create-principles-disciple 1.121.7 → 1.121.9

package/console/dist/server/models/PrincipleClassifier.d.ts

@@ -7,7 +7,7 @@
  *  - demo: Demo / example principles planted by the framework
  *  - smoke: Smoke-test principles for CI validation
  *  - historical: Archived or deprecated principles (already decided long ago)
- *  - builtin: Core Thinking OS axioms (T-01..T-10) — not governance targets
+ *  - builtin: Core Thinking OS axioms (registry T-NN ids) — not governance targets
  *  - already_decided: Approved / rejected via approval queue
  *
  * Classification is purely read-side; it does NOT mutate any data.

package/console/dist/server/models/PrincipleClassifier.js

@@ -7,14 +7,13 @@
  *  - demo: Demo / example principles planted by the framework
  *  - smoke: Smoke-test principles for CI validation
  *  - historical: Archived or deprecated principles (already decided long ago)
- *  - builtin: Core Thinking OS axioms (T-01..T-10) — not governance targets
+ *  - builtin: Core Thinking OS axioms (registry T-NN ids) — not governance targets
  *  - already_decided: Approved / rejected via approval queue
  *
  * Classification is purely read-side; it does NOT mutate any data.
  */
+import { isCorePrincipleId } from '@principles/core/runtime-v2';
 // ── Heuristics ────────────────────────────────────────────────────────────────
-/** Regex that matches core Thinking OS axiom IDs (T-NN pattern, e.g. T-01..T-10) */
-const BUILTIN_ID_REGEX = /^T-(0[1-9]|10)$/;
 /** ID prefixes that indicate demo / dogfood data */
 const DEMO_ID_PREFIXES = ['DEMO_', 'demo_', 'story-a', 'story_a', 'dogfood_'];
 /** ID prefixes that indicate smoke / test data */
@@ -32,8 +31,12 @@ function hasKeyword(text, keywords) {
     const lower = text.toLowerCase();
     return keywords.some((k) => lower.includes(k));
 }
+/**
+ * Core Thinking OS axiom IDs — validated against the @principles/core
+ * registry so the builtin set always mirrors the canonical T-01..T-10.
+ */
 function isBuiltinId(id) {
-    return BUILTIN_ID_REGEX.test(id);
+    return isCorePrincipleId(id);
 }
 // ── Classifier ────────────────────────────────────────────────────────────────
 /**

package/console/dist/server/models/PrinciplesConsoleModel.d.ts

@@ -1,4 +1,5 @@
-export type PrincipleStatus = 'candidate' | 'active' | 'archived' | 'deprecated' | 'probation';
+import type { PrincipleStatus } from '@principles/core/runtime-v2';
+export type { PrincipleStatus };
 export type PrinciplePriority = 'P0' | 'P1' | 'P2';
 export type PrincipleScope = 'general' | 'domain';
 export type PrincipleEvaluability = 'manual_only' | 'deterministic' | 'weak_heuristic';

package/console/dist/server/models/ReceiptsConsoleModel.d.ts

@@ -1,3 +1,4 @@
+import type { ReceiptEvidenceCoverage } from '@principles/core/runtime-v2';
 export interface ReceiptEvent {
     kind: 'rule_blocked' | 'auto_correct_applied' | 'self_reported' | 'prompt_injected';
     level: 'effect' | 'presence';
@@ -16,6 +17,7 @@ export interface PrincipleReceipts {
     presenceCount: number;
     lastEffectAt: string | null;
     events: ReceiptEvent[];
+    coverage: ReceiptEvidenceCoverage;
 }
 export interface ReceiptCountEntry {
     principleId: string;
@@ -28,6 +30,7 @@ export interface ReceiptCounts {
     reason?: string;
     nextAction?: string;
     counts: ReceiptCountEntry[];
+    coverage: ReceiptEvidenceCoverage;
 }
 export declare class ReceiptsConsoleModel {
     private readonly workspaceDir;
@@ -37,6 +40,8 @@ export declare class ReceiptsConsoleModel {
     /**
      * Shared preconditions: state.db exists + ledger flag enabled. Returns a
      * degraded partial response when a precondition fails (rc-9), else null.
+     * Unavailable outranks disabled (mirrors the legacy precheck order, so
+     * observable behavior is unchanged).
      */
     private precheck;
 }

package/console/dist/server/models/ReceiptsConsoleModel.js

@@ -1,11 +1,17 @@
 /**
- * Receipts Console Model — PRI-533 (SPEC §5.4).
+ * Receipts Console Model — PRI-533 (SPEC §5.4), coverage disclosure PRI-590..594.
  *
  * Read-side model for the principle receipt ledger (principle_applications,
  * written by the plugin when principle_receipt_ledger is enabled). Serves:
  * - per-principle receipt history (effect/presence counts + bounded timeline)
  * - per-principle counts for the activations page columns
  *
+ * Every response carries `coverage` (ReceiptEvidenceCoverage) describing what
+ * the numbers mean: source readability, data trustworthiness, observed range
+ * and retention policy. Coverage is derived from the same read — no extra
+ * fact source, no behavior change to the legacy status/reason/nextAction
+ * contract.
+ *
  * Degradation rules (rc-9): state.db missing, table missing (pre-PRI-531
  * workspace), or the ledger flag disabled → status degraded with reason +
  * nextAction. Never throws to the route.
@@ -14,7 +20,7 @@
  */
 import * as fs from 'node:fs';
 import * as path from 'node:path';
-import { SqliteConnection } from '@principles/core/runtime-v2';
+import { SqliteConnection, RECEIPT_RETENTION_POLICY_DAYS } from '@principles/core/runtime-v2';
 import { computeFlagsFromLoadResult, loadPdConfig } from '../config/pd-config-store.js';
 const KINDS = new Set(['rule_blocked', 'auto_correct_applied', 'self_reported', 'prompt_injected']);
 const LEVELS = new Set(['effect', 'presence']);
@@ -42,6 +48,43 @@ function toEvent(row) {
 function isMissingTableError(err) {
     return err instanceof Error && err.message.includes('no such table');
 }
+/**
+ * Coverage for a source that was not read. validationStatus stays 'valid' —
+ * no data assessment was performed (the unreadable state itself is carried
+ * by sourceStatus + reasonCode). See receipt-coverage.ts contract docs.
+ */
+function unreadCoverage(sourceStatus, reasonCode, nextActionCode) {
+    return {
+        sourceStatus,
+        validationStatus: 'valid',
+        observedFrom: null,
+        asOf: new Date().toISOString(),
+        retentionPolicyDays: RECEIPT_RETENTION_POLICY_DAYS,
+        reasonCode,
+        nextActionCode,
+    };
+}
+function readCoverage(validation, observedFrom) {
+    return {
+        sourceStatus: 'available',
+        validationStatus: validation.validationStatus,
+        observedFrom,
+        asOf: new Date().toISOString(),
+        retentionPolicyDays: RECEIPT_RETENTION_POLICY_DAYS,
+        ...(validation.reasonCode === undefined ? {} : { reasonCode: validation.reasonCode }),
+        ...(validation.nextActionCode === undefined ? {} : { nextActionCode: validation.nextActionCode }),
+    };
+}
+function resolveValidation(malformedReasonCode, partialReasonCode) {
+    if (malformedReasonCode !== undefined) {
+        // Counts are untrustworthy — owner must not read them as facts.
+        return { validationStatus: 'malformed', reasonCode: malformedReasonCode, nextActionCode: 'inspect_state_db' };
+    }
+    if (partialReasonCode !== undefined) {
+        return { validationStatus: 'partial', reasonCode: partialReasonCode, nextActionCode: 'inspect_state_db' };
+    }
+    return { validationStatus: 'valid' };
+}
 export class ReceiptsConsoleModel {
     workspaceDir;
     constructor(workspaceDir) {
@@ -50,23 +93,40 @@ export class ReceiptsConsoleModel {
     async getPrincipleReceipts(principleId) {
         const guard = this.precheck();
         if (guard) {
-            return { ...guard, principleId, effectCount: 0, presenceCount: 0, lastEffectAt: null, events: [] };
+            return {
+                ...guard,
+                principleId,
+                effectCount: 0,
+                presenceCount: 0,
+                lastEffectAt: null,
+                events: [],
+            };
         }
         const conn = new SqliteConnection({ workspaceDir: this.workspaceDir, readonly: true, bootstrapIfMissing: false });
         try {
             const rows = conn.getDb().prepare('SELECT kind, level, session_id, tool_name, file_path, digest, created_at FROM principle_applications WHERE principle_id = ? ORDER BY created_at DESC, id DESC LIMIT ?').all(principleId, TIMELINE_LIMIT);
             const events = [];
+            let droppedRows = 0;
             for (const row of Array.isArray(rows) ? rows : []) {
                 const event = toEvent(row);
                 if (event)
                     events.push(event);
+                else
+                    droppedRows++;
             }
-            const counts = conn.getDb().prepare("SELECT level, COUNT(*) AS n, MAX(created_at) AS last_at FROM principle_applications WHERE principle_id = ? GROUP BY level").all(principleId);
+            const counts = conn.getDb().prepare('SELECT level, COUNT(*) AS n, MAX(created_at) AS last_at, MIN(created_at) AS first_at FROM principle_applications WHERE principle_id = ? GROUP BY level').all(principleId);
             let effectCount = 0;
             let presenceCount = 0;
             let lastEffectAt = null;
+            let observedFrom = null;
+            let levelAnomaly = false;
             for (const row of Array.isArray(counts) ? counts : []) {
                 const rec = row;
+                // ISO8601-UTC lexicographic comparison: safe only while created_at stays
+                // zero-padded UTC from toISOString() — pin this precondition here.
+                const firstAt = asNullableString(rec.first_at);
+                if (firstAt !== null && (observedFrom === null || firstAt < observedFrom))
+                    observedFrom = firstAt;
                 if (rec.level === 'effect') {
                     effectCount = typeof rec.n === 'number' ? rec.n : 0;
                     lastEffectAt = asNullableString(rec.last_at);
@@ -74,8 +134,27 @@ export class ReceiptsConsoleModel {
                 else if (rec.level === 'presence') {
                     presenceCount = typeof rec.n === 'number' ? rec.n : 0;
                 }
+                else {
+                    // Rows exist outside the effect/presence level space (schema drift /
+                    // tampering) — the two counts above silently miss them, so the
+                    // aggregate is untrustworthy.
+                    levelAnomaly = true;
+                }
             }
-            return { status: 'ok', principleId, effectCount, presenceCount, lastEffectAt, events };
+            // COUNT(*) in a GROUP BY output is always a number — no unreadable-counts
+            // branch exists on this endpoint (ERR-099: no unreachable conditionals).
+            const malformedReasonCode = levelAnomaly ? 'ledger_level_invalid' : undefined;
+            const partialReasonCode = droppedRows > 0 ? 'receipt_rows_dropped' : undefined;
+            const validation = resolveValidation(malformedReasonCode, partialReasonCode);
+            return {
+                status: 'ok',
+                principleId,
+                effectCount,
+                presenceCount,
+                lastEffectAt,
+                events,
+                coverage: readCoverage(validation, observedFrom),
+            };
         }
         catch (err) {
             if (isMissingTableError(err)) {
@@ -83,7 +162,12 @@ export class ReceiptsConsoleModel {
                     status: 'degraded',
                     reason: 'principle_applications table not found — ledger not initialized on this workspace',
                     nextAction: 'Update the plugin to a version including PRI-531 and enable principle_receipt_ledger',
-                    principleId, effectCount: 0, presenceCount: 0, lastEffectAt: null, events: [],
+                    principleId,
+                    effectCount: 0,
+                    presenceCount: 0,
+                    lastEffectAt: null,
+                    events: [],
+                    coverage: unreadCoverage('unavailable', 'ledger_table_missing', 'update_plugin'),
                 };
             }
             throw err;
@@ -95,29 +179,67 @@ export class ReceiptsConsoleModel {
     async getReceiptCounts() {
         const guard = this.precheck();
         if (guard) {
-            return { status: guard.status, reason: guard.reason, nextAction: guard.nextAction, counts: [] };
+            return {
+                status: guard.status,
+                reason: guard.reason,
+                nextAction: guard.nextAction,
+                counts: [],
+                coverage: guard.coverage,
+            };
         }
         const conn = new SqliteConnection({ workspaceDir: this.workspaceDir, readonly: true, bootstrapIfMissing: false });
         try {
             const rows = conn.getDb().prepare(`SELECT principle_id,
                 SUM(CASE WHEN level = 'effect' THEN 1 ELSE 0 END) AS effect_count,
                 SUM(CASE WHEN level = 'presence' THEN 1 ELSE 0 END) AS presence_count,
-                MAX(CASE WHEN level = 'effect' THEN created_at END) AS last_effect_at
-         FROM principle_applications GROUP BY principle_id`).all();
+                MAX(CASE WHEN level = 'effect' THEN created_at END) AS last_effect_at,
+                COUNT(*) AS total_count,
+                SUM(CASE WHEN kind NOT IN ('rule_blocked','auto_correct_applied','self_reported','prompt_injected') THEN 1 ELSE 0 END) AS invalid_kind_count
+          FROM principle_applications GROUP BY principle_id`).all();
+            // Global observed range (the retention sweep is table-wide, not per principle).
+            const firstAtRow = conn.getDb().prepare('SELECT MIN(created_at) AS first_at FROM principle_applications').get();
+            const observedFrom = asNullableString(firstAtRow?.first_at);
             const counts = [];
+            let skippedRows = 0;
+            let levelAnomaly = false;
+            let kindAnomaly = false;
             for (const row of Array.isArray(rows) ? rows : []) {
                 const rec = row;
                 const principleId = asNullableString(rec.principle_id);
-                if (!principleId)
+                if (!principleId) {
+                    skippedRows++;
                     continue;
+                }
+                // SUM(CASE ... ELSE 0 END) / COUNT(*) in GROUP BY output are always
+                // numbers — no unreadable-counts branch exists on this endpoint
+                // (ERR-099: no unreachable conditionals).
+                const effectCount = typeof rec.effect_count === 'number' ? rec.effect_count : 0;
+                const presenceCount = typeof rec.presence_count === 'number' ? rec.presence_count : 0;
+                if (typeof rec.total_count === 'number' && rec.total_count > effectCount + presenceCount) {
+                    // Rows outside the effect/presence level space inflate the row total
+                    // without landing in either count — the aggregate is untrustworthy.
+                    levelAnomaly = true;
+                }
+                if (typeof rec.invalid_kind_count === 'number' && rec.invalid_kind_count > 0) {
+                    // Unknown-kind rows are still counted (valid level) but the detail
+                    // timeline drops them — align the partial verdict across endpoints.
+                    kindAnomaly = true;
+                }
                 counts.push({
                     principleId,
-                    effectCount: typeof rec.effect_count === 'number' ? rec.effect_count : 0,
-                    presenceCount: typeof rec.presence_count === 'number' ? rec.presence_count : 0,
+                    effectCount,
+                    presenceCount,
                     lastEffectAt: asNullableString(rec.last_effect_at),
                 });
             }
-            return { status: 'ok', counts };
+            const malformedReasonCode = levelAnomaly ? 'ledger_level_invalid' : undefined;
+            const partialReasonCode = skippedRows > 0 || kindAnomaly ? 'receipt_rows_dropped' : undefined;
+            const validation = resolveValidation(malformedReasonCode, partialReasonCode);
+            return {
+                status: 'ok',
+                counts,
+                coverage: readCoverage(validation, observedFrom),
+            };
         }
         catch (err) {
             if (isMissingTableError(err)) {
@@ -126,6 +248,7 @@ export class ReceiptsConsoleModel {
                     reason: 'principle_applications table not found — ledger not initialized on this workspace',
                     nextAction: 'Update the plugin to a version including PRI-531 and enable principle_receipt_ledger',
                     counts: [],
+                    coverage: unreadCoverage('unavailable', 'ledger_table_missing', 'update_plugin'),
                 };
             }
             throw err;
@@ -137,6 +260,8 @@ export class ReceiptsConsoleModel {
     /**
      * Shared preconditions: state.db exists + ledger flag enabled. Returns a
      * degraded partial response when a precondition fails (rc-9), else null.
+     * Unavailable outranks disabled (mirrors the legacy precheck order, so
+     * observable behavior is unchanged).
      */
     precheck() {
         const stateDbPath = path.join(this.workspaceDir, '.pd', 'state.db');
@@ -145,6 +270,7 @@ export class ReceiptsConsoleModel {
                 status: 'degraded',
                 reason: 'state.db not found — workspace may not be initialized',
                 nextAction: 'Run pd runtime diagnostics to check workspace state',
+                coverage: unreadCoverage('unavailable', 'state_db_missing', 'run_runtime_diagnostics'),
             };
         }
         const flags = computeFlagsFromLoadResult(loadPdConfig(this.workspaceDir));
@@ -153,6 +279,7 @@ export class ReceiptsConsoleModel {
                 status: 'degraded',
                 reason: 'principle_receipt_ledger flag is disabled — no receipt history is being recorded',
                 nextAction: 'Enable the flag in .pd/config.yaml: features.principle_receipt_ledger.enabled = true',
+                coverage: unreadCoverage('disabled', 'ledger_flag_disabled', 'enable_ledger_flag'),
             };
         }
         return null;

package/console/dist/server/routes/activations.js

@@ -175,7 +175,7 @@ export async function handleActivationsRoute(req, res, workspaceDir, subPath, au
             return;
         }
         try {
-            sendSuccess(res, await getModel(workspaceDir).getOwnerReview(activationId, authority?.ownerActor !== null && authority?.ownerActor !== undefined));
+            sendSuccess(res, await getModel(workspaceDir).getOwnerReview(activationId, authority?.ownerActor !== null && authority?.ownerActor !== undefined, authority?.ownerActor ?? undefined));
         }
         catch (err) {
             const message = err instanceof Error ? err.message : String(err);

package/console/dist/server/routes/failed-tasks.js

@@ -106,14 +106,14 @@ function tryParseJson(body) {
 }
 /**
  * Parse the optional recover request body. Accepts an empty body (reason is
- * optional) or a JSON object with an optional string `reason` field
- * (rc-1/rc-2: parsed value stays `unknown` until Object.hasOwn + typeof
- * checks pass). Returns a discriminated result; `ok === false` carries the
- * bad-request message.
+ * optional) or a JSON object with optional `reason` (string) and `force`
+ * (boolean) fields (rc-1/rc-2: parsed value stays `unknown` until
+ * Object.hasOwn + typeof checks pass). Returns a discriminated result;
+ * `ok === false` carries the bad-request message.
  */
 function parseRecoverBody(body) {
     if (body.trim().length === 0)
-        return { ok: true };
+        return { ok: true, force: false };
     const raw = tryParseJson(body);
     if (raw === undefined)
         return { ok: false, error: 'Request body must be valid JSON' };
@@ -127,8 +127,14 @@ function parseRecoverBody(body) {
             return { ok: false, error: `reason must be at most ${MAX_REASON_LENGTH} characters` };
         }
     }
+    // Fail loud on a malformed force flag (rc-3): silently coercing "yes" to
+    // false would silently downgrade an Owner-requested force recovery.
+    if (Object.hasOwn(raw, 'force') && typeof raw.force !== 'boolean') {
+        return { ok: false, error: 'force must be a boolean' };
+    }
     const reason = typeof raw.reason === 'string' && raw.reason.length > 0 ? raw.reason : undefined;
-    return { ok: true, reason };
+    const force = raw.force === true;
+    return { ok: true, reason, force };
 }
 /**
  * Dispatch one recovery attempt through the shared core services.
@@ -137,32 +143,40 @@ function parseRecoverBody(body) {
  * needs_human_review → owner authority reset. A null first result means
  * "missing or not failed"; the second call distinguishes not_found /
  * wrong-status / metadata_invalid. No recovery logic lives here.
+ *
+ * `force` applies only to the failed path: when true, an exhausted task
+ * (attemptCount >= maxAttempts) is reset anyway and its maxAttempts budget
+ * is raised (core raises it by +3). needs_human_review resets ignore it —
+ * the owner authority reset has its own budget semantics.
  */
-async function dispatchRecovery(workspaceDir, taskId) {
+async function dispatchRecovery(workspaceDir, taskId, force) {
     const { service, close } = await createRecoverySweepService({ workspaceDir });
     try {
         // failed → pending (crash-retry semantics: completionIntent preserved)
         try {
-            const failedResult = await service.recoverFailedTask(taskId);
+            const failedResult = await service.recoverFailedTask(taskId, force);
             if (failedResult) {
                 return {
                     ok: true,
                     result: 'recovered',
                     previousStatus: failedResult.previousStatus,
                     newStatus: failedResult.newStatus,
+                    forceApplied: failedResult.forceApplied,
                 };
             }
         }
         catch (err) {
             if (err instanceof PDRuntimeError && err.category === 'input_invalid') {
-                // attempt budget exhausted; Console v1 does not expose force
+                // Attempt budget exhausted and the request carried no force — either
+                // the client sent force:false or its row snapshot went stale between
+                // list render and click. Backstop; the UI sends force itself.
                 return {
                     ok: false,
                     failure: {
                         httpStatus: 409,
                         errorCode: 'task_attempts_exhausted',
                         message: err.message,
-                        nextAction: 'This task exhausted its attempt budget. Recover it with force via CLI: pd runtime recovery failed-tasks --confirm --force',
+                        nextAction: 'This task exhausted its attempt budget. Retry with force (force: true), or via CLI: pd runtime recovery failed-tasks --confirm --force',
                     },
                 };
             }
@@ -176,6 +190,7 @@ async function dispatchRecovery(workspaceDir, taskId) {
                 result: 'requeued',
                 previousStatus: outcome.previousStatus,
                 newStatus: 'pending',
+                forceApplied: false,
             };
         }
         if (outcome.status === 'not_found') {
@@ -349,7 +364,7 @@ export async function handleFailedTasksRoute(req, res, ctx) {
                 sendBadRequest(res, bodyResult.error);
                 return;
             }
-            const dispatch = await dispatchRecovery(workspaceDir, taskId);
+            const dispatch = await dispatchRecovery(workspaceDir, taskId, bodyResult.force);
             if (!dispatch.ok) {
                 sendError(res, dispatch.failure.httpStatus, dispatch.failure.errorCode, dispatch.failure.message, dispatch.failure.nextAction ? { nextAction: dispatch.failure.nextAction, ...dispatch.failure.extras } : dispatch.failure.extras);
                 return;
@@ -364,6 +379,7 @@ export async function handleFailedTasksRoute(req, res, ctx) {
                     result: dispatch.result,
                     operator: 'console',
                     reason: bodyResult.reason ?? null,
+                    forceApplied: dispatch.forceApplied,
                 });
             }
             catch (auditErr) {
@@ -377,6 +393,7 @@ export async function handleFailedTasksRoute(req, res, ctx) {
                 previousStatus: dispatch.previousStatus,
                 newStatus: dispatch.newStatus,
                 result: dispatch.result,
+                forceApplied: dispatch.forceApplied,
                 nextAction: 'Recovery accepted. The task is pending again and will be picked up by the internalization consumer (or advance it manually: pd runtime internalization run-once).',
             });
         }

package/console/dist/server/routes/governance.d.ts

@@ -1,3 +1,29 @@
 import type { IncomingMessage, ServerResponse } from 'node:http';
+import type { OwnerConfigSnapshot, OwnerIdentityResolved } from '@principles/core/runtime-v2';
+export interface GovernanceExperienceContext {
+    workspaceDir: string;
+    featureFlags?: Record<string, {
+        enabled: boolean;
+    } | undefined>;
+    ownerConfig: OwnerConfigSnapshot;
+}
+/**
+ * Owner identity evidence for the governance experience snapshot. Mirrors the
+ * activations authority wiring in server/index.ts (authConfig.isEnabled() +
+ * PD_OWNER_ID + PD_OWNER_CREDENTIAL_ID) — the two must stay in sync; the route
+ * tests lock the mapping.
+ */
+export declare function resolveOwnerConfigSnapshot(authConfig: {
+    isEnabled(): boolean;
+}, identity: OwnerIdentityResolved): OwnerConfigSnapshot;
+/**
+ * GET /api/v1/governance/experience — read-only Governance Experience Snapshot
+ * v1.5.1 (PRI-585).
+ *
+ * Flag contract (SPEC §14.1): with `governance_experience_v1` disabled the
+ * route returns 403 `feature_disabled` BEFORE any DB / ledger / config access.
+ * The snapshot explains governance state; it never authorizes mutations.
+ */
+export declare function handleGovernanceExperienceRoute(req: IncomingMessage, res: ServerResponse, ctx: GovernanceExperienceContext): Promise<void>;
 export declare function handleGovernanceRoute(req: IncomingMessage, res: ServerResponse, workspaceDir: string): Promise<void>;
 export declare function disposeGovernanceModels(): void;

package/console/dist/server/routes/governance.js

@@ -1,4 +1,5 @@
 import { GovernanceConsoleModel } from '../models/GovernanceConsoleModel.js';
+import { GovernanceExperienceCollector } from '../models/GovernanceExperienceCollector.js';
 import { sendSuccess, sendError, sendNotFound } from '../utils/response.js';
 const models = new Map();
 function getModel(workspaceDir) {
@@ -9,6 +10,55 @@ function getModel(workspaceDir) {
     }
     return model;
 }
+const experienceCollectors = new Map();
+function getExperienceCollector(workspaceDir) {
+    let collector = experienceCollectors.get(workspaceDir);
+    if (!collector) {
+        collector = new GovernanceExperienceCollector(workspaceDir);
+        experienceCollectors.set(workspaceDir, collector);
+    }
+    return collector;
+}
+/**
+ * Owner identity evidence for the governance experience snapshot. Mirrors the
+ * activations authority wiring in server/index.ts (authConfig.isEnabled() +
+ * PD_OWNER_ID + PD_OWNER_CREDENTIAL_ID) — the two must stay in sync; the route
+ * tests lock the mapping.
+ */
+export function resolveOwnerConfigSnapshot(authConfig, identity) {
+    const authEnabled = authConfig.isEnabled();
+    return {
+        authenticationMode: authEnabled ? 'authenticated' : 'no_auth',
+        ownerIdentityConfiguration: authEnabled && identity.ownerId && identity.credentialId ? 'configured' : 'missing',
+    };
+}
+/**
+ * GET /api/v1/governance/experience — read-only Governance Experience Snapshot
+ * v1.5.1 (PRI-585).
+ *
+ * Flag contract (SPEC §14.1): with `governance_experience_v1` disabled the
+ * route returns 403 `feature_disabled` BEFORE any DB / ledger / config access.
+ * The snapshot explains governance state; it never authorizes mutations.
+ */
+export async function handleGovernanceExperienceRoute(req, res, ctx) {
+    if (req.method !== 'GET') {
+        sendError(res, 405, 'method_not_allowed', 'Use GET for /api/v1/governance/experience.', { nextAction: 'Retry with GET.' });
+        return;
+    }
+    // Gate first — flag-off must not touch the database, ledger, or config files.
+    if (ctx.featureFlags?.governance_experience_v1?.enabled !== true) {
+        sendError(res, 403, 'feature_disabled', 'governance_experience_v1 feature flag is disabled. The governance experience snapshot endpoint is inactive.', { nextAction: 'Enable features.governance_experience_v1.enabled: true in .pd/config.yaml and restart the Console server.' });
+        return;
+    }
+    try {
+        const snapshot = getExperienceCollector(ctx.workspaceDir).collectSnapshot({ ownerConfig: ctx.ownerConfig });
+        sendSuccess(res, snapshot);
+    }
+    catch (err) {
+        const message = err instanceof Error ? err.message : String(err);
+        sendError(res, 500, 'governance_experience_error', message, { nextAction: 'Inspect the workspace state (.pd/state.db, .state/principle_training_state.json, .pd/config.yaml) and retry.' });
+    }
+}
 export async function handleGovernanceRoute(req, res, workspaceDir) {
     if (req.method !== 'GET') {
         sendNotFound(res, 'Route /api/v1/governance/queue not found');
@@ -29,4 +79,5 @@ export function disposeGovernanceModels() {
         model.dispose();
     }
     models.clear();
+    experienceCollectors.clear();
 }

package/console/dist/server/routes/owner-identity.d.ts

@@ -0,0 +1,31 @@
+/**
+ * GET/POST/DELETE /api/v1/owner-identity — install-level Owner identity
+ * registration (ADR-0022, PRI-578).
+ *
+ * - GET    resolved identity (env > ~/.pd/owner.json > none) + file record
+ *          + governance readiness (canonical resolveOwnerConfigSnapshot)
+ * - POST   register: write ~/.pd/owner.json (identifiers only, no secrets)
+ * - DELETE unregister: delete ~/.pd/owner.json (idempotent)
+ *
+ * Registration (where the identity comes from) and governance readiness
+ * (whether Owner governance actions can execute) are DIFFERENT facts: the
+ * latter additionally requires Console token authentication and is derived
+ * ONLY by resolveOwnerConfigSnapshot — never re-derived in the UI.
+ *
+ * Env vars remain the highest-priority source; file registration is the
+ * install-level fallback; a partial env pair is invalid and fails closed
+ * (no file fallback). Registration takes effect immediately (the resolver
+ * reads the file per call); env-var changes still require a process restart.
+ */
+import type { IncomingMessage, ServerResponse } from 'node:http';
+import { type OwnerIdentityResolved, type OwnerIdentityRecord, type OwnerConfigSnapshot } from '@principles/core/runtime-v2';
+export interface OwnerIdentityRouteView {
+    resolved: OwnerIdentityResolved;
+    fileRecord: OwnerIdentityRecord | null;
+    fileError?: string;
+    /** Canonical governance readiness — the same derivation the governance experience uses. */
+    governance: OwnerConfigSnapshot;
+}
+export declare function handleOwnerIdentityRoute(req: IncomingMessage, res: ServerResponse, homeDir: string, subPath: string, authConfig: {
+    isEnabled(): boolean;
+}): Promise<void>;