create-principles-disciple 1.118.0 → 1.119.0

package/console/dist/server/index.js

@@ -13,6 +13,7 @@ import { handleHealthRoute, disposeHealthModels } from './routes/health.js';
 import { handlePrinciplesRoute, disposePrinciplesModels } from './routes/principles.js';
 import { handleLifecycleRoute, disposeLifecycleModels } from './routes/lifecycle.js';
 import { handleActivationsRoute, disposeActivationsModels } from './routes/activations.js';
+import { handleReceiptsRoute, disposeReceiptsModels } from './routes/receipts.js';
 import { handleApprovalsGroupedRoute, disposeApprovalsGroupedModels } from './routes/approvals-grouped.js';
 import { handleGovernanceRoute, disposeGovernanceModels } from './routes/governance.js';
 import { handleEvidenceChainRoute, disposeEvidenceChainModels } from './routes/evidence-chain.js';
@@ -239,6 +240,7 @@ async function initServices(workspaceDir, authConfig) {
 async function closeServices() {
     disposeFeedbackReportModels();
     disposeFailedTasksModels();
+    disposeReceiptsModels();
     disposeApprovalsModels();
     disposeApprovalsGroupedModels();
     disposeHealthModels();
@@ -307,6 +309,12 @@ function handleRequest(services) {
                 asyncHandler(() => handleFailedTasksRoute(req, res, { workspaceDir: services.workspaceDir, subPath, featureFlags: services.feedbackFlags }))(req, res);
                 return;
             }
+            // PRI-533: GET /api/v1/receipts/counts, /api/v1/receipts/principles/:id
+            if (urlPath === '/api/v1/receipts' || urlPath.startsWith('/api/v1/receipts/')) {
+                const subPath = urlPath.slice('/api/v1/receipts'.length);
+                asyncHandler(() => handleReceiptsRoute(req, res, services.workspaceDir, subPath))(req, res);
+                return;
+            }
             // GET /api/v1/approvals/grouped (MUST be before approvals catch-all)
             if (urlPath === '/api/v1/approvals/grouped') {
                 asyncHandler(() => handleApprovalsGroupedRoute(req, res, services.workspaceDir))(req, res);
@@ -368,7 +376,15 @@ function handleRequest(services) {
             // CR8: GET /api/v1/activations
             if (urlPath === '/api/v1/activations' || urlPath.startsWith('/api/v1/activations/')) {
                 const subPath = urlPath.slice('/api/v1/activations'.length);
-                asyncHandler(() => handleActivationsRoute(req, res, services.workspaceDir, subPath))(req, res);
+                const ownerId = process.env.PD_OWNER_ID?.trim();
+                const credentialId = process.env.PD_OWNER_CREDENTIAL_ID?.trim();
+                const ownerActor = services.authConfig.isEnabled() && ownerId && credentialId
+                    ? { principal: { kind: 'configured_owner', ownerId }, authentication: { method: 'console_token', credentialId } }
+                    : null;
+                asyncHandler(() => handleActivationsRoute(req, res, services.workspaceDir, subPath, {
+                    ownerActor,
+                    breakGlassActor: { principal: { kind: 'break_glass', reason: 'local_no_auth_emergency' }, authentication: { method: 'local_break_glass' } },
+                }))(req, res);
                 return;
             }
             // CR8: GET /api/v1/governance/queue

package/console/dist/server/models/ActivationsConsoleModel.d.ts

@@ -1,3 +1,4 @@
+import type { ActivationStatusRecord, PromotionReadinessResult, ActivationControlState, ActivationDecisionRecord, GlobalRuleCodePause, OwnerPromotionActor, OwnerPromotionResult } from '@principles/core/runtime-v2';
 /**
  * PRI-491 — owner-observable activation record.
  *
@@ -43,6 +44,9 @@ export interface ActivationRecord {
     nextAction?: string;
     /** Present when the activation references a non-existent artifact. */
     warning?: string;
+    enforcement?: 'eligible' | 'safety_isolated';
+    legacyDecisionUnknown?: boolean;
+    ownerReviewDueAt?: string;
 }
 export interface ActivationsResponse {
     activations: ActivationRecord[];
@@ -53,10 +57,82 @@ export interface ActivationsResponse {
     /** Present when status is 'degraded' — next operator action. */
     nextAction?: string;
 }
+export interface RuleCodeOwnerReview {
+    activation: ActivationStatusRecord;
+    artifact: {
+        artifactId: string;
+        digest: string;
+        sourceTaskId: string;
+        lineageArtifactIds: string[];
+        content: Record<string, unknown> | null;
+    };
+    readiness: PromotionReadinessResult;
+    controlState: ActivationControlState | null;
+    decisions: ActivationDecisionRecord[];
+    globalPause: GlobalRuleCodePause | null;
+    ownerDecisionEnabled: boolean;
+    runtimeCapability: {
+        hostRuntimeVersion: string;
+        shadowEvidence: boolean;
+    };
+    liveMetrics: RuleCodeTelemetryMetrics;
+    behaviorDrift: {
+        approvedBlockRate: number | null;
+        liveBlockRate: number | null;
+        delta: number | null;
+    };
+}
+interface RuleCodeTelemetryWindow {
+    eligible: number | null;
+    matched: number | null;
+    blocked: number | null;
+    unhealthy: number | null;
+    circuitTrips: number;
+    toolDistribution: Record<string, number> | null;
+}
+interface RuleCodeTelemetryMetrics {
+    last24Hours: RuleCodeTelemetryWindow;
+    last7Days: RuleCodeTelemetryWindow;
+    representativeSamples: {
+        toolName: string;
+        decision: string;
+        pathCategory: string;
+    }[];
+}
+export interface OwnerMutationInput {
+    actor: OwnerPromotionActor;
+    idempotencyKey: string;
+    reasonCode: string;
+    note?: string;
+}
 export declare class ActivationsConsoleModel {
     private readonly workspaceDir;
     constructor(workspaceDir: string);
     getActivations(): Promise<ActivationsResponse>;
+    getOwnerReview(activationId: string, ownerIdentityConfigured?: boolean): Promise<RuleCodeOwnerReview>;
+    continueObserving(activationId: string, input: OwnerMutationInput): Promise<{
+        decisionId: string;
+    }>;
+    deactivateRuleCode(activationId: string, decision: 'reject_after_shadow' | 'emergency_deactivate', input: OwnerMutationInput): Promise<{
+        activationId: string;
+        decisionId: string;
+        deactivatedAt: string;
+    }>;
+    recoverRuleCodeToShadow(activationId: string, expectedControlVersion: number, input: OwnerMutationInput): Promise<{
+        sourceActivationId: string;
+        shadowActivationId: string;
+        decisionId: string;
+    }>;
+    pauseAllRuleCode(input: OwnerMutationInput): Promise<GlobalRuleCodePause>;
+    releaseRuleCodePause(pauseId: string, expectedVersion: number, input: OwnerMutationInput): Promise<GlobalRuleCodePause>;
+    promoteRuleCode(activationId: string, expected: {
+        artifactId: string;
+        artifactDigest: string;
+        controlVersion: number;
+        confirmed: boolean;
+    }, input: OwnerMutationInput): Promise<OwnerPromotionResult>;
+    private withMutableRuleCode;
+    private requireOwnerDecisionFeature;
     deactivateActivation(activationId: string): Promise<{
         ok: true;
     } | {
@@ -66,3 +142,4 @@ export declare class ActivationsConsoleModel {
     }>;
     dispose(): void;
 }
+export {};

package/console/dist/server/models/ActivationsConsoleModel.js

@@ -1,7 +1,9 @@
-import { SqliteConnection, SqliteActivationStateStore, SqlitePIArtifactStore, extractPrincipleId, extractEvidenceRefs, } from '@principles/core/runtime-v2';
+import { SqliteConnection, SqliteActivationStateStore, SqlitePIArtifactStore, extractPrincipleId, extractEvidenceRefs, PromotionReadinessReader, RuleHostWriter, createProductionGateDeps, SqliteActivationSafetyStore, isFeatureEnabled, RuleCodeOwnerDecisionService, collectOpenClawPromotionChecks, summarizeRuleCodeShadowEvents, } from '@principles/core/runtime-v2';
+import { OPENCLAW_HOST_LIVENESS_CONTRACT } from '@principles/host-runtime';
 import { loadPdConfig, computeFlagsFromLoadResult } from '../config/pd-config-store.js';
 import * as fs from 'node:fs';
 import * as path from 'node:path';
+import { createHash, randomUUID } from 'node:crypto';
 /**
  * Type guard for parsed JSON objects (rc-2-no-as-bypass).
  * Replaces `as Record<string, unknown>` casts on untrusted contentJson.
@@ -34,6 +36,80 @@ function toSnapshot(record) {
         updatedAt: record.updatedAt,
     };
 }
+function makeActivationDecision(value) {
+    const { activation, artifactDigest, decision, input } = value;
+    return {
+        decisionId: `decision-${randomUUID()}`,
+        subject: { kind: 'activation', activationId: activation.activationId, artifactId: activation.artifactId, artifactDigest },
+        decision, principal: input.actor.principal, authentication: input.actor.authentication,
+        ...(input.actor.operator ? { operator: input.actor.operator } : {}), reasonCode: input.reasonCode,
+        note: input.note?.trim() || null, evidenceSnapshotId: null, decidedAt: new Date().toISOString(),
+    };
+}
+function unavailableShadowSummary() {
+    return {
+        observed: null, matched: null, wouldBlock: null, wouldAllow: null,
+        requireApproval: null, autoCorrect: null, errors: null, neutralControl: null,
+        firstObservedAt: null, lastObservedAt: null,
+    };
+}
+function readRuleCodeTelemetry(workspaceDir, activationId, decisions) {
+    const logsDir = path.join(workspaceDir, '.pd', 'logs');
+    const countCircuitTrips = (minimumTime) => decisions.filter(decision => decision.decision === 'safety_isolate' && Date.parse(decision.decidedAt) >= minimumTime).length;
+    const now = Date.now();
+    const unavailableWindow = (minimumTime) => ({ eligible: null, matched: null, blocked: null, unhealthy: null, circuitTrips: countCircuitTrips(minimumTime), toolDistribution: null });
+    if (!fs.existsSync(logsDir))
+        return { shadowSummary: unavailableShadowSummary(), metrics: { last24Hours: unavailableWindow(now - 24 * 60 * 60 * 1000), last7Days: unavailableWindow(now - 7 * 24 * 60 * 60 * 1000), representativeSamples: [] } };
+    const entries = [];
+    try {
+        for (const file of fs.readdirSync(logsDir).filter(name => /^events_.*\.jsonl$/.test(name)).sort().slice(-7)) {
+            for (const line of fs.readFileSync(path.join(logsDir, file), 'utf8').split('\n').filter(Boolean)) {
+                try {
+                    entries.push(JSON.parse(line));
+                }
+                catch { /* malformed telemetry is excluded, readiness remains bounded */ }
+            }
+        }
+    }
+    catch {
+        return { shadowSummary: unavailableShadowSummary(), metrics: { last24Hours: unavailableWindow(now - 24 * 60 * 60 * 1000), last7Days: unavailableWindow(now - 7 * 24 * 60 * 60 * 1000), representativeSamples: [] } };
+    }
+    const summarizeWindow = (minimumTime) => {
+        let eligible = 0;
+        let matched = 0;
+        let blocked = 0;
+        let unhealthy = 0;
+        const tools = {};
+        for (const entry of entries) {
+            if (!isRecord(entry) || typeof entry.ts !== 'string' || Date.parse(entry.ts) < minimumTime || !isRecord(entry.data) || entry.data.activationId !== activationId)
+                continue;
+            if (entry.type === 'rulehost_unhealthy') {
+                unhealthy += 1;
+                continue;
+            }
+            if (entry.type !== 'rulehost_evaluated' || entry.data.activationMode !== 'live')
+                continue;
+            eligible += 1;
+            if (entry.data.matched === true)
+                matched += 1;
+            if (entry.data.decision === 'block')
+                blocked += 1;
+            if (typeof entry.data.toolName === 'string')
+                tools[entry.data.toolName] = (tools[entry.data.toolName] ?? 0) + 1;
+        }
+        return { eligible, matched, blocked, unhealthy, circuitTrips: countCircuitTrips(minimumTime), toolDistribution: tools };
+    };
+    const representativeSamples = [];
+    for (const entry of entries) {
+        if (representativeSamples.length >= 6)
+            break;
+        if (!isRecord(entry) || entry.type !== 'rulehost_evaluated' || !isRecord(entry.data) || entry.data.activationId !== activationId || typeof entry.data.toolName !== 'string' || typeof entry.data.decision !== 'string')
+            continue;
+        const filePath = typeof entry.data.filePath === 'string' ? entry.data.filePath : '';
+        representativeSamples.push({ toolName: entry.data.toolName, decision: entry.data.decision, pathCategory: path.extname(filePath) || (filePath ? 'workspace_path' : 'no_path') });
+    }
+    return { shadowSummary: summarizeRuleCodeShadowEvents(entries, activationId), metrics: { last24Hours: summarizeWindow(now - 24 * 60 * 60 * 1000), last7Days: summarizeWindow(now - 7 * 24 * 60 * 60 * 1000), representativeSamples } };
+}
 export class ActivationsConsoleModel {
     workspaceDir;
     constructor(workspaceDir) {
@@ -119,6 +195,17 @@ export class ActivationsConsoleModel {
             // suspended (not executing) even though they remain active in the DB.
             const featureFlags = computeFlagsFromLoadResult(loadPdConfig(this.workspaceDir));
             const v2FlagEnabled = featureFlags.flags.rulecode_context_v2?.enabled === true;
+            const safetyStore = new SqliteActivationSafetyStore(conn);
+            const controlByActivation = new Map();
+            const hasPromotionDecision = new Set();
+            for (const activation of allActivations) {
+                const control = await safetyStore.getControlState(activation.activationId);
+                if (control)
+                    controlByActivation.set(activation.activationId, control);
+                const decisions = await safetyStore.listDecisions(activation.activationId);
+                if (decisions.some(decision => decision.decision === 'promote_live'))
+                    hasPromotionDecision.add(activation.activationId);
+            }
             const facts = allActivations.map((record) => {
                 const meta = artifactMetadata.get(record.artifactId);
                 const contextVersion = meta?.contextVersion;
@@ -141,15 +228,15 @@ export class ActivationsConsoleModel {
                 }
                 else if (contextVersion === 'v2' && !v2FlagEnabled) {
                     status = 'suspended_by_flag';
-                    nextAction = `Enable rulecode_context_v2 flag or deactivate: pd activation deactivate --activation-id ${record.activationId} --confirm`;
+                    nextAction = `Enable rulecode_context_v2 flag or deactivate: pd activation deactivate --activation-id ${record.activationId}`;
                 }
                 else {
                     status = 'active';
                     if (mode === 'shadow') {
-                        nextAction = `pd activation promote --activation-id ${record.activationId} --confirm`;
+                        nextAction = 'Keep shadow; promotion requires an authenticated Owner decision, immutable evidence bindings, and a passing Promotion Readiness result.';
                     }
                     else if (mode === 'live') {
-                        nextAction = `pd activation deactivate --activation-id ${record.activationId} --confirm`;
+                        nextAction = `pd activation deactivate --activation-id ${record.activationId}`;
                     }
                     else {
                         nextAction = undefined;
@@ -171,6 +258,11 @@ export class ActivationsConsoleModel {
                     evidenceRefs,
                     evidenceSummary,
                     nextAction,
+                    enforcement: controlByActivation.get(record.activationId)?.enforcement,
+                    ...(mode === 'live' && !hasPromotionDecision.has(record.activationId) ? {
+                        legacyDecisionUnknown: true,
+                        ownerReviewDueAt: new Date(new Date(record.promotedAt ?? record.activatedAt ?? Date.now()).getTime() + 7 * 24 * 60 * 60 * 1000).toISOString(),
+                    } : {}),
                 };
                 if (danglingArtifactIds.has(record.artifactId)) {
                     enriched.warning = `artifact_id "${record.artifactId}" does not exist in pi_artifacts - activation is orphaned`;
@@ -198,6 +290,232 @@ export class ActivationsConsoleModel {
             catch { /* best-effort */ }
         }
     }
+    async getOwnerReview(activationId, ownerIdentityConfigured = false) {
+        const conn = new SqliteConnection({ workspaceDir: this.workspaceDir, readonly: true });
+        try {
+            const activationStore = new SqliteActivationStateStore(conn);
+            const artifactStore = new SqlitePIArtifactStore(conn);
+            const safetyStore = new SqliteActivationSafetyStore(conn);
+            const codeActivations = await activationStore.listCodeToolHookActivations(true);
+            const matches = codeActivations.filter(record => record.activationId === activationId);
+            if (matches.length !== 1)
+                throw new Error(`Owner review requires exactly one RuleCode activation: ${activationId}`);
+            const [activation] = matches;
+            if (!activation)
+                throw new Error(`Activation not found: ${activationId}`);
+            const artifact = await artifactStore.getArtifactById(activation.artifactId);
+            if (!artifact)
+                throw new Error(`Artifact not found for activation: ${activation.artifactId}`);
+            const digest = `sha256:${createHash('sha256').update(JSON.stringify(artifact), 'utf8').digest('hex')}`;
+            const decisions = await safetyStore.listDecisions(activationId);
+            const telemetry = readRuleCodeTelemetry(this.workspaceDir, activationId, decisions);
+            const flags = computeFlagsFromLoadResult(loadPdConfig(this.workspaceDir));
+            const writer = new RuleHostWriter({ gateDeps: createProductionGateDeps(), featureFlagProbe: id => isFeatureEnabled(flags, id) });
+            const reader = new PromotionReadinessReader({
+                listCodeToolHookActivations: () => activationStore.listCodeToolHookActivations(true),
+                getArtifactById: id => artifactStore.getArtifactById(id),
+                computeArtifactDigest: value => `sha256:${createHash('sha256').update(JSON.stringify(value), 'utf8').digest('hex')}`,
+                validateProductionArtifact: value => writer.canActivate(value),
+                collectHostChecks: async (value) => {
+                    const liveArtifacts = [];
+                    for (const active of codeActivations) {
+                        if (active.action !== 'code_tool_hook_live_activate' || active.deactivatedAt !== null)
+                            continue;
+                        const liveArtifact = await artifactStore.getArtifactById(active.artifactId);
+                        if (liveArtifact)
+                            liveArtifacts.push(liveArtifact);
+                    }
+                    return collectOpenClawPromotionChecks(value, {
+                        ownerIdentityConfigured,
+                        safetyControlsEnabled: isFeatureEnabled(flags, 'rulecode_safety_controls'),
+                        hostContract: OPENCLAW_HOST_LIVENESS_CONTRACT,
+                        existingLiveArtifacts: liveArtifacts,
+                        validateProductionArtifact: candidate => writer.canActivate(candidate),
+                    });
+                },
+                buildEvidenceSnapshot: (checks, value) => {
+                    const createdAt = new Date().toISOString();
+                    const artifactDigest = value
+                        ? `sha256:${createHash('sha256').update(JSON.stringify(value), 'utf8').digest('hex')}` : digest;
+                    const body = JSON.stringify({ artifactDigest, checks, createdAt });
+                    return {
+                        snapshotId: `snapshot-${randomUUID()}`,
+                        snapshotDigest: `sha256:${createHash('sha256').update(body, 'utf8').digest('hex')}`,
+                        artifactDigest, lineageRefs: value ? [value.sourceTaskId, ...value.lineageArtifactIds] : [],
+                        hostRuntimeVersion: 'openclaw-legacy@1', safetyGateResults: checks,
+                        shadowSummary: telemetry.shadowSummary,
+                        configurationVersion: 'pd-config-current', redaction: { version: 'v1', rawParametersStored: false }, createdAt,
+                    };
+                },
+                newEvaluationId: () => `readiness-${randomUUID()}`,
+            });
+            let content = null;
+            try {
+                const parsed = JSON.parse(artifact.contentJson);
+                if (isRecord(parsed))
+                    content = parsed;
+            }
+            catch { /* readiness reports validation failure */ }
+            let approvedBlockRate = null;
+            let promotion;
+            for (let index = decisions.length - 1; index >= 0; index -= 1) {
+                const candidate = decisions[index];
+                if (candidate?.decision === 'promote_live' && candidate.evidenceSnapshotId !== null) {
+                    promotion = candidate;
+                    break;
+                }
+            }
+            if (promotion?.evidenceSnapshotId) {
+                const row = conn.getDb().prepare('SELECT shadow_summary FROM activation_evidence_snapshots WHERE snapshot_id = ?').get(promotion.evidenceSnapshotId);
+                if (isRecord(row) && typeof row.shadow_summary === 'string') {
+                    try {
+                        const summary = JSON.parse(row.shadow_summary);
+                        if (isRecord(summary) && typeof summary.observed === 'number' && summary.observed > 0 && typeof summary.wouldBlock === 'number') {
+                            approvedBlockRate = summary.wouldBlock / summary.observed;
+                        }
+                    }
+                    catch { /* malformed immutable evidence leaves drift unavailable */ }
+                }
+            }
+            const live24 = telemetry.metrics.last24Hours;
+            const liveBlockRate = live24.eligible !== null && live24.eligible > 0 && live24.blocked !== null
+                ? live24.blocked / live24.eligible
+                : null;
+            return {
+                activation,
+                artifact: { artifactId: artifact.artifactId, digest, sourceTaskId: artifact.sourceTaskId, lineageArtifactIds: [...artifact.lineageArtifactIds], content },
+                readiness: await reader.evaluate({ activationId, expectedArtifactId: artifact.artifactId, expectedArtifactDigest: digest }),
+                controlState: await safetyStore.getControlState(activationId),
+                decisions,
+                globalPause: await safetyStore.getActiveGlobalPause(),
+                ownerDecisionEnabled: isFeatureEnabled(flags, 'rulecode_owner_live_decision'),
+                runtimeCapability: {
+                    hostRuntimeVersion: OPENCLAW_HOST_LIVENESS_CONTRACT.version,
+                    shadowEvidence: OPENCLAW_HOST_LIVENESS_CONTRACT.supportsShadowEvidence,
+                },
+                liveMetrics: telemetry.metrics,
+                behaviorDrift: {
+                    approvedBlockRate,
+                    liveBlockRate,
+                    delta: approvedBlockRate === null || liveBlockRate === null ? null : liveBlockRate - approvedBlockRate,
+                },
+            };
+        }
+        finally {
+            try {
+                conn.close();
+            }
+            catch { /* best effort */ }
+        }
+    }
+    async continueObserving(activationId, input) {
+        this.requireOwnerDecisionFeature();
+        return this.withMutableRuleCode(activationId, async (store, activation, artifactDigest) => store.recordOwnerDecision(makeActivationDecision({ activation, artifactDigest, decision: 'continue_observing', input }), input.idempotencyKey));
+    }
+    async deactivateRuleCode(activationId, decision, input) {
+        if (decision === 'reject_after_shadow')
+            this.requireOwnerDecisionFeature();
+        return this.withMutableRuleCode(activationId, async (store, activation, artifactDigest) => store.deactivateWithDecision(makeActivationDecision({ activation, artifactDigest, decision, input }), input.idempotencyKey));
+    }
+    async recoverRuleCodeToShadow(activationId, expectedControlVersion, input) {
+        this.requireOwnerDecisionFeature();
+        return this.withMutableRuleCode(activationId, async (store, activation, artifactDigest) => store.recoverToShadow({
+            ...makeActivationDecision({ activation, artifactDigest, decision: 'continue_observing', input }),
+            decision: 'recover_to_shadow',
+        }, { expectedControlVersion, newActivationId: `activation-recovery-${randomUUID()}`, idempotencyKey: input.idempotencyKey }));
+    }
+    async pauseAllRuleCode(input) {
+        const conn = new SqliteConnection({ workspaceDir: this.workspaceDir, readonly: false });
+        try {
+            const decision = {
+                decisionId: `decision-${randomUUID()}`, subject: { kind: 'all_live_rulecode' }, decision: 'global_emergency_pause',
+                principal: input.actor.principal, authentication: input.actor.authentication,
+                ...(input.actor.operator ? { operator: input.actor.operator } : {}), reasonCode: input.reasonCode,
+                note: input.note ?? null, evidenceSnapshotId: null, decidedAt: new Date().toISOString(),
+            };
+            return await new SqliteActivationSafetyStore(conn).pauseAllLive(decision, `pause-${randomUUID()}`, input.idempotencyKey);
+        }
+        finally {
+            try {
+                conn.close();
+            }
+            catch { /* best effort */ }
+        }
+    }
+    async releaseRuleCodePause(pauseId, expectedVersion, input) {
+        const conn = new SqliteConnection({ workspaceDir: this.workspaceDir, readonly: false });
+        try {
+            const decision = {
+                decisionId: `decision-${randomUUID()}`, subject: { kind: 'all_live_rulecode' }, decision: 'global_emergency_pause_release',
+                principal: input.actor.principal, authentication: input.actor.authentication,
+                ...(input.actor.operator ? { operator: input.actor.operator } : {}), reasonCode: input.reasonCode,
+                note: input.note ?? null, evidenceSnapshotId: null, decidedAt: new Date().toISOString(),
+            };
+            return await new SqliteActivationSafetyStore(conn).releaseGlobalPause(decision, { pauseId, expectedVersion, idempotencyKey: input.idempotencyKey });
+        }
+        finally {
+            try {
+                conn.close();
+            }
+            catch { /* best effort */ }
+        }
+    }
+    async promoteRuleCode(activationId, expected, input) {
+        const review = await this.getOwnerReview(activationId, input.actor.principal.kind === 'configured_owner' && input.actor.authentication.method === 'console_token');
+        const flags = computeFlagsFromLoadResult(loadPdConfig(this.workspaceDir));
+        const conn = new SqliteConnection({ workspaceDir: this.workspaceDir, readonly: false });
+        try {
+            const store = new SqliteActivationSafetyStore(conn);
+            const service = new RuleCodeOwnerDecisionService({
+                ownerLiveDecisionEnabled: () => isFeatureEnabled(flags, 'rulecode_owner_live_decision'),
+                safetyControlsEnabled: () => isFeatureEnabled(flags, 'rulecode_safety_controls'),
+                evaluateReadiness: async () => review.readiness,
+                commitPromotion: value => store.commitPromotion(value),
+                newDecisionId: () => `decision-${randomUUID()}`,
+                now: () => new Date().toISOString(),
+            });
+            return await service.promote({
+                activationId, expectedArtifactId: expected.artifactId, expectedArtifactDigest: expected.artifactDigest,
+                expectedControlVersion: expected.controlVersion, idempotencyKey: input.idempotencyKey,
+                reasonCode: input.reasonCode, note: input.note, confirmed: expected.confirmed,
+            }, input.actor);
+        }
+        finally {
+            try {
+                conn.close();
+            }
+            catch { /* best effort */ }
+        }
+    }
+    async withMutableRuleCode(activationId, action) {
+        const conn = new SqliteConnection({ workspaceDir: this.workspaceDir, readonly: false });
+        try {
+            const activationStore = new SqliteActivationStateStore(conn);
+            const artifactStore = new SqlitePIArtifactStore(conn);
+            const matches = (await activationStore.listCodeToolHookActivations(true)).filter(value => value.activationId === activationId);
+            if (matches.length !== 1)
+                throw new Error(`RuleCode mutation requires exactly one activation: ${activationId}`);
+            const [activation] = matches;
+            if (!activation)
+                throw new Error(`Activation not found: ${activationId}`);
+            const artifact = await artifactStore.getArtifactById(activation.artifactId);
+            if (!artifact)
+                throw new Error(`Artifact not found for activation: ${activation.artifactId}`);
+            const artifactDigest = `sha256:${createHash('sha256').update(JSON.stringify(artifact), 'utf8').digest('hex')}`;
+            return await action(new SqliteActivationSafetyStore(conn), activation, artifactDigest);
+        }
+        finally {
+            try {
+                conn.close();
+            }
+            catch { /* best effort */ }
+        }
+    }
+    requireOwnerDecisionFeature() {
+        const flags = computeFlagsFromLoadResult(loadPdConfig(this.workspaceDir));
+        if (!isFeatureEnabled(flags, 'rulecode_owner_live_decision'))
+            throw new Error('feature_not_enabled: enable rulecode_owner_live_decision only after the rollout gate passes');
+    }
     async deactivateActivation(activationId) {
         const stateDbPath = path.join(this.workspaceDir, '.pd', 'state.db');
         if (!fs.existsSync(stateDbPath)) {

package/console/dist/server/models/ReceiptsConsoleModel.d.ts

@@ -0,0 +1,42 @@
+export interface ReceiptEvent {
+    kind: 'rule_blocked' | 'auto_correct_applied' | 'self_reported' | 'prompt_injected';
+    level: 'effect' | 'presence';
+    sessionId: string | null;
+    toolName: string | null;
+    filePath: string | null;
+    digest: string | null;
+    createdAt: string;
+}
+export interface PrincipleReceipts {
+    status: 'ok' | 'degraded';
+    reason?: string;
+    nextAction?: string;
+    principleId: string;
+    effectCount: number;
+    presenceCount: number;
+    lastEffectAt: string | null;
+    events: ReceiptEvent[];
+}
+export interface ReceiptCountEntry {
+    principleId: string;
+    effectCount: number;
+    presenceCount: number;
+    lastEffectAt: string | null;
+}
+export interface ReceiptCounts {
+    status: 'ok' | 'degraded';
+    reason?: string;
+    nextAction?: string;
+    counts: ReceiptCountEntry[];
+}
+export declare class ReceiptsConsoleModel {
+    private readonly workspaceDir;
+    constructor(workspaceDir: string);
+    getPrincipleReceipts(principleId: string): Promise<PrincipleReceipts>;
+    getReceiptCounts(): Promise<ReceiptCounts>;
+    /**
+     * Shared preconditions: state.db exists + ledger flag enabled. Returns a
+     * degraded partial response when a precondition fails (rc-9), else null.
+     */
+    private precheck;
+}