefined;
+  try {
+    const dreamerTask = await stateManager.getTask(dreamerTaskId);
+    if (typeof dreamerTask?.diagnosticJson === 'string') {
+      const parsed: unknown = JSON.parse(dreamerTask.diagnosticJson);
+      if (parsed !== null && typeof parsed === 'object' && !Array.isArray(parsed)
+        && Object.hasOwn(parsed, 'candidateId')) {
+        const stored = Reflect.get(parsed, 'candidateId');
+        if (typeof stored === 'string' && stored.length > 0) candidateId = stored;
+      }
+    }
+  } catch {
+    return { status: 'candidate_unresolved' }; // malformed dreamer diagnosticJson
+  }
+  if (!candidateId) return { status: 'candidate_unresolved' };
+  let matches: { id: string }[];
+  try {
+    const ledger = new PrincipleTreeLedgerAdapter({ stateDir: path.join(workspaceDir, '.state') });
+    matches = ledger.listForCandidate(candidateId);
+  } catch {
+    // Ledger unreadable cannot be distinguished from "no ledger" here — the
+    // write attempt below will surface the concrete error; treat as missing
+    // with the skip note (same observable class as before Phase A).
+    return { status: 'ledger_missing', candidateId };
+  }
+  if (matches.length === 0) return { status: 'ledger_missing', candidateId };
+  if (matches.length > 1) {
+    return { status: 'ledger_ambiguous', candidateId, principleIds: matches.map((m) => m.id) };
+  }
+  const [unique] = matches;
+  if (unique === undefined) return { status: 'ledger_missing', candidateId };
+  return { status: 'resolved', principleId: unique.id };
+}
+
+interface BackfillIdentityParams {
+  readonly stateManager: RuntimeStateManager;
+  readonly artifactStore: PIArtifactStore;
+  readonly scribeTaskId: string;
+  readonly dreamerTaskId: string;
+  readonly workspaceDir: string;
+  readonly now: string;
+}
+
+/**
+ * EP002-R4 follow-up #2 + Phase A: backfill the scribe principle artifact's
+ * source_principle_id with the LEDGER principle UUID (shared by the rule and
+ * text paths — runs right after the scribe stage succeeds). Every downstream
+ * identity resolution reads this column FIRST (extractPrincipleId /
+ * EvaluatorRunner.extractPrincipleIdFromArtifact), so this single write is
+ * what binds approvals, Console grouping, ledger upgrades, and rule
+ * artifacts to the ledger UUID instead of the title namespace.
+ *
+ * Phase A contract changes vs the note-only version:
+ *   - the outcome is structured (ScribeIdentityBinding), not a free string;
+ *   - an existing binding that DISAGREES with the resolved ledger target is an
+ *     identity_conflict — never overwritten;
+ *   - a successful write is verified by reading the artifact back from the
+ *     PI store (log success alone is not binding evidence — SPEC §9.1);
+ *   - a pre-existing binding is only trusted when its target exists in the
+ *     ledger read (listForCandidate is not applicable — we check presence by
+ *     resolving through the same ledger load).
+ *
+ * Still never throws — identity enrichment must not break the generation
+ * chain; it only gates the later governance publication.
+ */
+export async function backfillScribeIdentity(params: BackfillIdentityParams): Promise<ScribeIdentityBinding> {
+  const { stateManager, artifactStore, scribeTaskId, dreamerTaskId, workspaceDir, now } = params;
+  try {
+    const arts = await artifactStore.listBySourceTaskId(scribeTaskId);
+    const principleArt = arts.find((a) => a.artifactKind === 'principle');
+    if (!principleArt) return { status: 'no_principle_artifact' };
+    const resolution = await resolveLedgerIdentity(stateManager, dreamerTaskId, workspaceDir);
+    if (principleArt.sourcePrincipleId) {
+      // Already bound (rerun). Idempotent success only when the binding is
+      // consistent with what the chain resolves to now.
+      if (resolution.status === 'resolved') {
+        if (resolution.principleId === principleArt.sourcePrincipleId) {
+          return { status: 'already_bound', principleId: principleArt.sourcePrincipleId };
+        }
+        return {
+          status: 'identity_conflict',
+          existingPrincipleId: principleArt.sourcePrincipleId,
+          resolvedPrincipleId: resolution.principleId,
+        };
+      }
+      if (resolution.status === 'ledger_ambiguous') return resolution;
+      // Chain candidate unresolved/missing on this replay — the durable
+      // binding still stands only if its target is a real ledger principle.
+      const ledger = new PrincipleTreeLedgerAdapter({ stateDir: path.join(workspaceDir, '.state') });
+      if (ledger.hasPrinciple(principleArt.sourcePrincipleId)) {
+        return { status: 'already_bound', principleId: principleArt.sourcePrincipleId };
+      }
+      return { status: 'bound_target_missing', principleId: principleArt.sourcePrincipleId };
+    }
+    if (resolution.status !== 'resolved') return resolution;
+    const ledgerPrincipleId = resolution.principleId;
+    await artifactStore.upsertArtifact({ ...principleArt, sourcePrincipleId: ledgerPrincipleId, updatedAt: now });
+    // Read-back verification: the PI store must return the bound ID.
+    try {
+      const readBack = await artifactStore.getArtifactById(principleArt.artifactId);
+      if (readBack?.sourcePrincipleId !== ledgerPrincipleId) {
+        return {
+          status: 'binding_readback_failed',
+          expectedPrincipleId: ledgerPrincipleId,
+          errorMessage: `read-back sourcePrincipleId=${readBack?.sourcePrincipleId ?? 'null'}`,
+        };
+      }
+    } catch (readErr: unknown) {
+      const msg = readErr instanceof Error ? readErr.message : String(readErr);
+      return { status: 'binding_readback_failed', expectedPrincipleId: ledgerPrincipleId, errorMessage: msg };
+    }
+    return { status: 'bound', principleId: ledgerPrincipleId };
+  } catch (err: unknown) {
+    const msg = err instanceof Error ? err.message : String(err);
+    return { status: 'binding_write_failed', errorMessage: msg };
+  }
+}
+
+/**
+ * Phase A (SPEC §9.1.6): before the rule artifact enters the approvable set,
+ * verify the chain's ledger identity is VERIFIED and the rule artifact carries
+ * exactly that binding. A chain without a verified unique ledger target must
+ * not publish, even if the artifact itself carries some id (e.g. a legacy
+ * title-namespace value the evaluator would have echoed). Returns the
+ * verified principle id, or null when publication must be refused.
+ */
+async function resolveRuleArtifactIdentity(
+  artifactStore: PIArtifactStore,
+  ruleArtifactId: string,
+  identityBinding: ScribeIdentityBinding,
+): Promise<string | null> {
+  if (!isIdentityBindingVerified(identityBinding)) return null;
+  let artifactSourcePrincipleId: string | undefined;
+  try {
+    const ruleArt = await artifactStore.getArtifactById(ruleArtifactId);
+    artifactSourcePrincipleId = ruleArt?.sourcePrincipleId;
+  } catch {
+    return null;
+  }
+  if (artifactSourcePrincipleId === undefined || artifactSourcePrincipleId !== identityBinding.principleId) return null;
+  return artifactSourcePrincipleId;
 }
 
 async function textPrincipleOnlyResult(
   params: TextPrincipleOnlyParams,
 ): Promise<RuleHostPipelineResult> {
-  const { painId, stages, scribeTaskId, disabledReason, artifactStore } = params;
+  const { painId, stages, scribeTaskId, disabledReason, artifactStore, approvalStore, now, identityBinding } = params;
   // Look up the principle artifact produced by the scribe stage.
   try {
     const arts = await artifactStore.listBySourceTaskId(scribeTaskId);
     const principleArt = arts.find((a) => a.artifactKind === 'principle');
+    // Identity backfill already ran on the shared post-scribe step
+    // (backfillScribeIdentity) for BOTH paths; nothing to do here.
+    // On the text path the evaluator never runs, so nothing else flips the
+    // validation status — mark it validated here (same store API the
+    // evaluator uses; scribe task success already implies its validator
+    // passed — peer-runner contract: output_invalid tasks never succeed).
+    let identityNote = '';
+    if (principleArt && principleArt.validationStatus !== 'validated') {
+      try {
+        await artifactStore.updateValidationStatus(principleArt.artifactId, 'validated');
+      } catch (err: unknown) {
+        const msg = err instanceof Error ? err.message : String(err);
+        identityNote = `; validation_status_mark_failed: ${msg}`;
+      }
+    }
+    // PRI-804: a text principle is a prompt-channel intervention and follows the
+    // same Owner governance as RuleCode (Owner decision 2026-09-15): enqueue it
+    // into the EXISTING approval queue so the Owner can approve it in Console.
+    // Deterministic approval id (apr_prompt_<artifactId>) + INSERT OR IGNORE make
+    // replays idempotent. Enqueue failure degrades observably (rc-9), never
+    // throwing away the artifact.
+    //
+    // Phase A governance publication boundary: an enqueue is only allowed when
+    // the artifact's ledger identity binding is VERIFIED. Unverified bindings
+    // keep the artifact (and its validation status) but must not create an
+    // Owner approval subject; recovery is a replay after identity repair.
+    let approvalId: string | null = null;
+    let enqueueNote = '';
+    if (!principleArt) {
+      enqueueNote = '; approval_enqueue_skipped: no principle artifact from scribe';
+    } else if (!isIdentityBindingVerified(identityBinding)) {
+      const reasonCode = scribeIdentityReasonCode(identityBinding);
+      enqueueNote = `; approval_enqueue_skipped: identity_binding_unverified (${reasonCode}). Principle artifact preserved; repair the ledger identity and re-run this pipeline to publish.`;
+    } else if (identityBinding.principleId !== principleArt.sourcePrincipleId) {
+      enqueueNote = `; approval_enqueue_skipped: identity_binding_unverified (identity_conflict: chain resolves to ${identityBinding.principleId}, artifact carries ${principleArt.sourcePrincipleId ?? 'no binding'}). Principle artifact preserved; repair the ledger identity and re-run this pipeline to publish.`;
+    } else {
+      try {
+        const record = await approvalStore.enqueue({
+          artifactId: principleArt.artifactId,
+          channel: 'prompt',
+          riskLevel: getChannelRiskLevel('prompt'),
+          summary: `Text principle candidate for pain ${painId}`,
+          triggerReason: `text_principle_only: pain=${painId}, principle=${principleArt.artifactId}; code-rule capability off (${disabledReason})`,
+        }, now);
+        const { approvalId: enqueuedApprovalId } = record;
+        approvalId = enqueuedApprovalId;
+      } catch (err: unknown) {
+        const msg = err instanceof Error ? err.message : String(err);
+        enqueueNote = `; approval_enqueue_failed: ${msg}. Manual enqueue required: pd activation dispatch --artifact-id ${principleArt.artifactId} --channel prompt`;
+      }
+    }
     return {
       decision: 'text_principle_only',
       painId,
@@ -863,8 +1196,8 @@ async function textPrincipleOnlyResult(
       scribeTaskId,
       ruleArtifactId: null,
       principleArtifactId: principleArt?.artifactId ?? null,
-      approvalId: null,
-      degradationReason: `code_rule_capability_off: ${disabledReason}`,
+      approvalId,
+      degradationReason: `code_rule_capability_off: ${disabledReason}${identityNote}${enqueueNote}`,
     };
   } catch (error: unknown) {
     const message = error instanceof Error ? error.message : String(error);

package/src/services/synthetic-baseline-runner.ts

@@ -21,7 +21,6 @@ import { auditCandidateLedgerConsistency } from '@principles/core/runtime-v2';
 import { OperatorHealthReadModel } from '@principles/core/runtime-v2';
 import { createInternalizationQueueReadModel } from '@principles/core/runtime-v2';
 import { createPITaskDiagnosticJson } from '@principles/core/runtime-v2';
-import { contentHashFn } from './rulehost-pipeline-runner.js';
 import {
   computeOverallStatus,
   boundedEvidence,
@@ -149,7 +148,6 @@ export async function runSyntheticBaseline(opts: SyntheticBaselineRunnerOptions)
         artifactStore: stateManager.piArtifactStore,
         validator: new DefaultDiagRootCauseValidator(),
         contextAssembler,
-        contentHashFn,
       },
       {
         owner: 'synthetic-baseline',
@@ -166,7 +164,6 @@ export async function runSyntheticBaseline(opts: SyntheticBaselineRunnerOptions)
         eventEmitter,
         artifactStore: stateManager.piArtifactStore,
         validator: new DefaultDiagDistillerValidator(),
-        contentHashFn,
       },
       {
         owner: 'synthetic-baseline',
@@ -183,7 +180,6 @@ export async function runSyntheticBaseline(opts: SyntheticBaselineRunnerOptions)
         eventEmitter,
         artifactStore: stateManager.piArtifactStore,
         committer,
-        contentHashFn,
       },
       {
         owner: 'synthetic-baseline',

package/src/services/version-report.ts

@@ -19,10 +19,27 @@ import * as path from 'node:path';
 
 export type VersionReportSource = 'official-installer' | 'official-legacy-overlay' | 'unknown';
 
+/**
+ * Where the component versions in a report were read from (SPEC §12, additive
+ * field). The installed canonical runtime is the live truth
+ * (`~/.pd/runtime/<component>/package.json`); the release cache under
+ * `~/.pd/releases/<id>/` remains the fallback for layouts without a runtime
+ * directory, and the legacy overlay reports its own bundle.
+ */
+export type VersionComponentsSource = 'runtime' | 'release-cached' | 'legacy-overlay';
+
 export interface VersionReport {
   readonly productVersion: string;
   readonly releaseId: string;
   readonly components: Readonly<Record<string, string>>;
+  /**
+   * Which layout the component versions were read from. Additive diagnostic
+   * ahead of the canonical SPEC §12 contract update (the authoritative copy
+   * lives in create-principles-disciple/src/update/product-identity.ts):
+   * optional so older consumers of this mirror stay compatible; the builder
+   * always emits it.
+   */
+  readonly componentsSource?: VersionComponentsSource;
   readonly bootstrapVersion: string;
   readonly channel: 'stable' | 'candidate';
   readonly source: VersionReportSource;
@@ -93,6 +110,7 @@ function buildLegacyOverlayReport(overlayDir: string, bootstrap: Record<string,
     productVersion: version,
     releaseId: '0'.repeat(64),
     components: { plugin: version },
+    componentsSource: 'legacy-overlay',
     bootstrapVersion: typeof bootstrapVersion === 'string' ? bootstrapVersion : 'unknown',
     channel: 'stable',
     source: 'official-legacy-overlay',
@@ -177,9 +195,40 @@ export function buildVersionReport(homeDir: string = os.homedir()): VersionRepor
     ? 'degraded'
     : releaseMetadataMatchesActive ? 'healthy' : 'corrupt';
 
+  // The live canonical runtime is the primary component-version source; the
+  // release cache stays as the fallback for layouts without a runtime
+  // directory (and per component when the runtime copy is absent). Component
+  // versions are read, never judged: independently versioned components are
+  // not corruption, and health remains bound to the active-identity
+  // verification above (a runtime full of readable package versions alone
+  // never makes the report healthy). A malformed component manifest degrades
+  // to an omitted component — this command exists to diagnose broken
+  // installs, so one corrupt manifest must not kill the whole report.
+  const runtimeDir = path.join(pdHome, 'runtime');
+  const componentsBaseDir = fs.existsSync(runtimeDir) ? runtimeDir : releaseDir;
+  const componentsSource: VersionReport['componentsSource'] = componentsBaseDir === runtimeDir
+    ? 'runtime'
+    : 'release-cached';
+  const readComponentManifest = (component: string): Record<string, unknown> | null => {
+    try {
+      return readJsonIfPresent(path.join(componentsBaseDir, component, 'package.json'));
+    } catch {
+      return null; // malformed live manifest: omit the component, keep the report
+    }
+  };
   const components: Record<string, string> = {};
-  for (const component of ['plugin', 'console', 'core', 'pd-cli', 'host-runtime', 'install-layout']) {
-    const manifest = readJsonIfPresent(path.join(releaseDir, component, 'package.json'));
+  for (const component of ['plugin', 'console', 'core', 'pd-cli', 'host-runtime', 'install-layout', 'codex-adapter', 'release-manager']) {
+    let manifest = readComponentManifest(component);
+    if (manifest === null && componentsBaseDir === runtimeDir) {
+      // Per-component fallback: a partially populated runtime dir (partial
+      // sync) must not silently drop components that the release cache can
+      // still report.
+      try {
+        manifest = readJsonIfPresent(path.join(releaseDir, component, 'package.json'));
+      } catch {
+        manifest = null;
+      }
+    }
     const version = manifest?.version;
     if (typeof version === 'string') {
       components[component] = version;
@@ -193,6 +242,7 @@ export function buildVersionReport(homeDir: string = os.homedir()): VersionRepor
     productVersion,
     releaseId,
     components,
+    componentsSource,
     bootstrapVersion: typeof bootstrapVersion === 'string' ? bootstrapVersion : 'unknown',
     channel: channelValue === 'candidate' ? 'candidate' : 'stable',
     source: 'official-installer',

package/tests/commands/config-doctor.test.ts

@@ -61,7 +61,6 @@ function makeValidConfigYaml(): string {
         evaluator: { enabled: false },
         rolloutReviewer: { enabled: false },
         correctionObserver: { enabled: false },
-        empathyObserver: { enabled: false },
       },
     },
     ui: { diagnostics: { mode: 'simple' } },
@@ -127,7 +126,6 @@ describe('Internal agent runtime binding readiness', () => {
             evaluator: { enabled: false },
             rolloutReviewer: { enabled: false },
                 correctionObserver: { enabled: false },
-            empathyObserver: { enabled: false },
           },
         },
       });

package/tests/commands/pain-evidence.test.ts

@@ -130,7 +130,7 @@ describe('parseTriggerDecisions', () => {
 // ── Integration: Real Log File Fixture ─────────────────────────────────────
 
 describe('real SYSTEM log fixture', () => {
-  const tmpDir = path.join(os.tmpdir(), `pd-test-evidence-${Date.now()}`);
+  const tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), 'pd-test-evidence-'));
   const logDir = path.join(tmpDir, 'memory', 'logs');
 
   beforeEach(() => {