create-principles-disciple 1.120.5 → 1.121.0

package/console/dist/server/index.js

@@ -211,10 +211,14 @@ async function initServices(workspaceDir, authConfig) {
     const feedbackChannelEnabled = pdFlags.flags.feedback_channel?.enabled ?? false;
     const failedTasksObservabilityEnabled = pdFlags.flags.failed_tasks_observability?.enabled ?? true;
     const governanceProjectionEnabled = pdFlags.flags.principle_governance_projection_v2?.enabled ?? false;
+    // Governance Recovery Actions v1: fail-closed — recovery stays disabled unless
+    // explicitly enabled (default off keeps the Console read-only).
+    const failedTaskRecoveryEnabled = pdFlags.flags.failed_task_recovery_console?.enabled ?? false;
     const feedbackFlags = {
         feedback_channel: { enabled: feedbackChannelEnabled },
         failed_tasks_observability: { enabled: failedTasksObservabilityEnabled },
         principle_governance_projection_v2: { enabled: governanceProjectionEnabled },
+        failed_task_recovery_console: { enabled: failedTaskRecoveryEnabled },
     };
     if (!configResult.ok) {
         console.warn('[pd-console] PD config loading failed (using defaults for feedback channel):', configResult.errors.map(e => e.reason).join('; '));

package/console/dist/server/models/GovernanceConsoleModel.d.ts

@@ -64,11 +64,19 @@ export interface DegradedFailureSummary {
  * Frontend maps these via i18n; some codes support interpolation
  * (e.g. {{count}} from pendingReviewCount).
  */
-export type StateReasonCode = 'state_db_missing' | 'no_pipeline_activity' | 'pending_approvals' | 'pipeline_active' | 'consumed_candidates' | 'degraded_state';
-export type NextActionCode = 'run_config_doctor' | 'wait_for_pipeline' | 'review_approvals' | 'check_degraded_signals' | 'check_pipeline_status';
+export type StateReasonCode = 'state_db_missing' | 'no_pipeline_activity' | 'pending_approvals' | 'tasks_need_human_review' | 'pipeline_active' | 'consumed_candidates' | 'degraded_state';
+export type NextActionCode = 'run_config_doctor' | 'wait_for_pipeline' | 'review_approvals' | 'review_failed_tasks' | 'check_degraded_signals' | 'check_pipeline_status';
 export interface GovernanceQueueResponse {
     /** Number of pending approvals awaiting owner review */
     pendingReviewCount: number;
+    /**
+     * Governance Recovery Actions v1 (Phase 0 signal fix): number of
+     * internalization tasks in needs_human_review status (all peer-runner
+     * kinds, incl. rollout_reviewer). These are owner-attention items — they
+     * wait for an explicit recovery decision, so unlike degraded signals they
+     * carry no time window. Set only when > 0 (mirrors evidenceInProgressCount).
+     */
+    pendingHumanReviewCount?: number;
     /** Number of high/critical risk pending approvals */
     behaviorDeviationCount: number;
     /** Stagnation signals for approvals older than 7 days */

package/console/dist/server/models/GovernanceConsoleModel.js

@@ -124,14 +124,27 @@ export class GovernanceConsoleModel {
             // 2. Check internalization pipeline activity (tasks)
             // PRI-556: pipeline activity still counts ALL tasks (drives in_progress),
             // but only in-window failures/retries produce degraded signals.
+            // Governance Recovery Actions v1 (Phase 0 signal fix): the kind list now
+            // includes rollout_reviewer (previously invisible even for degraded
+            // signals), and needs_human_review tasks surface as owner-attention
+            // items via pendingHumanReviewCount — previously NO stage's
+            // needs_human_review entered this queue.
             let hasInternalizationTasks = false;
             const retryWaitDetails = [];
             const failedDetails = [];
+            let pendingHumanReviewCount = 0;
             try {
-                const tasks = db.prepare(`SELECT task_id, task_kind, status, last_error, updated_at FROM tasks WHERE task_kind IN ('dreamer', 'philosopher', 'scribe', 'artificer', 'evaluator')`).all();
+                const tasks = db.prepare(`SELECT task_id, task_kind, status, last_error, updated_at FROM tasks WHERE task_kind IN ('dreamer', 'philosopher', 'scribe', 'artificer', 'evaluator', 'rollout_reviewer')`).all();
                 hasInternalizationTasks = tasks.length > 0;
                 const actionableCutoff = Date.now() - DEGRADED_SIGNAL_WINDOW_MS;
                 for (const task of tasks) {
+                    if (task.status === 'needs_human_review') {
+                        // Owner-attention item — NO time window: it waits for an explicit
+                        // recovery decision (unlike terminal `failed` rows, which PRI-556
+                        // windowed to avoid permanent signal pollution).
+                        pendingHumanReviewCount += 1;
+                        continue;
+                    }
                     if (task.status !== 'retry_wait' && task.status !== 'failed')
                         continue;
                     // updated_at is untrusted row data — malformed timestamps fall
@@ -207,7 +220,9 @@ export class GovernanceConsoleModel {
                 });
             }
             // ── Determine governance state ──────────────────────────────────────
-            const hasOwnerReadyItems = pendingReviewCount > 0;
+            // needs_human_review tasks are owner-attention items alongside pending
+            // approvals (Governance Recovery Actions v1 Phase 0): both flip the
+            // queue into owner_review_ready.
             const hasPipelineActivity = hasInternalizationTasks || hasConsumedCandidates || hasPendingCandidates;
             const hasDegradation = degradedSignals.length > 0;
             let governanceState;
@@ -216,13 +231,20 @@ export class GovernanceConsoleModel {
             let stateReason;
             let nextAction;
             let inProgressSummary;
-            if (hasOwnerReadyItems) {
+            if (pendingReviewCount > 0) {
                 governanceState = 'owner_review_ready';
                 stateReasonCode = 'pending_approvals';
                 nextActionCode = 'review_approvals';
                 stateReason = `${pendingReviewCount} principle(s) pending your review and decision.`;
                 nextAction = 'Review pending principles and approve, reject, or park.';
             }
+            else if (pendingHumanReviewCount > 0) {
+                governanceState = 'owner_review_ready';
+                stateReasonCode = 'tasks_need_human_review';
+                nextActionCode = 'review_failed_tasks';
+                stateReason = `${pendingHumanReviewCount} internalization task(s) are waiting for your review decision (needs_human_review).`;
+                nextAction = 'Open Failed Tasks to inspect and recover needs_human_review tasks.';
+            }
             else if (hasDegradation) {
                 governanceState = 'degraded';
                 stateReasonCode = 'degraded_state';
@@ -350,6 +372,9 @@ export class GovernanceConsoleModel {
             if (evidenceInProgressCount > 0) {
                 response.evidenceInProgressCount = evidenceInProgressCount;
             }
+            if (pendingHumanReviewCount > 0) {
+                response.pendingHumanReviewCount = pendingHumanReviewCount;
+            }
             if (gateBlocksToday > 0) {
                 response.gateBlocksToday = gateBlocksToday;
             }

package/console/dist/server/routes/failed-tasks.d.ts

@@ -14,11 +14,15 @@ export type FailedTasksContext = {
  * Handle requests to `/api/v1/failed-tasks*`.
  *
  * Routes:
- *   GET /api/v1/failed-tasks         — list failed/needs_human_review tasks
- *   GET /api/v1/failed-tasks/:id     — fetch single task detail (task + runs + lastError)
- *   other methods                    — 405 Method Not Allowed
+ *   GET  /api/v1/failed-tasks              — list failed/needs_human_review tasks
+ *   GET  /api/v1/failed-tasks/:id          — fetch single task detail (task + runs + lastError)
+ *   POST /api/v1/failed-tasks/:id/recover  — Owner recovery (failed | needs_human_review → pending)
+ *   other methods                          — 405 Method Not Allowed
  *
- * Feature flag gate: when `ctx.featureFlags.failed_tasks_observability.enabled`
- * is `false`, returns 403 `failed_tasks_observability_disabled`.
+ * Feature flag gates (checked before any DB access so a disabled flag
+ * short-circuits cleanly — rc-9: error responses include reason + next action):
+ *   - `failed_tasks_observability.enabled === false` → 403 for the whole route
+ *   - `failed_task_recovery_console.enabled !== true` → 403 for POST recover
+ *     (fail-closed mutation gate; default on, explicit disable keeps the Console read-only)
  */
 export declare function handleFailedTasksRoute(req: IncomingMessage, res: ServerResponse, ctx: FailedTasksContext): Promise<void>;

package/console/dist/server/routes/failed-tasks.js

@@ -5,14 +5,26 @@
 // detail (task record + run history + last error category). Gated by the
 // failed_tasks_observability feature flag.
 //
+// Governance Recovery Actions v1: POST /api/v1/failed-tasks/:id/recover lets the
+// Owner recover a task from the Console. failed → pending reuses
+// RecoverySweepService.recoverFailedTask; needs_human_review → pending reuses
+// the extracted owner-retry sequence (ownerRetryNeedsHumanReviewTask — the same
+// implementation `pd runtime internalization retry --confirm` calls). No
+// recovery logic is reimplemented here. Gated by failed_task_recovery_console
+// (default off → Console stays read-only). Every successful recovery appends a
+// RecoveryAction audit record (.state/recovery_actions.jsonl).
+//
 // Trust boundary (rc-1, rc-2): all query string values are read via
 // URLSearchParams.get() and treated as `unknown` until validated with typeof /
-// Number.isFinite. Store return values are typed by the core contract and
-// further validated by SqliteTaskStore's row readers (rc-1 at the DB boundary).
+// Number.isFinite. POST bodies are parsed to `unknown` and field-checked with
+// Object.hasOwn + typeof before use. Store return values are typed by the core
+// contract and further validated by SqliteTaskStore's row readers (rc-1 at the
+// DB boundary).
 import * as fs from 'node:fs';
 import * as path from 'node:path';
-import { SqliteConnection, SqliteTaskStore, } from '@principles/core/runtime-v2';
+import { SqliteConnection, SqliteTaskStore, PDRuntimeError, createRecoverySweepService, appendRecoveryAction, } from '@principles/core/runtime-v2';
 import { sendSuccess, sendError, sendNotFound, sendMethodNotAllowed, sendBadRequest, } from '../utils/response.js';
+import { readBody } from '../utils/request.js';
 const entries = new Map();
 function stateDbExists(workspaceDir) {
     return fs.existsSync(path.join(workspaceDir, '.pd', 'state.db'));
@@ -79,16 +91,143 @@ function extractQueryParams(req) {
         return null;
     return new URLSearchParams(urlStr.slice(qIdx + 1));
 }
+// ── Recovery helpers (Governance Recovery Actions v1) ───────────────────────
+const MAX_REASON_LENGTH = 2000;
+function isRecord(value) {
+    return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
+function tryParseJson(body) {
+    try {
+        return JSON.parse(body);
+    }
+    catch {
+        return undefined;
+    }
+}
+/**
+ * Parse the optional recover request body. Accepts an empty body (reason is
+ * optional) or a JSON object with an optional string `reason` field
+ * (rc-1/rc-2: parsed value stays `unknown` until Object.hasOwn + typeof
+ * checks pass). Returns a discriminated result; `ok === false` carries the
+ * bad-request message.
+ */
+function parseRecoverBody(body) {
+    if (body.trim().length === 0)
+        return { ok: true };
+    const raw = tryParseJson(body);
+    if (raw === undefined)
+        return { ok: false, error: 'Request body must be valid JSON' };
+    if (!isRecord(raw))
+        return { ok: false, error: 'Request body must be a JSON object' };
+    if (Object.hasOwn(raw, 'reason')) {
+        if (typeof raw.reason !== 'string') {
+            return { ok: false, error: 'reason must be a string' };
+        }
+        if (raw.reason.length > MAX_REASON_LENGTH) {
+            return { ok: false, error: `reason must be at most ${MAX_REASON_LENGTH} characters` };
+        }
+    }
+    const reason = typeof raw.reason === 'string' && raw.reason.length > 0 ? raw.reason : undefined;
+    return { ok: true, reason };
+}
+/**
+ * Dispatch one recovery attempt through the shared core services.
+ *
+ * Status dispatch (SPEC §6.1/§6.2): failed → recoverFailedTask; then
+ * needs_human_review → owner authority reset. A null first result means
+ * "missing or not failed"; the second call distinguishes not_found /
+ * wrong-status / metadata_invalid. No recovery logic lives here.
+ */
+async function dispatchRecovery(workspaceDir, taskId) {
+    const { service, close } = await createRecoverySweepService({ workspaceDir });
+    try {
+        // failed → pending (crash-retry semantics: completionIntent preserved)
+        try {
+            const failedResult = await service.recoverFailedTask(taskId);
+            if (failedResult) {
+                return {
+                    ok: true,
+                    result: 'recovered',
+                    previousStatus: failedResult.previousStatus,
+                    newStatus: failedResult.newStatus,
+                };
+            }
+        }
+        catch (err) {
+            if (err instanceof PDRuntimeError && err.category === 'input_invalid') {
+                // attempt budget exhausted; Console v1 does not expose force
+                return {
+                    ok: false,
+                    failure: {
+                        httpStatus: 409,
+                        errorCode: 'task_attempts_exhausted',
+                        message: err.message,
+                        nextAction: 'This task exhausted its attempt budget. Recover it with force via CLI: pd runtime recovery failed-tasks --confirm --force',
+                    },
+                };
+            }
+            throw err;
+        }
+        // not failed (or missing) → owner authority reset path
+        const outcome = await service.recoverNeedsHumanReviewTask(taskId);
+        if (outcome.status === 'requeued') {
+            return {
+                ok: true,
+                result: 'requeued',
+                previousStatus: outcome.previousStatus,
+                newStatus: 'pending',
+            };
+        }
+        if (outcome.status === 'not_found') {
+            return {
+                ok: false,
+                failure: {
+                    httpStatus: 404,
+                    errorCode: 'task_not_found',
+                    message: `Task ${taskId} not found`,
+                },
+            };
+        }
+        if (outcome.status === 'metadata_invalid') {
+            return {
+                ok: false,
+                failure: {
+                    httpStatus: 409,
+                    errorCode: 'metadata_invalid',
+                    message: 'Task metadata failed PI hydration; a recovery now would risk a partial authority reset.',
+                    nextAction: 'Run pd runtime internalization integrity --json to inspect the task metadata',
+                },
+            };
+        }
+        return {
+            ok: false,
+            failure: {
+                httpStatus: 409,
+                errorCode: 'task_not_recoverable',
+                message: `Task ${taskId} is in status '${outcome.previousStatus}' — only failed / needs_human_review tasks are recoverable.`,
+                nextAction: 'Wait for the current attempt to finish, or check pipeline status: pd runtime internalization queue --json',
+                extras: { previousStatus: outcome.previousStatus },
+            },
+        };
+    }
+    finally {
+        await close();
+    }
+}
 /**
  * Handle requests to `/api/v1/failed-tasks*`.
  *
  * Routes:
- *   GET /api/v1/failed-tasks         — list failed/needs_human_review tasks
- *   GET /api/v1/failed-tasks/:id     — fetch single task detail (task + runs + lastError)
- *   other methods                    — 405 Method Not Allowed
+ *   GET  /api/v1/failed-tasks              — list failed/needs_human_review tasks
+ *   GET  /api/v1/failed-tasks/:id          — fetch single task detail (task + runs + lastError)
+ *   POST /api/v1/failed-tasks/:id/recover  — Owner recovery (failed | needs_human_review → pending)
+ *   other methods                          — 405 Method Not Allowed
  *
- * Feature flag gate: when `ctx.featureFlags.failed_tasks_observability.enabled`
- * is `false`, returns 403 `failed_tasks_observability_disabled`.
+ * Feature flag gates (checked before any DB access so a disabled flag
+ * short-circuits cleanly — rc-9: error responses include reason + next action):
+ *   - `failed_tasks_observability.enabled === false` → 403 for the whole route
+ *   - `failed_task_recovery_console.enabled !== true` → 403 for POST recover
+ *     (fail-closed mutation gate; default on, explicit disable keeps the Console read-only)
  */
 export async function handleFailedTasksRoute(req, res, ctx) {
     const { workspaceDir, subPath } = ctx;
@@ -173,6 +312,79 @@ export async function handleFailedTasksRoute(req, res, ctx) {
         }
         return;
     }
+    // Recovery: POST /api/v1/failed-tasks/:id/recover (Governance Recovery
+    // Actions v1). Checked before the generic /:id detail branch.
+    // eslint-disable-next-line @typescript-eslint/prefer-regexp-exec -- String#match is semantically identical for a non-global regex; the repo's security write-gate false-positives on `<expr>.exec(userInput)` as command injection, so RegExp#exec is not writable here.
+    const recoverMatch = subPath.match(/^\/([^/]+)\/recover$/);
+    if (recoverMatch) {
+        // recoverMatch[1] = captured task id (segment between the leading '/'
+        // and the trailing '/recover')
+        const taskId = recoverMatch[1] ?? '';
+        // Fail-closed gate: this is a mutation endpoint — recovery is enabled by
+        // default (2026-08-24 owner decision) and 403 only when explicitly disabled
+        // via config (features.failed_task_recovery_console.enabled: false).
+        if (ctx.featureFlags?.failed_task_recovery_console?.enabled !== true) {
+            sendError(res, 403, 'failed_task_recovery_console_disabled', 'failed_task_recovery_console feature flag is disabled. Enable it via .pd/config.yaml (features.failed_task_recovery_console.enabled: true) to allow recovery from Console.');
+            return;
+        }
+        if (method !== 'POST') {
+            sendMethodNotAllowed(res);
+            return;
+        }
+        try {
+            if (taskId.length === 0 || !stateDbExists(workspaceDir)) {
+                sendNotFound(res, `Task ${taskId} not found`);
+                return;
+            }
+            let bodyResult;
+            try {
+                const body = await readBody(req);
+                bodyResult = parseRecoverBody(body);
+            }
+            catch (err) {
+                sendBadRequest(res, err instanceof Error ? err.message : 'Failed to read request body');
+                return;
+            }
+            if (bodyResult.ok === false) {
+                sendBadRequest(res, bodyResult.error);
+                return;
+            }
+            const dispatch = await dispatchRecovery(workspaceDir, taskId);
+            if (!dispatch.ok) {
+                sendError(res, dispatch.failure.httpStatus, dispatch.failure.errorCode, dispatch.failure.message, dispatch.failure.nextAction ? { nextAction: dispatch.failure.nextAction, ...dispatch.failure.extras } : dispatch.failure.extras);
+                return;
+            }
+            // Audit the owner action (SPEC §10). Best-effort: the recovery is
+            // already committed; an audit-write failure must not report the whole
+            // action as failed, and it is never silent (rc-9).
+            try {
+                appendRecoveryAction(workspaceDir, {
+                    taskId,
+                    previousStatus: dispatch.previousStatus,
+                    result: dispatch.result,
+                    operator: 'console',
+                    reason: bodyResult.reason ?? null,
+                });
+            }
+            catch (auditErr) {
+                console.warn('[failed-tasks] recovery audit append failed:', auditErr instanceof Error ? auditErr.message : String(auditErr));
+            }
+            // SPEC §6.4: "Recovery Accepted", not "Task Completed" — execution is
+            // asynchronous; the task merely re-enters the pending → leased →
+            // running → succeeded cycle.
+            sendSuccess(res, {
+                taskId,
+                previousStatus: dispatch.previousStatus,
+                newStatus: dispatch.newStatus,
+                result: dispatch.result,
+                nextAction: 'Recovery accepted. The task is pending again and will be picked up by the internalization consumer (or advance it manually: pd runtime internalization run-once).',
+            });
+        }
+        catch (err) {
+            sendError(res, 500, 'failed_task_recovery_error', errorMessage(err));
+        }
+        return;
+    }
     // Detail: GET /api/v1/failed-tasks/:id
     const id = subPath.replace(/^\//, '');
     if (id.length === 0) {

package/console/dist/ui/api.d.ts

@@ -1,7 +1,7 @@
 import type { ApiResponse } from "../types.js";
 import { listActiveSignalKeywords, listPendingSignalTerms, fetchKeywordStore, fetchPendingTerms, updateKeywordStore, admitPendingTerm, rejectPendingTerm } from "./utils/signal-keywords-api.js";
 import type { OwnerGovernanceView } from '@principles/core/runtime-v2';
-import type { FeedbackReportData, FeedbackDraftSummaryData, FeedbackDraftEnvelopeData, FeedbackChannelsData, FeedbackSubmitResultData, DeleteEnvelopeData, WorkspaceEntryData, RemovedEnvelopeData, SyncResultData, ConfigSummaryData, ConfigCatalogData, AgentBindingUpdateData, DefaultRuntimeUpdateData, RuntimeProfileMutationData, ReadinessCheckData, FeatureFlagUpdateData, OutputLanguageData, GovernanceQueueData, ActivationsData, DisableActivationData, LifecycleMetricsData, UpdateStatusData, UpdateHistoryData, ApplyUpdateResultData, RollbackResultData, ApprovalRecordData, PrinciplesListData, ApprovalsGroupedData, EvidenceChainData, TrajectoryData, IntentSummaryData, IntentDecisionRecordData, IntentDecisionResultData, IntentDecisionSummaryData, FollowUpResponseData, IntentInitResultData, IntentSaveResultData, IntentRawContentData, IntentVersionData, RuleCodeOwnerReviewData, RuleCodeMutationData } from "./utils/validators.js";
+import type { FeedbackReportData, FeedbackDraftSummaryData, FeedbackDraftEnvelopeData, FeedbackChannelsData, FeedbackSubmitResultData, DeleteEnvelopeData, WorkspaceEntryData, RemovedEnvelopeData, SyncResultData, ConfigSummaryData, ConfigCatalogData, AgentBindingUpdateData, DefaultRuntimeUpdateData, RuntimeProfileMutationData, ReadinessCheckData, FeatureFlagUpdateData, OutputLanguageData, GovernanceQueueData, RecoveryResultData, ActivationsData, DisableActivationData, LifecycleMetricsData, UpdateStatusData, UpdateHistoryData, ApplyUpdateResultData, RollbackResultData, ApprovalRecordData, PrinciplesListData, ApprovalsGroupedData, EvidenceChainData, TrajectoryData, IntentSummaryData, IntentDecisionRecordData, IntentDecisionResultData, IntentDecisionSummaryData, FollowUpResponseData, IntentInitResultData, IntentSaveResultData, IntentRawContentData, IntentVersionData, RuleCodeOwnerReviewData, RuleCodeMutationData } from "./utils/validators.js";
 declare function getToken(): string | null;
 declare function setToken(token: string): void;
 declare function clearToken(): void;
@@ -129,6 +129,7 @@ declare function patchFeatureFlag(featureName: string, enabled: boolean): Promis
 declare function fetchOutputLanguage(): Promise<ApiResponse<OutputLanguageData>>;
 declare function updateOutputLanguage(outputLanguage: string): Promise<ApiResponse<OutputLanguageData>>;
 declare function fetchGovernanceQueue(): Promise<ApiResponse<GovernanceQueueData>>;
+declare function recoverFailedTask(taskId: string, reason?: string): Promise<ApiResponse<RecoveryResultData>>;
 declare function fetchApprovalsGrouped(): Promise<ApiResponse<ApprovalsGroupedData>>;
 declare function fetchAllActivations(): Promise<ApiResponse<ActivationsData>>;
 declare function disableActivation(activationId: string): Promise<ApiResponse<DisableActivationData>>;
@@ -195,8 +196,8 @@ export interface FollowUpPayload {
     candidateId?: string;
 }
 declare function dispatchFollowUp(decisionId: string, payload: FollowUpPayload): Promise<ApiResponse<FollowUpResponseData>>;
-export { request, listActiveSignalKeywords, listPendingSignalTerms, fetchKeywordStore, fetchPendingTerms, updateKeywordStore, admitPendingTerm, rejectPendingTerm, getToken, setToken, clearToken, checkAuth, approveApproval, rejectApproval, editApproval, fetchPrinciples, fetchPrincipleDetail, fetchPrincipleGovernance, fetchPrincipleTrajectory, fetchPrincipleReceipts, fetchReceiptCounts, archivePrinciple, unarchivePrinciple, createFeedbackReport, listFeedbackReports, getFeedbackReport, deleteFeedbackReport, fetchFeedbackChannels, submitFeedbackReport, markFeedbackReportSent, fetchConfigSummary, fetchConfigCatalog, updateAgentBinding, updateDefaultRuntime, createRuntimeProfile, updateRuntimeProfile, deleteRuntimeProfile, fetchAgentReadiness, patchFeatureFlag, fetchOutputLanguage, updateOutputLanguage, fetchWorkspaces, addWorkspace, removeWorkspace, syncWorkspace, fetchGovernanceQueue, fetchApprovalsGrouped, fetchAllActivations, disableActivation, fetchRuleCodeOwnerReview, ruleCodeDecision, pauseAllRuleCode, releaseRuleCodePause, fetchLifecycleMetrics, fetchUpdateStatus, fetchUpdateHistory, applyUpdate, applyFullUpdate, rollbackUpdate, fetchEvidenceChain, fetchIntentSummary, fetchIntentContent, createIntentTemplate, saveIntentContent, fetchIntentVersions, recordIntentDecision, listIntentDecisionsByPainId, listIntentDecisionsByTaskId, fetchIntentDecisionSummary, dispatchFollowUp, };
-export type { FeedbackReportData, FeedbackDraftSummaryData, FeedbackDraftEnvelopeData, FeedbackChannelsData, FeedbackSubmitResultData, DeleteEnvelopeData, WorkspaceEntryData, RemovedEnvelopeData, SyncResultData, ConfigSummaryData, ConfigCatalogData, AgentBindingUpdateData, DefaultRuntimeUpdateData, RuntimeProfileMutationData, ReadinessCheckData, FeatureFlagUpdateData, OutputLanguageData, GovernanceQueueData, ActivationsData, DisableActivationData, RuleCodeOwnerReviewData, RuleCodeMutationData, LifecycleMetricsData, UpdateStatusData, UpdateHistoryData, ApplyUpdateResultData, RollbackResultData, ApprovalRecordData, PrinciplesListData, ApprovalsGroupedData, EvidenceChainData, EvidenceChainRecordData, EvidenceChainStateData, TrajectoryData, TrajectoryStageData, IntentSummaryData, IntentSectionsData, IntentDocWarningData, IntentDecisionRecordData, IntentDecisionResultData, IntentDecisionSummaryData, FollowUpResponseData, LinkCandidateFollowUpData, GuideRulehostFollowUpData, GeneratePatchProposalFollowUpData, IntentVersionEntry, IntentVersionData, } from "./utils/validators.js";
+export { request, listActiveSignalKeywords, listPendingSignalTerms, fetchKeywordStore, fetchPendingTerms, updateKeywordStore, admitPendingTerm, rejectPendingTerm, getToken, setToken, clearToken, checkAuth, approveApproval, rejectApproval, editApproval, fetchPrinciples, fetchPrincipleDetail, fetchPrincipleGovernance, fetchPrincipleTrajectory, fetchPrincipleReceipts, fetchReceiptCounts, archivePrinciple, unarchivePrinciple, createFeedbackReport, listFeedbackReports, getFeedbackReport, deleteFeedbackReport, fetchFeedbackChannels, submitFeedbackReport, markFeedbackReportSent, fetchConfigSummary, fetchConfigCatalog, updateAgentBinding, updateDefaultRuntime, createRuntimeProfile, updateRuntimeProfile, deleteRuntimeProfile, fetchAgentReadiness, patchFeatureFlag, fetchOutputLanguage, updateOutputLanguage, fetchWorkspaces, addWorkspace, removeWorkspace, syncWorkspace, fetchGovernanceQueue, recoverFailedTask, fetchApprovalsGrouped, fetchAllActivations, disableActivation, fetchRuleCodeOwnerReview, ruleCodeDecision, pauseAllRuleCode, releaseRuleCodePause, fetchLifecycleMetrics, fetchUpdateStatus, fetchUpdateHistory, applyUpdate, applyFullUpdate, rollbackUpdate, fetchEvidenceChain, fetchIntentSummary, fetchIntentContent, createIntentTemplate, saveIntentContent, fetchIntentVersions, recordIntentDecision, listIntentDecisionsByPainId, listIntentDecisionsByTaskId, fetchIntentDecisionSummary, dispatchFollowUp, };
+export type { FeedbackReportData, FeedbackDraftSummaryData, FeedbackDraftEnvelopeData, FeedbackChannelsData, FeedbackSubmitResultData, DeleteEnvelopeData, WorkspaceEntryData, RemovedEnvelopeData, SyncResultData, ConfigSummaryData, ConfigCatalogData, AgentBindingUpdateData, DefaultRuntimeUpdateData, RuntimeProfileMutationData, ReadinessCheckData, FeatureFlagUpdateData, OutputLanguageData, GovernanceQueueData, RecoveryResultData, ActivationsData, DisableActivationData, RuleCodeOwnerReviewData, RuleCodeMutationData, LifecycleMetricsData, UpdateStatusData, UpdateHistoryData, ApplyUpdateResultData, RollbackResultData, ApprovalRecordData, PrinciplesListData, ApprovalsGroupedData, EvidenceChainData, EvidenceChainRecordData, EvidenceChainStateData, TrajectoryData, TrajectoryStageData, IntentSummaryData, IntentSectionsData, IntentDocWarningData, IntentDecisionRecordData, IntentDecisionResultData, IntentDecisionSummaryData, FollowUpResponseData, LinkCandidateFollowUpData, GuideRulehostFollowUpData, GeneratePatchProposalFollowUpData, IntentVersionEntry, IntentVersionData, } from "./utils/validators.js";
 export type { SignalKeyword, PendingSignalTerm } from "./utils/signal-keywords-types.js";
 export type { ActivationRecordData as ActivationRecord } from "./utils/validators.js";
 export type { ApprovalRecordData as ApprovalRecord } from "./utils/validators.js";

package/console/dist/ui/api.js

@@ -1,5 +1,5 @@
 import { listActiveSignalKeywords, listPendingSignalTerms, fetchKeywordStore, fetchPendingTerms, updateKeywordStore, admitPendingTerm, rejectPendingTerm, } from "./utils/signal-keywords-api.js";
-import { validateErrorResponse, validateHeaders, validateFeedbackReport, validateFeedbackDraftsList, validateFeedbackDraftEnvelope, validateFeedbackChannels, validateFeedbackSubmitResult, validateDeleteEnvelope, validateWorkspaceEntry, validateWorkspaceList, validateRemovedEnvelope, validateSyncResult, validateConfigSummary, validateConfigCatalog, validateAgentBindingUpdate, validateDefaultRuntimeUpdate, validateRuntimeProfileMutation, validateReadinessCheck, validateFeatureFlagUpdate, validateOutputLanguage, validateGovernanceQueue, validateActivations, validateDisableActivation, validateLifecycleMetrics, validateUpdateStatus, validateUpdateHistory, validateApplyUpdateResult, validateRollbackResult, validateApprovalRecordDirect, validatePrinciplesList, validateApprovalsGrouped, validateEvidenceChain, validateTrajectoryData, validateIntentSummary, validateIntentDecisionList, validateIntentDecisionResult, validateIntentDecisionSummary, validateFollowUpResponse, validateIntentInitResult, validateIntentSaveResult, validateIntentRawContent, validateIntentVersions, validateOwnerGovernanceView, validateRuleCodeOwnerReview, validateRuleCodeMutation, } from "./utils/validators.js";
+import { validateErrorResponse, validateHeaders, validateFeedbackReport, validateFeedbackDraftsList, validateFeedbackDraftEnvelope, validateFeedbackChannels, validateFeedbackSubmitResult, validateDeleteEnvelope, validateWorkspaceEntry, validateWorkspaceList, validateRemovedEnvelope, validateSyncResult, validateConfigSummary, validateConfigCatalog, validateAgentBindingUpdate, validateDefaultRuntimeUpdate, validateRuntimeProfileMutation, validateReadinessCheck, validateFeatureFlagUpdate, validateOutputLanguage, validateGovernanceQueue, validateRecoveryResult, validateActivations, validateDisableActivation, validateLifecycleMetrics, validateUpdateStatus, validateUpdateHistory, validateApplyUpdateResult, validateRollbackResult, validateApprovalRecordDirect, validatePrinciplesList, validateApprovalsGrouped, validateEvidenceChain, validateTrajectoryData, validateIntentSummary, validateIntentDecisionList, validateIntentDecisionResult, validateIntentDecisionSummary, validateFollowUpResponse, validateIntentInitResult, validateIntentSaveResult, validateIntentRawContent, validateIntentVersions, validateOwnerGovernanceView, validateRuleCodeOwnerReview, validateRuleCodeMutation, } from "./utils/validators.js";
 // ── Auth ──────────────────────────────────────────────────────────────────────
 function getToken() {
     return sessionStorage.getItem("pd_token");
@@ -382,6 +382,18 @@ async function updateOutputLanguage(outputLanguage) {
 async function fetchGovernanceQueue() {
     return request('/api/v1/governance/queue', undefined, validateGovernanceQueue);
 }
+// Governance Recovery Actions v1: Owner-triggered recovery of a failed /
+// needs_human_review internalization task (failed→pending | needs_human_review→pending).
+async function recoverFailedTask(taskId, reason) {
+    const body = {};
+    if (reason !== undefined && reason.length > 0) {
+        body.reason = reason;
+    }
+    return request('/api/v1/failed-tasks/' + encodeURIComponent(taskId) + '/recover', {
+        method: 'POST',
+        body: JSON.stringify(body),
+    }, validateRecoveryResult);
+}
 async function fetchApprovalsGrouped() {
     return request('/api/v1/approvals/grouped', undefined, validateApprovalsGrouped);
 }
@@ -498,4 +510,4 @@ listActiveSignalKeywords, listPendingSignalTerms, fetchKeywordStore, fetchPendin
 // auth
 getToken, setToken, clearToken, checkAuth, approveApproval, rejectApproval, editApproval, fetchPrinciples, fetchPrincipleDetail, fetchPrincipleGovernance, fetchPrincipleTrajectory, fetchPrincipleReceipts, fetchReceiptCounts, archivePrinciple, unarchivePrinciple, createFeedbackReport, listFeedbackReports, getFeedbackReport, deleteFeedbackReport, 
 // Feedback submit ladder (Slice 3, spec §8)
-fetchFeedbackChannels, submitFeedbackReport, markFeedbackReportSent, fetchConfigSummary, fetchConfigCatalog, updateAgentBinding, updateDefaultRuntime, createRuntimeProfile, updateRuntimeProfile, deleteRuntimeProfile, fetchAgentReadiness, patchFeatureFlag, fetchOutputLanguage, updateOutputLanguage, fetchWorkspaces, addWorkspace, removeWorkspace, syncWorkspace, fetchGovernanceQueue, fetchApprovalsGrouped, fetchAllActivations, disableActivation, fetchRuleCodeOwnerReview, ruleCodeDecision, pauseAllRuleCode, releaseRuleCodePause, fetchLifecycleMetrics, fetchUpdateStatus, fetchUpdateHistory, applyUpdate, applyFullUpdate, rollbackUpdate, fetchEvidenceChain, fetchIntentSummary, fetchIntentContent, createIntentTemplate, saveIntentContent, fetchIntentVersions, recordIntentDecision, listIntentDecisionsByPainId, listIntentDecisionsByTaskId, fetchIntentDecisionSummary, dispatchFollowUp, };
+fetchFeedbackChannels, submitFeedbackReport, markFeedbackReportSent, fetchConfigSummary, fetchConfigCatalog, updateAgentBinding, updateDefaultRuntime, createRuntimeProfile, updateRuntimeProfile, deleteRuntimeProfile, fetchAgentReadiness, patchFeatureFlag, fetchOutputLanguage, updateOutputLanguage, fetchWorkspaces, addWorkspace, removeWorkspace, syncWorkspace, fetchGovernanceQueue, recoverFailedTask, fetchApprovalsGrouped, fetchAllActivations, disableActivation, fetchRuleCodeOwnerReview, ruleCodeDecision, pauseAllRuleCode, releaseRuleCodePause, fetchLifecycleMetrics, fetchUpdateStatus, fetchUpdateHistory, applyUpdate, applyFullUpdate, rollbackUpdate, fetchEvidenceChain, fetchIntentSummary, fetchIntentContent, createIntentTemplate, saveIntentContent, fetchIntentVersions, recordIntentDecision, listIntentDecisionsByPainId, listIntentDecisionsByTaskId, fetchIntentDecisionSummary, dispatchFollowUp, };

package/console/dist/ui/i18n/en.json

@@ -149,6 +149,7 @@
                 "state_db_missing": "State database not initialized. PD has not run in this workspace yet.",
                 "no_pipeline_activity": "No governance activity recorded yet.",
                 "pending_approvals": "{{count}} principle(s) pending your review and decision.",
+                "tasks_need_human_review": "{{count}} internalization task(s) are waiting for your review decision.",
                 "pipeline_active": "Pipeline has activity, but candidate principles are not ready for review.",
                 "consumed_candidates": "Candidate records exist, but have not entered the review stage.",
                 "degraded_state": "Part of the governance pipeline or data source is degraded."
@@ -157,6 +158,7 @@
                 "run_config_doctor": "Ensure the OpenClaw plugin is enabled, or run pd config doctor.",
                 "wait_for_pipeline": "PD will surface principle candidates here once behavior deviations are captured and reviewable artifacts are generated.",
                 "review_approvals": "Review pending principles and approve, reject, or park.",
+                "review_failed_tasks": "Open Failed Tasks to inspect and recover tasks awaiting your decision.",
                 "check_degraded_signals": "Check degraded signal details and follow suggested actions.",
                 "check_pipeline_status": "Wait for internalization tasks to complete. If no change for a long time, check pipeline status."
             },
@@ -1366,6 +1368,16 @@
             "error": "Failed to load failed tasks",
             "disabled": "Failed tasks observability is disabled. Enable 'failed_tasks_observability' in .pd/config.yaml to view.",
             "createDraft": "Create Feedback Draft",
+            "recover": "Resume Evolution",
+            "recoverConfirmTitle": "Recover this evolution task?",
+            "recoverConfirmStatus": "Current status",
+            "recoverConfirmActionLabel": "Action",
+            "recoverConfirmActionDesc": "Reset the task and allow runtime execution",
+            "recoverConfirmImpactLabel": "Impact",
+            "recoverConfirmImpactDesc": "Existing artifacts are preserved. A new execution attempt will be created.",
+            "recoverConfirmButton": "Recover",
+            "recoverSuccess": "Recovery accepted — the task is pending again",
+            "recoverFailed": "Recovery failed",
             "taskId": "Task ID",
             "painId": "Pain ID",
             "kind": "Kind",

package/console/dist/ui/i18n/zh-CN.json

@@ -149,6 +149,7 @@
                 "state_db_missing": "状态数据库未初始化。PD 尚未在此工作空间中运行。",
                 "no_pipeline_activity": "尚未记录到任何治理链路活动。",
                 "pending_approvals": "有 {{count}} 条原则需要你审查并决定是否批准。",
+                "tasks_need_human_review": "有 {{count}} 个内化任务正在等待你的审查决定。",
                 "pipeline_active": "管线中有活动，但候选原则尚未准备好审查。",
                 "consumed_candidates": "已存在候选人记录，但尚未进入审查阶段。",
                 "degraded_state": "部分治理链路或数据源处于降级状态。"
@@ -157,6 +158,7 @@
                 "run_config_doctor": "确保 OpenClaw 插件已启用，或运行 pd config doctor 检查配置。",
                 "wait_for_pipeline": "PD 会在捕获到行为偏差并生成可审查候选后，将其放到这里。",
                 "review_approvals": "审查待审批的原则，做出批准、拒绝或暂存的决定。",
+                "review_failed_tasks": "打开「失败任务」页面，查看并恢复等待你决定的任务。",
                 "check_degraded_signals": "检查降级信号详情，按建议操作修复。",
                 "check_pipeline_status": "等待内化任务完成。如果长期无变化，检查内化管线状态。"
             },
@@ -1366,6 +1368,16 @@
             "error": "加载失败任务失败",
             "disabled": "失败任务可观测性已禁用。请在 .pd/config.yaml 中启用 'failed_tasks_observability' 以查看。",
             "createDraft": "创建反馈草稿",
+            "recover": "继续演化",
+            "recoverConfirmTitle": "恢复此演化任务？",
+            "recoverConfirmStatus": "当前状态",
+            "recoverConfirmActionLabel": "恢复动作",
+            "recoverConfirmActionDesc": "重置任务并允许运行时重新执行",
+            "recoverConfirmImpactLabel": "影响",
+            "recoverConfirmImpactDesc": "既有产物将被保留，并将创建一次新的执行尝试。",
+            "recoverConfirmButton": "恢复",
+            "recoverSuccess": "恢复已接受——任务已重新进入待处理状态",
+            "recoverFailed": "恢复失败",
             "taskId": "任务 ID",
             "painId": "Pain ID",
             "kind": "类型",